Workplace Investigations

Evidence obtained in the context of an investigation must specify who provided it and the date it was provided. No retaliatory measures may be taken against the whistleblower for the act of whistleblowing.

In certain cases, the whistleblower report must be forwarded to the judicial authorities (eg, when there is an obligation to assist persons in imminent danger, for serious offences or a disclosure that a vulnerable person is in danger (ie, minors under 15 or a person who is unable to protect themselves)).

In 2023, Germany has implemented the EU Whistleblowing Directive into national law with the German Whistleblower Protection Act (HinSchG).

The German Whistleblower Protection Act provides that companies with at least 50 employees must establish internal reporting channels as further set out in the law. Among other things, the confidentiality of the whistleblower as well as of the individuals affected by the report must be protected.

Further, whistleblowers must be protected from negative consequences that may arise from their reports. If the employment of a whistleblower were terminated or if the whistleblower were to be denied promotion after reporting a violation, the employer would have to prove that this was not related to the whistleblowing but was based on justified reasons.

Employers should  familiarise themselves with the provisions of the new law.

If an employee complains to his or her superiors about grievances or misconduct in the workplace and is subsequently dismissed, this may constitute an unlawful termination (article 336, Swiss Code of Obligations). However, the prerequisite for this is that the employee behaves in good faith, which is not the case if he or she is (partly) responsible for the grievance.

If the outcome of the internal investigation has led to the sanctioning of an employee, this sanction may no longer be invoked to support a new sanction after three years. Moreover, under the GDPR principles, the duration of retention must be proportional to the use of the data. Therefore, the data must be retained only for a period that is “strictly necessary and proportionate”. If the employer wants to keep information about the investigation in the longer term, it is possible to archive the employee’s record even though the employer will no longer be able to use it against the employee after three years.

If there is no special statutory storage period (which is the case for investigative reports and findings), personal data may only be stored for as long as is necessary for the purposes for which they are collected. As soon as the data is no longer required, it must be deleted. In connection with workplace investigations, the question arises as to how this obligation to delete personal data relates to the company's corporate interests. From the company's perspective, there may well be legitimate interests that speak in favour of retaining existing data for as long as possible. Under the data protection regulations of the DSGVO and the BDSG, data can be stored for as long as it is required for the assertion, exercise or defence of (civil) legal claims. This means that the data can, in any event, be saved at least as long as any measures related to the workplace investigation have not yet been completed and any legal disputes have not yet been concluded.

From an employment law point of view, there is no statute of limitations on the employee's violations. Based on the specific circumstances (eg, damage incurred, type of violation, basis of trust or the position of the employee), a decision must be made as to the extent to which the outcome should remain on the record.

From a data protection point of view, only data that is in the interest of the employee (eg, to issue a reference letter) may be retained during the employment relationship. In principle, stored data must be deleted after the termination of the employment relationship. Longer retention may be justified if rights are still to be safeguarded or obligations are to be fulfilled in the future (eg, data needed regarding foreseeable legal proceedings, data required to issue a reference letter or data in relation to a non-competition clause).[1]