Workplace Investigations

The relevant laws and regulations in the PRC have not made explicit requirements regarding the supports received by the employee involved in the investigation. In practice, the employer will usually prepare an internal time schedule before carrying out the investigation. Although the detailed time schedule will not be disclosed to the employee, the employer will usually inform the employee of each investigation in advance. In order to improve the transparency of the investigation, we recommend that employer should make positive and proper responses to employee who enquires about the progress of the investigation, so as to avoid employee's suspicion.

In addition, the Personal Information Protection Law of the PRC stipulates the rights of individuals in the process of personal information processing. In the scenario of internal investigation of an employer, the investigated party may, in accordance with such provisions, ask the employer for the right to review and even copy the personal information collected. Where the employee finds that the personal information collected by internal investigation is inaccurate or incomplete, he/she is entitled to request for correction or supplementation.

Generally, when employees may also use their devices for private purposes, the employer should ensure it allows its employees to tag their private data as "private". This tagging may facilitate the differentiation between business data (relevant for the investigation) and (non-usable) private data in the event of e-mail and electronic data screening.

In addition, the employer may, in appropriate cases, assure the employee that, if there is complete and truthful disclosure of facts to be clarified, the employer will refrain from imposing sanctions under labour and civil law (eg, a warning, termination of employment and the assertion of any claims for damages). In practice, assistance in finding a lawyer and the payment of legal fees is sometimes offered. However, such amnesty programmes are commonly only useful if there is a large number of cases that are particularly complex, poorly documented and difficult to resolve without amnesty offers.

The employer does not generally need to provide specific support for employees that are subject to an internal investigation. The employer may, however, allow concerned employees to be accompanied by a trusted third party such as family members or friends.[1] These third parties will need to sign separate non-disclosure agreements before being involved in the internal investigation.

In addition, a company may appoint a so-called lawyer of confidence who has been approved by the employer and is thus subject to professional secrecy. This lawyer will not be involved in the internal investigation but may look after the concerned employees and give them confidential advice as well as inform them about their rights and obligations arising from the employment relationship.[2]

The relevant laws and regulations in the PRC have not clarified the retention period of the investigation findings. According to Article 19 of the Personal Information Protection Law of the PRC, unless otherwise required by laws or administrative regulations, the retention period of personal information shall be the shortest period necessary to achieve the purpose of handling the information. Since the employee's personal information is very likely to be involved in the investigation findings, such report should be retained for the shortest period necessary to achieve the purpose of handling the information. In general, once the investigation is completed, the purpose of the internal investigation has been achieved or it is no longer necessary to achieve the purpose, and the employer may, in accordance with Article 22 of the Administrative Regulations of the PRC on Network Data Security (Draft for Comments), delete or anonymize the personal information within fifteen (15) working days. If it is technically difficult to delete the personal information, or it is difficult to do so within fifteen (15) working days due to business complexity or other reasons, the employer shall not conduct any processing other than storing the personal information and adopting necessary security measures, and shall give reasonable explanations to the employee.

If there is no special statutory storage period (which is the case for investigative reports and findings), personal data may only be stored for as long as is necessary for the purposes for which they are collected. As soon as the data is no longer required, it must be deleted. In connection with workplace investigations, the question arises as to how this obligation to delete personal data relates to the company's corporate interests. From the company's perspective, there may well be legitimate interests that speak in favour of retaining existing data for as long as possible. Under the data protection regulations of the DSGVO and the BDSG, data can be stored for as long as it is required for the assertion, exercise or defence of (civil) legal claims. This means that the data can, in any event, be saved at least as long as any measures related to the workplace investigation have not yet been completed and any legal disputes have not yet been concluded.

From an employment law point of view, there is no statute of limitations on the employee's violations. Based on the specific circumstances (eg, damage incurred, type of violation, basis of trust or the position of the employee), a decision must be made as to the extent to which the outcome should remain on the record.

From a data protection point of view, only data that is in the interest of the employee (eg, to issue a reference letter) may be retained during the employment relationship. In principle, stored data must be deleted after the termination of the employment relationship. Longer retention may be justified if rights are still to be safeguarded or obligations are to be fulfilled in the future (eg, data needed regarding foreseeable legal proceedings, data required to issue a reference letter or data in relation to a non-competition clause).[1]