Workplace Investigations

Article 13 of the Constitution of the PRC provides that the lawful private property of the citizens shall not be violated. Therefore, during the process of investigation, without the employees' consent, the employer has no right to search the employees' personal possessions or files. If it is necessary to search the employees' personal possessions or files, the employer may require the employees to sign a Letter of Informed Consent before searching; or the employer may call the police and the search will be conducted under the escort of the public security authorities or directly by the public security authorities.

As discussed in question 7, it may be difficult for a company to search an employee’s personal possessions. The company may search and gather electronic data stored in work laptops or company servers, subject to legal requirements and restrictions (eg, obtaining consent). 

The PIPA provides specific guidance on the requirements for obtaining consent. Under the PIPA, to collect or use an individual’s personal information, the information holder must be informed of and consent to:

• the purpose of the collection or use;
• the personal information that will be collected;
• the period of retention and use; and
• his or her right to refuse to provide consent and any disadvantages that may result from such refusal.

There are separate requirements for obtaining consent to provide an individual’s personal information to a third party. Also, consent must be obtained separately for the collection, use or provision of sensitive or unique identification information.

Under limited circumstances, personal information may be collected, used, or provided to third parties without obtaining the consent of the information holder. For instance, a company may collect and use personal information without obtaining consent where obtaining the information is necessary to achieve the company’s “legitimate interests”, which clearly exceed the information holder’s right to his or her personal information, and the collection and use are carried out within reasonable bounds. The term “legitimate interests” in this context is generally understood as a concept similar to “justifiable act” under the Criminal Code. The Korean Supreme Court has held that under exceptional circumstances such as the following, the company’s collection and review of employee data may constitute a “justifiable act” under the Criminal Code:

1. the company had specific and reasonable suspicion that the employee had committed a crime and the company had an urgent need to verify the facts;
2. the scope of the company’s review was limited to the suspected crime through the use of keywords, etc;
3. the employee had signed an agreement stating that he or she would not use work computers in an unauthorised manner and that all work products would belong to the company; and
4. the company’s review uncovered materials that could be used to verify whether the employee committed the alleged crime.

The basic rule is that the employer may not search private data during internal investigations.

If there is a strong suspicion of criminal conduct on the part of the employee and a sufficiently strong justification exists, a search of private data may be justified.[1] The factual connection with the employment relationship is given, for example, in the case of a criminal act committed during working hours or using workplace infrastructure.[2]

For the employee: As mentioned in our response to question 22, the relevant laws and regulations in the PRC do not impose any obligation on an employer to share investigation report (including the findings) with its employee, unless otherwise expressly provided in its internal rules and regulations that the employer may share with its employee any investigation report or findings that do not involve trade secrets or another person's privacy or personal information. Therefore, the employer has the discretion to decide whether and to what extent to share the investigation report based on its business management needs.

For the police/regulatory authorities: In general, an employer shall provide a complete report according to the law as required by the authority handling the case. It is recommended that the employer should conduct a detailed review of the investigation authority and the information contained in the evidence collection documents issued by the authority, and communicate with the authority to specify the scope of assistance and evidentiary materials to be provided. Although the employer cannot refuse to provide relevant evidentiary materials to the investigation authority on the grounds that such evidentiary materials involve trade secret or personal privacy, it still needs to carefully assess the relevance of the evidentiary materials to the facts of the case and timely communicate with the authority to confirm and narrow the scope of providing evidence as much as possible. If necessary, the employer can consult professional lawyers to provide professional opinions. In addition, we suggest that the employer may also try to require the investigation officer to sign a confidentiality letter, and file the investigation materials involving trade secret or personal privacy, the reasons thereof, etc., for the purpose of reducing legal risks faced by the employer.

As discussed in question 22, when taking disciplinary action against an employee based on the outcome of an investigation, the company would need to disclose sufficient detail on the employee’s wrongdoing. However, this does not mean that the full investigation report would need to be shared with the employee to be disciplined. Key details of the investigation findings that apply to the relevant employee due to be disciplined should be shared, and not other findings concerning other persons.

There is also no requirement under Korean law for a company to disclose the investigation report or investigation findings to the whistleblower. If the company discloses the personal identity of the target employees, such disclosure could constitute a violation of the PIPA , libel or defamation under the Criminal Code. If the whistleblower strongly requests that the company share the investigation report or the findings, the company may consider providing a summary of the key findings concerning the allegations that the whistleblower raised, without disclosing personal information.

In principle, there is no obligation to disclose the final investigation report. Disclosure obligations may arise based on data protection law vis-à-vis the persons concerned (eg, the accused). Likewise, there is no obligation to disclose other documents, such as the records of interviews. The employee should be fully informed of the final investigation report, if necessary, with certain redactions (see question 22). The right of the employee concerned to information is comprehensive (ie, all investigation files must be disclosed to him).[1] Regarding publication to other bodies outside of criminal proceedings, the employer is bound by its duty of care (article 328, Swiss Code of Obligations) and must protect the employee as far as is possible and reasonable.[2]