Workplace Investigations

If any matter unrelated to this investigation is revealed during the investigation and the matter is suspected of violating regulations, the employer may comprehensively consider whether it is necessary to investigate the new matter. If the employer assesses that a combined investigation will seriously affect and hinder the progress of the investigation or complicate the investigation, the employer can handle the unrelated matters through separate investigations.

In addition, Article 6 of the Personal Information Protection Law of the PRC requires that the processing of personal information shall be for a specific and reasonable purpose and shall be directly related to the purpose of the processing and shall adopt the method with minimum impact on individuals' rights and interests. If the result of the investigation reveals unrelated personal information, it means that the collection and storage of such personal information are unrelated to the purpose of the processing. According to paragraph 1 of Article 47 of the Personal Information Protection Law of the PRC, the employer as the personal information processor shall take the initiative to delete personal information. If the employer fails to delete such information, the employee is entitled to request for deletion.

If any unrelated matters are revealed as a result of an investigation and are of legal importance, the applicable legal provisions must be implemented and any relevant policies or agreements between the involved parties should be taken into account. For example, if the reporting procedure sheds light on other criminal acts, criminal law procedure may be followed if the matter is reported to the competent authorities.

If these unrelated matters fall under the ambit of another company’s policies, the relevant procedures may also be followed separately. However, the employee under investigation must be allowed to defend him or herself, otherwise he or she may raise complaints relating to the procedural guarantees of the investigation.

There are no regulations in this regard in the Swiss employment law framework. However, in criminal proceedings, the rules regarding accidental findings apply (eg, article 243, Swiss Criminal Procedure Code for searches and examinations or article 278, Swiss Criminal Procedure Code for surveillance of post and telecommunications). In principle, accidental findings are usable, with the caveat of general prohibitions on the use of evidence.

The relevant laws and regulations in the PRC have not clarified the retention period of the investigation findings. According to Article 19 of the Personal Information Protection Law of the PRC, unless otherwise required by laws or administrative regulations, the retention period of personal information shall be the shortest period necessary to achieve the purpose of handling the information. Since the employee's personal information is very likely to be involved in the investigation findings, such report should be retained for the shortest period necessary to achieve the purpose of handling the information. In general, once the investigation is completed, the purpose of the internal investigation has been achieved or it is no longer necessary to achieve the purpose, and the employer may, in accordance with Article 22 of the Administrative Regulations of the PRC on Network Data Security (Draft for Comments), delete or anonymize the personal information within fifteen (15) working days. If it is technically difficult to delete the personal information, or it is difficult to do so within fifteen (15) working days due to business complexity or other reasons, the employer shall not conduct any processing other than storing the personal information and adopting necessary security measures, and shall give reasonable explanations to the employee.

Under the General Data Protection Regulation, employees’ personal details and information must be kept in the business records for as long as is necessary for the purposes of the employment relationship. Otherwise, stored data must be deleted. However, under L.4990/2022[14], reports remain in the relevant record for a reasonable and necessary time, and in any case until the completion of investigations or proceedings before the courts that have been initiated as a consequence of a complaint against the employee under investigation, the complainant or any third parties.

From an employment law point of view, there is no statute of limitations on the employee's violations. Based on the specific circumstances (eg, damage incurred, type of violation, basis of trust or the position of the employee), a decision must be made as to the extent to which the outcome should remain on the record.

From a data protection point of view, only data that is in the interest of the employee (eg, to issue a reference letter) may be retained during the employment relationship. In principle, stored data must be deleted after the termination of the employment relationship. Longer retention may be justified if rights are still to be safeguarded or obligations are to be fulfilled in the future (eg, data needed regarding foreseeable legal proceedings, data required to issue a reference letter or data in relation to a non-competition clause).[1]