Workplace Investigations

Internal investigations can be initiated either upon a complaint or report by an employee, (or other persons providing services or seeking employment, etc) in the workplace or by the employer as part of their managerial right.

If from an employee, the complaint or report may fall within the scope of an internal disciplinary procedure, if any, or may concern an alleged workplace violence or harassment incident, or fall within the scope of L.4990/2022 on the protection of persons who report breaches of Union law.  

Reports by whistleblowers are submitted to the manager with responsibility for receiving and monitoring reports, a person appointed for that purpose under L.4990/2022. Complaints for incidents and harassment in the workplace can also be submitted, according to L.4808/2022, to the person or internal body specifically assigned to receive such complaints. Both laws require the employer to define the persons competent for receiving and monitoring complaints or reports and notifying the employees stricto sensu and any other persons falling within the scope of the respective provisions.

There are no legal requirements in this respect – it depends on the internal policies or practices at a given working establishment. Based on our experience – an internal investigation usually commences with a preliminary assessment of a reported irregularity. If the preliminary assessment leads to a conclusion that a reported situation may be an irregularity, an investigation is launched by appointing a commission or team that conducts the investigation or selecting an investigator. Then, a plan of investigation is established. Depending on the circumstances, the investigation plan may involve a collection of documents or files, their analysis, and interviews with a victim, witnesses or a subject (although the procedure depends on the type of case, internal rules and practice). At the end of the process, the report is prepared by the commission or team with facts established during the process, recommendations, and other suggestions as to the investigated issue.

Internal investigations are usually initiated after reports about possible violations of the employer's code of conduct, applicable laws or regulations have been submitted by employees to their superiors, the human resources department or designated internal reporting systems such as hotlines (including whistleblowing hotlines).

For an internal investigation to be initiated, there must be a reasonable suspicion (grounds).[1] If no such grounds exist, the employer must ask the informant for further or more specific information. If no grounds for reasonable suspicion exists, the case must be closed. If grounds for reasonable suspicion exist, the appropriate investigative steps can be initiated by a formal investigation request from the company management.[2]

Under the General Data Protection Regulation, employees’ personal details and information must be kept in the business records for as long as is necessary for the purposes of the employment relationship. Otherwise, stored data must be deleted. However, under L.4990/2022[14], reports remain in the relevant record for a reasonable and necessary time, and in any case until the completion of investigations or proceedings before the courts that have been initiated as a consequence of a complaint against the employee under investigation, the complainant or any third parties.

Neither Polish law nor the Draft Law specifically provide for a mandatory period during which the outcome of the investigation should be kept on the employee’s record.

At the same time, the Draft Law indicates that the register of whistleblowing reports, which should also contain information about follow-up actions undertaken as a result of the report, should be kept for 15 months starting from the end of the calendar year in which the follow-up actions have been completed, or the proceedings initiated by those actions have been terminated.

Also, while determining how long the outcome of an internal investigation should be kept, additional legal considerations can be taken into account, especially data privacy.

The GDPR does not specify precise storage time for personal data. The employer must assess what will be an appropriate time for storage of the data, taking into consideration the necessity of keeping personal data concerning the purpose of the processing in question. Employees' personal data should be kept for the period necessary for the performance of the employment relationship and may be kept for a period appropriate for the statute of limitations for claims and criminal deeds. A longer retention period may result from applicable laws. Following the Regulation of the Minister of Family, Labour and Social Policy on employee documentation, the employer may keep a copy of the notice of punishment and other documents related to the employee’s incurring of disciplinary responsibility in the employee record.

There are different retention periods for the data contained in employee files:

• 10 years if the employee was hired on or after 1 January 2019;
•  if the employment relationship began between 1 January 1999 and 1 January 2019, the retention period is 50 years, but may be reduced to 10 years if the employer provides the Polish Social Insurance Institution with certain mandatory information; and
•  for 50 years if the employee was hired before 1 January 1999. It does not matter whether the person is still working or not.

From an employment law point of view, there is no statute of limitations on the employee's violations. Based on the specific circumstances (eg, damage incurred, type of violation, basis of trust or the position of the employee), a decision must be made as to the extent to which the outcome should remain on the record.

From a data protection point of view, only data that is in the interest of the employee (eg, to issue a reference letter) may be retained during the employment relationship. In principle, stored data must be deleted after the termination of the employment relationship. Longer retention may be justified if rights are still to be safeguarded or obligations are to be fulfilled in the future (eg, data needed regarding foreseeable legal proceedings, data required to issue a reference letter or data in relation to a non-competition clause).[1]