Workplace Investigations

For the employee: As mentioned in our response to question 22, the relevant laws and regulations in the PRC do not impose any obligation on an employer to share investigation report (including the findings) with its employee, unless otherwise expressly provided in its internal rules and regulations that the employer may share with its employee any investigation report or findings that do not involve trade secrets or another person's privacy or personal information. Therefore, the employer has the discretion to decide whether and to what extent to share the investigation report based on its business management needs.

For the police/regulatory authorities: In general, an employer shall provide a complete report according to the law as required by the authority handling the case. It is recommended that the employer should conduct a detailed review of the investigation authority and the information contained in the evidence collection documents issued by the authority, and communicate with the authority to specify the scope of assistance and evidentiary materials to be provided. Although the employer cannot refuse to provide relevant evidentiary materials to the investigation authority on the grounds that such evidentiary materials involve trade secret or personal privacy, it still needs to carefully assess the relevance of the evidentiary materials to the facts of the case and timely communicate with the authority to confirm and narrow the scope of providing evidence as much as possible. If necessary, the employer can consult professional lawyers to provide professional opinions. In addition, we suggest that the employer may also try to require the investigation officer to sign a confidentiality letter, and file the investigation materials involving trade secret or personal privacy, the reasons thereof, etc., for the purpose of reducing legal risks faced by the employer.

In principle, there is no obligation to disclose the final investigation report. Disclosure obligations may arise based on data protection law vis-à-vis the persons concerned (eg, the accused). Likewise, there is no obligation to disclose other documents, such as the records of interviews. The employee should be fully informed of the final investigation report, if necessary, with certain redactions (see question 22). The right of the employee concerned to information is comprehensive (ie, all investigation files must be disclosed to him).[1] Regarding publication to other bodies outside of criminal proceedings, the employer is bound by its duty of care (article 328, Swiss Code of Obligations) and must protect the employee as far as is possible and reasonable.[2]

The relevant laws and regulations in the PRC have not clarified the retention period of the investigation findings. According to Article 19 of the Personal Information Protection Law of the PRC, unless otherwise required by laws or administrative regulations, the retention period of personal information shall be the shortest period necessary to achieve the purpose of handling the information. Since the employee's personal information is very likely to be involved in the investigation findings, such report should be retained for the shortest period necessary to achieve the purpose of handling the information. In general, once the investigation is completed, the purpose of the internal investigation has been achieved or it is no longer necessary to achieve the purpose, and the employer may, in accordance with Article 22 of the Administrative Regulations of the PRC on Network Data Security (Draft for Comments), delete or anonymize the personal information within fifteen (15) working days. If it is technically difficult to delete the personal information, or it is difficult to do so within fifteen (15) working days due to business complexity or other reasons, the employer shall not conduct any processing other than storing the personal information and adopting necessary security measures, and shall give reasonable explanations to the employee.

From an employment law point of view, there is no statute of limitations on the employee's violations. Based on the specific circumstances (eg, damage incurred, type of violation, basis of trust or the position of the employee), a decision must be made as to the extent to which the outcome should remain on the record.

From a data protection point of view, only data that is in the interest of the employee (eg, to issue a reference letter) may be retained during the employment relationship. In principle, stored data must be deleted after the termination of the employment relationship. Longer retention may be justified if rights are still to be safeguarded or obligations are to be fulfilled in the future (eg, data needed regarding foreseeable legal proceedings, data required to issue a reference letter or data in relation to a non-competition clause).[1]