Workplace Investigations

As far as the persons in charge of an internal investigation are concerned, L. 4990/2022 on the protection of persons who report breaches of Union law provides for certain conditions that should be met when exercising their duties (ie, being impartial and abstaining when there is a conflict of interest), which also apply as general principles in all disciplinary procedures. Whistleblowing legislation stipulates that persons appointed to receive and investigate a whistleblowing procedure should meet certain conditions, including no penal proceedings against them, no disciplinary proceedings or convictions for specific offences, and no workplace suspensions.

Official disciplinary procedures are conducted by the competent bodies as described in the respective internal labour regulations.

Although not specifically regulated, support from external advisors (eg, lawyers) is allowed.

In general, from an employment law perspective, there is no specific legal rule governing the minimum qualifications of who should conduct a workplace investigation. Generally speaking, a workplace investigation is carried out by the internal audit function, when there is one (generally in large companies), or by the HR or legal departments.

Outside the workplace, the employer may carry out investigations on the employee – normally without the latter knowing – through a private investigator. This investigation should be carried out to verify that the employee does not engage in conduct contrary to the company’s interests (eg, unlawful competition, disclosure of confidential information, criminal breaches). In such cases, the private investigator must comply with specific rules, mainly found in Italian Royal Decree No. 773 of 1931, according to which the investigator must, among other things: hold a licence issued by the competent authority; and keep a register of the activities conducted daily.

In addition, if there is a suspicion that a crime has been committed, the company may appoint a criminal law lawyer to conduct their own defensive criminal law investigation, as provided by article 391bis and the Italian Criminal Procedure Code.

The examinations can be carried out internally by designated internal employees, by external specialists, or by a combination thereof. The addition of external advisors is particularly recommended if the allegations are against an employee of a high hierarchical level[1], if the allegations concerned are quite substantive and, in any case, where an increased degree of independence is sought.

GDPR and the provisions of L. 4624/2019 regulate the gathering of physical evidence from a data protection perspective, providing, among other things, that personal data should be processed with transparency and to the extent necessary for the investigation.

L.4990/2022 on the protection of persons who report breaches of Union law regulates data protection issues in the context of whistleblowing investigations, mainly to safeguard confidentiality throughout the investigations.  

Several legal and case-law principles may be relevant depending on the kind of investigation, including the following:

• gathering evidence through employee “physical inspections and inspections on the employee’s belongings”: according to article 6 of the Workers’ Statute, these inspections are generally prohibited. They are permitted only where necessary to protect company assets (in such cases, corporal inspections may be carried out, subject to trade union agreement or National Labour Inspectorate authorisation, provided that, for example, they are carried out outside the workplace, that employees are selected with an automatic selection tool, and that the dignity and confidentiality of employees are protected);
• gathering evidence through “audiovisual equipment and other instruments from which the possibility of remote control of employees’ activities arises”: according to article 4 of the Workers’ Statute, remote systems cannot be directly aimed at controlling employees’ activity, but can only be put in place for organisational, production, work safety or asset-protection needs (which may result in an indirect control over employees’ activity), and may be installed before a trade union agreement or with previous authorisation from the National Labour Inspectorate; however, these rules do not apply to working tools in an employee’s possession (see question 8) and, in any case, employees must be informed of the possibility of remote control;
• gathering physical evidence through so-called defensive controls: according to the most recent case law, “defensive controls” can be defined as investigations carried out by the company where it has a suspicion of unlawful conduct by its employees. These controls can be carried out within certain limits and restrictions provided by case law – even in the absence of the guarantees provided for in article 4 of the Workers’ Statute.

In addition, when gathering physical evidence, there may be other provisions of law not strictly related to employment law that must be followed, for example, regarding privacy regulations (eg, minimisation of the use of personal data, collection of data only for specific purposes, and adoption of safety measures).

The Swiss Federal Act on Data Protection applies to the gathering of evidence, in particular such collection must be lawful, transparent, reasonable and in good faith, and data security must be preserved.[1]

It can be derived from the duty to disclose and hand over benefits received and work produced (article 321b, Swiss Code of Obligations) as they belong to the employer.[2] The employer is, therefore, generally entitled to collect and process data connected with the end product of any work completely by an employee and associated with their business. However, it is prohibited by the Swiss Criminal Code to open a sealed document or consignment to gain knowledge of its contents without being authorised to do so (article 179 et seq, Swiss Criminal Code). Anyone who disseminates or makes use of information of which he or she has obtained knowledge by opening a sealed document or mailing not intended for him or her may become criminally liable (article 179 paragraph 1, Swiss Criminal Code).

It is advisable to state in internal regulations that the workplace might be searched as part of an internal investigation and in compliance with all applicable data protection rules if this is necessary as part of the investigation.