Workplace Investigations

There is no explicit legal provision stating the whole report must be communicated with the employee under investigation. The legal framework (L.4990/2022 and L.4808/2021) is governed by strict confidentiality obligations and obligations to protect the complainant’s data. From a data protection regulation perspective, it could be argued that the right of the person under investigation to know the identity of the complainant, witnesses or sources of information should be limited to protect the rights of such persons.

However, if the outcome of the investigation leads to the imposition of disciplinary measures, the right of the employee under investigation to request the whole investigation report, to aid in their defence is enhanced. Moreover, if a complaint is made in bad faith or is unfounded, it may be supported that the employee under investigation is entitled to receive full documentation so he or she can seek adequate legal protection or file an action before the courts.

The employer is generally not obliged to share the investigation report or the findings with the employee under Hong Kong law, absent any express obligations under the employment contract.

However, according to the PDPO, the content of the investigation report or meeting minutes related to the employee (including any findings and opinions expressed in such documents) are likely to constitute the personal data of the employee under investigation. In that case, the employee may have a right under the PDPO to obtain a copy of such documents by making a statutory data access request after the workplace investigation is completed. The employer’s obligation to comply with such request is subject to certain exemptions under Part 8 of the PDPO, which include (among others) an exemption on the provision of personal data held for the prevention, preclusion or remedying of unlawful or seriously improper conduct, and the disclosure of which would be likely to prejudice the said purpose or directly or indirectly identify the person who is the source of the data.[1] Therefore, where there is a parallel criminal proceeding or investigation that has not been concluded, the employer may reject an employee’s data access request on the basis that the requested disclosure may prejudice the prevention and remedy of the unlawful conduct. Further, any information protected by legal privilege is also exempt from disclosure under Part 8 of the PDPO.[2]

If the requested documents also contain the personal data of any other third parties (such as other co-workers of the employee who have also participated in the investigation), the employer should always redact or erase such data before providing the requested documents to the employee under investigation, unless the relevant third parties have consented to the disclosure of the data.

In principle, there is no obligation to disclose the final investigation report. Disclosure obligations may arise based on data protection law vis-à-vis the persons concerned (eg, the accused). Likewise, there is no obligation to disclose other documents, such as the records of interviews. The employee should be fully informed of the final investigation report, if necessary, with certain redactions (see question 22). The right of the employee concerned to information is comprehensive (ie, all investigation files must be disclosed to him).[1] Regarding publication to other bodies outside of criminal proceedings, the employer is bound by its duty of care (article 328, Swiss Code of Obligations) and must protect the employee as far as is possible and reasonable.[2]

In principle, there is no specific obligation for investigating persons to disclose their findings. For proceedings before a court that have been initiated or investigated by the police or competent regulatory bodies, the relevant findings may be communicated under strict conditions and provided that the personal data of the parties involved are not publicly disclosed.

More specifically, under L. 4490/2022, in the context of whistleblowing procedures, personal data and any information that leads, directly or indirectly, to the identification of the complainant are not disclosed to anyone other than employees involved in the investigation, unless the complainant consents. The identity of the complainant and any other information may only be disclosed in the context of investigations by competent authorities or judicial proceedings, to the extent necessary for the protection of the employee under investigation’s rights of defence. Confidentiality obligations govern the procedure for revealing trade secrets to police and regulatory bodies, especially in the framework of L.4990/2022.

As mentioned in questions 21, 22 and 23, under Hong Kong law, the employer is generally not obliged to actively disclose the findings of a workplace investigation to any party.

Having said that, the employer should be aware of certain statutory disclosure requirements that may become applicable as a result of the matters revealed during the workplace investigation. For example, if the investigation reveals or gives rise to any knowledge or suspicion that any property represents the proceeds of an indictable offence[1], drug trafficking[2], or terrorism[3], the employer is required to report its knowledge or suspicion, together with any matter on which that knowledge or suspicion is based, to the JFIU as soon as is reasonably practicable (even where the investigation has not yet been concluded). Employers who are licensed corporations must also provide the SFC with information about whether departing licensed employees were the subject of an internal investigation in the six months prior to his/her departure. If the internal investigation commences after the departure of the licensed employee, the licensed corporation should notify the SFC as soon as practicable[4].

In any event, as in question 14, if any documents related to the investigation are protected by legal professional privilege, they can generally be kept confidential and would not be subject to disclosure even if the employer is subject to a mandatory reporting or disclosure obligation.

The employer is generally not required to disclose the final report, or the data obtained in connection with the investigation. In particular, the employer is not obliged to file a criminal complaint with the police or the public prosecutor's office.

Exceptions may arise, for example, from data protection law (see question 22) or a duty to release records may arise in a subsequent state proceeding.

Data voluntarily submitted in a proceeding in connection with the internal investigation shall be considered private opinion or party assertion.[1] If the company refuses to hand over the documents upon request, coercive measures may be used under certain circumstances.[2]