Workplace Investigations

Here, the investigation “collides” with the right to privacy of the persons involved.

First, the rules and principles of the GDPR will apply if personal data is involved. Therefore, the employer will have to find a data-processing ground, which could be his or her legitimate interest or the fact that the investigation could lead to legal proceedings, etc. The data processing should also be limited to what is proportionate and the data subjects should be informed. Due to this obligation, it is arguable that the GDPR policy already provides the necessary information for the employees not to jeopardise the investigation. In any case, data subjects should not be able to use their right to access data to ascertain the preliminary findings of the investigation (which are confidential) or any confidential identities involved (eg, in the whistleblower procedure, the identity of the report should be protected at all times).

Also, the employer should follow the procedure of Collective Bargaining Agreement No. 81 on searching the e-mails or computer files and internet searches of employees. This CBA limits the purposes for searches and lays down a double-phase procedure that needs to be followed if private data is involved. Next to this, the employer should also take into account the case law of the European Court of Human Rights, which only allows e-mail and computer searches based on the following:

• whether the employee has been notified of the possibility that the employer might take measures to monitor correspondence and the implementation of such measures;
• the extent of the monitoring and the degree of intrusion into the employee’s privacy (including a distinction between the monitoring of the flow or the content of the communications);
• whether the employer has provided legitimate reasons to justify monitoring of the communications and accessing of their actual content; and
• whether it would have been possible to establish a monitoring system based on less intrusive measures, the consequences of the monitoring for the employee who is subject to it, and whether the employee had been provided with adequate safeguards.

Next, if the employer wants to use camera images, the rules of Collective Bargaining Agreement No. 68 should have been followed when installing cameras. If not, the images might have been collected illegally.

Generally, the basic principles set out by the GDPR and the Finnish Data Protection Act apply to data processing in connection with investigations, including evidence gathering: there must be a legal basis for processing, personal data may only be processed and stored when and for as long as necessary considering the purposes of processing, etc.

Additionally, if physical evidence concerns the electronic communications (such as emails and online chats) of an employee, gathering evidence is subject to certain restrictions based on Finnish ePrivacy and employee privacy laws. As a general rule, an employee’s electronic communications accounts, including those provided by the employer for work purposes, may not be accessed and electronic communications may not be searched or reviewed by the employer. In practice, the employer may access such electronic correspondence only in limited situations stipulated in the Act on Protection of Privacy in Working Life (759/2004), or by obtaining case-specific consent from the employee, which is typically not possible in internal investigations, particularly concerning the employee suspected of wrongdoing.

However, monitoring data flow strictly between the employee and the employer's information systems (eg, the employee saving data to USB sticks, using printers) is allowed under Finnish legislation, provided that employee emails, chats, etc, are not accessed and monitored. If documentation is unrelated to electronic communications, it also may be reviewed by the employer. Laptops, paper archives and other similar company documentation considered "physical evidence" may be investigated while gathering evidence on the condition that any private documentation, communications, pictures or other content of an employee are not accessed.

If the investigation leads to the establishment of grave errors by the employee, this can lead to sanctions. The employer must follow the procedure laid down in the internal work rules of the company and can only impose sanctions that are included in the internal work rules. In general, these are: a verbal warning; a written warning; a suspension (remunerated or not); a fine (capped to one-fifth of daily remuneration); and dismissal. If there are very serious errors leading to an immediate inability to continue the employment relationship with the employee, the employer can dismiss the employee with urgent cause without any notice period or indemnity in lieu of notice (following the specific procedure for these types of dismissals). In less serious cases, the employer could still dismiss the employee with a notice period or indemnity in lieu of notice. In principle, the employer has a right to dismiss the employee, even if this sanction is not included in the internal work rules.

As said previously, disciplinary sanctions (included in the internal work rules) must be communicated to the sanctioned employee the day after the employer or his delegate has established fault. The sanction must be registered in a sanction register, with the name of the employee, the date, the reason and the nature of the sanction. If there is a fine, the amount of the fine should be mentioned. The proceeds of the fines must be used for the benefit of employees. Where a works council exists, the use of the proceeds of the fines must be determined after consultation with it.

The employer decides whether misconduct has taken place or not. Depending on the case, the employer may recommend a workplace conciliation in which the parties try to find a solution that can be accepted by both sides. The employer may choose to give an oral reprimand or a written warning. If the legal conditions are met, the employer may also terminate the employment agreement.