Workplace Investigations

GDPR and the provisions of L. 4624/2019 regulate the gathering of physical evidence from a data protection perspective, providing, among other things, that personal data should be processed with transparency and to the extent necessary for the investigation.

L.4990/2022 on the protection of persons who report breaches of Union law regulates data protection issues in the context of whistleblowing investigations, mainly to safeguard confidentiality throughout the investigations.  

The Swiss Federal Act on Data Protection applies to the gathering of evidence, in particular such collection must be lawful, transparent, reasonable and in good faith, and data security must be preserved.[1]

It can be derived from the duty to disclose and hand over benefits received and work produced (article 321b, Swiss Code of Obligations) as they belong to the employer.[2] The employer is, therefore, generally entitled to collect and process data connected with the end product of any work completely by an employee and associated with their business. However, it is prohibited by the Swiss Criminal Code to open a sealed document or consignment to gain knowledge of its contents without being authorised to do so (article 179 et seq, Swiss Criminal Code). Anyone who disseminates or makes use of information of which he or she has obtained knowledge by opening a sealed document or mailing not intended for him or her may become criminally liable (article 179 paragraph 1, Swiss Criminal Code).

It is advisable to state in internal regulations that the workplace might be searched as part of an internal investigation and in compliance with all applicable data protection rules if this is necessary as part of the investigation.

Most forms of workplace surveillance involve the processing of personal data that is regulated by the UK GDPR and DPA 2018. The UK GDPR requires that personal data must be processed lawfully, fairly and in a transparent manner; it also must be adequate, relevant and limited to what is necessary concerning the purposes for which it is processed.

Employers should ensure that they have undertaken a data protection impact assessment (DPIA) to document the lawful basis for processing data, and informed employees that their files may be searched before proceeding. They should also ideally have a clear policy on the use of electronic communications systems, detailing when, how and for what purpose they may be monitored by the employer. In Q3 2023 the ICO produced new guidance on monitoring workers (https://ico.org.uk/for-organisations/uk-gdpr-guidance-and-resources/employment/monitoring-workers/) and on email and security (https://ico.org.uk/for-organisations/uk-gdpr-guidance-and-resources/security/email-and-security/) which employers should bear in mind during investigations. Employers should also be prepared to make the data collected through employee monitoring available to employees, should the employee submit a data subject access request under the DPA 2018.

The IPA 2016 makes it unlawful in certain circumstances to intercept a communication (such as one on an employer’s telephone or computer network) in the course of its transmission in the UK. The IPA Regs 2018 set out the circumstances where, in a business context, such interception will be lawful. These include monitoring or recording communications without consent to: establish the existence of facts; ascertain compliance with the regulatory or self-regulatory practices or procedures relevant to the business; ascertain or demonstrate standards which are or ought to be achieved by persons using the system; and prevent or detect crime.

Covert surveillance can lead to a breach of an employee's right to privacy under the HRA 1998. The employer will need to consider if covert surveillance is proportionate, which will depend on the facts of each case. Employers should be careful not to use the investigation as an excuse to undertake a "fishing expedition", and should avoid gathering material that is obviously personal, such as private messages and diary entries (see question 8).

According to L.4990/2022, any form of retaliation against complainants is prohibited, including threats of retaliation[9]. The complainants have the right to cost-free legal advice about possible acts of retaliation as well as cost-free provision of psychological support (to be defined by Ministerial Decisions)[10]. In terms of other types of support, the complainants are not in principle liable for the acquisition of information or releasing the information they reported under specific conditions (eg, the acquisition or access does not independently constitute a criminal offence, if they had reasonable grounds for believing that a report was necessary to reveal the violation)[11].

L. 4808/2021 states that the dismissal or termination of the legal relationship of employment and any other discrimination that constitutes an act of revenge or retaliation is prohibited and invalid[12].

The employer does not generally need to provide specific support for employees that are subject to an internal investigation. The employer may, however, allow concerned employees to be accompanied by a trusted third party such as family members or friends.[1] These third parties will need to sign separate non-disclosure agreements before being involved in the internal investigation.

In addition, a company may appoint a so-called lawyer of confidence who has been approved by the employer and is thus subject to professional secrecy. This lawyer will not be involved in the internal investigation but may look after the concerned employees and give them confidential advice as well as inform them about their rights and obligations arising from the employment relationship.[2]

The employer needs to consider the health and wellbeing of all staff involved in the investigation, since this can be a very stressful process. The employer and investigator can assist by ensuring that all parties are aware of what is expected of them. Timings are also important; having a clear and expeditious timetable and providing updates if the timetable slips will help. Regular catch-ups by managers can be used to monitor how employees are coping. They should be reminded about any resources to help support them, such as employee helplines or employee assistance programmes.

Where an employer has particular concerns about an employee’s health, a referral to occupational health can assist. The employer may also wish to consider whether employees should be given additional time off, or whether any other adjustments can be made to the investigation process. For particularly serious allegations, the employer may consider facilitating the provision of independent legal advice for the employee, or making a contribution towards legal fees.