Workplace Investigations

In general, an internal investigation is only initiated if there is suspicion of a violation. The decision to commence an internal investigation is up to the company, and it has to weigh the pros and cons. For limited liability companies, which are subject to the Association Responsibility Act, an internal investigation may exempt them from criminal liability. Disadvantages may include investigation costs, disruption of operations, discovery of information requiring later disclosure, possible negative media coverage and increased risk of exposure to external parties.

Investigations can relate to specific individuals, departments, or the entire company. An investigation may include various measures, such as obtaining and analysing files and documents, conducting questionnaires and employee interviews, monitoring internet use, video or telephone surveillance of employees and setting up whistleblowing hotlines. Not all measures are acceptable without restrictions. The provisions of labour law and data protection law must always be complied with.

To avoid wasting resources, the objectives of the investigation should be defined in advance. In addition, the selection and sequence of instruments to be used should be determined. A legal assessment of the chosen measures is essential to avoid legal complications.

Internal investigations are usually initiated after reports about possible violations of the employer's code of conduct, applicable laws or regulations have been submitted by employees to their superiors, the human resources department or designated internal reporting systems such as hotlines (including whistleblowing hotlines).

For an internal investigation to be initiated, there must be a reasonable suspicion (grounds).[1] If no such grounds exist, the employer must ask the informant for further or more specific information. If no grounds for reasonable suspicion exists, the case must be closed. If grounds for reasonable suspicion exist, the appropriate investigative steps can be initiated by a formal investigation request from the company management.[2]

In general, it is advisable to back up data, documents, emails and other records promptly to prevent their deletion. Admissibility depends on whether the data originates from personal or professional records and whether they are legally relevant. If internal investigations are carried out based on a specific suspicion of a criminal offence, it is the processing of legally relevant data. In general, the processing of professional emails or documents is permissible. If there is no professional connection, access to private files and documents is only permitted in exceptional cases.

If, for example, using a business email account for private purposes is not allowed, the employer can usually assume that the data processed is only "general" data within the meaning of article 6 GDPR and that such data processing is justified by a balancing of interests. However, if private use is allowed, the data may still be part of a special category within the meaning of article 9 GDPR. In such cases, the justification for its use must be based on one of the grounds explicitly mentioned in article 9(2) GDPR.

The employer must protect the employee's rights under section 16 of the ABGB and must consider the proportionality of the interference. Only the least restrictive means – the method that least interferes with the employee's rights – may be used to obtain the necessary information. The employer's interest in obtaining the information must outweigh the employee's interest in protecting his or her rights. The implementation or initiation of controls by the employer does not automatically constitute an interference with personal rights, as being subject to the employer's rights of control is part of the position as an employee.

The basic rule is that the employer may not search private data during internal investigations.

If there is a strong suspicion of criminal conduct on the part of the employee and a sufficiently strong justification exists, a search of private data may be justified.[1] The factual connection with the employment relationship is given, for example, in the case of a criminal act committed during working hours or using workplace infrastructure.[2]