Workplace Investigations

Article 13 of the Constitution of the PRC provides that the lawful private property of the citizens shall not be violated. Therefore, during the process of investigation, without the employees' consent, the employer has no right to search the employees' personal possessions or files. If it is necessary to search the employees' personal possessions or files, the employer may require the employees to sign a Letter of Informed Consent before searching; or the employer may call the police and the search will be conducted under the escort of the public security authorities or directly by the public security authorities.

As discussed in question 7, it may be difficult for a company to search an employee’s personal possessions. The company may search and gather electronic data stored in work laptops or company servers, subject to legal requirements and restrictions (eg, obtaining consent). 

The PIPA provides specific guidance on the requirements for obtaining consent. Under the PIPA, to collect or use an individual’s personal information, the information holder must be informed of and consent to:

• the purpose of the collection or use;
• the personal information that will be collected;
• the period of retention and use; and
• his or her right to refuse to provide consent and any disadvantages that may result from such refusal.

There are separate requirements for obtaining consent to provide an individual’s personal information to a third party. Also, consent must be obtained separately for the collection, use or provision of sensitive or unique identification information.

Under limited circumstances, personal information may be collected, used, or provided to third parties without obtaining the consent of the information holder. For instance, a company may collect and use personal information without obtaining consent where obtaining the information is necessary to achieve the company’s “legitimate interests”, which clearly exceed the information holder’s right to his or her personal information, and the collection and use are carried out within reasonable bounds. The term “legitimate interests” in this context is generally understood as a concept similar to “justifiable act” under the Criminal Code. The Korean Supreme Court has held that under exceptional circumstances such as the following, the company’s collection and review of employee data may constitute a “justifiable act” under the Criminal Code:

1. the company had specific and reasonable suspicion that the employee had committed a crime and the company had an urgent need to verify the facts;
2. the scope of the company’s review was limited to the suspected crime through the use of keywords, etc;
3. the employee had signed an agreement stating that he or she would not use work computers in an unauthorised manner and that all work products would belong to the company; and
4. the company’s review uncovered materials that could be used to verify whether the employee committed the alleged crime.

The basic rule is that the employer may not search private data during internal investigations.

If there is a strong suspicion of criminal conduct on the part of the employee and a sufficiently strong justification exists, a search of private data may be justified.[1] The factual connection with the employment relationship is given, for example, in the case of a criminal act committed during working hours or using workplace infrastructure.[2]

The employer has the property right over all its properties. When discovering employee's misconduct, the employer is entitled to conduct an investigation within a certain scope according to the relevant laws and regulations, as well as the management system of the employer. Generally speaking, the employer is not required to obtain consent of the employee when conducting an investigation of the space and objects owned by it. The employer has no right to directly conduct an investigation of the employee's private space, objects, bank accounts and stock trading accounts. The public security organ or other public authorities should be involved in the investigation. In principle, if the employee's private space or objects are mixed with the employer's private space or objects, the employer should obtain consent of the employee for an investigation. Meanwhile, the employer's investigation should be controlled within the reasonable and necessary limit, and the employer is not allowed to illegally use or disclose the investigation results, otherwise it may constitute infringement. In addition, we also recommend that the employer stipulate explicitly in the employment contract and the internal management system that the employer has the right to detain and inspect the articles or equipment distributed by the employer, so as to reduce the compliance risk of internal investigation.

No law recognises the common law concept of “attorney-client privilege” in Korea. However, communication with an attorney is protected to some extent under certain laws, such as the Constitution, the Attorney Act, the Criminal Procedure Act, and the Civil Procedure Act. This protection is based on the attorney’s confidentiality obligation, which prohibits an attorney from divulging confidential matters acquired in the course of representing clients, unless otherwise prescribed by law. This confidentiality obligation generally allows an attorney to refuse to testify or comply with document production orders for information or materials the attorney obtained in the course of his or her duties that relate to the confidential information of clients.

In addition, there could be instances where materials from an investigation conducted in Korea may become subject to discovery outside of Korea. It is, therefore, important to ensure investigation materials are privileged under the relevant non-Korean laws in the jurisdictions where attorney-client privilege is recognised (eg, the US).

As outlined above, all employees generally have the right to know whether and what personal data is being or has been processed about them (article 8 paragraph 1, Swiss Federal Act on Data Protection; article 328b, Swiss Code of Obligations).

The employer may refuse, restrict or postpone the disclosure or inspection of internal investigation documents if a legal statute so provides, if such action is necessary because of overriding third-party interests (article 9 paragraph 1, Swiss Federal Act on Data Protection) or if the request for information is manifestly unfounded or malicious. Furthermore, a restriction is possible if overriding the self-interests of the responsible company requires such a measure and it also does not disclose the personal data to third parties. The employer or responsible party must justify its decision (article 9 paragraph 5, Swiss Federal Act on Data Protection).[1]

The scope of the disclosure of information must, therefore, be determined by carefully weighing the interests of all parties involved in the internal investigation.