Workplace Investigations

Currently there are no unified laws, administrative regulations or policies in the field of labor laws in People's Republic of China (referred to as “PRC”) regarding investigations on workplaces of ordinary employers. The laws and regulations of employers in certain specific industries (such as banking, securities, insurance, medical institutions, etc.) and the laws and regulations governing certain personnel (such as officers of state-owned enterprises and members of the Communist Party of China) contain provisions relating to investigations on employees' conduct, but such provisions are only applicable to the aforementioned specific industries or personnel.

Employers generally will specify their investigation rights and rules and procedures of internal investigations in their internal rules and regulations (such as the employee handbook) or the employment contracts entered into with their employees. However, it should be noted that workplace investigations are still subject to laws and regulations in relation to personal information, privacy and data protection.

Workplace investigations in Sweden are governed by several rules and regulations. Listed below are the central legislation and regulations that govern a workplace investigation related to alleged employee misconduct.

• The Swedish Discrimination Act (2008:567).
• The Swedish Work Environment Act (1977:1160), which is complemented by the Swedish Work Environment Authority’s other statutes.[1]
• The Swedish Whistleblowing Act (2021:890).

If a workplace investigation has been initiated after the receipt of a report filed through a reporting channel established under the Swedish Whistleblowing Act, that law applies provided that the report has been filed by a person who may report under the Act and provided that the subject of the report falls under the material scope of the Act. The Swedish Whistleblowing Act implements Directive (EU) 2019/1937 on the protection of persons who report breaches of Union law and has been given a wide material scope in Sweden. The Swedish Whistleblowing Act may apply if the reported irregularity concerns breaches of certain EU laws or if the reported irregularity is of public interest.

In addition to the regulations mentioned above, certain data protection legislation may affect workplace investigations by restricting what personal data may be processed. Such data protection legislation includes the following:

• Regulation (EU) 2016/679 on the protection of natural persons concerning the processing of personal data and the free movement of such data (the GDPR);
• the Swedish Supplementary Data Protection Act (2018:218);
• the Swedish Supplementary Data Protection Regulation (2018:219);

• Regulation DIFS:2018:2 on the processing of personal data relating to criminal convictions or offences. This regulation governs the processing of personal data relating to criminal convictions or suspected criminal offences in internal workplace investigations that are not governed by the Swedish Whistleblowing Act.[2]

The above-mentioned legislation and regulations may overlap in many aspects and it is therefore important before starting an investigation, as well as during an investigation, to assess which rules and regulations apply to the situation at hand. Another aspect of this is that many issues that can arise during an investigation are not regulated by law or other legislation. If the investigation is a non-whistleblowing investigation there are limited rules on exactly how and by whom the investigation should be carried out.

A Swedish law firm that undertakes a workplace investigation also has to adhere to the Swedish Bar Association’s Code of Conduct. The Code of Conduct includes additional considerations, mainly ethical, which will not be addressed in this submission. Furthermore, this submission will not focus on investigations following an employee’s possible misappropriation of proprietary information or breach of the Swedish Trade Secrets Act (2018:558). Investigations into such irregularities are often conducted to gather evidence and these investigations include the same or similar investigative measures used in other investigations, such as interviews with employees and IT-forensic searches, but also infringement investigations carried out by the authorities or other measures by the police.

There is no specific legal regulation for internal investigations in Switzerland. The legal framework is derived from general rules such as the employer's duty of care, the employee's duty of loyalty and the employee's data protection rights. Depending on the context of the investigation, additional legal provisions may apply; for instance, additional provisions of the Swiss Federal Act on Data Protection or the Swiss Criminal Code.

The employer will generally obtain clues of employees' misconduct, actively or passively, through such means as internal audit, employee whistleblowing, whistleblowing from suppliers or partners, regular or irregular compliance management assessment of the employer and management concerns, and carry out investigation based on such clues. Meanwhile, the employer will further investigate whether the employees involved have committed other acts of misconduct.

The investigation is usually carried out from outside to inside and from the macro level to the specific level. That is to first interview the provider of the clues and other insiders for verification and obtaining further information. Then to conduct internal and external system and written documents review based on the investigation clues. Preliminary evidence will be formed after the basic verification of facts. Finally, the employer will interview the employees involved and listen to their explanations, and finally determine the subsequent handling method.

An investigation can be initiated in several ways. It is usually as a result of whistleblowing or a report on work environment deficiencies, or through other channels (eg, HR, the police, media coverage).

Internal investigations are usually initiated after reports about possible violations of the employer's code of conduct, applicable laws or regulations have been submitted by employees to their superiors, the human resources department or designated internal reporting systems such as hotlines (including whistleblowing hotlines).

For an internal investigation to be initiated, there must be a reasonable suspicion (grounds).[1] If no such grounds exist, the employer must ask the informant for further or more specific information. If no grounds for reasonable suspicion exists, the case must be closed. If grounds for reasonable suspicion exist, the appropriate investigative steps can be initiated by a formal investigation request from the company management.[2]

When an employer is found to have engaged in misconduct of an employee, whether it has the right to suspend the employee from his/her duties and subject him/her to investigation, there are no explicit provisions in the existing labor law. Generally speaking, suspension of investigation arranged internally by an employer is within the scope of autonomous management of the employer. However, such suspension of investigation is subject to certain restrictions, and the basic rights and interests of the employee must be guaranteed. For example, the employer should continue to pay social insurance fund for the employee.

Suspension investigation shall generally be specified in advance in the labor contract or rules and regulations, and the duration of suspension investigation should be within the necessary and reasonable period. Indefinite suspension or the suspension of obviously long time will not be supported by arbitral tribunals and courts.

Generally annual leave may be taken preferentially by the employees during suspension period. The annual leave period shall be deemed as normal attendance, and the salary shall remain unchanged. Under the circumstance that the annual leave has been used up, in judicial practice, there are few cases supporting the claim that the employer can fully deduct the employee's salary during the suspension period. It is generally believed that the employer shall at least guarantee the basic living needs of the employee during the suspension period (i.e. the salary shall not be lower than the local minimum salary standard) or pay the employee as per the original salary standard. However, in judicial practice, some arbitrators and judges hold the view that an employer may use its discretion to reduce employees' salary if all of the following conditions are met:

• it is stipulated in its rules and regulations or a contract that it is entitled to suspend employees from their duties and reduce salaries if their fraudulent behaviour harms the employer's interests;
• the rules and regulations are stipulated in its rules and regulations, and are publicly announced and accepted by the employees; and
• there is evidence showing the corresponding fraudulent behaviour of the employees.

In general, an employee in the private sector may be temporarily suspended for a short period with pay and other benefits during a workplace investigation. The room for suspension without pay is, by contrast, very limited. An applicable collective bargaining agreement may impose additional restrictions on the right to temporary suspend an employee. The suspension should be limited in time and only be in force during the investigation, but can be repeated for (multiple) additional short periods if necessary to conclude the investigation. An assessment needs to be made on a case-by-case basis as suspension in some cases may be considered unlawful. If not executed with sufficient consideration of the employee’s interests, it may be considered a constructive dismissal or a breach of the employer’s work environment obligations. If the employee is unionised, trade unions sometimes request that the employer initiates consultations as part of a decision to suspend an employee.

In the public sector, the right to suspension is limited. There are also special regulations regarding the suspension of certain employees, for example, employees who are employed as permanent judges.

It is possible to suspend an employee during a workplace investigation.[1] While there are no limits on duration, the employee will remain entitled to full pay during this time.

In some laws and regulations for specific industries, enterprises or personnel, there are certain requirements for the qualifications of investigators. For example, according to the Interim Measures for Investigating and Dealing with Disciplinary Violations of Professional Personnel by Medical Institutions, the personnel conducting an investigation and evidence collection shall not be less than two. If the investigator is a close relative of the investigated person, or a tip-off person or a key witness of the issue to be investigated, the investigator shall withdraw from the investigation.

However, at present, there are no unified and detailed national rules and regulations on the qualification of the investigators and organizations. In practice, the selection of the personnel and organizations responsible for internal investigation is usually based on the relevant provisions in the internal rules and regulations of the employer. The personnel conducting internal investigation are usually internal functional departments of the employer and are independent to some extent, including the personnel department, legal department, compliance department or risk control department. For significant or complex issues or senior management investigations, in order to ensure professionalism, accuracy and compliance, external law firms, consultants and accounting firms are also frequently hired to conduct investigations.

If the workplace investigation falls under the Swedish Whistleblowing Act, the investigation has to be conducted by independent and autonomous persons or entities designated under the Swedish Whistleblowing Act as competent to investigate reports.

If the workplace investigation is not governed by the Swedish Whistleblowing Act, there are no minimum qualification requirements. When appointing an investigator, one should consider who would be most suitable in the given situation. For example, it may in some situations be more suitable to have an external investigator to ensure impartiality.

The examinations can be carried out internally by designated internal employees, by external specialists, or by a combination thereof. The addition of external advisors is particularly recommended if the allegations are against an employee of a high hierarchical level[1], if the allegations concerned are quite substantive and, in any case, where an increased degree of independence is sought.

There is no provision in the law which provides the employee the right to suspend or interrupt an investigation by initiating a lawsuit. However, the employee who is suspended for investigation may request to terminate the employment contract unilaterally and demand the employer to pay economic compensation on the ground that the employer has not paid enough remuneration, and may initiate labor arbitration and litigation accordingly, but such arbitration and litigation will not have the effect of suspending or interrupting the investigation.

In addition, if the employee's privacy or personal information is improperly disposed of during the investigation, the relevant evidence obtained during the suspension investigation may be deemed as illegal evidence by arbitral tribunals and courts, and the employer may also be exposed to relevant legal liabilities for the infringement of privacy, etc.

No. It should, however, be noted that the employee under investigation may claim a right to rectification under article 16 of the GDPR and its right to object to processing under article 21 of the GDPR. This may give the employee under investigation an undesirable opportunity to withhold evidence and obstruct or impede the investigation. The risk of these rights being exercised is, however, considered to be low.

The accused could theoretically request a court to stop the investigation, for instance, by arguing that there is no reason for the investigation and that the investigation infringes the employee's personality rights. However, if the employer can prove that there were grounds for reasonable suspicion and is conducting the investigation properly, it is unlikely that such a request would be successful.

Article 75 of the Civil Procedure Law of the PRC (Amended in 2021) provides, "All entities and individuals that are aware of the circumstances of a case shall have the obligation to testify in court. The persons-in-charge of relevant entities shall support the witnesses to testify in court. "Article 193 of the Criminal Procedure Law of the PRC (Amended in 2018) provides, "Where, after the notification of a people's court, a witness refuses to testify in court without justified reasons, the people's court may compel the witness to appear in court, unless the witness is the spouse, a parent or a child of the defendant."

According to relevant provisions of the Civil Procedure Law of the PRC, only a court has the power to compel a witness to appear in court. Neither the employer nor any other individual may compel any colleague to act as a witness and testify in court. However, the employer may set forth in the employment contract or its internal rules and regulations that the employee shall cooperate with its internal investigation.

As for the legal system for witness protection, PRC's criminal procedure laws stipulate a relatively detailed legal system for witness protection, such as establishing a crime of retaliating against a witness; making public a witness's personal information such as name, address, employer and contact information for the purpose of protecting the personal safety of the witness; using assumed names in the indictments; and so on. However, there are relatively few legal provisions regarding the legal protection of witness in civil procedure, and provisions only regulate the expenses that may be incurred by the witness for testifying in court. For instance, Article 77 of the Civil Procedure Law of the PRC (Amended in 2021) provides, "The necessary expenses incurred by a witness in fulfilling his obligation to testify in court, including transportation, accommodation and meals, as well as the loss of salaries, shall be borne by the losing party. If a party applies for a witness to testify, the costs and expenses shall be advanced by the party; if the people's court notifies a witness to testify without the application by a party, the costs and expenses shall be advanced by the people's court. "

In general, yes, employees in Sweden have a far-reaching duty of loyalty toward their employers. This includes, among other things, a duty to truthfully answer an employer’s questions and to inform the employer of events that may be of interest to the employer. An employee’s obligation to assist is, however, more limited when assistance would entail self-incrimination.

A person acting as a witness under an investigation governed by the Swedish Whistleblowing Act will be protected by confidentiality. Personal data and details that could reveal the identity of a witness may not be disclosed without authorisation.

Due to the employee's duty of loyalty towards the employer and the employer's right to give instructions to its employees, employees generally must take part in an ongoing investigation and comply with any summons for questioning if the employer demands this (article 321d, Swiss Code of Obligations). If the employees refuse to participate, they generally are in breach of their statutory duties, which may lead to measures such as a termination of employment.

The question of whether employees may refuse to testify if they would have to incriminate themselves is disputed in legal doctrine.[1] However, according to legal doctrine, a right to refuse to testify exists if criminal conduct regarding the questioned employee or a relative (article 168 et seq, Swiss Criminal Procedure Code) is involved, and it cannot be ruled out that the investigation documentation may later end up with the prosecuting authorities (ie, where employees have a right to refuse to testify in criminal proceedings, they cannot be forced to incriminate themselves by answering questions in an internal investigation).[2]

The Civil Code of the PRC, the Personal Information Protection Law of the PRC and other laws provide for the protection of employees' personal information and privacy. Employers are often involved in checking the information and materials stored in the computers, hard disks and other electronic office equipment provided to employees in internal investigation and are likely to access the employees' personal information including personal privacy information, such as the communication records stored in instant communication software such as WeChat, QQ or other instant communication software or to and from private email boxes. According to the Personal Information Protection Law of the PRC, employers are required to perform the obligation of informing and obtain the individuals' consent prior to the processing of personal information, i.e. the principle of informing + consent. Moreover, the Civil Code of the PRC stipulates that no organization or individual may process any person's private information, except as otherwise provided by law or with the explicit consent of the right holder.

Therefore, the legitimacy of obtaining data evidence can be enhanced and guaranteed only if it is explicitly stated in the relevant rules and regulations that the employer shall have the right to the work equipment provided to the employees or obtains the employees' personal consent.

To the extent the gathering of physical evidence includes the processing of personal data, please see question 1.

The Swiss Federal Act on Data Protection applies to the gathering of evidence, in particular such collection must be lawful, transparent, reasonable and in good faith, and data security must be preserved.[1]

It can be derived from the duty to disclose and hand over benefits received and work produced (article 321b, Swiss Code of Obligations) as they belong to the employer.[2] The employer is, therefore, generally entitled to collect and process data connected with the end product of any work completely by an employee and associated with their business. However, it is prohibited by the Swiss Criminal Code to open a sealed document or consignment to gain knowledge of its contents without being authorised to do so (article 179 et seq, Swiss Criminal Code). Anyone who disseminates or makes use of information of which he or she has obtained knowledge by opening a sealed document or mailing not intended for him or her may become criminally liable (article 179 paragraph 1, Swiss Criminal Code).

It is advisable to state in internal regulations that the workplace might be searched as part of an internal investigation and in compliance with all applicable data protection rules if this is necessary as part of the investigation.

Article 13 of the Constitution of the PRC provides that the lawful private property of the citizens shall not be violated. Therefore, during the process of investigation, without the employees' consent, the employer has no right to search the employees' personal possessions or files. If it is necessary to search the employees' personal possessions or files, the employer may require the employees to sign a Letter of Informed Consent before searching; or the employer may call the police and the search will be conducted under the escort of the public security authorities or directly by the public security authorities.

An employer can search an employee’s personal possessions (eg, handbag, pockets and locker) if the employer has a legitimate interest in a search. This could, for example, include a reasonable suspicion of theft of employer property. Furthermore, an employer may search, but not continually monitor, an employee’s computer and email provided that it is in accordance with GDPR requirements. For the processing to be lawful under the GDPR, the employer has to establish a purpose and a legal basis for the processing of personal data. Furthermore, data subjects must have received information on the legal basis for and purpose of the processing of personal data beforehand. If the data subjects have not received such information, the employer’s right to process their data is limited. However, if the employer has reasonable grounds to believe that trade secrets or similar has been copied and stolen, no such requirements would typically apply.

Investigations into an employee's possessions may, under certain circumstances, also be carried out by the Swedish authorities.

The basic rule is that the employer may not search private data during internal investigations.

If there is a strong suspicion of criminal conduct on the part of the employee and a sufficiently strong justification exists, a search of private data may be justified.[1] The factual connection with the employment relationship is given, for example, in the case of a criminal act committed during working hours or using workplace infrastructure.[2]

In practice, the following factors to be considered will be: (1) verification of the informant's identity; (2) whether the informant has any conflict of interest with the reported employee or whether it will affect the objectivity of their reporting; (3) how to persuade the informant to provide more information or evidence, or to cooperate in court as a witness; (4) how to increase the admissibility of evidence when the informant refuses to cooperate in court as a witness or fails to provide original evidence; (5) how to improve the evidence chain and protect the informant from being attacked or retaliated by the informant, etc.

If the Swedish Whistleblowing Act governs the investigation, additional considerations apply relating to who may investigate a reported irregularity (see question 4) and the duty of confidentiality and restrictions on access to and disclosure of personal data in investigations (see questions 6, 10 and 11), as well as the rights and protections of whistleblowers.

As regards the rights and protections of whistleblowers, the following can be noted. A person reporting in a reporting channel governed by the Swedish Whistleblowing Act is protected against retaliation and restrictive measures. Thus, companies are prohibited from preventing or trying to prevent a person from reporting, and retaliating against a person who reports. Furthermore, a reporting person will not be held liable for breach of confidentiality for collecting the reported information if the person had reasonable grounds to believe that it was necessary to submit the report to expose irregularities. Under the Swedish Whistleblowing Act, any person reporting irregularities in a reporting channel established under the Swedish Whistleblowing Act may also report irregularities to designated Swedish authorities.

If an employee complains to his or her superiors about grievances or misconduct in the workplace and is subsequently dismissed, this may constitute an unlawful termination (article 336, Swiss Code of Obligations). However, the prerequisite for this is that the employee behaves in good faith, which is not the case if he or she is (partly) responsible for the grievance.

Although there are no specific laws or regulations regulating the extent of confidentiality obligation employers or the investigators shall comply with, in practice, the confidentiality obligation of both parties usually originates from the confidentiality agreement between the employee and the employer, as well as general provisions on protection of personal information and right of privacy, etc.

In this regard, it is advisable to require the relevant personnel responsible for handling the suspension for investigation to sign a confidentiality agreement or a letter of commitment, and require them to pay attention to the protection of the personal information and privacy of the complainant and other relevant personnel, for the purpose of avoiding extra losses caused by the occurrence of disputes relating to right of reputation, right of privacy and personal information leakage during the investigation.

If the Swedish Whistleblowing Act applies, the persons or entities handling the investigation have a duty of confidentiality and may not, without permission, disclose any information that could reveal the identity of the reporting person, any person subject to the report or any other person mentioned in the report or during the investigation of the report. Access to personal data is limited to designated competent entities or persons. Investigative material including personal data may not be shared with other persons or entities during the investigation. Once the investigation has reached actionable conclusions, investigative material may be shared with other persons or entities, such as HR or the police, provided that such sharing is necessary to take action on the outcome of the investigation. Investigative material may also be shared if it is necessary for the use of reports as evidence in legal proceedings or under the law or other regulations.

If the Swedish Whistleblowing Act does not apply, there are no particular confidentiality obligations for employers. Yet, an employer needs to consider what information is suitable to share during an investigation, how this is done and to whom it is shared. An employer must also respect employees’ privacy in line with what is generally considered good practice in the labour market. This means that an employer should be careful as to what sensitive and personal information is shared during an investigation. Furthermore, the spreading of damaging information (even if true) about an employee to a wider group may be a criminal offence under the Swedish Criminal Code.

Besides the employee's duty of performance (article 319, Swiss Code of Obligations), the employment relationship is defined by the employer's duty of care (article 328, Swiss Code of Obligations) and the employee's duty of loyalty (article 321a, Swiss Code of Obligations). Ancillary duties can be derived from the two duties, which are of importance for the confidentiality of an internal investigation.[1]

In principle, the employer must respect and protect the personality (including confidentiality and privacy) and integrity of the employee (article 328 paragraph 1, Swiss Code of Obligations) and take appropriate measures to protect the employee. Because of the danger of pre-judgment or damage to reputation as well as other adverse consequences, the employer must conduct an internal investigation discreetly and objectively. The limits of the duty of care are found in the legitimate self-interest of the employer.[2]

In return for the employer's duty of care, employees must comply with their duty of loyalty and safeguard the employer's legitimate interests. In connection with an internal investigation, employees must therefore keep the conduct of an investigation confidential. Additionally, employees must keep confidential and not disclose to any third party any facts that they have acquired in the course of the employment relationship, and which are neither obvious nor publicly accessible.[3]

Although there are no explicit provisions of law or policy requiring employers to provide specific information of allegations to investigated employees, in practice, at the early stage of investigation, in order to avoid alerting the investigated employee and reduce the possibility that the investigated employee may destroy the relevant evidence, the employer usually will not disclose the information of allegations to the investigated employee at the beginning of investigation. At the later stage of an investigation, when the employer has already obtained main evidence, the employer usually will properly disclose to the investigated employee the allegations that are clearly known by the employer and have sufficient evidence, and listen to the counterparty's opinions or argument, for the purpose of obtaining more information or getting the employee's confession.

According to article 14 of the GDPR, no information must be provided. The exemption in article 14.5(b) applies to the extent the obligation to provide such information is likely to render impossible or seriously impair the objectives of the processing of the personal data of the employee under investigation (ie, to diligently investigate the suspected irregularity).

If the Swedish Whistleblowing Act applies, information about where the personal data processed originates from may not be provided under article 14 of the GDPR, as the personal data must remain confidential subject to obligations under the Swedish Whistleblowing Act.

In addition to the above, an investigation should, to the extent possible and suitable, be characterised by the principles in ECHR (particularly articles 6 and 8). The employee under investigation should, among other things, be presented with sufficient information to safeguard his or her interests and be allowed to respond to the allegations. The investigation must also be compliant with the work environment responsibilities that the employer has concerning the involved parties (see questions 17 and 20).

As a result of the employer's duty of care (article 328, Swiss Code of Obligations), employees under investigation have certain procedural rights. These include, in principle, the right of the accused to be heard. In this context, the accused has the right to be informed at the beginning of the questioning about the subject of the investigation and at least the main allegations and they must be allowed to share their view and provide exculpatory evidence.[1] The employer, on the other hand, is not obliged to provide the employee with existing evidence, documents, etc, before the start of the questioning.[2]

Covert investigations in which employees are involved in informal or even private conversations to induce them to provide statements are not compatible with the data-processing principles of good faith and the requirement of recognisability, according to article 4 of the Swiss Federal Act on Data Protection.[3]

Also, rights to information arise from the Swiss Federal Act on Data Protection. In principle, the right to information (article 8, Swiss Federal Act on Data Protection) is linked to a corresponding request for information by the concerned person and the existence of data collection within the meaning of article 3 (lit. g), Swiss Federal Act on Data Protection. Insofar as the documents from the internal investigation recognisably relate to a specific person, there is in principle a right to information concerning these documents. Subject to certain conditions, the right to information may be denied, restricted or postponed by law (article 9 paragraph 1, Swiss Federal Act on Data Protection). For example, such documents and reports may also affect the confidentiality and protection interests of third parties, such as other employees. Based on the employer's duty of care (article 328, Swiss Code of Obligations), the employer is required to protect them by taking appropriate measures (eg, by making appropriate redactions before handing out copies of the respective documents (article 9 paragraph 1 (lit. b), Swiss Federal Act on Data Protection)).[4] Furthermore, the employer may refuse, restrict or defer the provision of information where the company’s interests override the employee’s, and not disclose personal data to third parties (article 9 paragraph 4, Swiss Federal Act on Data Protection). The right to information is also not subject to the statute of limitations, and individuals may waive their right to information in advance (article 8 paragraph 6, Swiss Federal Act on Data Protection). If there are corresponding requests, the employer must generally grant access, or provide a substantiated decision on the restriction of the right of access, within 30 days (article 8 paragraph 5, Swiss Federal Act on Data Protection and article 1 paragraph 4, Ordinance to the Federal Act on Data Protection).

At the level of criminal procedure in PRC, only the Criminal Procedure Law of PRC provides that pseudonyms may be used in the indictment as a substitute for the disclosure of a witness's personal information, such as name, address, employer and contact information, to protect the personal safety of the witness. However, there are no relevant provisions on whether the identity of the complainant, the witness in civil litigation and the provider of information shall be kept confidential during an investigation.

During the course of an investigation, in order to protect the privacy of relevant personnel and avoid the risk of infringement, the employer usually keeps the identity of the complainant or the provider of investigation information confidential. However, at the civil litigation stage, the witness is unavoidably required to testify in court, and must truthfully identify himself/herself to the court.

If the Swedish Whistleblowing Act applies, their identity must be kept confidential under the duty of confidentiality. If the Swedish Whistleblowing Act does not apply, their identity can to a large extent be kept confidential.

It can also be noted that a workplace investigation carried out in the public sector will often (eventually) become an official document, which means that the document can be requested by the public. There are, however, provisions on secrecy that may restrict the right to gain access to official documents. These provisions are found in the Public Access to Information and Secrecy Act (2009:400).

As mentioned under Question 10, the employer’s duty of care (article 328, Swiss Code of Obligations) also entails the employer’s duty to respect and protect the personality (including confidentiality and privacy) and integrity of employees (article 328 paragraph 1, Swiss Code of Obligations) and to take appropriate measures to protect them.

However, in combination with the right to be heard and the right to be informed regarding an investigation, the accused also has the right that incriminating evidence is presented to them throughout the investigation and that they can comment on it. For instance, this right includes disclosure of the persons accusing them and their concrete statements. Anonymisation or redaction of such statements is permissible if the interests of the persons incriminating the accused or the interests of the employer override the accused’ interests to be presented with the relevant documents or statements (see question 11; see also article 9 paragraphs 1 and 4, Swiss Federal Act on Data Protection). However, a careful assessment of interests is required, and these must be limited to what is necessary. In principle, a person accusing another person must take responsibility for their information and accept criticism from the person implicated by the information provided.[1]

Yes. In practice, before conducting a compliance investigation, we recommend that the employer and the investigator enter into a confidentiality agreement to require the investigator to keep confidential the facts and the substance of the investigation. This will not only better protect the personal information of the complainant, the witness and the investigated employee, but also help the investigation to proceed smoothly.

NDAs can be used for some investigations carried out in the private sector. However, under the Swedish Whistleblowing Act, a contract is void to the extent it retracts or restricts a person’s rights under the Swedish Whistleblowing Act. An NDA that restricts the right to report irregularities to authorities or the media would, therefore, typically be void.

In addition to the above-mentioned statutory confidentiality obligations, separate non-disclosure agreements can be signed. In an internal investigation, the employee should be expressly instructed to maintain confidentiality.

The employer has the property right over all its properties. When discovering employee's misconduct, the employer is entitled to conduct an investigation within a certain scope according to the relevant laws and regulations, as well as the management system of the employer. Generally speaking, the employer is not required to obtain consent of the employee when conducting an investigation of the space and objects owned by it. The employer has no right to directly conduct an investigation of the employee's private space, objects, bank accounts and stock trading accounts. The public security organ or other public authorities should be involved in the investigation. In principle, if the employee's private space or objects are mixed with the employer's private space or objects, the employer should obtain consent of the employee for an investigation. Meanwhile, the employer's investigation should be controlled within the reasonable and necessary limit, and the employer is not allowed to illegally use or disclose the investigation results, otherwise it may constitute infringement. In addition, we also recommend that the employer stipulate explicitly in the employment contract and the internal management system that the employer has the right to detain and inspect the articles or equipment distributed by the employer, so as to reduce the compliance risk of internal investigation.

Attorney-client privilege will apply to all communication and investigative material between a client and its law firm. Attorney-client privilege is, however, not without limitations. Regarding investigations into alleged employee misconduct, a law firm may have to report suspected money laundering to the authorities and under certain circumstances disclose information to the financial police.

Written material covered by attorney-client privilege generally may not be seized.

As outlined above, all employees generally have the right to know whether and what personal data is being or has been processed about them (article 8 paragraph 1, Swiss Federal Act on Data Protection; article 328b, Swiss Code of Obligations).

The employer may refuse, restrict or postpone the disclosure or inspection of internal investigation documents if a legal statute so provides, if such action is necessary because of overriding third-party interests (article 9 paragraph 1, Swiss Federal Act on Data Protection) or if the request for information is manifestly unfounded or malicious. Furthermore, a restriction is possible if overriding the self-interests of the responsible company requires such a measure and it also does not disclose the personal data to third parties. The employer or responsible party must justify its decision (article 9 paragraph 5, Swiss Federal Act on Data Protection).[1]

The scope of the disclosure of information must, therefore, be determined by carefully weighing the interests of all parties involved in the internal investigation.

The relevant laws and regulations in the PRC have not made explicit provision regarding rights to representation. In practice, some arbitral tribunals and courts hold the view that it is reasonable for the employee to refuse to cooperate with the investigation if he/she is not accompanied or has no legal representatives. Therefore, the employer usually cannot impose disciplinary punishment by warning or even termination of employment contract on the basis of such refusal. Therefore, we tend to believe that, where the employee under investigation requests to be accompanied or have legal representation, the employer should fully consider and communicate with the employee about the request, and prudently impose disciplinary punishment on the employee for failing to cooperate with the investigation.

Of course, considering that satisfying such request will increase the difficulties and obstacles for the employer to carry out the investigation to a certain extent, we still suggest that the employer include in its rules and regulations such provisions as "the employee being investigated shall actively and unconditionally cooperate with the employer's investigation", etc., in order to provide institutional support for the follow-up requirement or even disciplinary punishment by the employer on employee and to encourage the employee to cooperate in the investigation.

The employee has no right to bring legal representation. However, the outcome of an investigation may lead to employment-related consequences, so it may be appropriate (depending on the situation) to offer the employee the opportunity to bring a union representative (if the employee is unionised) or a legal representative.

In the case of an employee involved in an internal investigation, a distinction must be made as to whether the employee is acting purely as an informant or whether there are conflicting interests between the company and the employee involved. If the employee is acting purely as an informant, the employee has, in principle, no right to be accompanied by their own legal representative.[1]

However, if there are conflicting interests between the company and the employee involved, when the employee is accused of any misconduct, the employee must be able to be accompanied by their own legal representative. For example, if the employee's conduct might potentially constitute a criminal offence, the involvement of a legal representative must be permitted.[2] Failure to allow an accused person to be accompanied by a legal representative during an internal investigation, even though the facts in question are relevant to criminal law, raises the question of the admissibility of statements made in a subsequent criminal proceeding. The principles of the Swiss Criminal Procedure Code cannot be undermined by alternatively collecting evidence in civil proceedings and thus circumventing the stricter rules applicable in criminal proceedings.[3]

In general, it is advisable to allow the involvement of a legal representative to increase the willingness of the employee involved to cooperate.

The relevant laws and regulations in the PRC have not expressly provided the employer’s obligation to inform the trade union of the internal investigation or the right of the trade union to participate in the employer's internal investigation. In practice, given the confidential nature of internal investigation, the employer usually does not voluntarily inform the trade union of such information. However, in accordance with Article 25 of the Measures for the Supervision of Labor Law by Trade Unions of the PRC, the trade union shall have the right to conduct an investigation if the employer has violated the labor laws and regulations or infringed the legitimate rights and interests of the employee. Therefore, it is still possible that the employer, in the course of the internal investigation, may be investigated by the trade union if it has violated the labor laws and regulations or infringed the legitimate rights and interests of the employee (e.g. being suspected of infringing personal information or privacy).

In addition, if the employer determines that the employee has committed a serious disciplinary offence based on the result of the internal investigation and thus decides to terminate the employment contract unilaterally, it shall notify the trade union of the reasons for termination in advance. If the employer has violated the laws, administrative regulations or the provisions of the employment contract, the trade union is entitled to request the employer to make corrections.

No, but if the employee under investigation is unionised it is appropriate to inform the union about the investigation. If the employer chooses to take action against the employee during, or after, the investigation, the trade union generally needs to be consulted before any final decisions are made.

If the Swedish Whistleblowing Act applies, the employer is not authorised to inform a works council or trade union about the investigation, as it may be in violation of the duty of confidentiality (see question 10).

In general, works councils and trade unions are not very common in Switzerland and there are no statutory rules that would provide a works council or trade union a right to be informed or involved in an ongoing internal investigation. However, respective obligations might be foreseen in an applicable collective bargaining agreement, internal regulations or similar.

The relevant laws and regulations in the PRC have not made explicit requirements regarding the supports received by the employee involved in the investigation. In practice, the employer will usually prepare an internal time schedule before carrying out the investigation. Although the detailed time schedule will not be disclosed to the employee, the employer will usually inform the employee of each investigation in advance. In order to improve the transparency of the investigation, we recommend that employer should make positive and proper responses to employee who enquires about the progress of the investigation, so as to avoid employee's suspicion.

In addition, the Personal Information Protection Law of the PRC stipulates the rights of individuals in the process of personal information processing. In the scenario of internal investigation of an employer, the investigated party may, in accordance with such provisions, ask the employer for the right to review and even copy the personal information collected. Where the employee finds that the personal information collected by internal investigation is inaccurate or incomplete, he/she is entitled to request for correction or supplementation.

The employer is responsible for the work environment and must ensure that employees are not at risk of mental (or physical) illness due to an investigation. If an employee, in connection with an investigation, requires support or if risk of ill health is otherwise anticipated, the employer is obliged to assess the situation and provide said employee with sufficient support (eg, counselling or work adjustments).

The employer does not generally need to provide specific support for employees that are subject to an internal investigation. The employer may, however, allow concerned employees to be accompanied by a trusted third party such as family members or friends.[1] These third parties will need to sign separate non-disclosure agreements before being involved in the internal investigation.

In addition, a company may appoint a so-called lawyer of confidence who has been approved by the employer and is thus subject to professional secrecy. This lawyer will not be involved in the internal investigation but may look after the concerned employees and give them confidential advice as well as inform them about their rights and obligations arising from the employment relationship.[2]

If any matter unrelated to this investigation is revealed during the investigation and the matter is suspected of violating regulations, the employer may comprehensively consider whether it is necessary to investigate the new matter. If the employer assesses that a combined investigation will seriously affect and hinder the progress of the investigation or complicate the investigation, the employer can handle the unrelated matters through separate investigations.

In addition, Article 6 of the Personal Information Protection Law of the PRC requires that the processing of personal information shall be for a specific and reasonable purpose and shall be directly related to the purpose of the processing and shall adopt the method with minimum impact on individuals' rights and interests. If the result of the investigation reveals unrelated personal information, it means that the collection and storage of such personal information are unrelated to the purpose of the processing. According to paragraph 1 of Article 47 of the Personal Information Protection Law of the PRC, the employer as the personal information processor shall take the initiative to delete personal information. If the employer fails to delete such information, the employee is entitled to request for deletion.

According to the GDPR, personal data can only be processed for specified, explicit and legitimate purposes and may not be further processed in a manner that is incompatible with those purposes. This imposes restrictions on the use of material from previous investigations in new investigations when the material was collected for other purposes. It is, therefore, necessary to ensure whether the new matter relates to the investigation and falls within the purpose of the investigation. If the new matter is unrelated to the investigation and does not fall within the purpose of the investigation, the identified information may not be processed under the GDPR.

Except for what is stated above, no regulation limits how the employer can use information regarding unrelated matters. Unrelated matters may be a myriad of different things, and could in some instances just be discarded, while in other situations the information may invoke a responsibility to act for the employer (eg, if the unrelated matters concern work environment issues or other severe misconduct by an employee who is not the target of the investigation). Furthermore, the employer may always use any revealed information (unrelated or not) as evidence in a court of law, since the principle of free examination of evidence applies.

There are no regulations in this regard in the Swiss employment law framework. However, in criminal proceedings, the rules regarding accidental findings apply (eg, article 243, Swiss Criminal Procedure Code for searches and examinations or article 278, Swiss Criminal Procedure Code for surveillance of post and telecommunications). In principle, accidental findings are usable, with the caveat of general prohibitions on the use of evidence.

There is no specific provision on this in relevant laws and regulations in the PRC. In practice, the employer will usually stipulate the relevant grievance procedure and process in its internal rules and regulations, and provide the employee with the relevant grievance rights in accordance with the grievance regulations. Alternatively, even if there is no provision on grievance procedure and process in their internal rules and regulations, from the perspective of fairness and rationality, we recommend that the employer should review and evaluate the grievance raised by the employee. If it is confirmed that irregularities exist in the investigation, which may directly affect the conclusions of the investigation (e.g. a past conflict between the employee and the investigator or the employee was unfairly treated in the investigation), the employer shall suspend the investigation and resume the investigation after timely resolution of such complaint. If the grievance does not affect the normal conduct of the investigation, the employer can still proceed with the investigation.

There are no formal rules or processes for handling grievances in Sweden. Depending on the nature of the grievance, such a complaint may also have to be investigated (unless the grievance is deemed to be trivial). This could, for example, be the case if the grievance concerns new or other work environment issues that the employer is obliged to investigate.

In the context of private internal investigations, grievances initially raised by the employee do not usually have an impact on the investigation.

However, if the employer terminates the employment contract due to a justified legal complaint raised by an employee, a court might consider the termination to be abusive and award the employee compensation in an amount to be determined by the court but not exceeding six months’ pay for the employee (article 336 paragraph 1 (lit. b) and article 337c paragraph 3, Swiss Code of Obligations). Furthermore, a termination by the employer may be challenged if it takes place without good cause following a complaint of discrimination by the employee to a superior or the initiation of proceedings before a conciliation board or a court by the employee (article 10, Federal Act on Gender Equality).

During the investigation, the employer should fully respect the basic labor rights of the employee. According to the relevant provisions of Labor Contract Law of the PRC, if an employee is sick during the investigation, the employer should permit him/her to take sick leave provided that he/she provides the medical certificate issued by the medical institution and performs the medical leave application procedure as required by the employer. Therefore, the employer usually needs to request the employee to cooperate with the investigation after the sick leave, and cannot force the investigation by means of coercion or violence.

However, for the contents that can be investigated by the employer alone, such as the information publicized by the employee on social media and the employee's relevant information publicized on official website, since the investigation of such information is not affected by the employee's physical condition, the employer may adjust the investigation plan and conduct such part of the investigation first.

The employer is responsible for the employee’s work environment during the investigation. The employer must assess the situation and the impact on the employee’s health and may, depending on the situation, have to postpone certain investigative measures, such as interviewing the employee in question. The investigation may even have to be completed without the employee participating.

The time spent on the internal investigation by the employee should be counted as working time[1]. The general statutory and internal company principles on sick leave apply. Sick leave for which the respective employee is not responsible must generally be compensated (article 324a paragraph 1 and article 324b, Swiss Code of Obligations). During certain periods of sick leave (blocking period), the employer may not ordinarily terminate the employment contract; however, immediate termination for cause remains possible.

The duration of the blocking period depends on the employee's seniority, amounting to 30 days in the employee's first year of service, 90 days in the employee's second to ninth year of service and 180 days thereafter (article 336c paragraph 1 (lit. c), Swiss Code of Obligations).

The PRC law is silent on how to deal with the conflict between internal investigation and criminal or regulatory investigation. In general, the employer should cooperate with the criminal or regulatory investigation being conducted by the investigating authority to avoid hindering official business.

According to the Civil Procedure Law of the PRC, the Administrative Procedure Law of the PRC, and the Criminal Procedure Law of the PRC, the investigating authorities (including the public security authority, the people's procuratorate, the people's court, and the supervision authority) have the power to investigate and verify evidence from the witness or the individuals or entities that have access to the evidentiary materials. Therefore, the investigating authorities have the power to compel the employer to share or provide evidentiary materials relating to the case, and the employer shall cooperate and provide such materials. If the employer refuses to cooperate, it may face administrative liability (such as warning, fine and detention of the directly responsible person), judicial liability (fine shall be imposed on the main person in charge or the directly responsible person, and detention may be granted to those who refuse to cooperate) and even criminal liability (those who conceal criminal evidence may be guilty of perjury).

Handling a parallel investigation will have to be assessed on a case-by-case basis depending on the applicable rules. For instance, an investigation under the Swedish Discrimination Act is subject to certain timing requirements with which the employer must comply. In other cases, it may be more appropriate to hold off the workplace investigation while awaiting the outcome of the parallel investigation.

The police or regulator can, depending on the matter at hand, request an employer to share evidence. The police or the regulator may also, under certain circumstances, retain evidence in a search.

The actions of the employer may carry through to a subsequent state proceeding. First and foremost, any prohibitions on the use of evidence must be considered. Whereas in civil proceedings the interest in establishing the truth must merely prevail for exploitation (article 152 paragraph 2, Swiss Civil Procedure Code), in criminal proceedings, depending on the nature of the unlawful act, there is a risk that the evidence may not be used (see question 27 and article 140 et seq, Swiss Civil Procedure Code).

There is no explicit stipulation in the laws and regulations in the PRC on this issue. In practice, given the confidentiality of any investigation into a violation, the employer usually will not disclose the investigation result or submit the investigation report to the investigated employee, unless it is explicitly provided in its rules and regulations that the employer is obliged to inform the employee of the investigation result. However, according to the Employment Contract Law of the PRC and the opinions of the mainstream arbitration tribunals and courts, if an employer decides to take disciplinary action against an employee (in particular, termination of employment contract) according to the investigation result, it is generally required to inform the employee of the investigation result. In other words, the employer generally needs to inform the employee of the specific facts based on which the disciplinary action is taken. Failure to do so may result in the generalization of serious violation of the employer's rules and regulations and lead the arbitration tribunals and courts to regard the termination as illegal.

This depends on the outcome of the investigation and the applicable rules.

If the outcome of the investigation leads to termination, the employer will have to disclose some information regarding the reason for termination. If the employee questions the termination, the employer may have to disclose more information in a subsequent dispute. If the outcome of the investigation leads to less invasive measures, such as a warning, there are less extensive requirements to provide information.

If the Swedish Whistleblowing Act applies, the duty of confidentiality and the restrictions on access to and disclosure of personal data must be considered (see question 10). If the investigation is based on the rules in the Swedish Discrimination Act, there are also feedback requirements concerning the involved parties.

Workplace investigations often result in an investigation report that is intended to serve as the basis for any measures to be taken by the company's decisionmakers.

The employee's right to information based on article 8, Swiss Federal Act on Data Protection also covers the investigation report, provided that the report and the data contained therein relate to the employee.[1] In principle, the employee concerned is entitled to receive a written copy of the entire investigation report free of charge (article 8 paragraph 5, Swiss Federal Act on Data Protection and article 1 et seq, Ordinance to the Federal Act on Data Protection). Redactions may be made where the interests of the company or third parties so require, but they are the exception and must be kept to a minimum.[2]

For the employee: As mentioned in our response to question 22, the relevant laws and regulations in the PRC do not impose any obligation on an employer to share investigation report (including the findings) with its employee, unless otherwise expressly provided in its internal rules and regulations that the employer may share with its employee any investigation report or findings that do not involve trade secrets or another person's privacy or personal information. Therefore, the employer has the discretion to decide whether and to what extent to share the investigation report based on its business management needs.

For the police/regulatory authorities: In general, an employer shall provide a complete report according to the law as required by the authority handling the case. It is recommended that the employer should conduct a detailed review of the investigation authority and the information contained in the evidence collection documents issued by the authority, and communicate with the authority to specify the scope of assistance and evidentiary materials to be provided. Although the employer cannot refuse to provide relevant evidentiary materials to the investigation authority on the grounds that such evidentiary materials involve trade secret or personal privacy, it still needs to carefully assess the relevance of the evidentiary materials to the facts of the case and timely communicate with the authority to confirm and narrow the scope of providing evidence as much as possible. If necessary, the employer can consult professional lawyers to provide professional opinions. In addition, we suggest that the employer may also try to require the investigation officer to sign a confidentiality letter, and file the investigation materials involving trade secret or personal privacy, the reasons thereof, etc., for the purpose of reducing legal risks faced by the employer.

There is no obligation to share the investigation report, neither in full nor key findings, with the involved parties. An assessment needs to be made in each case of what is appropriate to share and with whom.

When sharing an investigation report, certain data protection considerations must be made. A purpose and legal basis for the sharing must be established and, in principle, documented.

If the Swedish Whistleblowing Act applies, the duty of confidentiality and the restrictions on access to and disclosure of personal data must be considered (see question 10).

In principle, there is no obligation to disclose the final investigation report. Disclosure obligations may arise based on data protection law vis-à-vis the persons concerned (eg, the accused). Likewise, there is no obligation to disclose other documents, such as the records of interviews. The employee should be fully informed of the final investigation report, if necessary, with certain redactions (see question 22). The right of the employee concerned to information is comprehensive (ie, all investigation files must be disclosed to him).[1] Regarding publication to other bodies outside of criminal proceedings, the employer is bound by its duty of care (article 328, Swiss Code of Obligations) and must protect the employee as far as is possible and reasonable.[2]

The employer may take disciplinary actions against the employee based on the investigation result and pursue their civil, administrative and even criminal liabilities. To be specific: 1) the employer may criticize and educate the employee, or take disciplinary actions such as warning, demotion and removal according to the internal rules and regulations of the employer. If the misconduct of the employee constitutes one of the circumstances stipulated in Article 39 of the Employment Contract Law of the PRC, the employer is entitled to take the most severe disciplinary action, namely termination of employment contract; 2) if the employee has caused economic loss to the employer, the employer may lawfully initiate a civil litigation recourse procedure; 3) if the employee violates the Law on Administrative Penalties for Public Security Administration of the PRC, the employer may deliver the case to the administrative department for corresponding administrative penalties; 4) if the employee is suspected of a crime, the employer should deliver the case to the public security authority and pursue his/her corresponding criminal liabilities according to the law.

An investigation may result in employment law measures (eg, support, training, relocation, warning, termination or dismissal). An investigation may also be inconclusive and not result in any action.

If the investigation uncovers misconduct, the question arises as to what steps should be taken. Of course, the severity of the misconduct and the damage caused play a significant role. Furthermore, it must be noted that the cooperation of the employee concerned may be of decisive importance for the outcome of the investigation. The possibilities are numerous, ranging, for example, from preventive measures to criminal complaints.[1]

If individual disciplinary actions are necessary, these may range from warnings to ordinary or immediate termination of employment.

If the relevant investigation authorities or regulatory authorities require the employer to provide the investigation findings and the interview records of its employee's illegal activities, the employer is usually obliged to cooperate with the authorities and make disclosures according to the requirements of the law. Meanwhile, according to Article 110 of the Criminal Procedure Law of the PRC, any entity or individual who has found out facts of a crime or a criminal suspect has both the right and the duty to report the case or provide information to the public security authority, the people's procuratorate or the people's court. Therefore, if the investigation findings show that the employee is suspected of a crime, the employer should disclose the information to the relevant investigation authorities including the public security authority. For some special industries, for example, the investigation findings against the banking industry usually also need to be reported to the higher-level banking supervisory authorities. Although the relevant investigation staff and supervisory staff are usually required to comply with the confidentiality obligations according to the laws or regulations, the risk of leakage of the reported information due to the expansion of the scope of persons who are aware of the investigation findings cannot be completely excluded.

In addition, an employer may decide whether to disclose the results of an investigation (mainly including the violation of disciplines and the disciplinary punishment) to other employees at its own discretion, but has to disclose the relevant information among employees to the extent that it is "minimum and necessary", so as to avoid infringing on the employee's personal information or privacy or even right of reputation.

Findings may have to be handed over to the police or the regulator – there is no separate legal protection for material in employer investigations related to authorities. If the investigation has been carried out by a law firm, see question 14 on attorney-client privilege.

The employer is generally not required to disclose the final report, or the data obtained in connection with the investigation. In particular, the employer is not obliged to file a criminal complaint with the police or the public prosecutor's office.

Exceptions may arise, for example, from data protection law (see question 22) or a duty to release records may arise in a subsequent state proceeding.

Data voluntarily submitted in a proceeding in connection with the internal investigation shall be considered private opinion or party assertion.[1] If the company refuses to hand over the documents upon request, coercive measures may be used under certain circumstances.[2]

The relevant laws and regulations in the PRC have not clarified the retention period of the investigation findings. According to Article 19 of the Personal Information Protection Law of the PRC, unless otherwise required by laws or administrative regulations, the retention period of personal information shall be the shortest period necessary to achieve the purpose of handling the information. Since the employee's personal information is very likely to be involved in the investigation findings, such report should be retained for the shortest period necessary to achieve the purpose of handling the information. In general, once the investigation is completed, the purpose of the internal investigation has been achieved or it is no longer necessary to achieve the purpose, and the employer may, in accordance with Article 22 of the Administrative Regulations of the PRC on Network Data Security (Draft for Comments), delete or anonymize the personal information within fifteen (15) working days. If it is technically difficult to delete the personal information, or it is difficult to do so within fifteen (15) working days due to business complexity or other reasons, the employer shall not conduct any processing other than storing the personal information and adopting necessary security measures, and shall give reasonable explanations to the employee.

Under the GDPR personal data may not, according to the general principle on storage limitation, be retained for longer than is necessary for the purposes for which the personal data are processed. The GDPR does not stipulate a generally applicable storage limitation period. Such a regulation is, on the other hand, included in the Swedish Whistleblowing Act. If the Swedish Whistleblowing Act applies, the outcome of the investigation and all personal data should be retained for as long as necessary, but not for longer than two years after the investigation has been closed.

From an employment law point of view, there is no statute of limitations on the employee's violations. Based on the specific circumstances (eg, damage incurred, type of violation, basis of trust or the position of the employee), a decision must be made as to the extent to which the outcome should remain on the record.

From a data protection point of view, only data that is in the interest of the employee (eg, to issue a reference letter) may be retained during the employment relationship. In principle, stored data must be deleted after the termination of the employment relationship. Longer retention may be justified if rights are still to be safeguarded or obligations are to be fulfilled in the future (eg, data needed regarding foreseeable legal proceedings, data required to issue a reference letter or data in relation to a non-competition clause).[1]

It is inevitable that the investigation involves the employee's personal information, and once the investigation is mishandled, the employer may face the following legal risks:

Civil liability: Both the Civil Code of the PRC and the Personal Information Protection Law of the PRC, clearly provide the civil liability for infringement of privacy and illegal processing of personal information. Therefore, the investigated employee or relevant organizations such as the people's procuratorate have the right to claim or file a public interest lawsuit on the employer's improper collection of evidence, requiring the employer to bear the liability for infringement. In addition, the evidence obtained by an employer through infringing the employee's privacy and personal information rights and interests, in violation of the law, cannot be used as the valid evidence for the employer's unilateral termination of the employment contract or requiring the employee to compensate for losses.

Administrative liability: Article 66 of the Personal Information Protection Law of the PRC provides that, where personal information is processed in violation of regulations, administrative penalties imposed by the department performing duties of personal information protection may be up to revoking the business license, and the person directly in charge and other directly liable persons may be fined up to one million yuan and prohibited from practicing within a time limit. Meanwhile, Article 67 of the Personal Information Protection Law of the PRC provides that relevant illegal acts shall be recorded in the employer's credit files and disclosed to the public.

Criminal liability: if an employer illegally sells or provides to others the personal information obtained during the internal investigation, and the circumstance is serious enough, the judicial authority has the right to hold the employer, the managers directly in charge and other directly liable persons criminally liable in accordance with the crime of "infringement of citizens' personal information" under Article 253A of the Criminal Law of the PRC.

It should be noted that a compliance investigation may also involve the employer's communication and investigation reporting with overseas authorities, or overseas institutions' direct access to information from the employer's domestic systems. If the employer conducts cross-border transmission of such personal information, it shall also meet one of the conditions set out in Article 38 of the Personal Information Protection Law of the PRC (i.e. passing the security assessment organized by the national cyberspace administration authority, obtaining certification from a professional institution concerning the protection of personal information or entering into a standard contract with an overseas recipient). Violations of the above provisions may result in civil, administrative and even criminal liability.

Errors resulting in terminations can be unlawful and, if they lead to employees terminating their employment as a result of the employer’s missteps, could be seen as constructive dismissal. Constructive dismissal is generally equivalent to an unlawful dismissal. Unlawful terminations generally result in an obligation to pay financial and general damages to the affected employees.

Failure to fulfil the obligations under the Swedish Discrimination Act may lead to an obligation to pay financial and general damages.

If an employer does not fulfil its obligations according to work environment legislation, there is a risk that the Swedish Work Environment Authority will issue injunctions or prohibitions against the employer. If an employer omits to meet its work environment related obligations, and that in turn results in a work related accident, e.g. self-harm in connection with an internal investigation, it may also, in a worst case scenario, lead to criminal liability.

The Swedish Work Environment Authority is also responsible for monitoring compliance with the provisions of the Swedish Whistleblowing Act. The Swedish Work Environment Authority may, if necessary to ensure compliance with the Swedish Whistleblowing Act, order an operator to comply with the obligations and requirements of the Swedish Whistleblowing Act. Employers violating the Swedish Whistleblowing Act may also be liable to pay damages to the affected employees.

If personal data is processed in a way that violates the GDPR, the authorised supervisory authority may issue warnings or reprimands to the data controller, order the controller to comply with the GDPR, impose a ban on processing, or impose an administrative fine on the controller. Companies violating the GDPR may also be liable to pay damages to data subjects.

As there are no specific regulations for internal investigations, the usual legal framework within which the employer must act towards the employee derives from general rules such as the employer's duty of care, the employee's duty of loyalty and the employee's data protection rights.

But, for example, unwarranted surveillance could conceivably result in criminal liability (article 179 et seq, Swiss Criminal Code) for violations of the employee's privacy. Furthermore, errors made by the employer could have an impact on any later criminal proceedings (eg, in the form of prohibitions on the use of evidence).[1]

Evidence obtained unlawfully may only be used in civil proceedings if there is an overriding interest in establishing the truth (article 152 paragraph 2, Swiss Civil Procedure Code). Consequently, in each case, a balance must be struck between the individual’s interest in not using the evidence and in establishing the truth.[2] The question of the admissibility of evidence based on an unlawful invasion of privacy is a sensitive one – admissibility in this case is likely to be accepted only with restraint.[3] Since the parties in civil proceedings do not have any means of coercion at their disposal, it is not necessary, in contrast to criminal proceedings, to examine whether the evidence could also have been obtained by legal means.[4]

Unlawful action by the employer may also have consequences on future criminal proceedings: The prohibitions on exploitation (article 140 et seq, Swiss Criminal Procedure Code) apply a priori only to evidence obtained directly from public authorities. Evidence obtained unlawfully by private persons (ie, the employer) may also be used if it could have been lawfully obtained by the authority and if the interest in establishing the truth outweighs the interest of the individual in not using the evidence.[5] Art. 140 paragraph 1 Swiss Criminal Procure Code remains reserved: Evidence obtained in violation of Art. 140 paragraph 1 Swiss Criminal Procure Code is subject to an absolute ban on the use of evidence (e.g. evidence obtained under the use of torture[6]).[7]