Workplace Investigations

According to section 6(1) of the DSG, employees who have access to personal data in the course of their professional activities must maintain data confidentiality and continue to do so even after termination of their employment.

Non-disclosure agreements can generally be used to achieve this but are subject to certain restrictions. They may not be used to conceal criminal activity, violate the privacy rights of individuals, circumvent legal disclosure obligations, prevent the exercise of legal rights or contain clauses that violate existing laws, in particular data protection regulations.

In addition to the above-mentioned statutory confidentiality obligations, separate non-disclosure agreements can be signed. In an internal investigation, the employee should be expressly instructed to maintain confidentiality.

If a lawyer is involved in the investigation, communication between the lawyer and client is subject to legal professional privilege. These communications must not be disclosed. Any documents collected by an internal audit can be seized and used. However, a document created by a lawyer can only be seized. The same applies to other professional representatives of parties, such as notaries and auditors, as potential holders of professional secrecy.

As outlined above, all employees generally have the right to know whether and what personal data is being or has been processed about them (article 8 paragraph 1, Swiss Federal Act on Data Protection; article 328b, Swiss Code of Obligations).

The employer may refuse, restrict or postpone the disclosure or inspection of internal investigation documents if a legal statute so provides, if such action is necessary because of overriding third-party interests (article 9 paragraph 1, Swiss Federal Act on Data Protection) or if the request for information is manifestly unfounded or malicious. Furthermore, a restriction is possible if overriding the self-interests of the responsible company requires such a measure and it also does not disclose the personal data to third parties. The employer or responsible party must justify its decision (article 9 paragraph 5, Swiss Federal Act on Data Protection).[1]

The scope of the disclosure of information must, therefore, be determined by carefully weighing the interests of all parties involved in the internal investigation.