Workplace Investigations

In respect of data protection, the processing of personal data in whistleblowing systems is considered by the Finnish Data Protection Ombudsman (DPO) as requiring a data protection impact assessment (DPIA).

The employer should first identify which individuals may have protection as whistleblowers. This could be a current or former employee who raises the initial complaint, a co-worker who gives evidence as part of the investigation, or the accused employee.

In each case, consider whether a “protected disclosure” has been made (under Part IVA ERA 1996). This requires analysis of the subject matter of the disclosure, how it is made, and a reasonable belief that it is made in the public interest.

Employers must then ensure there is no detrimental treatment or dismissal of any worker on the grounds of their protected disclosure. Although the causation test for these purposes is not straightforward, as a general rule if the protected disclosure has a “material influence” on the decision to discipline or dismiss, there may be liability. Individual managers may be personally liable alongside the employer. Compensation for whistleblowing cases is uncapped, meaning businesses and individuals can face significant financial and reputational exposure.

What this means in practical terms is that the employer should promote a “speak-up” culture and, where protected disclosures are made, ensure they are handled by a team who are properly trained in how to do so.

Concerning a workplace investigation, there is no specific legislation in force at the moment regarding confidentiality obligations. All normal legal confidentiality obligations (eg, obligations outlined in the Trade Secrets Act (595/2018)), and if using an external investigator, the confidentiality obligations outlined in the agreement between the employer and the external investigator, apply. Attorneys-at-law always have strict confidentiality obligations as per the Advocates Act (496/1958).

Workplace investigations should usually be conducted on a confidential basis, so that only those involved in the investigation are aware of its existence and subject matter. The need to maintain confidentiality about both the fact of the investigation, and any content discussed with an investigator, should be emphasised to all those involved. It may also be necessary to explain that a breach of confidentiality could be viewed as a disciplinary matter. Appropriate exceptions must, however, be made to allow employees to speak to any relevant employee or trade union representative, legal adviser and potentially the police or other regulators. Confidentiality provisions cannot override the rights of workers to make protected disclosures (see question 9).

In some situations, such as those involving a wide-ranging investigation into the organisation’s working practices and culture, it may be more appropriate to investigate a more “open” basis, and inform employees and other stakeholders.