Workplace Investigations

Spain has not passed any statutes, regulations or policies specifically governing workplace investigations. Instead, general employment and data protection legislation, which safeguards employees’ rights, is fully applicable during these types of enquiries.

These statutes focus on employee privacy. As a result, the application of this legislation:

• limits the matters that may be investigated: they have to be relevant to the employment relationship and there has to be a legitimate reason to conduct the enquiry;
• sets boundaries to the means that may be lawfully used by the company in the investigation: they must be the least intrusive means for employees’ rights (for instance, an email review should be a last resort, reserved for when less-invasive means are not available or would not be effective); and
• states that the companies’ decisions during the investigation must be proportional in light of the facts under review and the legal consequences attached to them.

Collective bargaining agreements, which in Spain generally apply to every company within their scope of application (normally a given economic sector), may regulate workplace investigations. However, it is unusual for collective bargaining agreements to regulate workplace investigations.

Finally, major international corporations with a presence in Spain do tend to have an ethics or whistleblowing policy that governs how an investigation should be conducted. Even if these are self-imposed policies, they are contractually binding and, once established, must be respected by companies.

Workplace investigations in Sweden are governed by several rules and regulations. Listed below are the central legislation and regulations that govern a workplace investigation related to alleged employee misconduct.

• The Swedish Discrimination Act (2008:567).
• The Swedish Work Environment Act (1977:1160), which is complemented by the Swedish Work Environment Authority’s other statutes.[1]
• The Swedish Whistleblowing Act (2021:890).

If a workplace investigation has been initiated after the receipt of a report filed through a reporting channel established under the Swedish Whistleblowing Act, that law applies provided that the report has been filed by a person who may report under the Act and provided that the subject of the report falls under the material scope of the Act. The Swedish Whistleblowing Act implements Directive (EU) 2019/1937 on the protection of persons who report breaches of Union law and has been given a wide material scope in Sweden. The Swedish Whistleblowing Act may apply if the reported irregularity concerns breaches of certain EU laws or if the reported irregularity is of public interest.

In addition to the regulations mentioned above, certain data protection legislation may affect workplace investigations by restricting what personal data may be processed. Such data protection legislation includes the following:

• Regulation (EU) 2016/679 on the protection of natural persons concerning the processing of personal data and the free movement of such data (the GDPR);
• the Swedish Supplementary Data Protection Act (2018:218);
• the Swedish Supplementary Data Protection Regulation (2018:219);

• Regulation DIFS:2018:2 on the processing of personal data relating to criminal convictions or offences. This regulation governs the processing of personal data relating to criminal convictions or suspected criminal offences in internal workplace investigations that are not governed by the Swedish Whistleblowing Act.[2]

The above-mentioned legislation and regulations may overlap in many aspects and it is therefore important before starting an investigation, as well as during an investigation, to assess which rules and regulations apply to the situation at hand. Another aspect of this is that many issues that can arise during an investigation are not regulated by law or other legislation. If the investigation is a non-whistleblowing investigation there are limited rules on exactly how and by whom the investigation should be carried out.

A Swedish law firm that undertakes a workplace investigation also has to adhere to the Swedish Bar Association’s Code of Conduct. The Code of Conduct includes additional considerations, mainly ethical, which will not be addressed in this submission. Furthermore, this submission will not focus on investigations following an employee’s possible misappropriation of proprietary information or breach of the Swedish Trade Secrets Act (2018:558). Investigations into such irregularities are often conducted to gather evidence and these investigations include the same or similar investigative measures used in other investigations, such as interviews with employees and IT-forensic searches, but also infringement investigations carried out by the authorities or other measures by the police.

There is no specific legal regulation for internal investigations in Switzerland. The legal framework is derived from general rules such as the employer's duty of care, the employee's duty of loyalty and the employee's data protection rights. Depending on the context of the investigation, additional legal provisions may apply; for instance, additional provisions of the Swiss Federal Act on Data Protection or the Swiss Criminal Code.

Since workplace investigations are not regulated in Spain, there are no clear rules as to the amount of information on the investigation that would need to be shared with an employee if the company was compelled to disclose the enquiry (see questions 11 and 22). A good rule of thumb is that an employee should have access to all the information that is relevant to be in a position to oppose the alleged breaches.

Moreover, if the disciplinary measures taken were challenged before a Labour Court – employees in Spain tend to challenge these types of measures – the plaintiff could request the Labour Court to order the company to produce all of the investigation details, including the findings and the full investigation report.

Finally, companies will normally have an interest in producing a report that clearly states the moment in which the fact-finding exercise was concluded and the company had a full picture of the facts. This is because the statute of limitations to sanction employment breaches, which ranges from 10 to 60 days depending on the seriousness of the misconduct, starts to count when the company has a comprehensive view of the events (which would coincide with the date the investigation report was issued).

There is no obligation to share the investigation report, neither in full nor key findings, with the involved parties. An assessment needs to be made in each case of what is appropriate to share and with whom.

When sharing an investigation report, certain data protection considerations must be made. A purpose and legal basis for the sharing must be established and, in principle, documented.

If the Swedish Whistleblowing Act applies, the duty of confidentiality and the restrictions on access to and disclosure of personal data must be considered (see question 10).

In principle, there is no obligation to disclose the final investigation report. Disclosure obligations may arise based on data protection law vis-à-vis the persons concerned (eg, the accused). Likewise, there is no obligation to disclose other documents, such as the records of interviews. The employee should be fully informed of the final investigation report, if necessary, with certain redactions (see question 22). The right of the employee concerned to information is comprehensive (ie, all investigation files must be disclosed to him).[1] Regarding publication to other bodies outside of criminal proceedings, the employer is bound by its duty of care (article 328, Swiss Code of Obligations) and must protect the employee as far as is possible and reasonable.[2]