Workplace Investigations

There is no specific legislation regarding a workplace investigation. In general, an employer has the right to investigate incidents at the workplace based on their authority over employees. However, the investigative powers of the employer are among others limited by the general right to privacy, which is also enshrined in Collective Bargaining Agreement No. 81 of 26 April 2002 to protect the privacy of employees concerning the control of electronic online data. If there are official complaints by employees due to sexual harassment, bullying or violence at work,  well-being legislation provides a specific procedure. Also, upcoming whistleblower rules include some specifications for an investigation, but at the time of publication these are not yet final (we refer to is in more detail below). The information below is only valid for workplace investigations in the private sector. The public sector has a set of specific rules and principles, which are outside the scope of this chapter.

Mainly, the Occupational Safety and Health Act (738/2002). In addition, the following also have relevance in connection to a workplace investigation: the Employment Contracts Act (55/2001), the Criminal Code (39/1889), the Act on Occupational Safety and Health Enforcement and Cooperation on Occupational Safety and Health at Workplaces (44/2006), the Act on Equality between Women and Men (609/1986) and the Non-discrimination Act (1325/2014). In addition, the employer's own policies must be taken into consideration while conducting a workplace investigation.

First, the employer should appoint an investigator or investigative team that will be responsible for conducting the investigation. Next, the employer or the investigators might think about communicating with the involved employees. It depends on the situation if this is a good idea or not. In general, it can be recommended that the employer is transparent towards the involved employees and openly communicates about the (start of the) investigation process. This is definitively the case if it is already clear that the involved employees are under scrutiny because of their actions. In this case, the actual investigation can begin with a hearing of the involved employees. However, if there is a risk that employees will hide or destroy evidence or will collude to prevent the employer from finding the truth, the investigation can also start without any communication. In this case, it would be better to start collecting evidence before hearing from the employees involved.

When the employer becomes aware of possible misconduct, the employer must commence an investigation immediately, in practice within about two weeks. The information may come to the employer's knowledge via, for example, the employer's own observations, from the complainant or their colleagues or an employee representative.

In principle, you cannot unilaterally suspend an employee during a workplace investigation, as there is a risk of constructive dismissal (ie, wrongful termination of the employment contract by the unilateral modification of one of its essential elements). Consequences could include the payment of an indemnity in lieu of notice based on seniority as foreseen by the Employment Contracts Act, plus possible damages (three to 17 weeks remuneration if an unreasonable dismissal, plus alternative or additional damages based on real prejudice suffered). The parties can nevertheless agree on a suspension of the employment contract. In this scenario, the remuneration will still have to be paid. Furthermore, a suspension could be a sanction that follows the outcome of the investigation, but even then it will only be possible for a limited time (and a suspension without pay is usually only allowed by the courts for a maximum of three days). However, if the complaint is about sexual harassment, bullying or violence at work, the prevention advisor (see question 4) can recommend that the employer take certain actions, which in grave circumstances could lead to employee suspension. The suspended employee should continue to receive his pay if this occurs.

There is no legislation on temporary suspension in the event of a workplace investigation or similar. In some situations, the employer may relieve the employee from their working obligation with pay for a short period.

In general, there are no legal minimum qualifications, the employer can delegate the investigation task to anyone. Of course, it is strongly recommended to appoint someone who is not involved in the case and who can lead the investigation objectively with the necessary authority to take investigative measures.

However, in the specific case of an official complaint due to sexual harassment, violence or bullying at work, the investigation will be conducted by the prevention advisor for psychosocial aspects. Next, if the investigation is based on an internal whistleblowing report, there will have to be an independent reporting manager responsible for receiving the report, giving feedback to the whistleblower and ensuring a decent follow-up to the report. Logically, the reporting manager will lead the investigation in this case, but he can be assisted by other persons or a team who are bound by a duty of confidentiality.

The employer must conduct the investigation, but the actual work can be done either by the employer's personnel or by an external investigator, for example, a law firm. Either way, there are no formal criteria for the persons executing the investigation; however, impartiality is required from the person conducting the investigation

This is only possible if the employee claims that his or her rights (eg, the right to privacy) are violated by the investigation (but this will merely limit the investigation methods) or if he or she finds that the investigation constitutes an abuse of rights. In any case, it will be very hard for an employee to completely halt the investigation.

The employee does not have a legal right to stop the investigation. The employer must fulfil its obligation to investigate the alleged misconduct.

Employees cannot be forced by their employer to act as a witness. If they decide to nonetheless testify as a witness, they do not, in principle, have particular rights. If the employee puts himself in a difficult or even dangerous position to act as a witness, it is up to the employer to offer the necessary protection or take measures to prevent any harm (eg, by keeping the identity of the witness confidential or by planning the hearing at a place or time when the employees involved are not aware of it).  

However, this is not the case for whistleblowing reports, where a witness might be seen as a “facilitator” who can receive protection against any retaliation by the employer.

Also, workers who were direct witnesses to official allegations of sexual harassment, violence or bullying at work are protected against retaliation by the employer. This also applies to witnesses in court.

There is no legislation on a witness's role in investigations. However, the legislation on occupational safety requires that employees must report any irregularities they observe. Depending on the situation, participating in the investigation may also be part of the person's work duties, role or position, in which case the employer may require the employee to contribute to clarifying the situation. However, there is no formal obligation to act as a witness, and there is no legislation regarding the protection of witnesses. If a witness wishes, they may have, for example, an employee representative as a support person during the hearing. 

Here, the investigation “collides” with the right to privacy of the persons involved.

First, the rules and principles of the GDPR will apply if personal data is involved. Therefore, the employer will have to find a data-processing ground, which could be his or her legitimate interest or the fact that the investigation could lead to legal proceedings, etc. The data processing should also be limited to what is proportionate and the data subjects should be informed. Due to this obligation, it is arguable that the GDPR policy already provides the necessary information for the employees not to jeopardise the investigation. In any case, data subjects should not be able to use their right to access data to ascertain the preliminary findings of the investigation (which are confidential) or any confidential identities involved (eg, in the whistleblower procedure, the identity of the report should be protected at all times).

Also, the employer should follow the procedure of Collective Bargaining Agreement No. 81 on searching the e-mails or computer files and internet searches of employees. This CBA limits the purposes for searches and lays down a double-phase procedure that needs to be followed if private data is involved. Next to this, the employer should also take into account the case law of the European Court of Human Rights, which only allows e-mail and computer searches based on the following:

• whether the employee has been notified of the possibility that the employer might take measures to monitor correspondence and the implementation of such measures;
• the extent of the monitoring and the degree of intrusion into the employee’s privacy (including a distinction between the monitoring of the flow or the content of the communications);
• whether the employer has provided legitimate reasons to justify monitoring of the communications and accessing of their actual content; and
• whether it would have been possible to establish a monitoring system based on less intrusive measures, the consequences of the monitoring for the employee who is subject to it, and whether the employee had been provided with adequate safeguards.

Next, if the employer wants to use camera images, the rules of Collective Bargaining Agreement No. 68 should have been followed when installing cameras. If not, the images might have been collected illegally.

Generally, the basic principles set out by the GDPR and the Finnish Data Protection Act apply to data processing in connection with investigations, including evidence gathering: there must be a legal basis for processing, personal data may only be processed and stored when and for as long as necessary considering the purposes of processing, etc.

Additionally, if physical evidence concerns the electronic communications (such as emails and online chats) of an employee, gathering evidence is subject to certain restrictions based on Finnish ePrivacy and employee privacy laws. As a general rule, an employee’s electronic communications accounts, including those provided by the employer for work purposes, may not be accessed and electronic communications may not be searched or reviewed by the employer. In practice, the employer may access such electronic correspondence only in limited situations stipulated in the Act on Protection of Privacy in Working Life (759/2004), or by obtaining case-specific consent from the employee, which is typically not possible in internal investigations, particularly concerning the employee suspected of wrongdoing.

However, monitoring data flow strictly between the employee and the employer's information systems (eg, the employee saving data to USB sticks, using printers) is allowed under Finnish legislation, provided that employee emails, chats, etc, are not accessed and monitored. If documentation is unrelated to electronic communications, it also may be reviewed by the employer. Laptops, paper archives and other similar company documentation considered "physical evidence" may be investigated while gathering evidence on the condition that any private documentation, communications, pictures or other content of an employee are not accessed.

The employer is, in principle, not entitled to search the employee’s private possessions, except with the explicit consent of the employee. Digital files on the computer or laptop of an employee can be searched under the rules of CBA No. 81 (see question 7) and other privacy rules.  

Only the police can search employees' possessions (assuming that the prerequisites outlined in the legislation are met).

If the investigation is based on a whistleblower report that falls under the scope of the upcoming rules, the investigators are bound by a strict duty of confidentiality, especially regarding the identity of the report. The rules also provide some procedural deadlines for feeding back to the reporter. Within seven days of receiving the report through an internal reporting channel, the reporting manager needs to send a receipt to the whistleblower. From that moment, the reporting manager has three months to investigate the report and give feedback and an adequate follow-up to the report. Next, the rules offer strong protection against any retaliatory measures the reporter may experience. Regardless, these rules are mostly intended to offer the necessary protection for whistleblowers and to ensure that companies take necessary investigative steps following a report, but they do not include much information about the actual procedure of the investigation besides certain deadlines, nor do they deal with other employees involved (or under investigation).

In respect of data protection, the processing of personal data in whistleblowing systems is considered by the Finnish Data Protection Ombudsman (DPO) as requiring a data protection impact assessment (DPIA).

A workplace investigation is often a sensitive matter that requires necessary confidentiality to find out the truth discreetly and objectively. Nevertheless, there is often pressure from employees, trade unions or even the media and general public to be transparent and communicate about the case. From a legal perspective, it is not recommended to communicate openly about an ongoing investigation, as this can jeopardise the investigation or the possibility of taking disciplinary measures.

Whistleblower investigations will be bound by a strict duty of confidentiality regarding anything that could reveal the identity of the reporter.

In complaints due to sexual harassment, violence or bullying at work, the prevention adviser is bound by professional secrecy. Consequently, he or she may not disclose to third parties any information about individuals that have come to his or her knowledge in the performance of his or her duties. However, he or she still has the freedom to inform the people concerned to carry out his or her tasks in the procedure.

Concerning a workplace investigation, there is no specific legislation in force at the moment regarding confidentiality obligations. All normal legal confidentiality obligations (eg, obligations outlined in the Trade Secrets Act (595/2018)), and if using an external investigator, the confidentiality obligations outlined in the agreement between the employer and the external investigator, apply. Attorneys-at-law always have strict confidentiality obligations as per the Advocates Act (496/1958).

In general, the employee should be informed that there is an ongoing investigation (unless this could jeopardise the investigation, in which case disclosure could be postponed until this is no longer the situation). Next, before imposing measures or sanctions, the employee should be allowed to be heard or to give his or her version of the facts. Of course, the employee can only do this if he or she is aware of the facts being investigated. It is not necessary to give the employee a full insight into the investigation, only the necessary facts that allow him or her to offer a defence are sufficient.

The process must be transparent and impartial, and therefore all the information that may influence the conclusions made during the investigation should be shared with the employee.

If the complainant made use of an internal whistleblowing procedure, confidentiality regarding the identity of a reporter is mandatory. Also, in other cases and for other involved persons (witnesses), it is recommended to keep their identity confidential to prevent the risk of intimidation or other negative consequences.

In complaints due to sexual harassment, violence or bullying at work, if the prevention adviser heard or took written statements from persons that were considered useful for the evaluation, these persons may remain anonymous.

The employee must, nevertheless, receive sufficient information to be able to offer a defence concerning the facts of which he or she is accused.

See question 11, there is no protection of anonymity as the process must be transparent to the parties involved.

In principle this is possible. However, these NDAs do have their limits and cannot prevent involved persons from, for example, bringing a legal claim or filing a report if they are legally entitled to do so. Under whistleblower rules, a reporter can even publish his or her complaint under certain circumstances.

Yes, however, the need for an NDA is assessed always on a case-by-case basis.

If the investigation is conducted by a prevention advisor, the investigation and the prevention advisor are bound and protected by a professional duty of confidentiality.

The privilege of investigation materials concerns a rather limited amount of cases. In practice, materials may be considered privileged in connection with the litigation process under the Procedural Code (4/1734). For example, communications between a client and an attorney may attract protection against forcible public disclosure.

An employee can be assisted by a member of a trade union. They are also free to consult a lawyer.

The employee under investigation has a right to have a support person present (eg, a lawyer or an employee representative) during the hearings and a right to assistance in preparing written statements.

At the request of the involved employee, an employee can be assisted by a member of the trade union delegation, for example, during his or her hearing.

The works council should be informed of an investigation if there is a considerable impact on the company; this will only be the case if the investigation concerns a very serious, important or widespread issue. This information should be communicated as soon as possible and before measures are taken as a result of the investigation. This is only a right to information, not consultation. Moreover, members of the works council may be asked to respect their duty of confidentiality. However, as the enforcement of this duty of confidentiality is difficult, the timing of the information should be chosen wisely so it does not jeopardise the investigation.

A works council or a trade union does not have a role in the investigation.

There are no other mandatory support measures. However, an employer is free to offer additional support, for example, by granting leave from work. If tensions at the workplace are high, it may be a good idea to ask the employee under investigation to take some leave. Some companies also provide certain legal, moral or even psychological support. If the complaint concerns sexual harassment, bullying or violence at work, the prevention adviser can also recommend that the employer take additional measures to support certain employees.

Furthermore, under the whistleblower rules, an external reporting authority can grant any support measure (eg, legal advice or financial, technical, psychological or media-related, social support).

For complaints due to sexual harassment, violence or bullying at work, and if the facts are serious, the prevention adviser should, during the examination of the request and before giving his or her opinion to the employer, propose protective measures to the employer. These measures are necessary to avoid serious damage to the complainant's health or a significant deterioration in the situation (for example, causing opposing parties to commit criminal offences). The final decision on taking these measures rests with the employer. This means that the employer does not necessarily have to take the measures proposed by the prevention adviser. They may take other measures that provide an equivalent level of protection for the employee.

They can request assistance, for example, from an occupational health and safety representative, a shop steward or the occupational healthcare provider.

If the investigation is not protected by confidentiality towards the employer (e.g. the prevention advisor cannot disclose confidential information to the employer), it could result in further measures taken by the employer or lead to a new investigation.

If they are related to the work or workplace, the employer will handle the emerging matters separately. In internal investigations, the employer is allowed to use any material legally available.

This will depend on where the employee raises a grievance and the content of the grievance. If it is against the employer, the investigation can take this into account and continue from there. If the grievance is raised against the authorities, it will depend on the steps taken by the authorities.

If the nature of the grievance relates to the employer's obligations to handle such matters in general, the grievance will be investigated either separately or as a part of the ongoing investigation.

If this occurs, there is a risk that any measure resulting from the investigation (eg, a dismissal) can be (wrongly) interpreted as discrimination based on the illness of the employee. However, if the employer can prove that the measure is not related to the illness but solely related to the investigation (which is also not related to the illness), there may be no discrimination. The sickness of the employee may prevent the continuation of the investigation because, for example, it becomes impossible to hear from the employee. In this instance, the investigation can be suspended, postponed or extendeded until the employee returns. If it is a long-term absence, this could lead to a disproportionate amount of time to complete the investigation. Therefore, the employer should take any necessary steps to invite the ill employee to a hearing anyway (eg, through digital means). If the employee unreasonably refuses (several) of these invitations, it could be argued that the employee is wilfully boycotting the investigation and therefore forfeits his or her opportunity to be heard.

As a general rule, sick leave does not prevent an investigation from progressing. Depending on the nature of the sickness, the employee can attend hearings and take part in the procedure. If the sickness prevents the employee from participating, the employer can put the process on hold temporarily.

In legal proceedings, a criminal procedure takes precedence over civil procedures. However, disciplinary internal proceedings (like a workplace investigation) and an investigation by the authorities may run parallel to each other. If the public investigation leads to a court procedure that results in the acquittal of the employee under investigation, it could lead to legal problems if the employer has already imposed sanctions based on the same employee. Therefore, the employer could make the internal investigation dependent on the public investigation, and could take preventive measures while awaiting the outcome.

The public authorities normally have the legal competence to request information that can help them in their investigation. Therefore, they could rightfully ask the employer to share evidence or findings from the internal investigation.

Regardless of a possible criminal investigation, the employer must run its internal workplace investigation without unnecessary delay. A workplace investigation and a criminal investigation are two separate processes and can be ongoing simultaneously, so the criminal process does not require the workplace investigation to be stayed. Thus, parallel investigations are to be considered as two separate matters. The police may only obtain evidence or material from the company or employer if strict requirements for equipment searches are met after a request for investigation has been submitted to the police.

It is highly recommended to inform the employee under investigation of the outcome. If disciplinary measures are imposed upon him or her, the legal procedure must be followed and the sanction must be imposed or communicated the day after the employer or his delegate has established the wrongdoing of the employee.

The employer's conclusions from the investigation.

It is recommended to limit the communication to the findings and details of the report that are necessary for the employee to fully understand the outcome. This is especially true if the investigation is bound by a duty of confidentiality (eg, under the whistleblowing rules), as the employee should not be allowed access to the full report.

The employee under investigation may only be informed of the conclusions.

If the investigation leads to the establishment of grave errors by the employee, this can lead to sanctions. The employer must follow the procedure laid down in the internal work rules of the company and can only impose sanctions that are included in the internal work rules. In general, these are: a verbal warning; a written warning; a suspension (remunerated or not); a fine (capped to one-fifth of daily remuneration); and dismissal. If there are very serious errors leading to an immediate inability to continue the employment relationship with the employee, the employer can dismiss the employee with urgent cause without any notice period or indemnity in lieu of notice (following the specific procedure for these types of dismissals). In less serious cases, the employer could still dismiss the employee with a notice period or indemnity in lieu of notice. In principle, the employer has a right to dismiss the employee, even if this sanction is not included in the internal work rules.

As said previously, disciplinary sanctions (included in the internal work rules) must be communicated to the sanctioned employee the day after the employer or his delegate has established fault. The sanction must be registered in a sanction register, with the name of the employee, the date, the reason and the nature of the sanction. If there is a fine, the amount of the fine should be mentioned. The proceeds of the fines must be used for the benefit of employees. Where a works council exists, the use of the proceeds of the fines must be determined after consultation with it.

The employer decides whether misconduct has taken place or not. Depending on the case, the employer may recommend a workplace conciliation in which the parties try to find a solution that can be accepted by both sides. The employer may choose to give an oral reprimand or a written warning. If the legal conditions are met, the employer may also terminate the employment agreement.

If the investigated acts constitute a crime, the authorities or the police should be informed. In certain cases, not doing so could lead to the company being accused of concealing a crime or becoming jointly responsible for it. However, if the company is the only victim of the crime and it is minor, the company may choose not to inform the authorities. For example, there is an enormous difference between a bank employee stealing large amounts of money from clients and an employee who is stealing toilet paper from the company. As stated above, the interview records could be at risk of disclosure if the authorities or police seize them for their investigation.

In general, investigation materials, including findings, that includes personal data should only be processed by the personnel of the organisation who are responsible for internal investigations. However, it may in some situations be required by applicable legislation that findings are disclosed to competent authorities for the performance of their duties, such as conducting investigations in connection with malpractice and violations of the law.

According to the GDPR, personal data should only be stored for a proportionate amount of time. Usually, this means that it can be stored as long as it is relevant for the employment contract, and even afterwards, if there is a risk of legal proceedings (ie, regarding the dismissal of the employee).

Please see question 7. The outcome of the investigation involving personal data may be retained only for as long as is necessary considering the purposes of the processing. In general, the retention of investigation-related data may be necessary while the investigation is still ongoing and even then the requirements of data minimization and accuracy should be considered. The data concerning the outcome of an investigation should be registered to the employee's record merely to the extent necessary in light of the employment relationship or potential disciplinary measures. In this respect, the applicable retention time depends on labour law-related rights and limitations, considering eg, the applicable periods for filing a suit.

In general, abusive investigations could lead to a legal claim regarding the abuse of rights. During an investigation, an employer should be guided by principles of due diligence and not take disproportionate action. If the investigation causes unnecessary damage, involved employees could file for compensation (eg, before the labour court). Next, the employer is also responsible for following the mandatory procedure for official complaints regarding sexual harassment, bullying and violence at work and investigations of whistleblower reports. In the first case, an employer who does not follow the procedure or obstructs the procedure can be liable for penal or administrative fines (maximum 8,000 euro) or, if the employer has not taken necessary measures to mitigate the risks for the employee and the employee suffers damage to their health, they may be liable for a fine of a maximum of 48,000 euro and imprisonment for between six months and three years. In the second case (whistleblower procedure), if an employer did not follow or has obstructed the procedure, they can be fined up to 5% of the annual revenue of the preceding year.

If the complaints involve allegations of sexual harassment, violence or bullying at work, the employer might risk an investigation of the inspection on supervision and well-being at work. If the prevention advisor finds out, before giving his advice, that the employer did not take any suitable protective measures after they were recommended, the prevention advisor is obliged to call an inspection on supervision and well-being at work.

There are no regulations regarding the actual investigation process. Therefore, the employer cannot be accused of procedural errors as such. However, once the matter has been adequately investigated, the employer must decide whether or not misconduct has taken place. If the employer considers that misconduct has taken place, the employer must take adequate measures for remedying the situation. Failure to adequately conduct the investigation could result in criminal sanctions being imposed on the employer as an organisation or the employer’s representative, or damages.