Workplace Investigations

In some laws and regulations for specific industries, enterprises or personnel, there are certain requirements for the qualifications of investigators. For example, according to the Interim Measures for Investigating and Dealing with Disciplinary Violations of Professional Personnel by Medical Institutions, the personnel conducting an investigation and evidence collection shall not be less than two. If the investigator is a close relative of the investigated person, or a tip-off person or a key witness of the issue to be investigated, the investigator shall withdraw from the investigation.

However, at present, there are no unified and detailed national rules and regulations on the qualification of the investigators and organizations. In practice, the selection of the personnel and organizations responsible for internal investigation is usually based on the relevant provisions in the internal rules and regulations of the employer. The personnel conducting internal investigation are usually internal functional departments of the employer and are independent to some extent, including the personnel department, legal department, compliance department or risk control department. For significant or complex issues or senior management investigations, in order to ensure professionalism, accuracy and compliance, external law firms, consultants and accounting firms are also frequently hired to conduct investigations.

The examinations can be carried out internally by designated internal employees, by external specialists, or by a combination thereof. The addition of external advisors is particularly recommended if the allegations are against an employee of a high hierarchical level[1], if the allegations concerned are quite substantive and, in any case, where an increased degree of independence is sought.

The investigator would typically be a line manager or HR representative. Complex cases, particularly if criminality is suspected, or cases where a senior employee is accused of misconduct, may require the investigator to be someone more senior within the organisation, or someone from the in-house legal team. Employers should bear in mind the need for someone more senior than the investigator to act as a disciplinary decisionmaker, if disciplinary action is found to be warranted.

Check the organisation’s policies and procedures, which may stipulate who can act as an investigator.

The investigator should be someone without any personal involvement in the matters under investigation, or any conflict of interest, but with sufficient knowledge of the organisation and where possible with both training and experience in conducting investigations.

The business should consider how any prospective investigator may appear if they are called as a witness in court, or to give evidence before any governmental committee or regulatory panel. They should also consider whether the employee accused of wrongdoing should have any say in the choice of investigator; this would not typically occur, but having the employee’s buy-in can increase the chances of a successful outcome to the investigation.

It is becoming increasingly common for businesses to use an external consultant or lawyer to conduct workplace investigations. This may be beneficial where it is not operationally viable within the employer organisation to have a different person conducting the investigation and the disciplinary hearing, or if the investigation is particularly sensitive or complex, or relates to a very senior employee. If an external investigator is appointed, the employer remains responsible for that investigation.

The Civil Code of the PRC, the Personal Information Protection Law of the PRC and other laws provide for the protection of employees' personal information and privacy. Employers are often involved in checking the information and materials stored in the computers, hard disks and other electronic office equipment provided to employees in internal investigation and are likely to access the employees' personal information including personal privacy information, such as the communication records stored in instant communication software such as WeChat, QQ or other instant communication software or to and from private email boxes. According to the Personal Information Protection Law of the PRC, employers are required to perform the obligation of informing and obtain the individuals' consent prior to the processing of personal information, i.e. the principle of informing + consent. Moreover, the Civil Code of the PRC stipulates that no organization or individual may process any person's private information, except as otherwise provided by law or with the explicit consent of the right holder.

Therefore, the legitimacy of obtaining data evidence can be enhanced and guaranteed only if it is explicitly stated in the relevant rules and regulations that the employer shall have the right to the work equipment provided to the employees or obtains the employees' personal consent.

The Swiss Federal Act on Data Protection applies to the gathering of evidence, in particular such collection must be lawful, transparent, reasonable and in good faith, and data security must be preserved.[1]

It can be derived from the duty to disclose and hand over benefits received and work produced (article 321b, Swiss Code of Obligations) as they belong to the employer.[2] The employer is, therefore, generally entitled to collect and process data connected with the end product of any work completely by an employee and associated with their business. However, it is prohibited by the Swiss Criminal Code to open a sealed document or consignment to gain knowledge of its contents without being authorised to do so (article 179 et seq, Swiss Criminal Code). Anyone who disseminates or makes use of information of which he or she has obtained knowledge by opening a sealed document or mailing not intended for him or her may become criminally liable (article 179 paragraph 1, Swiss Criminal Code).

It is advisable to state in internal regulations that the workplace might be searched as part of an internal investigation and in compliance with all applicable data protection rules if this is necessary as part of the investigation.

Most forms of workplace surveillance involve the processing of personal data that is regulated by the UK GDPR and DPA 2018. The UK GDPR requires that personal data must be processed lawfully, fairly and in a transparent manner; it also must be adequate, relevant and limited to what is necessary concerning the purposes for which it is processed.

Employers should ensure that they have undertaken a data protection impact assessment (DPIA) to document the lawful basis for processing data, and informed employees that their files may be searched before proceeding. They should also ideally have a clear policy on the use of electronic communications systems, detailing when, how and for what purpose they may be monitored by the employer. In Q3 2023 the ICO produced new guidance on monitoring workers (https://ico.org.uk/for-organisations/uk-gdpr-guidance-and-resources/employment/monitoring-workers/) and on email and security (https://ico.org.uk/for-organisations/uk-gdpr-guidance-and-resources/security/email-and-security/) which employers should bear in mind during investigations. Employers should also be prepared to make the data collected through employee monitoring available to employees, should the employee submit a data subject access request under the DPA 2018.

The IPA 2016 makes it unlawful in certain circumstances to intercept a communication (such as one on an employer’s telephone or computer network) in the course of its transmission in the UK. The IPA Regs 2018 set out the circumstances where, in a business context, such interception will be lawful. These include monitoring or recording communications without consent to: establish the existence of facts; ascertain compliance with the regulatory or self-regulatory practices or procedures relevant to the business; ascertain or demonstrate standards which are or ought to be achieved by persons using the system; and prevent or detect crime.

Covert surveillance can lead to a breach of an employee's right to privacy under the HRA 1998. The employer will need to consider if covert surveillance is proportionate, which will depend on the facts of each case. Employers should be careful not to use the investigation as an excuse to undertake a "fishing expedition", and should avoid gathering material that is obviously personal, such as private messages and diary entries (see question 8).