Workplace Investigations

According to express provisions of L.4990/2020, in principle personal data and any other information that may lead directly or indirectly to the identification of the complainant must not be disclosed to anyone other than the investigating individuals unless the complainant gives consent[4] and that is why pseudonyms should be used. The witnesses and third persons that aid the complainant are deemed as “mediators” by the Law and their contribution to the procedure should be confidential[5].

L.4808/2021 does not indicate when such disclosures are permitted; however, it is obvious that this is a matter of cost-benefit analysis where the public interest and the fundamental rights of the involved persons should be considered in a balanced way to ensure the best results. From a data protection perspective, it could be argued that the person under investigation’s right to know the identity of the complainant, witnesses or sources of information should be limited to protect the rights of these persons.

Such information can be kept confidential, subject to questions 10 and 11. However, disclosure may nevertheless be compelled in court or arbitration proceedings as well as by disclosure requests or directions by the police or statutory authorities, including the MOM.

As mentioned under Question 10, the employer’s duty of care (article 328, Swiss Code of Obligations) also entails the employer’s duty to respect and protect the personality (including confidentiality and privacy) and integrity of employees (article 328 paragraph 1, Swiss Code of Obligations) and to take appropriate measures to protect them.

However, in combination with the right to be heard and the right to be informed regarding an investigation, the accused also has the right that incriminating evidence is presented to them throughout the investigation and that they can comment on it. For instance, this right includes disclosure of the persons accusing them and their concrete statements. Anonymisation or redaction of such statements is permissible if the interests of the persons incriminating the accused or the interests of the employer override the accused’ interests to be presented with the relevant documents or statements (see question 11; see also article 9 paragraphs 1 and 4, Swiss Federal Act on Data Protection). However, a careful assessment of interests is required, and these must be limited to what is necessary. In principle, a person accusing another person must take responsibility for their information and accept criticism from the person implicated by the information provided.[1]

In principle, there is no specific obligation for investigating persons to disclose their findings. For proceedings before a court that have been initiated or investigated by the police or competent regulatory bodies, the relevant findings may be communicated under strict conditions and provided that the personal data of the parties involved are not publicly disclosed.

More specifically, under L. 4490/2022, in the context of whistleblowing procedures, personal data and any information that leads, directly or indirectly, to the identification of the complainant are not disclosed to anyone other than employees involved in the investigation, unless the complainant consents. The identity of the complainant and any other information may only be disclosed in the context of investigations by competent authorities or judicial proceedings, to the extent necessary for the protection of the employee under investigation’s rights of defence. Confidentiality obligations govern the procedure for revealing trade secrets to police and regulatory bodies, especially in the framework of L.4990/2022.

A summary of the investigation’s findings should be disclosed to the employee who lodged the grievance and the employee under investigation.

If there are parallel criminal or regulatory investigations, the investigation findings should also be disclosed to the authorities.

Interview records or transcripts should be kept private unless disclosure is required by a court order or at the direction of the authorities.

The employer is generally not required to disclose the final report, or the data obtained in connection with the investigation. In particular, the employer is not obliged to file a criminal complaint with the police or the public prosecutor's office.

Exceptions may arise, for example, from data protection law (see question 22) or a duty to release records may arise in a subsequent state proceeding.

Data voluntarily submitted in a proceeding in connection with the internal investigation shall be considered private opinion or party assertion.[1] If the company refuses to hand over the documents upon request, coercive measures may be used under certain circumstances.[2]