Workplace Investigations

In respect of data protection, the processing of personal data in whistleblowing systems is considered by the Finnish Data Protection Ombudsman (DPO) as requiring a data protection impact assessment (DPIA).

In 2023, Germany has implemented the EU Whistleblowing Directive into national law with the German Whistleblower Protection Act (HinSchG).

The German Whistleblower Protection Act provides that companies with at least 50 employees must establish internal reporting channels as further set out in the law. Among other things, the confidentiality of the whistleblower as well as of the individuals affected by the report must be protected.

Further, whistleblowers must be protected from negative consequences that may arise from their reports. If the employment of a whistleblower were terminated or if the whistleblower were to be denied promotion after reporting a violation, the employer would have to prove that this was not related to the whistleblowing but was based on justified reasons.

Employers should  familiarise themselves with the provisions of the new law.

Concerning a workplace investigation, there is no specific legislation in force at the moment regarding confidentiality obligations. All normal legal confidentiality obligations (eg, obligations outlined in the Trade Secrets Act (595/2018)), and if using an external investigator, the confidentiality obligations outlined in the agreement between the employer and the external investigator, apply. Attorneys-at-law always have strict confidentiality obligations as per the Advocates Act (496/1958).

Depending on the subject of the investigation and the severity and significance of the suspected violation, employees who are involved in the workplace investigation may already have to maintain confidentiality based on their contractual duties. The prerequisite for this is that the employer has a legitimate interest in maintaining confidentiality. Criminal acts are not subject to confidentiality, but there is also no general obligation for the employee to report or disclose a criminal act to the authorities or the public prosecutor. However, reporting to the competent authorities may be required in certain cases (see question 25).

Lawyers are bound by professional confidentiality and are generally not allowed to provide information about any information they receive from their clients. An exception exists, for example, if the lawyer must provide information to defend himself in court proceedings. There is also no absolute protection against the seizure of documents at an attorney’s office (see question 14).