Workplace Investigations

Confidentiality applies as a general principle in disciplinary investigations.

Moreover, L. 4990/2022, which transposed EU Directive 2019/1937 into Greek Law, regulates the issue of confidentiality during investigations that start based on an internal report. The managers conducting the investigation must respect and abide by the rules of confidentiality regarding the information they have become aware of when exercising their duties[1]. They must also protect the complainant’s and any third party’s (referred to in the report) confidentiality by preventing unauthorised persons from accessing the report[2].

Finally, L. 4808/2021 provides that employers must create a procedure that should be communicated to employees regarding all the necessary steps of an investigation following a complaint. Throughout the whole process, the employer, managers and the employer’s representatives responsible for the investigation must respect and abide by the rules of confidentiality in a manner that safeguards the dignity and personal data of the complainant and the person under investigation[3].

This will depend on the nature of the investigation but, generally, investigations should be conducted on a confidential basis. All who participate in the investigation should be informed and reminded that confidentiality is a paramount consideration taken very seriously. However, it should be borne in mind that confidentiality cannot be guaranteed by an employer as the respondent in an investigation is entitled to know who has made complaints against them. Furthermore, the respondent is entitled to cross-examine the complainant and any witnesses, although in practice this right is rarely invoked strictly and is facilitated by the investigator, with questions from the respondent being put to the complainant and other witnesses.

On occasion, a breach of confidentiality may warrant disciplinary action, but this will depend on the circumstances. Exceptions to the requirement to keep matters confidential will of course apply where employees seek support and advice from others such as companions, trade union representatives or legal advisors. It may also not be possible to maintain confidentiality where regulators or the authorities are informed of the investigation.

Also, confidentiality may not be maintained if it is in the interests of the employer to communicate the complaint and any subsequent investigation, for example on a health and safety basis.

The law does not cover this issue, apart from whistleblower regulations, as it should be regulated by the employer in their internal rules. The employer should ensure all participants of the investigation keep information related to it secret, as long as is necessary for the investigation (or even longer, if required by law concerning personal data or other specially protected information). Reputation, personal data and the personal rights of other people cannot be breached during the proceedings and this should be protected.

Moreover, according to the Draft Law – a whistleblower’s personal data should be kept confidential. It can only be disclosed if law enforcement authorities require it. Also, confidentiality should be guaranteed for the subject and other interested persons.

Besides the employee's duty of performance (article 319, Swiss Code of Obligations), the employment relationship is defined by the employer's duty of care (article 328, Swiss Code of Obligations) and the employee's duty of loyalty (article 321a, Swiss Code of Obligations). Ancillary duties can be derived from the two duties, which are of importance for the confidentiality of an internal investigation.[1]

In principle, the employer must respect and protect the personality (including confidentiality and privacy) and integrity of the employee (article 328 paragraph 1, Swiss Code of Obligations) and take appropriate measures to protect the employee. Because of the danger of pre-judgment or damage to reputation as well as other adverse consequences, the employer must conduct an internal investigation discreetly and objectively. The limits of the duty of care are found in the legitimate self-interest of the employer.[2]

In return for the employer's duty of care, employees must comply with their duty of loyalty and safeguard the employer's legitimate interests. In connection with an internal investigation, employees must therefore keep the conduct of an investigation confidential. Additionally, employees must keep confidential and not disclose to any third party any facts that they have acquired in the course of the employment relationship, and which are neither obvious nor publicly accessible.[3]

There is no explicit legal provision stating the whole report must be communicated with the employee under investigation. The legal framework (L.4990/2022 and L.4808/2021) is governed by strict confidentiality obligations and obligations to protect the complainant’s data. From a data protection regulation perspective, it could be argued that the right of the person under investigation to know the identity of the complainant, witnesses or sources of information should be limited to protect the rights of such persons.

However, if the outcome of the investigation leads to the imposition of disciplinary measures, the right of the employee under investigation to request the whole investigation report, to aid in their defence is enhanced. Moreover, if a complaint is made in bad faith or is unfounded, it may be supported that the employee under investigation is entitled to receive full documentation so he or she can seek adequate legal protection or file an action before the courts.

The investigation report should be shared in full, unless there is some specific reason for not doing so. One example is where there is a possibility of a criminal investigation; in that instance, it may be appropriate not to share the full report. Occasionally, there may be several respondents involved in the complaint, and each respondent may only be entitled to the report that relates to them.

It does not need to be shared with the employees at all. It may be shared only to the extent such a disclosure will not violate any law, including personal data protection law or personal rights.

In principle, there is no obligation to disclose the final investigation report. Disclosure obligations may arise based on data protection law vis-à-vis the persons concerned (eg, the accused). Likewise, there is no obligation to disclose other documents, such as the records of interviews. The employee should be fully informed of the final investigation report, if necessary, with certain redactions (see question 22). The right of the employee concerned to information is comprehensive (ie, all investigation files must be disclosed to him).[1] Regarding publication to other bodies outside of criminal proceedings, the employer is bound by its duty of care (article 328, Swiss Code of Obligations) and must protect the employee as far as is possible and reasonable.[2]