Workplace Investigations

When collecting data (in physical or digital form), the employer must ensure compliance with the data protection principles according to the General Data Protection Regulation (DSGVO) and the German Data Protection Act (BDSG). These principles include, among other things, that data collection must be carried out lawfully (principle of legality) and transparently (transparency principle) and must be comprehensively documented – specifically concerning the purpose of the workplace investigation – to be able to prove compliance with data protection.

The principle of legality states that data may only be collected on a legal basis (ie, there must either be a law authorising this or the employee must have consented to the collection of his data).

The transparency principle may constitute a special challenge during workplace investigations. Under the transparency principle, the employee must be generally informed about the collection of his data. This includes information on who processes the data, the purposes for which it is processed and whether the data is made available to third parties. However, there may be a risk of collusion, particularly when electronic data has to be reviewed, and thus the success of the investigation may be jeopardised if the relevant employee is comprehensively informed in advance. Accordingly, the employer should check, with the assistance of the data protection officer, whether the obligation to provide information may be dispensed with. This may be the case if providing the information would impair the assertion, exercise or defence of legal claims and the interests of the employer in not providing the information outweigh the interests of the employee. The respective circumstances and employer's considerations should be well documented in each case.

Regardless of whether the employee is informed about the investigation, to prevent data loss, the employee should be sent a so-called hold notice (ie, a prohibition to delete data). Additionally, to prevent automatic deletion, blocking mechanisms should also be implemented.

When gathering evidence by searching the employee's possessions or files, the employee's privacy rights also need to be observed (see question 8).

Workplace investigations that do not require the presence or active cooperation of the employee may also start or continue during the employee's absence due to illness. If the employee's cooperation is required, for example for an interview, the employer can only instruct the employee to participate despite an existing illness if certain narrow conditions are met:

Regarding staff meetings at the company, the German Federal Labour Court has ruled that the employer can only instruct the employee to attend the staff meeting during illness if

• there is an urgent operational reason for doing so, which does not allow the instruction to be postponed until after the end of the incapacity to work; and
• the employee's presence at the company is urgently required and can be expected of him.

Similar rules are likely to apply to the employee's presence for workplace investigations.

Urgent operational reasons that cannot be postponed could exist, for example, if during the employee's absence due to illness, there is a risk that evidence will be lost (eg, where only the employee affected has access to certain files or data) or there is a risk of significant damage to the employer if workplace investigations are stopped until after the employee's return.