Workplace Investigations

L. 4990/2022 includes specific requirements regarding, among other things, the procedure of receiving and investigating respective reports, confidentiality issues (especially regarding the identity of the whistleblower), data protection issues (including restrictions to the right of access) and the employer’s right to keep a record of the relevant complaint and investigation. Such provisions are expected to be further detailed by Ministerial Decisions in future.

Aside from the legal obligations imposed on the company when dealing with a whistleblower who is subject to the WPA as discussed in question 1, there are also practical considerations the company should keep in mind when dealing with a whistleblower, regardless of whether the whistleblower falls under the WPA.

For example, there have been instances where an employee who raised allegations filed a complaint with Korean authorities (such as the Anti-Corruption and Civil Rights Commission (ACRC) or the Labour Office) that the company took retaliatory action against the whistleblower. The company should carefully review the legal risks before taking action, such as personnel action or civil or criminal action, against an employee who raises allegations if that employee was also involved in the wrongdoing.

If an employee complains to his or her superiors about grievances or misconduct in the workplace and is subsequently dismissed, this may constitute an unlawful termination (article 336, Swiss Code of Obligations). However, the prerequisite for this is that the employee behaves in good faith, which is not the case if he or she is (partly) responsible for the grievance.

In principle, there is no specific obligation for investigating persons to disclose their findings. For proceedings before a court that have been initiated or investigated by the police or competent regulatory bodies, the relevant findings may be communicated under strict conditions and provided that the personal data of the parties involved are not publicly disclosed.

More specifically, under L. 4490/2022, in the context of whistleblowing procedures, personal data and any information that leads, directly or indirectly, to the identification of the complainant are not disclosed to anyone other than employees involved in the investigation, unless the complainant consents. The identity of the complainant and any other information may only be disclosed in the context of investigations by competent authorities or judicial proceedings, to the extent necessary for the protection of the employee under investigation’s rights of defence. Confidentiality obligations govern the procedure for revealing trade secrets to police and regulatory bodies, especially in the framework of L.4990/2022.

There is generally no obligation to report violations to the Korean authorities, subject to limited exceptions (eg, financial institutions are required to report certain types of wrongdoing to the financial regulator; if there was a leak of an industrial technology developed through a national research and development project or a national core technology, this leak should be reported to the Ministry of Trade, Industry and Energy and the National Intelligence Service). However, even in the absence of a self-reporting obligation, the company may consider strategically deciding to make a voluntary report. For example, there have been instances where the police or prosecutors’ investigations were conducted in a more limited manner where the company filed a voluntary report and cooperated with the investigation. Also, for certain types of violations (eg, cartel activities), self-reporting to the relevant authority may entitle the company to leniency provided under the law.

In certain instances, the company may also consider reporting violations to the relevant foreign authorities, in addition to, or instead of, the Korean authorities. For example, if the company found potential violations of US law such as sanctions law or the Foreign Corrupt Practice Act, the company may want to self-report these violations to the relevant authorities such as the Office of Foreign Assets Control, or the US Department of Justice.

The employer is generally not required to disclose the final report, or the data obtained in connection with the investigation. In particular, the employer is not obliged to file a criminal complaint with the police or the public prosecutor's office.

Exceptions may arise, for example, from data protection law (see question 22) or a duty to release records may arise in a subsequent state proceeding.

Data voluntarily submitted in a proceeding in connection with the internal investigation shall be considered private opinion or party assertion.[1] If the company refuses to hand over the documents upon request, coercive measures may be used under certain circumstances.[2]