Workplace Investigations

Mainly, the Occupational Safety and Health Act (738/2002). In addition, the following also have relevance in connection to a workplace investigation: the Employment Contracts Act (55/2001), the Criminal Code (39/1889), the Act on Occupational Safety and Health Enforcement and Cooperation on Occupational Safety and Health at Workplaces (44/2006), the Act on Equality between Women and Men (609/1986) and the Non-discrimination Act (1325/2014). In addition, the employer's own policies must be taken into consideration while conducting a workplace investigation.

There is no codified law in India on conducting workplace investigations, so they largely depend on the internal policies of the employer. Certain requirements and best practice measures have evolved through judicial precedent, and these are codified through internal policies.

For claims involving sexual harassment, however, investigations can only be undertaken by the Internal Committee (IC), which an employer needs to constitute under the Prevention of Sexual Harassment of Women and Workplace (Prevention, Prohibition and Redressal) Act 2013 (SH Act).  

The general principle laid down by the courts is that any action against an employee for misconduct should be taken after conducting a disciplinary inquiry as per the principles of natural justice (PNJ). Whether or not a disciplinary inquiry can be done away with in any circumstances is a very fact-specific assessment and depends on various factors, including but not limited to the seniority and location of employment of the employee, and the nature and circumstances of the alleged misconduct.

The PNJ broadly require:

• that the accused employee should be issued with a written charge sheet or notice setting out the allegations against him or her along with a reasonable opportunity to respond;
• appointment of an independent inquiry officer to assess whether the allegations are proven or not; and
• that action must be taken based on the outcome of the inquiry, any punishment ordered should be proportionate to the gravity of the misconduct, and also take into account the service history (eg, prior warnings) of the individual.

The charge sheet or notice issued to the employee has to set out the evidence used by the employer to support the allegations in sufficient detail. Therefore, gathering necessary information and evidence is usually a critical precursor for any disciplinary process that an employer may eventually initiate against an employee.

Generally, the basic principles set out by the GDPR and the Finnish Data Protection Act apply to data processing in connection with investigations, including evidence gathering: there must be a legal basis for processing, personal data may only be processed and stored when and for as long as necessary considering the purposes of processing, etc.

Additionally, if physical evidence concerns the electronic communications (such as emails and online chats) of an employee, gathering evidence is subject to certain restrictions based on Finnish ePrivacy and employee privacy laws. As a general rule, an employee’s electronic communications accounts, including those provided by the employer for work purposes, may not be accessed and electronic communications may not be searched or reviewed by the employer. In practice, the employer may access such electronic correspondence only in limited situations stipulated in the Act on Protection of Privacy in Working Life (759/2004), or by obtaining case-specific consent from the employee, which is typically not possible in internal investigations, particularly concerning the employee suspected of wrongdoing.

However, monitoring data flow strictly between the employee and the employer's information systems (eg, the employee saving data to USB sticks, using printers) is allowed under Finnish legislation, provided that employee emails, chats, etc, are not accessed and monitored. If documentation is unrelated to electronic communications, it also may be reviewed by the employer. Laptops, paper archives and other similar company documentation considered "physical evidence" may be investigated while gathering evidence on the condition that any private documentation, communications, pictures or other content of an employee are not accessed.

In India, the collection, disclosure, transfer and storage of personal data is regulated by the Information Technology (Reasonable Security Practices and Procedures and Sensitive Personal Data or Information) Rules, 2011 (SPD Rules). Accordingly, if during an investigation any sensitive personal information (such as information relating to passwords; financial information such as a bank account, credit or debit card or other payment instrument details; a physical, physiological or mental health condition; sexual orientation; medical history; and biometric information) is collected, then the requirements under the SPD Rules will need to be complied with. This would include obtaining an individual’s “informed consent” before collecting any sensitive personal data if such information is intended to be collected or stored in an electronic format.