Workplace Investigations

When the employer becomes aware of possible misconduct, the employer must commence an investigation immediately, in practice within about two weeks. The information may come to the employer's knowledge via, for example, the employer's own observations, from the complainant or their colleagues or an employee representative.

Investigations can start in multiple ways. They usually stem from an employee raising a grievance, a bullying complaint, or a possible protected disclosure. Investigations may also stem from the employer in a disciplinary context, or indeed can be commenced if an external complaint or issue is raised by a third party of the organisation.

The first thing the employer must consider is whether an investigation is necessary. It may be that the issue at hand can be resolved informally or is of such a nature that it cannot be investigated, either through a lack of detail or simply because the subject of the complaint is no longer an employee. Any such decision to investigate or not should be carefully documented.

The next step to determine is the nature of the investigation. It should be clear at the outset whether the investigation is simply a fact-gathering exercise or if the investigator will be tasked with making findings on the evidence. The distinction is significant as a fact-gathering investigation can proceed without prompting the full panoply of rights, but the basic principles of fairness should still be applied. A fact-gathering investigation should determine whether there is or is not, a case to answer. If a disciplinary hearing follows then the rights outlined in question 1 will apply at that stage. If it is a fact-finding investigation, the rights apply from the outset of the process. The employee who is required to respond to the issues (the respondent) should be fully aware of the extent of the investigation. The investigator appointed to do the investigation should be clear about what is expected of them.

If the employer believes an investigation is necessary, it should be acknowledged and started without delay. In particular, according to the Protected Disclosures legislation, a report should be acknowledged within seven days.

An employer should consider and identify the scope of the investigation and establish who will investigate the matter. Terms of reference under which the investigation will be carried out should be established by the employer and shared with the employee raising the issue (the complainant). An employer should not seek agreement on the terms, but invite commentary to ensure that the full scope of the investigation is captured within the terms of reference. Robust terms of reference that lay down the clear parameters of the investigation will assist the investigator and all parties involved in the process.

Generally, the basic principles set out by the GDPR and the Finnish Data Protection Act apply to data processing in connection with investigations, including evidence gathering: there must be a legal basis for processing, personal data may only be processed and stored when and for as long as necessary considering the purposes of processing, etc.

Additionally, if physical evidence concerns the electronic communications (such as emails and online chats) of an employee, gathering evidence is subject to certain restrictions based on Finnish ePrivacy and employee privacy laws. As a general rule, an employee’s electronic communications accounts, including those provided by the employer for work purposes, may not be accessed and electronic communications may not be searched or reviewed by the employer. In practice, the employer may access such electronic correspondence only in limited situations stipulated in the Act on Protection of Privacy in Working Life (759/2004), or by obtaining case-specific consent from the employee, which is typically not possible in internal investigations, particularly concerning the employee suspected of wrongdoing.

However, monitoring data flow strictly between the employee and the employer's information systems (eg, the employee saving data to USB sticks, using printers) is allowed under Finnish legislation, provided that employee emails, chats, etc, are not accessed and monitored. If documentation is unrelated to electronic communications, it also may be reviewed by the employer. Laptops, paper archives and other similar company documentation considered "physical evidence" may be investigated while gathering evidence on the condition that any private documentation, communications, pictures or other content of an employee are not accessed.

Under the GDPR (General Data Protection Regulation), personal data must be processed lawfully, fairly and in a transparent manner in relation to the data subject. The Data Protection Commission published Data Protection in the Workplace: Employer Guidance in April 2023, which is a useful guide.

Employers should exercise caution when gathering physical evidence that may involve the use of CCTV or other surveillance practices. The Irish Court of Appeal in the case of Doolin v DPC examined the use by an employer of CCTV footage for disciplinary purposes and found such use constituted unlawful further processing. The original reason for processing the CCTV footage was to establish who was responsible for terrorist-related graffiti that was carved into a table in the staff tearoom. It subsequently transpired Mr Doolin, who was in no way connected to the graffiti incident, had accessed the tearoom for unauthorised breaks and a workplace investigation followed. The original reason for viewing the CCTV related to security, but further use of the CCTV footage in the disciplinary investigation was not related to the original reason. This case confirms that employers must have clear policies in place in compliance with both GDPR and the Data Protection Act 2018 specifying the purpose for which CCTV or any other monitoring system is being used. Not only that, but these policies must be communicated to employees specifying the use of such practices.

It is not only data about the investigation that must be processed fairly, but any retention of the data, which can only be further processed with good reason. It is a legitimate business reason to retain data to deal with any subsequent requests or appeals under various internal or statutory processes, provided employees have been advised of the relevant retention period.