Workplace Investigations

The General Data Protection Regulation and the Spanish Data Protection Law apply when gathering any type of evidence, including physical evidence. This means that companies may only process personal data when they have lawful grounds to do so and within the limits set forth for special categories of personal data (health, union affiliation, criminal records, etc.).

The Spanish Statute of Workers specifically states that employees and their possessions may be registered when it is necessary to protect the companies’ property (or the property of other co-workers). This registration must:

• be conducted in the workplace and during working hours;
• respect the employee’s privacy and dignity; and
• be performed in front of an employee representative or, if not possible, in the presence of another employee of the company.

The Swiss Federal Act on Data Protection applies to the gathering of evidence, in particular such collection must be lawful, transparent, reasonable and in good faith, and data security must be preserved.[1]

It can be derived from the duty to disclose and hand over benefits received and work produced (article 321b, Swiss Code of Obligations) as they belong to the employer.[2] The employer is, therefore, generally entitled to collect and process data connected with the end product of any work completely by an employee and associated with their business. However, it is prohibited by the Swiss Criminal Code to open a sealed document or consignment to gain knowledge of its contents without being authorised to do so (article 179 et seq, Swiss Criminal Code). Anyone who disseminates or makes use of information of which he or she has obtained knowledge by opening a sealed document or mailing not intended for him or her may become criminally liable (article 179 paragraph 1, Swiss Criminal Code).

It is advisable to state in internal regulations that the workplace might be searched as part of an internal investigation and in compliance with all applicable data protection rules if this is necessary as part of the investigation.

The issue with revealing unrelated matters to the investigation is that it may jeopardise the entire enquiry. If the unrelated matters are private or the disclosure is construed as a breach of employees’ fundamental rights, then the materials gathered during the investigation could be considered to be unlawfully obtained and would not be admitted as evidence in court.

Moreover, the employee could seek damages and a fine could be imposed on the company for breaching its employee’s rights.

Finally, if unrelated matters are revealed, it could be a clear sign that the company has failed to conduct a diligent investigation and use the least intrusive means available to it (see question 1). One of the reasons to minimise the number of employees conducting the investigation (see question 4) is to reduce damages if matters unrelated to the investigation are revealed.

There are no regulations in this regard in the Swiss employment law framework. However, in criminal proceedings, the rules regarding accidental findings apply (eg, article 243, Swiss Criminal Procedure Code for searches and examinations or article 278, Swiss Criminal Procedure Code for surveillance of post and telecommunications). In principle, accidental findings are usable, with the caveat of general prohibitions on the use of evidence.

Companies may only disclose the outcome of an investigation to employees or officers of the company who are empowered to adopt the measures that are necessary because of the investigation’s results (see question 4).

This disclosure obligation does not extend to authorities: while there is a general obligation to report criminal or administrative offences to the competent authorities, this obligation must be read in line with the companies’ right not to self-report themselves. What a company must not do is cover up, aid or otherwise become an accessory to the offence.

The employer is generally not required to disclose the final report, or the data obtained in connection with the investigation. In particular, the employer is not obliged to file a criminal complaint with the police or the public prosecutor's office.

Exceptions may arise, for example, from data protection law (see question 22) or a duty to release records may arise in a subsequent state proceeding.

Data voluntarily submitted in a proceeding in connection with the internal investigation shall be considered private opinion or party assertion.[1] If the company refuses to hand over the documents upon request, coercive measures may be used under certain circumstances.[2]