Workplace Investigations
Contributing Editors
Workplace investigations are growing in number, size and complexity. Employers are under greater scrutiny as of the importance of ESG rises. Regulated industries such as finance, healthcare and legal face additional hurdles, but public scrutiny of businesses and how they treat their people across the board has never been higher. Conducting a fair and thorough workplace investigation is therefore critical to the optimal operation, governance and legal exposure of every business.
IEL’s Guide to Workplace Investigations examines key issues that organisations need to consider as they initiate, conduct and conclude investigations in 29 major jurisdictions around the world.
Learn more about the response taken in specific countries or build your own report to compare approaches taken around the world.
Choose countries
Choose questions
Choose the questions you would like answering, or choose all for the full picture.
07. What data protection or other regulations apply when gathering physical evidence?
07. What data protection or other regulations apply when gathering physical evidence?
Greece
Greece
- at Karatzas & Partners
- at Karatzas & Partners
- at Karatzas & Partners
- at Karatzas & Partners
GDPR and the provisions of L. 4624/2019 regulate the gathering of physical evidence from a data protection perspective, providing, among other things, that personal data should be processed with transparency and to the extent necessary for the investigation.
L.4990/2022 on the protection of persons who report breaches of Union law regulates data protection issues in the context of whistleblowing investigations, mainly to safeguard confidentiality throughout the investigations.
Netherlands
Netherlands
- at De Brauw Blackstone Westbroek
- at De Brauw Blackstone Westbroek
- at De Brauw Blackstone Westbroek
Dutch data protection rules are based on the EU Data Protection Directive. The employer has to notify the Dutch Data Protection Authority when processing personal data as part of an internal investigation. Given that the notification can be accessed publicly, it is recommended that the employer give a sufficiently high-level description of the case. In addition, the description should be sufficiently broad to include the entire investigation, and any future expansions of the scope of the investigation. Often companies make filings for all future internal investigations, without referring to specific matters.
The employer has to notify employees whose personal data is being processed about – among other things – the purposes of the investigation and any other relevant information. According to the Dutch Data Protection Act, this information obligation may only be suspended on restricted grounds, i.e. if the purpose of the investigation is the prevention, detection and prosecution of crimes and postponement is necessary for the interests of the investigation (e.g., because there is a risk of losing evidence, or collusion by individuals coordinating responses before being interviewed)). These exceptions on the duty to inform involved persons must be interpreted very restrictively. As soon as the reason for postponement is no longer applicable (e.g., because the evidence has been secured), the individuals need to be informed.
Dutch data protection law does not require the consent of employees. Consent given by employees, however, also cannot compensate for a lack of legitimate purpose or unnecessary or disproportionate data processing, as the consent given by an employee to its employer is not considered to be voluntary given the inequality of power between them.
Furthermore, internal company policies may contain specific data protection rules.
Switzerland
Switzerland
- at Bär & Karrer
- at Bär & Karrer
The Swiss Federal Act on Data Protection applies to the gathering of evidence, in particular such collection must be lawful, transparent, reasonable and in good faith, and data security must be preserved.[1]
It can be derived from the duty to disclose and hand over benefits received and work produced (article 321b, Swiss Code of Obligations) as they belong to the employer.[2] The employer is, therefore, generally entitled to collect and process data connected with the end product of any work completely by an employee and associated with their business. However, it is prohibited by the Swiss Criminal Code to open a sealed document or consignment to gain knowledge of its contents without being authorised to do so (article 179 et seq, Swiss Criminal Code). Anyone who disseminates or makes use of information of which he or she has obtained knowledge by opening a sealed document or mailing not intended for him or her may become criminally liable (article 179 paragraph 1, Swiss Criminal Code).
It is advisable to state in internal regulations that the workplace might be searched as part of an internal investigation and in compliance with all applicable data protection rules if this is necessary as part of the investigation.
22. What must the employee under investigation be told about the outcome of an investigation?
22. What must the employee under investigation be told about the outcome of an investigation?
Greece
Greece
- at Karatzas & Partners
- at Karatzas & Partners
- at Karatzas & Partners
- at Karatzas & Partners
The employer has an obligation, towards the alleged victim but also the alleged perpetrator, to carefully investigate the report and any existing evidence before making decisions. The employee under investigation must be informed about the outcome of the procedure and any measures adopted in this regard. The respective decision must have due justification.
Netherlands
Netherlands
- at De Brauw Blackstone Westbroek
- at De Brauw Blackstone Westbroek
- at De Brauw Blackstone Westbroek
There are no statutory requirements as to employee feedback in internal investigations. The principle of due care requires an employer to typically confront implicated persons with any allegations that concern them; and provide a draft report on their interviews for feedback, if the investigative findings will form the basis of disciplinary measures. It is good practice to also inform an employee under investigation once the investigation is closed.
Switzerland
Switzerland
- at Bär & Karrer
- at Bär & Karrer
Workplace investigations often result in an investigation report that is intended to serve as the basis for any measures to be taken by the company's decisionmakers.
The employee's right to information based on article 8, Swiss Federal Act on Data Protection also covers the investigation report, provided that the report and the data contained therein relate to the employee.[1] In principle, the employee concerned is entitled to receive a written copy of the entire investigation report free of charge (article 8 paragraph 5, Swiss Federal Act on Data Protection and article 1 et seq, Ordinance to the Federal Act on Data Protection). Redactions may be made where the interests of the company or third parties so require, but they are the exception and must be kept to a minimum.[2]