Workplace Investigations

Regarding L.4990/2022 for whistleblowers’ procedures, many categories of privilege may occur during an investigation, such as: attorney-client privilege; doctor-patient privilege; and court or other proceedings’ privilege deemed as classified. L.4990/2022 provides that its provisions do not affect any of these privileges and these privileges supersede[6].

Privilege may also be attached to investigation materials in investigations relating to workplace harassment and violence incidents; however, since L.4808/2021 does not offer a specific provision and criminal proceedings may also commence, the matter of privilege must be examined ad hoc.

Professional advice given by an "advocate" to a client is protected as “privileged communication” and is not admissible as evidence in a court of law. Such privilege may not attach to advice or communications involving in-house lawyers as they are not licensed advocates (since they are expected to surrender their bar licences when they take on in-house roles). This is a grey area as there are conflicting judicial precedents on this. Hence, communications, documents or information gathered during an investigation conducted entirely internally may not be legally privileged and may be discoverable in a dispute. That said, companies generally mark sensitive communications with in-house attorneys as privileged and confidential in an attempt to protect the same.

For the above reasons, investigations conducted by external advocates have better chances of retaining legal privilege. However, the following will not be treated as privileged information:

• any correspondence about the commission of a crime or fraud by the client; and
• the observations of an attorney that would suggest that a crime or fraud will be committed by the client.

As outlined above, all employees generally have the right to know whether and what personal data is being or has been processed about them (article 8 paragraph 1, Swiss Federal Act on Data Protection; article 328b, Swiss Code of Obligations).

The employer may refuse, restrict or postpone the disclosure or inspection of internal investigation documents if a legal statute so provides, if such action is necessary because of overriding third-party interests (article 9 paragraph 1, Swiss Federal Act on Data Protection) or if the request for information is manifestly unfounded or malicious. Furthermore, a restriction is possible if overriding the self-interests of the responsible company requires such a measure and it also does not disclose the personal data to third parties. The employer or responsible party must justify its decision (article 9 paragraph 5, Swiss Federal Act on Data Protection).[1]

The scope of the disclosure of information must, therefore, be determined by carefully weighing the interests of all parties involved in the internal investigation.

Under the General Data Protection Regulation, employees’ personal details and information must be kept in the business records for as long as is necessary for the purposes of the employment relationship. Otherwise, stored data must be deleted. However, under L.4990/2022[14], reports remain in the relevant record for a reasonable and necessary time, and in any case until the completion of investigations or proceedings before the courts that have been initiated as a consequence of a complaint against the employee under investigation, the complainant or any third parties.

There is no statutory guidance on this. It is common for employers to retain details of disciplinary proceedings on an employee's record for the entire duration of their employment.

It is also advisable to retain the details of any investigations or disciplinary proceedings for at least three years after an individual has been dismissed on account of such proceedings, as this is the general limitation period for raising claims of unfair dismissal. In labour matters, courts in India often allow delays in filing suit after the limitation period, meaning organisations sometimes make a practical call to retain details of investigations and disciplinary proceedings for longer.

From an employment law point of view, there is no statute of limitations on the employee's violations. Based on the specific circumstances (eg, damage incurred, type of violation, basis of trust or the position of the employee), a decision must be made as to the extent to which the outcome should remain on the record.

From a data protection point of view, only data that is in the interest of the employee (eg, to issue a reference letter) may be retained during the employment relationship. In principle, stored data must be deleted after the termination of the employment relationship. Longer retention may be justified if rights are still to be safeguarded or obligations are to be fulfilled in the future (eg, data needed regarding foreseeable legal proceedings, data required to issue a reference letter or data in relation to a non-competition clause).[1]