Workplace Investigations

The employer may take disciplinary actions against the employee based on the investigation result and pursue their civil, administrative and even criminal liabilities. To be specific: 1) the employer may criticize and educate the employee, or take disciplinary actions such as warning, demotion and removal according to the internal rules and regulations of the employer. If the misconduct of the employee constitutes one of the circumstances stipulated in Article 39 of the Employment Contract Law of the PRC, the employer is entitled to take the most severe disciplinary action, namely termination of employment contract; 2) if the employee has caused economic loss to the employer, the employer may lawfully initiate a civil litigation recourse procedure; 3) if the employee violates the Law on Administrative Penalties for Public Security Administration of the PRC, the employer may deliver the case to the administrative department for corresponding administrative penalties; 4) if the employee is suspected of a crime, the employer should deliver the case to the public security authority and pursue his/her corresponding criminal liabilities according to the law.

Depending on the results of the investigation, different steps may have to be taken by the employer. Specifically, the following should be considered:

• in certain cases, there may be an obligation (or at least good reason) to share the results of the workplace investigation with the authorities (see question 25);
• filing of a criminal complaint against the employee;
• disciplinary measures against the employee such as a warning, ordinary termination or termination for cause;
• assessing and asserting claims for damages against the employee;
• offering compliance training to the relevant employees or introducing additional measures to prevent further violations;
• if there is a risk that the company itself is exposed to investigative proceedings at some point and may have to defend itself, investigation materials should be stored at the company's external attorney's office; and
• depending on the individual circumstances of the case and to mitigate potential reputational damage, proactively informing the public (eg, by issuing a press release) may be beneficial.

If the investigation uncovers misconduct, the question arises as to what steps should be taken. Of course, the severity of the misconduct and the damage caused play a significant role. Furthermore, it must be noted that the cooperation of the employee concerned may be of decisive importance for the outcome of the investigation. The possibilities are numerous, ranging, for example, from preventive measures to criminal complaints.[1]

If individual disciplinary actions are necessary, these may range from warnings to ordinary or immediate termination of employment.

The relevant laws and regulations in the PRC have not clarified the retention period of the investigation findings. According to Article 19 of the Personal Information Protection Law of the PRC, unless otherwise required by laws or administrative regulations, the retention period of personal information shall be the shortest period necessary to achieve the purpose of handling the information. Since the employee's personal information is very likely to be involved in the investigation findings, such report should be retained for the shortest period necessary to achieve the purpose of handling the information. In general, once the investigation is completed, the purpose of the internal investigation has been achieved or it is no longer necessary to achieve the purpose, and the employer may, in accordance with Article 22 of the Administrative Regulations of the PRC on Network Data Security (Draft for Comments), delete or anonymize the personal information within fifteen (15) working days. If it is technically difficult to delete the personal information, or it is difficult to do so within fifteen (15) working days due to business complexity or other reasons, the employer shall not conduct any processing other than storing the personal information and adopting necessary security measures, and shall give reasonable explanations to the employee.

If there is no special statutory storage period (which is the case for investigative reports and findings), personal data may only be stored for as long as is necessary for the purposes for which they are collected. As soon as the data is no longer required, it must be deleted. In connection with workplace investigations, the question arises as to how this obligation to delete personal data relates to the company's corporate interests. From the company's perspective, there may well be legitimate interests that speak in favour of retaining existing data for as long as possible. Under the data protection regulations of the DSGVO and the BDSG, data can be stored for as long as it is required for the assertion, exercise or defence of (civil) legal claims. This means that the data can, in any event, be saved at least as long as any measures related to the workplace investigation have not yet been completed and any legal disputes have not yet been concluded.

From an employment law point of view, there is no statute of limitations on the employee's violations. Based on the specific circumstances (eg, damage incurred, type of violation, basis of trust or the position of the employee), a decision must be made as to the extent to which the outcome should remain on the record.

From a data protection point of view, only data that is in the interest of the employee (eg, to issue a reference letter) may be retained during the employment relationship. In principle, stored data must be deleted after the termination of the employment relationship. Longer retention may be justified if rights are still to be safeguarded or obligations are to be fulfilled in the future (eg, data needed regarding foreseeable legal proceedings, data required to issue a reference letter or data in relation to a non-competition clause).[1]