Workplace Investigations

All data processing must comply with the principles of article 5 GDPR (lawfulness, fairness, transparency, purpose limitation, data minimisation, accuracy, storage limitation and integrity). Personal data may only be collected and processed for specific, lawful purposes.

The admissibility of data processing depends on whether the suspicion relates to a criminal offence or another violation of the law. If the data processing is relevant to criminal law, article 10 GDPR or section 4(3) of the Austrian Data Protection Act (DSG) applies. If the investigations are exclusively to clarify violations under civil or labour law, such as an assertion of claims for damages or if they are general investigations to establish a criminal offence, the permissibility of data processing is based on article 6 or, for data covered by article 9 GDPR, on this provision.

GDPR principles fully apply to data gathering, as well as case law protecting the right to respect one’s private life and the secret of correspondence.

The Swiss Federal Act on Data Protection applies to the gathering of evidence, in particular such collection must be lawful, transparent, reasonable and in good faith, and data security must be preserved.[1]

It can be derived from the duty to disclose and hand over benefits received and work produced (article 321b, Swiss Code of Obligations) as they belong to the employer.[2] The employer is, therefore, generally entitled to collect and process data connected with the end product of any work completely by an employee and associated with their business. However, it is prohibited by the Swiss Criminal Code to open a sealed document or consignment to gain knowledge of its contents without being authorised to do so (article 179 et seq, Swiss Criminal Code). Anyone who disseminates or makes use of information of which he or she has obtained knowledge by opening a sealed document or mailing not intended for him or her may become criminally liable (article 179 paragraph 1, Swiss Criminal Code).

It is advisable to state in internal regulations that the workplace might be searched as part of an internal investigation and in compliance with all applicable data protection rules if this is necessary as part of the investigation.

Private investigations differ from criminal or regulatory investigations. Nevertheless, even for internal investigations, it is advisable to collect evidence in a way that can be admitted in court, as it may have to be presented to the authorities during the investigation process. Generally, any evidence obtained in the course of an internal investigation may be admitted in subsequent administrative or judicial proceedings.

If the evidence is not voluntarily surrendered, seizure or confiscation is possible. Since official proceedings are often lengthy, suspension is not always recommended.

A criminal investigation always takes precedence over other investigations. However, this does not mean that the internal investigation has to stop. It can and should continue, and the report drawn up upon completion of the investigation could be used by the authorities in the criminal investigation. In some cases, especially when privilege does not apply, police or regulatory authorities may request that the employer share such evidence. However, even when privilege does apply, there is no certainty that the evidence would not have to be communicated to certain authorities.

Some administrative authorities often challenge the application of legal privilege or try to reduce its scope. For example, the French financial markets authority (AMF) regularly puts forward its view of legal privilege, according to which an email where a lawyer is only copied (and is not one of the main recipients) in from one of their clients is not confidential and can therefore be disclosed in proceedings. However, if the AMF investigators impose disclosure of privileged documents, this should result in the annulment of the investigation procedure. By way of exception, legal privilege cannot be invoked against certain other authorities, such as the URSSAF (authority in charge of collecting social security contributions) or the DGCCRF (directorate-general for competition, consumer protection and anti-fraud investigations). Where legal privilege is enforceable, the judge must first determine whether the documents constitute correspondence relating to defence rights and, second, must cancel the seizure of documents that they find to be covered by legal privilege due to the principle of professional secrecy of relations between a lawyer and their client and the rights of defence.

The actions of the employer may carry through to a subsequent state proceeding. First and foremost, any prohibitions on the use of evidence must be considered. Whereas in civil proceedings the interest in establishing the truth must merely prevail for exploitation (article 152 paragraph 2, Swiss Civil Procedure Code), in criminal proceedings, depending on the nature of the unlawful act, there is a risk that the evidence may not be used (see question 27 and article 140 et seq, Swiss Civil Procedure Code).