Workplace Investigations

GDPR principles fully apply to data gathering, as well as case law protecting the right to respect one’s private life and the secret of correspondence.

Dutch data protection rules are based on the EU Data Protection Directive. The employer has to notify the Dutch Data Protection Authority when processing personal data as part of an internal investigation. Given that the notification can be accessed publicly, it is recommended that the employer give a sufficiently high-level description of the case. In addition, the description should be sufficiently broad to include the entire investigation, and any future expansions of the scope of the investigation. Often companies make filings for all future internal investigations, without referring to specific matters.

The employer has to notify employees whose personal data is being processed about – among other things – the purposes of the investigation and any other relevant information. According to the Dutch Data Protection Act, this information obligation may only be suspended on restricted grounds, i.e. if the purpose of the investigation is the prevention, detection and prosecution of crimes and postponement is necessary for the interests of the investigation (e.g., because there is a risk of losing evidence, or collusion by individuals coordinating responses before being interviewed)). These exceptions on the duty to inform involved persons must be interpreted very restrictively. As soon as the reason for postponement is no longer applicable (e.g., because the evidence has been secured), the individuals need to be informed.

Dutch data protection law does not require the consent of employees. Consent given by employees, however, also cannot compensate for a lack of legitimate purpose or unnecessary or disproportionate data processing, as the consent given by an employee to its employer is not considered to be voluntary given the inequality of power between them.

Furthermore, internal company policies may contain specific data protection rules.

The Swiss Federal Act on Data Protection applies to the gathering of evidence, in particular such collection must be lawful, transparent, reasonable and in good faith, and data security must be preserved.[1]

It can be derived from the duty to disclose and hand over benefits received and work produced (article 321b, Swiss Code of Obligations) as they belong to the employer.[2] The employer is, therefore, generally entitled to collect and process data connected with the end product of any work completely by an employee and associated with their business. However, it is prohibited by the Swiss Criminal Code to open a sealed document or consignment to gain knowledge of its contents without being authorised to do so (article 179 et seq, Swiss Criminal Code). Anyone who disseminates or makes use of information of which he or she has obtained knowledge by opening a sealed document or mailing not intended for him or her may become criminally liable (article 179 paragraph 1, Swiss Criminal Code).

It is advisable to state in internal regulations that the workplace might be searched as part of an internal investigation and in compliance with all applicable data protection rules if this is necessary as part of the investigation.

A criminal investigation always takes precedence over other investigations. However, this does not mean that the internal investigation has to stop. It can and should continue, and the report drawn up upon completion of the investigation could be used by the authorities in the criminal investigation. In some cases, especially when privilege does not apply, police or regulatory authorities may request that the employer share such evidence. However, even when privilege does apply, there is no certainty that the evidence would not have to be communicated to certain authorities.

Some administrative authorities often challenge the application of legal privilege or try to reduce its scope. For example, the French financial markets authority (AMF) regularly puts forward its view of legal privilege, according to which an email where a lawyer is only copied (and is not one of the main recipients) in from one of their clients is not confidential and can therefore be disclosed in proceedings. However, if the AMF investigators impose disclosure of privileged documents, this should result in the annulment of the investigation procedure. By way of exception, legal privilege cannot be invoked against certain other authorities, such as the URSSAF (authority in charge of collecting social security contributions) or the DGCCRF (directorate-general for competition, consumer protection and anti-fraud investigations). Where legal privilege is enforceable, the judge must first determine whether the documents constitute correspondence relating to defence rights and, second, must cancel the seizure of documents that they find to be covered by legal privilege due to the principle of professional secrecy of relations between a lawyer and their client and the rights of defence.

In case there is a parallel criminal or regulatory investigation usually consultation between the investigators and the authorities takes place. Agreements are then sometimes made about the investigation conducted by / for the employer. In some cases, the authorities will ask to stay the investigation. There is no policy from the government on this topic.

There are situations where the authorities can compel the employer to share evidence. This depends on the exact circumstances of the case. For instance if the employer is the suspect in a criminal case.

It does occur that the authorities are given evidence upon request without the authorities having to order the extradition of evidence.  

The actions of the employer may carry through to a subsequent state proceeding. First and foremost, any prohibitions on the use of evidence must be considered. Whereas in civil proceedings the interest in establishing the truth must merely prevail for exploitation (article 152 paragraph 2, Swiss Civil Procedure Code), in criminal proceedings, depending on the nature of the unlawful act, there is a risk that the evidence may not be used (see question 27 and article 140 et seq, Swiss Civil Procedure Code).