Workplace Investigations

There are no specific legislative requirements for workplace investigations in Germany. In 2020, the Federal Ministry of Justice presented a draft bill with regulations on internal investigations and, in particular, employee interviews. However, this law failed to pass under the previous government. The current government has announced it will take up this matter again and plans to create a precise legal framework for internal investigations. Details, timing and content remain to be seen.

Nevertheless, workplace investigations do not take place in a "lawless space". They must comply with the provisions of employment and data protection law. Further, criminal and corporate law aspects can play a role. Moreover, works council information and co-determination rights may have to be taken into account.

Typical triggers for a workplace investigation may be internal hints (eg, from employees), internal audits, compliance or the legal department. However, investigations by the public prosecutor or other authorities can also lead to a workplace investigation.

There are no strict guidelines for the course of the investigation. The measures to be taken and the sequence in which they will be carried out to clarify the facts must be decided on a case-by-case basis. However, the first step should be to secure evidence. All relevant documents and records (eg, e-mails, hard disks, text messages, data carriers, copies) should be collected and employees may be interviewed. The second step should be to evaluate the evidence and the third step is to decide how to deal with the results (eg, whether any disciplinary measures should be taken or the intended procedures should be adjusted).

Irrespective of how a workplace investigation is commenced, when it comes to severe breaches of duty by an employee, a two-week exclusion period for issuing a termination for cause must be observed at all stages. This two-week period starts when the employer becomes aware of the relevant facts but is suspended as long as the employer is still investigating and collecting information, provided that the investigation is carried out swiftly.

Generally, under German employment law, an employee has a right to perform his[1] work and, therefore, suspending an employee would only be possible with the employee's consent. If an employer decided to suspend an employee without his consent, the employee could then claim his right to employment has been affected and seek a preliminary injunction before the competent labour court.

Unilaterally suspending an employee is, in principle, not permissible. Exceptions are made in cases where the employer has a legitimate interest. Typically, such legitimate interest exists after the employer has issued a notice of termination. During a workplace investigation, the employer may have a legitimate interest in suspending the employee, for example, if there is a risk that evidence may be destroyed, colleagues may be influenced, or the employee's presence may otherwise have a detrimental effect on the investigation or employer. Whether or not there is a legitimate interest must be assessed in each case. In practice, it is rare for employees to take legal action against a suspension.

In any event, during a suspension, the employee would be entitled to further payment of his salary without the employer receiving any services in return.

It is up to the company to decide who should carry out the workplace investigation and individual investigative steps. If their staff is used, the question arises of which person or department (compliance, legal, internal audit, HR or management) should take the lead. The answer to this question may depend on various factors such as the number of employees affected by the workplace investigation and the nature of the alleged misconduct. In any event, due to various employment law and data protection issues, the HR department and the legal department should be involved.

Further, it may make sense to bring in external advisors to lead the investigation together with an internal investigation team of the company. The engagement of an external investigation team can also be advantageous concerning the two-week exclusion period for termination for cause. This period does not start to run as long as the external advisors are investigating, but only when the persons authorised to terminate employment receive the investigation report.

There is no general legal remedy against the conduct of the investigation itself. However, if individual measures are carried out in violation of the law (eg, data protection rules), the employee can take legal action against the specific measure through an interim injunction. In addition, the employee has the right to complain to the works council and ask for the works council's support if he feels that the employer has discriminated against him, has treated him unfairly, or that he has been adversely affected in any other way (section 84 paragraph 1 s 2, German Works Constitution Act (BetrVG)).

Additionally, the works council has the right to take legal action against investigative measures that were carried out in violation of its co-determination rights (see question 16).

Since there is no mandatory law (yet) that provides a framework for workplace investigation interviews, there are also no special protective regulations for employees acting as witnesses.

Employees have a contractual duty to participate in interviews – be it as a suspect or as a witness – as part of workplace investigations. The employee must provide truthful information based on his duty of loyalty if:

• the questions relate to his area of work;
• the employer has an interest worthy of protection in obtaining the information; and
• the requested information does not represent an excessive burden for the employee.

Whether such a burden can be assumed when the employee must make statements by which he may incriminate himself is disputed in German case law and legal literature. The German Federal Labour Court has not yet decided on this question. Since an internal workplace investigation interview is an interview under private law and not under criminal law, there are, in our view, good arguments that the employee must also make a true statement even if he incriminates himself, provided his area of work is concerned. However, some labour courts assume that in these cases such a statement could not be used in criminal proceedings.

When collecting data (in physical or digital form), the employer must ensure compliance with the data protection principles according to the General Data Protection Regulation (DSGVO) and the German Data Protection Act (BDSG). These principles include, among other things, that data collection must be carried out lawfully (principle of legality) and transparently (transparency principle) and must be comprehensively documented – specifically concerning the purpose of the workplace investigation – to be able to prove compliance with data protection.

The principle of legality states that data may only be collected on a legal basis (ie, there must either be a law authorising this or the employee must have consented to the collection of his data).

The transparency principle may constitute a special challenge during workplace investigations. Under the transparency principle, the employee must be generally informed about the collection of his data. This includes information on who processes the data, the purposes for which it is processed and whether the data is made available to third parties. However, there may be a risk of collusion, particularly when electronic data has to be reviewed, and thus the success of the investigation may be jeopardised if the relevant employee is comprehensively informed in advance. Accordingly, the employer should check, with the assistance of the data protection officer, whether the obligation to provide information may be dispensed with. This may be the case if providing the information would impair the assertion, exercise or defence of legal claims and the interests of the employer in not providing the information outweigh the interests of the employee. The respective circumstances and employer's considerations should be well documented in each case.

Regardless of whether the employee is informed about the investigation, to prevent data loss, the employee should be sent a so-called hold notice (ie, a prohibition to delete data). Additionally, to prevent automatic deletion, blocking mechanisms should also be implemented.

When gathering evidence by searching the employee's possessions or files, the employee's privacy rights also need to be observed (see question 8).

Files and documents that are purely business-related – whether in physical or digital form – may, in principle, be inspected by the employer without restriction. The employee has no right to refuse inspection.

When searching business laptops, computers, phones and e-mail accounts, a distinction must be made as to whether private use is permitted (or at least tolerated) or not: if the employee is allowed to use the items exclusively for business purposes, the employer may monitor and control them. If private use is permitted, the employee's right to privacy must be observed for private files, as must the protection of the secrecy of correspondence. Accordingly, the employer must avoid accessing private documents, files and e-mails. However, a review of private documents, files and e-mails may be permissible in the event of particularly serious violations if the employer's interest in the review outweighs the employee's interest in safeguarding his right to privacy. Generally, employers should allow private use of electronic devices only if employees have previously consented to the terms of use (including searches in certain cases).

A search of the employee's workplace by the employer is, in principle, permissible. However, a search of personal items (eg, bags, clothes, personal mobile phone) is generally only permissible with the employee's consent. Similarly to the review of digital personal data, a search of personal items may be permitted, however, in the event of particularly serious violations if the employer's interest in the search outweighs the employee's right to privacy.

In 2023, Germany has implemented the EU Whistleblowing Directive into national law with the German Whistleblower Protection Act (HinSchG).

The German Whistleblower Protection Act provides that companies with at least 50 employees must establish internal reporting channels as further set out in the law. Among other things, the confidentiality of the whistleblower as well as of the individuals affected by the report must be protected.

Further, whistleblowers must be protected from negative consequences that may arise from their reports. If the employment of a whistleblower were terminated or if the whistleblower were to be denied promotion after reporting a violation, the employer would have to prove that this was not related to the whistleblowing but was based on justified reasons.

Employers should  familiarise themselves with the provisions of the new law.

Depending on the subject of the investigation and the severity and significance of the suspected violation, employees who are involved in the workplace investigation may already have to maintain confidentiality based on their contractual duties. The prerequisite for this is that the employer has a legitimate interest in maintaining confidentiality. Criminal acts are not subject to confidentiality, but there is also no general obligation for the employee to report or disclose a criminal act to the authorities or the public prosecutor. However, reporting to the competent authorities may be required in certain cases (see question 25).

Lawyers are bound by professional confidentiality and are generally not allowed to provide information about any information they receive from their clients. An exception exists, for example, if the lawyer must provide information to defend himself in court proceedings. There is also no absolute protection against the seizure of documents at an attorney’s office (see question 14).

In principle, the employer does not have to inform the employees about the investigation. Furthermore, there is no obligation to inform the "suspect" about the specific content of the workplace investigation itself and the allegations against him.

However, if personal data relating to the employee is collected and reviewed, the employee must be informed under German data protection principles (see question 7).

If the employer considers issuing a notice of termination based on the suspicion of wrongdoing, the employee must be allowed to comment on the allegations against him before receiving the termination notice. This requires that the employee be properly informed about the allegations and evidence against him. However, until the time of such a hearing, which usually follows the workplace investigation, there is no obligation on the part of the employer to inform the employee concerned about ongoing investigations.

There is no general obligation on the part of the employer to disclose to the employee concerned the identity of the complainant, witnesses or other sources of information during the workplace investigation.

However, as described in question 11, the employee must be sufficiently informed of the allegations before a termination based on suspicion of wrongdoing is issued. This may also require disclosing the complainant's or witnesses' identity or other sources of information. In addition, the employer would have the burden of proof in the context of a legal dispute (eg, termination protection proceedings or proceedings about the legality of certain investigation measures) and may have to name witnesses and disclose sources of information.

In principle, it is possible to conclude non-disclosure agreements with external consultants of the investigation or with employees involved in the investigation. However, regarding external lawyers, a non-disclosure agreement is not necessary since lawyers are already subject to professional confidentiality. Concerning employees, it is rare in Germany to conclude confidentiality agreements in connection with a workplace investigation.

The legal situation regarding attorney-client privilege for investigation materials compiled by external advisors (in particular investigation reports) is unclear. In principle, there is no absolute protection against seizure by the public prosecutor in the relationship between client and lawyer. Such protection only exists in the relationship between the accused in a criminal proceeding and his criminal defence attorney.

In recent years, German courts have repeatedly issued different rulings on the question of whether investigation materials (at the company itself or a lawyer's office) may be seized. In 2018, the Federal Constitutional Court (BVerfG) ruled that the seizure of documents at the offices of an international law firm that is not based in Germany, and therefore can not invoke German constitutional rights, is lawful. However, the BVerfG did not comment on what would apply to seizures at law firms based in Germany.

For violations that could lead to the company itself being exposed to investigative proceedings at some point and possibly having to defend itself, there are, in our view, good arguments for investigation materials being subject to attorney-client privilege. Additionally, the lawyer's hand file, in which he usually keeps his notes on the case or minutes of conversations with his client, may also not be seized. In all other cases, under the current legal situation, there is a risk that the materials may be seized, even in the office of the company’s lawyer. From a practical point of view, it is nevertheless advisable to label investigative materials, especially interview protocols and investigation reports, with a notice that they are confidential documents subject to attorney-client privilege and to store them not at the company’s premises but in an attorney’s office.

Generally, the employee is free to engage a lawyer at his own expense if he needs legal advice in connection with a workplace investigation. However, the employee does not have a right to consult a lawyer at the employer's expense or to have a lawyer present at an interview. Similarly, the employee is not entitled to be accompanied, for example, by a works council member, during an interview. The involvement of legal counsel may potentially inflate the investigation unnecessarily, making it longer and more expensive. However, it may be advisable from the employer's point of view to (proactively) allow legal representation (eg, to increase the employee's willingness to testify or to create trust) and even to bear the legal counsel's fees. Specifically, if the employee is already a defendant in criminal proceedings or runs the risk of incriminating himself, he should be allowed to be accompanied by a lawyer, otherwise he may be unwilling to cooperate.

The works council does not have a general right of co-determination on whether and in what way a workplace investigation is carried out. However, workplace investigations may trigger co-determination rights of the works council in specific cases, as outlined below. If co-determination rights come into consideration, the employer must inform the works council about the investigation to put the works council in a position to assess whether or not co-determination rights are affected.

In connection with workplace investigations, the works council may have a co-determination right in the following cases:

• If e-mail accounts and data are screened by using technical devices that are suitable to monitor the behaviour or performance of employees (section 87 paragraph 1 no. 6, BetrVG).
• If, for example, the employer instructs all or a large group of employees to participate in interviews, the co-determination right of the works council regarding the rules of operation of the establishment and the conduct of employees in the establishment (section 87 paragraph 1 no. 1, BetrVG) may be affected.
• If standardised questionnaires are used in employee interviews, provided they are used for a large group of interviewed employees (section 94, BetrVG).

If co-determination rights exist in the specific case, the works council has the right to co-determine the type and structure of the specific investigative measures used (ie, the relevant investigative measure cannot be carried out without the works council's consent). To avoid any conflicts, the employer should set up, together with the works council, general rules about workplace investigations well ahead of any investigation.

Trade unions have no right of co-determination in workplace investigations.

Generally, when employees may also use their devices for private purposes, the employer should ensure it allows its employees to tag their private data as "private". This tagging may facilitate the differentiation between business data (relevant for the investigation) and (non-usable) private data in the event of e-mail and electronic data screening.

In addition, the employer may, in appropriate cases, assure the employee that, if there is complete and truthful disclosure of facts to be clarified, the employer will refrain from imposing sanctions under labour and civil law (eg, a warning, termination of employment and the assertion of any claims for damages). In practice, assistance in finding a lawyer and the payment of legal fees is sometimes offered. However, such amnesty programmes are commonly only useful if there is a large number of cases that are particularly complex, poorly documented and difficult to resolve without amnesty offers.

There are no specific rules if unrelated matters are revealed during the investigation. If, in the course of the workplace investigation, new facts are discovered, the same principles apply as for the original reason for the investigation and the employer should consider whether to extend the investigation to the new matter too.

As seen in question 6, the employee must participate in interviews requested by the employer under certain circumstances. Generally, the employee must provide truthful information even if it is incriminating.

The raising of a grievance by the employee does not directly affect the workplace investigation (ie, the investigation does not have to be stopped and the employee's obligation to provide truthful information continues). This may change, however, once the court decides that certain measures were conducted unlawfully and must, therefore, cease.

Workplace investigations that do not require the presence or active cooperation of the employee may also start or continue during the employee's absence due to illness. If the employee's cooperation is required, for example for an interview, the employer can only instruct the employee to participate despite an existing illness if certain narrow conditions are met:

Regarding staff meetings at the company, the German Federal Labour Court has ruled that the employer can only instruct the employee to attend the staff meeting during illness if

• there is an urgent operational reason for doing so, which does not allow the instruction to be postponed until after the end of the incapacity to work; and
• the employee's presence at the company is urgently required and can be expected of him.

Similar rules are likely to apply to the employee's presence for workplace investigations.

Urgent operational reasons that cannot be postponed could exist, for example, if during the employee's absence due to illness, there is a risk that evidence will be lost (eg, where only the employee affected has access to certain files or data) or there is a risk of significant damage to the employer if workplace investigations are stopped until after the employee's return.

In principle, workplace investigations and criminal or regulatory investigations are not dependent on each other and can therefore be conducted in parallel. German public prosecutors have an ambivalent view of internal investigations. On the one hand, they are to some extent sceptical about workplace investigations. They fear that evidence will be destroyed and facts manipulated. On the other hand, they often do not have the resources to conduct investigations as extensive as the companies do. In any event, due to the principle of official investigation that applies in Germany, the investigating public prosecutor's office will usually reassess the results of an internal investigation and conduct independent investigations.

Regarding whether internal investigations reports and material have to be shared with or can be seized by the public prosecutor, please see question 14.

The employer has no general obligation to proactively inform the employee about the outcome of an investigation. However, if personal data was collected, the employee has the right to request certain information: the purpose of the data collection, type of data, recipients of the data, the planned storage period of the data, his right to have the data corrected or deleted, his right to complain to a supervisory authority, and information on the source of the data.

Generally, general data protection regulations apply. This means that, after the investigation, the information described in question 22 must only be provided if the employee requests it.

Whether, in the context of such a request, the full report needs to be shared is disputed in Germany. Some legal scholars and labour courts argue that a summary of the content of the report is sufficient. Others state that the employee should be presented with the full report, whereby passages that do not concern him should be redacted. In practice, it is highly uncommon to share the full report with the employee.

Depending on the results of the investigation, different steps may have to be taken by the employer. Specifically, the following should be considered:

• in certain cases, there may be an obligation (or at least good reason) to share the results of the workplace investigation with the authorities (see question 25);
• filing of a criminal complaint against the employee;
• disciplinary measures against the employee such as a warning, ordinary termination or termination for cause;
• assessing and asserting claims for damages against the employee;
• offering compliance training to the relevant employees or introducing additional measures to prevent further violations;
• if there is a risk that the company itself is exposed to investigative proceedings at some point and may have to defend itself, investigation materials should be stored at the company's external attorney's office; and
• depending on the individual circumstances of the case and to mitigate potential reputational damage, proactively informing the public (eg, by issuing a press release) may be beneficial.

At the end of the workplace investigation, the results are presented to the company's management bodies so that they can make a decision. This may be a mere summary of the facts, or it may contain a legal assessment and recommendation for action.

There is no general obligation to report compliance violations to the police or public prosecutor's office. For some violations, there are statutory disclosure requirements. For example, data protection violations must be reported to the responsible supervisory authority (article 33 and 34, DSGVO), violations in connection with money laundering must be reported to the Central Office for Financial Transaction Investigations (section 43, Anti-Money Laundering Act), unlawful claiming of subventions must be disclosed to the subsidy-providing authority (section 3, Subventions Act), and incorrect information in the tax declaration must be reported to the tax authority (section 153, Tax Code). Additionally, in listed companies, criminal acts may constitute insider information in individual cases, and this must be disclosed within the framework of ad hoc publicity following market abuse regulations.

Also, there may be cases where reporting to the authorities should be considered for corporate policy and tactical reasons (eg, to avoid or mitigate negative consequences for the business).

Pursuant to section 17 paragraph 2, HinSchG, feedback will need to be provided to the whistleblower within three months of confirmation of receipt of the report or, if the receipt has not been confirmed to the whistleblower, within three months and seven days after receipt of the report. This includes the communication of planned and already taken follow-up measures as well as their reasons. Feedback to the whistleblower may only be provided to the extent that it does not affect the workplace investigation and does not prejudice the rights of the persons who are the subject of the report or who are named in the report.

For the question of whether internal investigations reports and material need to be shared with or can be seized by the public prosecutor, please see question 14.

If there is no special statutory storage period (which is the case for investigative reports and findings), personal data may only be stored for as long as is necessary for the purposes for which they are collected. As soon as the data is no longer required, it must be deleted. In connection with workplace investigations, the question arises as to how this obligation to delete personal data relates to the company's corporate interests. From the company's perspective, there may well be legitimate interests that speak in favour of retaining existing data for as long as possible. Under the data protection regulations of the DSGVO and the BDSG, data can be stored for as long as it is required for the assertion, exercise or defence of (civil) legal claims. This means that the data can, in any event, be saved at least as long as any measures related to the workplace investigation have not yet been completed and any legal disputes have not yet been concluded.

Different consequences may result from mistakes made by the employer (or its advisors) in the course of the workplace investigation. For example, if the employer has violated the data protection provisions of the DSGVO or BDSG, this may result in fines. This may also result in claims for damages by the employee. The employee may also have a claim for damages if it turns out that the suspicion of misconduct on the part of the employee is not confirmed and the employer has arbitrarily conducted workplace investigations without sufficient cause.