Workplace Investigations

Generally, the basic principles set out by the GDPR and the Finnish Data Protection Act apply to data processing in connection with investigations, including evidence gathering: there must be a legal basis for processing, personal data may only be processed and stored when and for as long as necessary considering the purposes of processing, etc.

Additionally, if physical evidence concerns the electronic communications (such as emails and online chats) of an employee, gathering evidence is subject to certain restrictions based on Finnish ePrivacy and employee privacy laws. As a general rule, an employee’s electronic communications accounts, including those provided by the employer for work purposes, may not be accessed and electronic communications may not be searched or reviewed by the employer. In practice, the employer may access such electronic correspondence only in limited situations stipulated in the Act on Protection of Privacy in Working Life (759/2004), or by obtaining case-specific consent from the employee, which is typically not possible in internal investigations, particularly concerning the employee suspected of wrongdoing.

However, monitoring data flow strictly between the employee and the employer's information systems (eg, the employee saving data to USB sticks, using printers) is allowed under Finnish legislation, provided that employee emails, chats, etc, are not accessed and monitored. If documentation is unrelated to electronic communications, it also may be reviewed by the employer. Laptops, paper archives and other similar company documentation considered "physical evidence" may be investigated while gathering evidence on the condition that any private documentation, communications, pictures or other content of an employee are not accessed.

Under the GDPR (General Data Protection Regulation), personal data must be processed lawfully, fairly and in a transparent manner in relation to the data subject. The Data Protection Commission published Data Protection in the Workplace: Employer Guidance in April 2023, which is a useful guide.

Employers should exercise caution when gathering physical evidence that may involve the use of CCTV or other surveillance practices. The Irish Court of Appeal in the case of Doolin v DPC examined the use by an employer of CCTV footage for disciplinary purposes and found such use constituted unlawful further processing. The original reason for processing the CCTV footage was to establish who was responsible for terrorist-related graffiti that was carved into a table in the staff tearoom. It subsequently transpired Mr Doolin, who was in no way connected to the graffiti incident, had accessed the tearoom for unauthorised breaks and a workplace investigation followed. The original reason for viewing the CCTV related to security, but further use of the CCTV footage in the disciplinary investigation was not related to the original reason. This case confirms that employers must have clear policies in place in compliance with both GDPR and the Data Protection Act 2018 specifying the purpose for which CCTV or any other monitoring system is being used. Not only that, but these policies must be communicated to employees specifying the use of such practices.

It is not only data about the investigation that must be processed fairly, but any retention of the data, which can only be further processed with good reason. It is a legitimate business reason to retain data to deal with any subsequent requests or appeals under various internal or statutory processes, provided employees have been advised of the relevant retention period.

In respect of data protection, the processing of personal data in whistleblowing systems is considered by the Finnish Data Protection Ombudsman (DPO) as requiring a data protection impact assessment (DPIA).

Most whistleblowing policies will include a section that provides for an initial assessment of the complaint as to whether it meets the definition of a protected disclosure. This assessment, which ought to be carried out by a designated person who has been appointed to deal with disclosures, is a useful tool as some matters which may be labelled as whistleblowing may fall under the grievance procedure.

Where there are grounds, an investigation will be commenced. Under the Protected Disclosures (Amendment) Act 2022, whistleblowers are protected from penalisation for having made a protected disclosure, under the Act.

Penalisation may include; suspension, lay-off or dismissal; demotion, loss of opportunity for promotion or withholding of promotion; transfer of duties, change of location or place of work; reduction in wages or change in working hours; the imposition or administering of any discipline, reprimand or other penalty (including a financial penalty); coercion, intimidation, harassment or ostracism; or discrimination, disadvantage or unfair treatment.

If an employee (which includes trainees, volunteers, and job applicants) alleges that they have suffered penalisation as a result of making a protected disclosure, they may apply to the Circuit Court for interim relief within 21 days of the date of the last act of penalisation by the employer.

A claim for penalisation may also be brought before the WRC within six months of the alleged act of penalisation. If an employee alleges that they were dismissed for having made a protected disclosure, the potential award that the WRC can make increases from the usual unfair dismissal cap of two years’ pay to up to five years’ gross pay, based on actual loss.

Where a complaint of whistleblowing is made, employers should ensure that they appoint investigators with the appropriate knowledge and expertise to deal with such a matter and comply with the time limits set by legislation.