Workplace Investigations

In internal investigations, the fundamental rights and freedoms of employees are at stake,  including the right to privacy, respect for the privacy of home life and correspondence, freedom of expression, and the obligation of loyalty in searching for evidence.

In principle, work emails and files can be reviewed, even without the employee's consent, prior knowledge or warning. This includes: work email accounts; files stored on a work computer or a USB key connected to a work computer; and SMS messages and files stored on a work mobile phone and documents stored in the workplace unless they are labelled as “personal”. On the other hand, it is not permissible for an employer (or an investigator) to review “personal” emails and files, such as documents or emails identified as “personal” by the employee, or personal email accounts (Gmail, Yahoo, etc), even if accessed from a work computer.

There are certain exceptions to the above principle. An employer is allowed to check “personal” emails or data in any of the following cases:

• if the employee is present during the review;
• if the employee is absent, but was duly notified and invited to be present;
• if there is a particularly serious “specific risk or event”;
• if the review is authorised by a judge (this means having to prove a legitimate reason justifying not informing the employee).

When documents or emails are not marked as “personal” but contain information of a personal nature, the employer may open and review the data but may not use such documents or emails to justify applying disciplinary measures to the employee or use such documents or emails as evidence in court if they indeed relate to the employee’s private life.

Special attention must be given to employee representatives who must be entirely free to carry out their duties.

The basic rule is that the employer may not search private data during internal investigations.

If there is a strong suspicion of criminal conduct on the part of the employee and a sufficiently strong justification exists, a search of private data may be justified.[1] The factual connection with the employment relationship is given, for example, in the case of a criminal act committed during working hours or using workplace infrastructure.[2]

It may sometimes be difficult to draw a clear distinction between the property of the employer and employees’ personal property, both physical and electronic, particularly where employees are increasingly working from home. Employers should ideally have a clear policy to delineate what is the employer’s property.

Employees typically have a reasonable expectation of privacy at work, although how far this extends will depend on the circumstances of each case and the employer’s policies.

When it comes to employees’ personal possessions, a search should only be conducted in exceptional circumstances where there is a clear, legitimate justification. The employer should always consider whether it is possible to establish the relevant facts through the collection of other evidence. Even if the employee’s contract specifies that it is permitted, employers would usually require explicit employee consent for the search to be lawful. The employee should be invited to be present during the search; if this is not feasible, another independent third party (such as a manager) should be present.  

If the employee refuses to consent to a search of their personal possessions, their refusal should not be used to assume guilt; the investigator should explore why the employee has refused and seek to resolve their concerns if possible.

If the employer believes that a criminal offence has been committed it should consider involving the police, since they have wider powers to search individuals and their possessions. 

A criminal investigation always takes precedence over other investigations. However, this does not mean that the internal investigation has to stop. It can and should continue, and the report drawn up upon completion of the investigation could be used by the authorities in the criminal investigation. In some cases, especially when privilege does not apply, police or regulatory authorities may request that the employer share such evidence. However, even when privilege does apply, there is no certainty that the evidence would not have to be communicated to certain authorities.

Some administrative authorities often challenge the application of legal privilege or try to reduce its scope. For example, the French financial markets authority (AMF) regularly puts forward its view of legal privilege, according to which an email where a lawyer is only copied (and is not one of the main recipients) in from one of their clients is not confidential and can therefore be disclosed in proceedings. However, if the AMF investigators impose disclosure of privileged documents, this should result in the annulment of the investigation procedure. By way of exception, legal privilege cannot be invoked against certain other authorities, such as the URSSAF (authority in charge of collecting social security contributions) or the DGCCRF (directorate-general for competition, consumer protection and anti-fraud investigations). Where legal privilege is enforceable, the judge must first determine whether the documents constitute correspondence relating to defence rights and, second, must cancel the seizure of documents that they find to be covered by legal privilege due to the principle of professional secrecy of relations between a lawyer and their client and the rights of defence.

The actions of the employer may carry through to a subsequent state proceeding. First and foremost, any prohibitions on the use of evidence must be considered. Whereas in civil proceedings the interest in establishing the truth must merely prevail for exploitation (article 152 paragraph 2, Swiss Civil Procedure Code), in criminal proceedings, depending on the nature of the unlawful act, there is a risk that the evidence may not be used (see question 27 and article 140 et seq, Swiss Civil Procedure Code).

This situation needs to be handled with caution. It is important to remember that regulatory or criminal proceedings, and employment proceedings, are separate; while there may be an overlap of alleged misconduct, they are usually addressing different questions, with different standards of proof. The outcome in one should not, therefore, be treated as determinative of the other.

Where the employee is suspected of, charged with, or convicted of, a criminal or regulatory offence, the employer should still investigate the facts as far as possible, come to a view about them and consider whether the conduct is sufficiently serious to warrant instituting the disciplinary procedure.

In terms of timing, there are no concrete rules governing how an employer must proceed in the circumstances of a parallel criminal investigation. Much will depend upon the circumstances of the case, the length of delay, the size of and resources available to the employer, and the preferences (if expressed) of the external authority. If the employer is concerned about prejudicing the regulatory or criminal proceedings or otherwise prefers to wait for their conclusion before instigating internal proceedings, they are unlikely to be criticised for delaying. The accused employee may also be advised not to provide a statement in the workplace investigation for fear of a negative impact on the criminal investigation. This would make it difficult to proceed with the workplace investigation, unless the employer is confident it has strong enough evidence to justify any disciplinary action subsequently taken.

On the other hand, regulatory or criminal investigations may take months or years to progress; it may not be realistic for the employer to keep any investigation in abeyance for so long. This is particularly true when the accused employee is suspended on full pay, witness recollections will grow less reliable, and the alleged victim may feel unable to return to work until the matter is resolved.

In these circumstances, the employer may continue with their investigation if they believe it is reasonable to do so, and consultations have commenced with the external agency. The court will usually only intervene if the employee can show that the continuation of the disciplinary proceedings will give rise to a real danger that there would be a miscarriage of justice in the criminal proceedings.

Employers should consider carefully whether and when to involve the police in allegations of employee misconduct. Employers must be careful not to subject their employees to the heavy burden of potential criminal proceedings without the most careful consideration, and a genuine and reasonable belief that the case, if established, might justify the epithet “criminal” being applied to the employee's conduct.

Where the police are called in, they should not be asked to conduct any investigation on behalf of the employer, nor should they be present at any meeting or disciplinary meeting. The employer should, however, communicate with the police to see if they have a strong view about whether the internal process should be stayed, or whether they should interview witnesses first.