Workplace Investigations

Typical triggers for a workplace investigation may be internal hints (eg, from employees), internal audits, compliance or the legal department. However, investigations by the public prosecutor or other authorities can also lead to a workplace investigation.

There are no strict guidelines for the course of the investigation. The measures to be taken and the sequence in which they will be carried out to clarify the facts must be decided on a case-by-case basis. However, the first step should be to secure evidence. All relevant documents and records (eg, e-mails, hard disks, text messages, data carriers, copies) should be collected and employees may be interviewed. The second step should be to evaluate the evidence and the third step is to decide how to deal with the results (eg, whether any disciplinary measures should be taken or the intended procedures should be adjusted).

Irrespective of how a workplace investigation is commenced, when it comes to severe breaches of duty by an employee, a two-week exclusion period for issuing a termination for cause must be observed at all stages. This two-week period starts when the employer becomes aware of the relevant facts but is suspended as long as the employer is still investigating and collecting information, provided that the investigation is carried out swiftly.

The workplace investigation can be exercised by an internal (ad hoc) investigation department of the company itself, for example under the direction of the internal audit department or compliance department. This is possible if there is sufficient manpower with the necessary independence, knowledge and experience. Case law, however, shows that courts tend to be more critical of internal investigations than external investigations. For more complex and sensitive investigations, a forensic accountant or lawyer is often involved. The advantage of involving a lawyer is that the investigation and its outcome are covered by privilege. This guarantees the confidentiality of the investigation, also regarding supervisors and investigating authorities. Yet, at the same time, there is increasing debate about the role of lawyers as investigators, given their inherent bias to work in the interests of their client (the employer).

The investigation starts with a plan of approach that must be signed by the contractor. This plan of approach outlines the legal framework of the investigation, such as the scope, the means to be used, how it will deal with data, the use of experts, how the interviews will be conducted, the way of reporting and confidentiality. Furthermore, there must be a protocol for how the investigator conducts the investigation and that applies to all parties involved.

Gathering information can be done in various ways. For example:

• An inventory can be made of the household effects of a company. In the event of theft, an inventory can be an appropriate means of establishing exactly what has been stolen.
• An investigation of the books: this is an investigation of all documents of the company. These are not private documents of employees, but documents of the company itself. For an investigator, an interview can be a good way to gather more information, for example by interviewing witnesses. In practice, there are almost always several interviews with the suspects, the employer and other people involved.
• Open source research, which often involves researching a person's social media, or public documents relevant to the research. In principle, “open sources” refers to all public documents in the world; nowadays, many public documents are digitised.
• A workplace search, which includes everything present in the workplace: diaries, computer files, e-mails, letters, and even the contents of a wastebasket.
• A digital data investigation: this is a frequently used tool in fraud investigations. Most communication and documents are digital nowadays. It is, therefore, very likely that evidence can be found in digital data. Each of these means of investigation must respect the principles of an internal investigation and comply with the GDPR principles .

Internal investigations are usually initiated after reports about possible violations of the employer's code of conduct, applicable laws or regulations have been submitted by employees to their superiors, the human resources department or designated internal reporting systems such as hotlines (including whistleblowing hotlines).

For an internal investigation to be initiated, there must be a reasonable suspicion (grounds).[1] If no such grounds exist, the employer must ask the informant for further or more specific information. If no grounds for reasonable suspicion exists, the case must be closed. If grounds for reasonable suspicion exist, the appropriate investigative steps can be initiated by a formal investigation request from the company management.[2]

The legal situation regarding attorney-client privilege for investigation materials compiled by external advisors (in particular investigation reports) is unclear. In principle, there is no absolute protection against seizure by the public prosecutor in the relationship between client and lawyer. Such protection only exists in the relationship between the accused in a criminal proceeding and his criminal defence attorney.

In recent years, German courts have repeatedly issued different rulings on the question of whether investigation materials (at the company itself or a lawyer's office) may be seized. In 2018, the Federal Constitutional Court (BVerfG) ruled that the seizure of documents at the offices of an international law firm that is not based in Germany, and therefore can not invoke German constitutional rights, is lawful. However, the BVerfG did not comment on what would apply to seizures at law firms based in Germany.

For violations that could lead to the company itself being exposed to investigative proceedings at some point and possibly having to defend itself, there are, in our view, good arguments for investigation materials being subject to attorney-client privilege. Additionally, the lawyer's hand file, in which he usually keeps his notes on the case or minutes of conversations with his client, may also not be seized. In all other cases, under the current legal situation, there is a risk that the materials may be seized, even in the office of the company’s lawyer. From a practical point of view, it is nevertheless advisable to label investigative materials, especially interview protocols and investigation reports, with a notice that they are confidential documents subject to attorney-client privilege and to store them not at the company’s premises but in an attorney’s office.

If an attorney is engaged to provide legal advice or representation in respect of the (subject matter of the) investigation and as such also conducts (part of) the investigation, work products prepared by such an attorney will typically be subject to the legal privilege. Such work products may include, for example, interview minutes, investigation reports, investigation updates, attorney-client correspondence on the investigation, and legal advice rendered in connection with the (subject matter of the) investigation.

As outlined above, all employees generally have the right to know whether and what personal data is being or has been processed about them (article 8 paragraph 1, Swiss Federal Act on Data Protection; article 328b, Swiss Code of Obligations).

The employer may refuse, restrict or postpone the disclosure or inspection of internal investigation documents if a legal statute so provides, if such action is necessary because of overriding third-party interests (article 9 paragraph 1, Swiss Federal Act on Data Protection) or if the request for information is manifestly unfounded or malicious. Furthermore, a restriction is possible if overriding the self-interests of the responsible company requires such a measure and it also does not disclose the personal data to third parties. The employer or responsible party must justify its decision (article 9 paragraph 5, Swiss Federal Act on Data Protection).[1]

The scope of the disclosure of information must, therefore, be determined by carefully weighing the interests of all parties involved in the internal investigation.