Workplace Investigations

Files and documents that are purely business-related – whether in physical or digital form – may, in principle, be inspected by the employer without restriction. The employee has no right to refuse inspection.

When searching business laptops, computers, phones and e-mail accounts, a distinction must be made as to whether private use is permitted (or at least tolerated) or not: if the employee is allowed to use the items exclusively for business purposes, the employer may monitor and control them. If private use is permitted, the employee's right to privacy must be observed for private files, as must the protection of the secrecy of correspondence. Accordingly, the employer must avoid accessing private documents, files and e-mails. However, a review of private documents, files and e-mails may be permissible in the event of particularly serious violations if the employer's interest in the review outweighs the employee's interest in safeguarding his right to privacy. Generally, employers should allow private use of electronic devices only if employees have previously consented to the terms of use (including searches in certain cases).

A search of the employee's workplace by the employer is, in principle, permissible. However, a search of personal items (eg, bags, clothes, personal mobile phone) is generally only permissible with the employee's consent. Similarly to the review of digital personal data, a search of personal items may be permitted, however, in the event of particularly serious violations if the employer's interest in the search outweighs the employee's right to privacy.

As part of an investigation, an employer may search objects or files that are the company’s property (eg, electronic devices given by the employer for business purposes and emails or messages stored on the company’s server) without prior notice and the employee’s consent is not needed. The employer, however, has no right to search an employee’s possessions (eg, a private smartphone) without the employee’s consent.

To avoid arguments as to who a particular object belongs to, employers may specify in internal policies what is to be regarded as a corporate asset and could be subject to a search in a workplace investigation.

Concerning an employee’s possessions, even if he or she consents to a search, it is good practice for the employer to conduct the search in the presence of the employee or an independent third party who can act as a witness to the search. If the employer suspects that a criminal offence has been committed and that a search of the employee’s possessions would reveal evidence, the employer should consider reporting its suspicion to the police, as they have wider legal powers to search.[1]

The basic rule is that the employer may not search private data during internal investigations.

If there is a strong suspicion of criminal conduct on the part of the employee and a sufficiently strong justification exists, a search of private data may be justified.[1] The factual connection with the employment relationship is given, for example, in the case of a criminal act committed during working hours or using workplace infrastructure.[2]

At the end of the workplace investigation, the results are presented to the company's management bodies so that they can make a decision. This may be a mere summary of the facts, or it may contain a legal assessment and recommendation for action.

There is no general obligation to report compliance violations to the police or public prosecutor's office. For some violations, there are statutory disclosure requirements. For example, data protection violations must be reported to the responsible supervisory authority (article 33 and 34, DSGVO), violations in connection with money laundering must be reported to the Central Office for Financial Transaction Investigations (section 43, Anti-Money Laundering Act), unlawful claiming of subventions must be disclosed to the subsidy-providing authority (section 3, Subventions Act), and incorrect information in the tax declaration must be reported to the tax authority (section 153, Tax Code). Additionally, in listed companies, criminal acts may constitute insider information in individual cases, and this must be disclosed within the framework of ad hoc publicity following market abuse regulations.

Also, there may be cases where reporting to the authorities should be considered for corporate policy and tactical reasons (eg, to avoid or mitigate negative consequences for the business).

Pursuant to section 17 paragraph 2, HinSchG, feedback will need to be provided to the whistleblower within three months of confirmation of receipt of the report or, if the receipt has not been confirmed to the whistleblower, within three months and seven days after receipt of the report. This includes the communication of planned and already taken follow-up measures as well as their reasons. Feedback to the whistleblower may only be provided to the extent that it does not affect the workplace investigation and does not prejudice the rights of the persons who are the subject of the report or who are named in the report.

For the question of whether internal investigations reports and material need to be shared with or can be seized by the public prosecutor, please see question 14.

As mentioned in questions 21, 22 and 23, under Hong Kong law, the employer is generally not obliged to actively disclose the findings of a workplace investigation to any party.

Having said that, the employer should be aware of certain statutory disclosure requirements that may become applicable as a result of the matters revealed during the workplace investigation. For example, if the investigation reveals or gives rise to any knowledge or suspicion that any property represents the proceeds of an indictable offence[1], drug trafficking[2], or terrorism[3], the employer is required to report its knowledge or suspicion, together with any matter on which that knowledge or suspicion is based, to the JFIU as soon as is reasonably practicable (even where the investigation has not yet been concluded). Employers who are licensed corporations must also provide the SFC with information about whether departing licensed employees were the subject of an internal investigation in the six months prior to his/her departure. If the internal investigation commences after the departure of the licensed employee, the licensed corporation should notify the SFC as soon as practicable[4].

In any event, as in question 14, if any documents related to the investigation are protected by legal professional privilege, they can generally be kept confidential and would not be subject to disclosure even if the employer is subject to a mandatory reporting or disclosure obligation.

The employer is generally not required to disclose the final report, or the data obtained in connection with the investigation. In particular, the employer is not obliged to file a criminal complaint with the police or the public prosecutor's office.

Exceptions may arise, for example, from data protection law (see question 22) or a duty to release records may arise in a subsequent state proceeding.

Data voluntarily submitted in a proceeding in connection with the internal investigation shall be considered private opinion or party assertion.[1] If the company refuses to hand over the documents upon request, coercive measures may be used under certain circumstances.[2]