Workplace Investigations

Currently there are no unified laws, administrative regulations or policies in the field of labor laws in People's Republic of China (referred to as “PRC”) regarding investigations on workplaces of ordinary employers. The laws and regulations of employers in certain specific industries (such as banking, securities, insurance, medical institutions, etc.) and the laws and regulations governing certain personnel (such as officers of state-owned enterprises and members of the Communist Party of China) contain provisions relating to investigations on employees' conduct, but such provisions are only applicable to the aforementioned specific industries or personnel.

Employers generally will specify their investigation rights and rules and procedures of internal investigations in their internal rules and regulations (such as the employee handbook) or the employment contracts entered into with their employees. However, it should be noted that workplace investigations are still subject to laws and regulations in relation to personal information, privacy and data protection.

Mainly, the Occupational Safety and Health Act (738/2002). In addition, the following also have relevance in connection to a workplace investigation: the Employment Contracts Act (55/2001), the Criminal Code (39/1889), the Act on Occupational Safety and Health Enforcement and Cooperation on Occupational Safety and Health at Workplaces (44/2006), the Act on Equality between Women and Men (609/1986) and the Non-discrimination Act (1325/2014). In addition, the employer's own policies must be taken into consideration while conducting a workplace investigation.

The employer will generally obtain clues of employees' misconduct, actively or passively, through such means as internal audit, employee whistleblowing, whistleblowing from suppliers or partners, regular or irregular compliance management assessment of the employer and management concerns, and carry out investigation based on such clues. Meanwhile, the employer will further investigate whether the employees involved have committed other acts of misconduct.

The investigation is usually carried out from outside to inside and from the macro level to the specific level. That is to first interview the provider of the clues and other insiders for verification and obtaining further information. Then to conduct internal and external system and written documents review based on the investigation clues. Preliminary evidence will be formed after the basic verification of facts. Finally, the employer will interview the employees involved and listen to their explanations, and finally determine the subsequent handling method.

When the employer becomes aware of possible misconduct, the employer must commence an investigation immediately, in practice within about two weeks. The information may come to the employer's knowledge via, for example, the employer's own observations, from the complainant or their colleagues or an employee representative.

When an employer is found to have engaged in misconduct of an employee, whether it has the right to suspend the employee from his/her duties and subject him/her to investigation, there are no explicit provisions in the existing labor law. Generally speaking, suspension of investigation arranged internally by an employer is within the scope of autonomous management of the employer. However, such suspension of investigation is subject to certain restrictions, and the basic rights and interests of the employee must be guaranteed. For example, the employer should continue to pay social insurance fund for the employee.

Suspension investigation shall generally be specified in advance in the labor contract or rules and regulations, and the duration of suspension investigation should be within the necessary and reasonable period. Indefinite suspension or the suspension of obviously long time will not be supported by arbitral tribunals and courts.

Generally annual leave may be taken preferentially by the employees during suspension period. The annual leave period shall be deemed as normal attendance, and the salary shall remain unchanged. Under the circumstance that the annual leave has been used up, in judicial practice, there are few cases supporting the claim that the employer can fully deduct the employee's salary during the suspension period. It is generally believed that the employer shall at least guarantee the basic living needs of the employee during the suspension period (i.e. the salary shall not be lower than the local minimum salary standard) or pay the employee as per the original salary standard. However, in judicial practice, some arbitrators and judges hold the view that an employer may use its discretion to reduce employees' salary if all of the following conditions are met:

• it is stipulated in its rules and regulations or a contract that it is entitled to suspend employees from their duties and reduce salaries if their fraudulent behaviour harms the employer's interests;
• the rules and regulations are stipulated in its rules and regulations, and are publicly announced and accepted by the employees; and
• there is evidence showing the corresponding fraudulent behaviour of the employees.

There is no legislation on temporary suspension in the event of a workplace investigation or similar. In some situations, the employer may relieve the employee from their working obligation with pay for a short period.

In some laws and regulations for specific industries, enterprises or personnel, there are certain requirements for the qualifications of investigators. For example, according to the Interim Measures for Investigating and Dealing with Disciplinary Violations of Professional Personnel by Medical Institutions, the personnel conducting an investigation and evidence collection shall not be less than two. If the investigator is a close relative of the investigated person, or a tip-off person or a key witness of the issue to be investigated, the investigator shall withdraw from the investigation.

However, at present, there are no unified and detailed national rules and regulations on the qualification of the investigators and organizations. In practice, the selection of the personnel and organizations responsible for internal investigation is usually based on the relevant provisions in the internal rules and regulations of the employer. The personnel conducting internal investigation are usually internal functional departments of the employer and are independent to some extent, including the personnel department, legal department, compliance department or risk control department. For significant or complex issues or senior management investigations, in order to ensure professionalism, accuracy and compliance, external law firms, consultants and accounting firms are also frequently hired to conduct investigations.

The employer must conduct the investigation, but the actual work can be done either by the employer's personnel or by an external investigator, for example, a law firm. Either way, there are no formal criteria for the persons executing the investigation; however, impartiality is required from the person conducting the investigation

There is no provision in the law which provides the employee the right to suspend or interrupt an investigation by initiating a lawsuit. However, the employee who is suspended for investigation may request to terminate the employment contract unilaterally and demand the employer to pay economic compensation on the ground that the employer has not paid enough remuneration, and may initiate labor arbitration and litigation accordingly, but such arbitration and litigation will not have the effect of suspending or interrupting the investigation.

In addition, if the employee's privacy or personal information is improperly disposed of during the investigation, the relevant evidence obtained during the suspension investigation may be deemed as illegal evidence by arbitral tribunals and courts, and the employer may also be exposed to relevant legal liabilities for the infringement of privacy, etc.

The employee does not have a legal right to stop the investigation. The employer must fulfil its obligation to investigate the alleged misconduct.

Article 75 of the Civil Procedure Law of the PRC (Amended in 2021) provides, "All entities and individuals that are aware of the circumstances of a case shall have the obligation to testify in court. The persons-in-charge of relevant entities shall support the witnesses to testify in court. "Article 193 of the Criminal Procedure Law of the PRC (Amended in 2018) provides, "Where, after the notification of a people's court, a witness refuses to testify in court without justified reasons, the people's court may compel the witness to appear in court, unless the witness is the spouse, a parent or a child of the defendant."

According to relevant provisions of the Civil Procedure Law of the PRC, only a court has the power to compel a witness to appear in court. Neither the employer nor any other individual may compel any colleague to act as a witness and testify in court. However, the employer may set forth in the employment contract or its internal rules and regulations that the employee shall cooperate with its internal investigation.

As for the legal system for witness protection, PRC's criminal procedure laws stipulate a relatively detailed legal system for witness protection, such as establishing a crime of retaliating against a witness; making public a witness's personal information such as name, address, employer and contact information for the purpose of protecting the personal safety of the witness; using assumed names in the indictments; and so on. However, there are relatively few legal provisions regarding the legal protection of witness in civil procedure, and provisions only regulate the expenses that may be incurred by the witness for testifying in court. For instance, Article 77 of the Civil Procedure Law of the PRC (Amended in 2021) provides, "The necessary expenses incurred by a witness in fulfilling his obligation to testify in court, including transportation, accommodation and meals, as well as the loss of salaries, shall be borne by the losing party. If a party applies for a witness to testify, the costs and expenses shall be advanced by the party; if the people's court notifies a witness to testify without the application by a party, the costs and expenses shall be advanced by the people's court. "

There is no legislation on a witness's role in investigations. However, the legislation on occupational safety requires that employees must report any irregularities they observe. Depending on the situation, participating in the investigation may also be part of the person's work duties, role or position, in which case the employer may require the employee to contribute to clarifying the situation. However, there is no formal obligation to act as a witness, and there is no legislation regarding the protection of witnesses. If a witness wishes, they may have, for example, an employee representative as a support person during the hearing. 

The Civil Code of the PRC, the Personal Information Protection Law of the PRC and other laws provide for the protection of employees' personal information and privacy. Employers are often involved in checking the information and materials stored in the computers, hard disks and other electronic office equipment provided to employees in internal investigation and are likely to access the employees' personal information including personal privacy information, such as the communication records stored in instant communication software such as WeChat, QQ or other instant communication software or to and from private email boxes. According to the Personal Information Protection Law of the PRC, employers are required to perform the obligation of informing and obtain the individuals' consent prior to the processing of personal information, i.e. the principle of informing + consent. Moreover, the Civil Code of the PRC stipulates that no organization or individual may process any person's private information, except as otherwise provided by law or with the explicit consent of the right holder.

Therefore, the legitimacy of obtaining data evidence can be enhanced and guaranteed only if it is explicitly stated in the relevant rules and regulations that the employer shall have the right to the work equipment provided to the employees or obtains the employees' personal consent.

Generally, the basic principles set out by the GDPR and the Finnish Data Protection Act apply to data processing in connection with investigations, including evidence gathering: there must be a legal basis for processing, personal data may only be processed and stored when and for as long as necessary considering the purposes of processing, etc.

Additionally, if physical evidence concerns the electronic communications (such as emails and online chats) of an employee, gathering evidence is subject to certain restrictions based on Finnish ePrivacy and employee privacy laws. As a general rule, an employee’s electronic communications accounts, including those provided by the employer for work purposes, may not be accessed and electronic communications may not be searched or reviewed by the employer. In practice, the employer may access such electronic correspondence only in limited situations stipulated in the Act on Protection of Privacy in Working Life (759/2004), or by obtaining case-specific consent from the employee, which is typically not possible in internal investigations, particularly concerning the employee suspected of wrongdoing.

However, monitoring data flow strictly between the employee and the employer's information systems (eg, the employee saving data to USB sticks, using printers) is allowed under Finnish legislation, provided that employee emails, chats, etc, are not accessed and monitored. If documentation is unrelated to electronic communications, it also may be reviewed by the employer. Laptops, paper archives and other similar company documentation considered "physical evidence" may be investigated while gathering evidence on the condition that any private documentation, communications, pictures or other content of an employee are not accessed.

Article 13 of the Constitution of the PRC provides that the lawful private property of the citizens shall not be violated. Therefore, during the process of investigation, without the employees' consent, the employer has no right to search the employees' personal possessions or files. If it is necessary to search the employees' personal possessions or files, the employer may require the employees to sign a Letter of Informed Consent before searching; or the employer may call the police and the search will be conducted under the escort of the public security authorities or directly by the public security authorities.

Only the police can search employees' possessions (assuming that the prerequisites outlined in the legislation are met).

In practice, the following factors to be considered will be: (1) verification of the informant's identity; (2) whether the informant has any conflict of interest with the reported employee or whether it will affect the objectivity of their reporting; (3) how to persuade the informant to provide more information or evidence, or to cooperate in court as a witness; (4) how to increase the admissibility of evidence when the informant refuses to cooperate in court as a witness or fails to provide original evidence; (5) how to improve the evidence chain and protect the informant from being attacked or retaliated by the informant, etc.

In respect of data protection, the processing of personal data in whistleblowing systems is considered by the Finnish Data Protection Ombudsman (DPO) as requiring a data protection impact assessment (DPIA).

Although there are no specific laws or regulations regulating the extent of confidentiality obligation employers or the investigators shall comply with, in practice, the confidentiality obligation of both parties usually originates from the confidentiality agreement between the employee and the employer, as well as general provisions on protection of personal information and right of privacy, etc.

In this regard, it is advisable to require the relevant personnel responsible for handling the suspension for investigation to sign a confidentiality agreement or a letter of commitment, and require them to pay attention to the protection of the personal information and privacy of the complainant and other relevant personnel, for the purpose of avoiding extra losses caused by the occurrence of disputes relating to right of reputation, right of privacy and personal information leakage during the investigation.

Concerning a workplace investigation, there is no specific legislation in force at the moment regarding confidentiality obligations. All normal legal confidentiality obligations (eg, obligations outlined in the Trade Secrets Act (595/2018)), and if using an external investigator, the confidentiality obligations outlined in the agreement between the employer and the external investigator, apply. Attorneys-at-law always have strict confidentiality obligations as per the Advocates Act (496/1958).

Although there are no explicit provisions of law or policy requiring employers to provide specific information of allegations to investigated employees, in practice, at the early stage of investigation, in order to avoid alerting the investigated employee and reduce the possibility that the investigated employee may destroy the relevant evidence, the employer usually will not disclose the information of allegations to the investigated employee at the beginning of investigation. At the later stage of an investigation, when the employer has already obtained main evidence, the employer usually will properly disclose to the investigated employee the allegations that are clearly known by the employer and have sufficient evidence, and listen to the counterparty's opinions or argument, for the purpose of obtaining more information or getting the employee's confession.

The process must be transparent and impartial, and therefore all the information that may influence the conclusions made during the investigation should be shared with the employee.

At the level of criminal procedure in PRC, only the Criminal Procedure Law of PRC provides that pseudonyms may be used in the indictment as a substitute for the disclosure of a witness's personal information, such as name, address, employer and contact information, to protect the personal safety of the witness. However, there are no relevant provisions on whether the identity of the complainant, the witness in civil litigation and the provider of information shall be kept confidential during an investigation.

During the course of an investigation, in order to protect the privacy of relevant personnel and avoid the risk of infringement, the employer usually keeps the identity of the complainant or the provider of investigation information confidential. However, at the civil litigation stage, the witness is unavoidably required to testify in court, and must truthfully identify himself/herself to the court.

See question 11, there is no protection of anonymity as the process must be transparent to the parties involved.

Yes. In practice, before conducting a compliance investigation, we recommend that the employer and the investigator enter into a confidentiality agreement to require the investigator to keep confidential the facts and the substance of the investigation. This will not only better protect the personal information of the complainant, the witness and the investigated employee, but also help the investigation to proceed smoothly.

Yes, however, the need for an NDA is assessed always on a case-by-case basis.

The employer has the property right over all its properties. When discovering employee's misconduct, the employer is entitled to conduct an investigation within a certain scope according to the relevant laws and regulations, as well as the management system of the employer. Generally speaking, the employer is not required to obtain consent of the employee when conducting an investigation of the space and objects owned by it. The employer has no right to directly conduct an investigation of the employee's private space, objects, bank accounts and stock trading accounts. The public security organ or other public authorities should be involved in the investigation. In principle, if the employee's private space or objects are mixed with the employer's private space or objects, the employer should obtain consent of the employee for an investigation. Meanwhile, the employer's investigation should be controlled within the reasonable and necessary limit, and the employer is not allowed to illegally use or disclose the investigation results, otherwise it may constitute infringement. In addition, we also recommend that the employer stipulate explicitly in the employment contract and the internal management system that the employer has the right to detain and inspect the articles or equipment distributed by the employer, so as to reduce the compliance risk of internal investigation.

The privilege of investigation materials concerns a rather limited amount of cases. In practice, materials may be considered privileged in connection with the litigation process under the Procedural Code (4/1734). For example, communications between a client and an attorney may attract protection against forcible public disclosure.

The relevant laws and regulations in the PRC have not made explicit provision regarding rights to representation. In practice, some arbitral tribunals and courts hold the view that it is reasonable for the employee to refuse to cooperate with the investigation if he/she is not accompanied or has no legal representatives. Therefore, the employer usually cannot impose disciplinary punishment by warning or even termination of employment contract on the basis of such refusal. Therefore, we tend to believe that, where the employee under investigation requests to be accompanied or have legal representation, the employer should fully consider and communicate with the employee about the request, and prudently impose disciplinary punishment on the employee for failing to cooperate with the investigation.

Of course, considering that satisfying such request will increase the difficulties and obstacles for the employer to carry out the investigation to a certain extent, we still suggest that the employer include in its rules and regulations such provisions as "the employee being investigated shall actively and unconditionally cooperate with the employer's investigation", etc., in order to provide institutional support for the follow-up requirement or even disciplinary punishment by the employer on employee and to encourage the employee to cooperate in the investigation.

The employee under investigation has a right to have a support person present (eg, a lawyer or an employee representative) during the hearings and a right to assistance in preparing written statements.

The relevant laws and regulations in the PRC have not expressly provided the employer’s obligation to inform the trade union of the internal investigation or the right of the trade union to participate in the employer's internal investigation. In practice, given the confidential nature of internal investigation, the employer usually does not voluntarily inform the trade union of such information. However, in accordance with Article 25 of the Measures for the Supervision of Labor Law by Trade Unions of the PRC, the trade union shall have the right to conduct an investigation if the employer has violated the labor laws and regulations or infringed the legitimate rights and interests of the employee. Therefore, it is still possible that the employer, in the course of the internal investigation, may be investigated by the trade union if it has violated the labor laws and regulations or infringed the legitimate rights and interests of the employee (e.g. being suspected of infringing personal information or privacy).

In addition, if the employer determines that the employee has committed a serious disciplinary offence based on the result of the internal investigation and thus decides to terminate the employment contract unilaterally, it shall notify the trade union of the reasons for termination in advance. If the employer has violated the laws, administrative regulations or the provisions of the employment contract, the trade union is entitled to request the employer to make corrections.

A works council or a trade union does not have a role in the investigation.

The relevant laws and regulations in the PRC have not made explicit requirements regarding the supports received by the employee involved in the investigation. In practice, the employer will usually prepare an internal time schedule before carrying out the investigation. Although the detailed time schedule will not be disclosed to the employee, the employer will usually inform the employee of each investigation in advance. In order to improve the transparency of the investigation, we recommend that employer should make positive and proper responses to employee who enquires about the progress of the investigation, so as to avoid employee's suspicion.

In addition, the Personal Information Protection Law of the PRC stipulates the rights of individuals in the process of personal information processing. In the scenario of internal investigation of an employer, the investigated party may, in accordance with such provisions, ask the employer for the right to review and even copy the personal information collected. Where the employee finds that the personal information collected by internal investigation is inaccurate or incomplete, he/she is entitled to request for correction or supplementation.

They can request assistance, for example, from an occupational health and safety representative, a shop steward or the occupational healthcare provider.

If any matter unrelated to this investigation is revealed during the investigation and the matter is suspected of violating regulations, the employer may comprehensively consider whether it is necessary to investigate the new matter. If the employer assesses that a combined investigation will seriously affect and hinder the progress of the investigation or complicate the investigation, the employer can handle the unrelated matters through separate investigations.

In addition, Article 6 of the Personal Information Protection Law of the PRC requires that the processing of personal information shall be for a specific and reasonable purpose and shall be directly related to the purpose of the processing and shall adopt the method with minimum impact on individuals' rights and interests. If the result of the investigation reveals unrelated personal information, it means that the collection and storage of such personal information are unrelated to the purpose of the processing. According to paragraph 1 of Article 47 of the Personal Information Protection Law of the PRC, the employer as the personal information processor shall take the initiative to delete personal information. If the employer fails to delete such information, the employee is entitled to request for deletion.

If they are related to the work or workplace, the employer will handle the emerging matters separately. In internal investigations, the employer is allowed to use any material legally available.

There is no specific provision on this in relevant laws and regulations in the PRC. In practice, the employer will usually stipulate the relevant grievance procedure and process in its internal rules and regulations, and provide the employee with the relevant grievance rights in accordance with the grievance regulations. Alternatively, even if there is no provision on grievance procedure and process in their internal rules and regulations, from the perspective of fairness and rationality, we recommend that the employer should review and evaluate the grievance raised by the employee. If it is confirmed that irregularities exist in the investigation, which may directly affect the conclusions of the investigation (e.g. a past conflict between the employee and the investigator or the employee was unfairly treated in the investigation), the employer shall suspend the investigation and resume the investigation after timely resolution of such complaint. If the grievance does not affect the normal conduct of the investigation, the employer can still proceed with the investigation.

If the nature of the grievance relates to the employer's obligations to handle such matters in general, the grievance will be investigated either separately or as a part of the ongoing investigation.

During the investigation, the employer should fully respect the basic labor rights of the employee. According to the relevant provisions of Labor Contract Law of the PRC, if an employee is sick during the investigation, the employer should permit him/her to take sick leave provided that he/she provides the medical certificate issued by the medical institution and performs the medical leave application procedure as required by the employer. Therefore, the employer usually needs to request the employee to cooperate with the investigation after the sick leave, and cannot force the investigation by means of coercion or violence.

However, for the contents that can be investigated by the employer alone, such as the information publicized by the employee on social media and the employee's relevant information publicized on official website, since the investigation of such information is not affected by the employee's physical condition, the employer may adjust the investigation plan and conduct such part of the investigation first.

As a general rule, sick leave does not prevent an investigation from progressing. Depending on the nature of the sickness, the employee can attend hearings and take part in the procedure. If the sickness prevents the employee from participating, the employer can put the process on hold temporarily.

The PRC law is silent on how to deal with the conflict between internal investigation and criminal or regulatory investigation. In general, the employer should cooperate with the criminal or regulatory investigation being conducted by the investigating authority to avoid hindering official business.

According to the Civil Procedure Law of the PRC, the Administrative Procedure Law of the PRC, and the Criminal Procedure Law of the PRC, the investigating authorities (including the public security authority, the people's procuratorate, the people's court, and the supervision authority) have the power to investigate and verify evidence from the witness or the individuals or entities that have access to the evidentiary materials. Therefore, the investigating authorities have the power to compel the employer to share or provide evidentiary materials relating to the case, and the employer shall cooperate and provide such materials. If the employer refuses to cooperate, it may face administrative liability (such as warning, fine and detention of the directly responsible person), judicial liability (fine shall be imposed on the main person in charge or the directly responsible person, and detention may be granted to those who refuse to cooperate) and even criminal liability (those who conceal criminal evidence may be guilty of perjury).

Regardless of a possible criminal investigation, the employer must run its internal workplace investigation without unnecessary delay. A workplace investigation and a criminal investigation are two separate processes and can be ongoing simultaneously, so the criminal process does not require the workplace investigation to be stayed. Thus, parallel investigations are to be considered as two separate matters. The police may only obtain evidence or material from the company or employer if strict requirements for equipment searches are met after a request for investigation has been submitted to the police.

There is no explicit stipulation in the laws and regulations in the PRC on this issue. In practice, given the confidentiality of any investigation into a violation, the employer usually will not disclose the investigation result or submit the investigation report to the investigated employee, unless it is explicitly provided in its rules and regulations that the employer is obliged to inform the employee of the investigation result. However, according to the Employment Contract Law of the PRC and the opinions of the mainstream arbitration tribunals and courts, if an employer decides to take disciplinary action against an employee (in particular, termination of employment contract) according to the investigation result, it is generally required to inform the employee of the investigation result. In other words, the employer generally needs to inform the employee of the specific facts based on which the disciplinary action is taken. Failure to do so may result in the generalization of serious violation of the employer's rules and regulations and lead the arbitration tribunals and courts to regard the termination as illegal.

The employer's conclusions from the investigation.

For the employee: As mentioned in our response to question 22, the relevant laws and regulations in the PRC do not impose any obligation on an employer to share investigation report (including the findings) with its employee, unless otherwise expressly provided in its internal rules and regulations that the employer may share with its employee any investigation report or findings that do not involve trade secrets or another person's privacy or personal information. Therefore, the employer has the discretion to decide whether and to what extent to share the investigation report based on its business management needs.

For the police/regulatory authorities: In general, an employer shall provide a complete report according to the law as required by the authority handling the case. It is recommended that the employer should conduct a detailed review of the investigation authority and the information contained in the evidence collection documents issued by the authority, and communicate with the authority to specify the scope of assistance and evidentiary materials to be provided. Although the employer cannot refuse to provide relevant evidentiary materials to the investigation authority on the grounds that such evidentiary materials involve trade secret or personal privacy, it still needs to carefully assess the relevance of the evidentiary materials to the facts of the case and timely communicate with the authority to confirm and narrow the scope of providing evidence as much as possible. If necessary, the employer can consult professional lawyers to provide professional opinions. In addition, we suggest that the employer may also try to require the investigation officer to sign a confidentiality letter, and file the investigation materials involving trade secret or personal privacy, the reasons thereof, etc., for the purpose of reducing legal risks faced by the employer.

The employee under investigation may only be informed of the conclusions.

The employer may take disciplinary actions against the employee based on the investigation result and pursue their civil, administrative and even criminal liabilities. To be specific: 1) the employer may criticize and educate the employee, or take disciplinary actions such as warning, demotion and removal according to the internal rules and regulations of the employer. If the misconduct of the employee constitutes one of the circumstances stipulated in Article 39 of the Employment Contract Law of the PRC, the employer is entitled to take the most severe disciplinary action, namely termination of employment contract; 2) if the employee has caused economic loss to the employer, the employer may lawfully initiate a civil litigation recourse procedure; 3) if the employee violates the Law on Administrative Penalties for Public Security Administration of the PRC, the employer may deliver the case to the administrative department for corresponding administrative penalties; 4) if the employee is suspected of a crime, the employer should deliver the case to the public security authority and pursue his/her corresponding criminal liabilities according to the law.

The employer decides whether misconduct has taken place or not. Depending on the case, the employer may recommend a workplace conciliation in which the parties try to find a solution that can be accepted by both sides. The employer may choose to give an oral reprimand or a written warning. If the legal conditions are met, the employer may also terminate the employment agreement.

If the relevant investigation authorities or regulatory authorities require the employer to provide the investigation findings and the interview records of its employee's illegal activities, the employer is usually obliged to cooperate with the authorities and make disclosures according to the requirements of the law. Meanwhile, according to Article 110 of the Criminal Procedure Law of the PRC, any entity or individual who has found out facts of a crime or a criminal suspect has both the right and the duty to report the case or provide information to the public security authority, the people's procuratorate or the people's court. Therefore, if the investigation findings show that the employee is suspected of a crime, the employer should disclose the information to the relevant investigation authorities including the public security authority. For some special industries, for example, the investigation findings against the banking industry usually also need to be reported to the higher-level banking supervisory authorities. Although the relevant investigation staff and supervisory staff are usually required to comply with the confidentiality obligations according to the laws or regulations, the risk of leakage of the reported information due to the expansion of the scope of persons who are aware of the investigation findings cannot be completely excluded.

In addition, an employer may decide whether to disclose the results of an investigation (mainly including the violation of disciplines and the disciplinary punishment) to other employees at its own discretion, but has to disclose the relevant information among employees to the extent that it is "minimum and necessary", so as to avoid infringing on the employee's personal information or privacy or even right of reputation.

In general, investigation materials, including findings, that includes personal data should only be processed by the personnel of the organisation who are responsible for internal investigations. However, it may in some situations be required by applicable legislation that findings are disclosed to competent authorities for the performance of their duties, such as conducting investigations in connection with malpractice and violations of the law.

The relevant laws and regulations in the PRC have not clarified the retention period of the investigation findings. According to Article 19 of the Personal Information Protection Law of the PRC, unless otherwise required by laws or administrative regulations, the retention period of personal information shall be the shortest period necessary to achieve the purpose of handling the information. Since the employee's personal information is very likely to be involved in the investigation findings, such report should be retained for the shortest period necessary to achieve the purpose of handling the information. In general, once the investigation is completed, the purpose of the internal investigation has been achieved or it is no longer necessary to achieve the purpose, and the employer may, in accordance with Article 22 of the Administrative Regulations of the PRC on Network Data Security (Draft for Comments), delete or anonymize the personal information within fifteen (15) working days. If it is technically difficult to delete the personal information, or it is difficult to do so within fifteen (15) working days due to business complexity or other reasons, the employer shall not conduct any processing other than storing the personal information and adopting necessary security measures, and shall give reasonable explanations to the employee.

Please see question 7. The outcome of the investigation involving personal data may be retained only for as long as is necessary considering the purposes of the processing. In general, the retention of investigation-related data may be necessary while the investigation is still ongoing and even then the requirements of data minimization and accuracy should be considered. The data concerning the outcome of an investigation should be registered to the employee's record merely to the extent necessary in light of the employment relationship or potential disciplinary measures. In this respect, the applicable retention time depends on labour law-related rights and limitations, considering eg, the applicable periods for filing a suit.

It is inevitable that the investigation involves the employee's personal information, and once the investigation is mishandled, the employer may face the following legal risks:

Civil liability: Both the Civil Code of the PRC and the Personal Information Protection Law of the PRC, clearly provide the civil liability for infringement of privacy and illegal processing of personal information. Therefore, the investigated employee or relevant organizations such as the people's procuratorate have the right to claim or file a public interest lawsuit on the employer's improper collection of evidence, requiring the employer to bear the liability for infringement. In addition, the evidence obtained by an employer through infringing the employee's privacy and personal information rights and interests, in violation of the law, cannot be used as the valid evidence for the employer's unilateral termination of the employment contract or requiring the employee to compensate for losses.

Administrative liability: Article 66 of the Personal Information Protection Law of the PRC provides that, where personal information is processed in violation of regulations, administrative penalties imposed by the department performing duties of personal information protection may be up to revoking the business license, and the person directly in charge and other directly liable persons may be fined up to one million yuan and prohibited from practicing within a time limit. Meanwhile, Article 67 of the Personal Information Protection Law of the PRC provides that relevant illegal acts shall be recorded in the employer's credit files and disclosed to the public.

Criminal liability: if an employer illegally sells or provides to others the personal information obtained during the internal investigation, and the circumstance is serious enough, the judicial authority has the right to hold the employer, the managers directly in charge and other directly liable persons criminally liable in accordance with the crime of "infringement of citizens' personal information" under Article 253A of the Criminal Law of the PRC.

It should be noted that a compliance investigation may also involve the employer's communication and investigation reporting with overseas authorities, or overseas institutions' direct access to information from the employer's domestic systems. If the employer conducts cross-border transmission of such personal information, it shall also meet one of the conditions set out in Article 38 of the Personal Information Protection Law of the PRC (i.e. passing the security assessment organized by the national cyberspace administration authority, obtaining certification from a professional institution concerning the protection of personal information or entering into a standard contract with an overseas recipient). Violations of the above provisions may result in civil, administrative and even criminal liability.

There are no regulations regarding the actual investigation process. Therefore, the employer cannot be accused of procedural errors as such. However, once the matter has been adequately investigated, the employer must decide whether or not misconduct has taken place. If the employer considers that misconduct has taken place, the employer must take adequate measures for remedying the situation. Failure to adequately conduct the investigation could result in criminal sanctions being imposed on the employer as an organisation or the employer’s representative, or damages.