Workplace Investigations

The Swiss Federal Act on Data Protection applies to the gathering of evidence, in particular such collection must be lawful, transparent, reasonable and in good faith, and data security must be preserved.[1]

It can be derived from the duty to disclose and hand over benefits received and work produced (article 321b, Swiss Code of Obligations) as they belong to the employer.[2] The employer is, therefore, generally entitled to collect and process data connected with the end product of any work completely by an employee and associated with their business. However, it is prohibited by the Swiss Criminal Code to open a sealed document or consignment to gain knowledge of its contents without being authorised to do so (article 179 et seq, Swiss Criminal Code). Anyone who disseminates or makes use of information of which he or she has obtained knowledge by opening a sealed document or mailing not intended for him or her may become criminally liable (article 179 paragraph 1, Swiss Criminal Code).

It is advisable to state in internal regulations that the workplace might be searched as part of an internal investigation and in compliance with all applicable data protection rules if this is necessary as part of the investigation.

Most forms of workplace surveillance involve the processing of personal data that is regulated by the UK GDPR and DPA 2018. The UK GDPR requires that personal data must be processed lawfully, fairly and in a transparent manner; it also must be adequate, relevant and limited to what is necessary concerning the purposes for which it is processed.

Employers should ensure that they have undertaken a data protection impact assessment (DPIA) to document the lawful basis for processing data, and informed employees that their files may be searched before proceeding. They should also ideally have a clear policy on the use of electronic communications systems, detailing when, how and for what purpose they may be monitored by the employer. In Q3 2023 the ICO produced new guidance on monitoring workers (https://ico.org.uk/for-organisations/uk-gdpr-guidance-and-resources/employment/monitoring-workers/) and on email and security (https://ico.org.uk/for-organisations/uk-gdpr-guidance-and-resources/security/email-and-security/) which employers should bear in mind during investigations. Employers should also be prepared to make the data collected through employee monitoring available to employees, should the employee submit a data subject access request under the DPA 2018.

The IPA 2016 makes it unlawful in certain circumstances to intercept a communication (such as one on an employer’s telephone or computer network) in the course of its transmission in the UK. The IPA Regs 2018 set out the circumstances where, in a business context, such interception will be lawful. These include monitoring or recording communications without consent to: establish the existence of facts; ascertain compliance with the regulatory or self-regulatory practices or procedures relevant to the business; ascertain or demonstrate standards which are or ought to be achieved by persons using the system; and prevent or detect crime.

Covert surveillance can lead to a breach of an employee's right to privacy under the HRA 1998. The employer will need to consider if covert surveillance is proportionate, which will depend on the facts of each case. Employers should be careful not to use the investigation as an excuse to undertake a "fishing expedition", and should avoid gathering material that is obviously personal, such as private messages and diary entries (see question 8).

The actions of the employer may carry through to a subsequent state proceeding. First and foremost, any prohibitions on the use of evidence must be considered. Whereas in civil proceedings the interest in establishing the truth must merely prevail for exploitation (article 152 paragraph 2, Swiss Civil Procedure Code), in criminal proceedings, depending on the nature of the unlawful act, there is a risk that the evidence may not be used (see question 27 and article 140 et seq, Swiss Civil Procedure Code).

This situation needs to be handled with caution. It is important to remember that regulatory or criminal proceedings, and employment proceedings, are separate; while there may be an overlap of alleged misconduct, they are usually addressing different questions, with different standards of proof. The outcome in one should not, therefore, be treated as determinative of the other.

Where the employee is suspected of, charged with, or convicted of, a criminal or regulatory offence, the employer should still investigate the facts as far as possible, come to a view about them and consider whether the conduct is sufficiently serious to warrant instituting the disciplinary procedure.

In terms of timing, there are no concrete rules governing how an employer must proceed in the circumstances of a parallel criminal investigation. Much will depend upon the circumstances of the case, the length of delay, the size of and resources available to the employer, and the preferences (if expressed) of the external authority. If the employer is concerned about prejudicing the regulatory or criminal proceedings or otherwise prefers to wait for their conclusion before instigating internal proceedings, they are unlikely to be criticised for delaying. The accused employee may also be advised not to provide a statement in the workplace investigation for fear of a negative impact on the criminal investigation. This would make it difficult to proceed with the workplace investigation, unless the employer is confident it has strong enough evidence to justify any disciplinary action subsequently taken.

On the other hand, regulatory or criminal investigations may take months or years to progress; it may not be realistic for the employer to keep any investigation in abeyance for so long. This is particularly true when the accused employee is suspended on full pay, witness recollections will grow less reliable, and the alleged victim may feel unable to return to work until the matter is resolved.

In these circumstances, the employer may continue with their investigation if they believe it is reasonable to do so, and consultations have commenced with the external agency. The court will usually only intervene if the employee can show that the continuation of the disciplinary proceedings will give rise to a real danger that there would be a miscarriage of justice in the criminal proceedings.

Employers should consider carefully whether and when to involve the police in allegations of employee misconduct. Employers must be careful not to subject their employees to the heavy burden of potential criminal proceedings without the most careful consideration, and a genuine and reasonable belief that the case, if established, might justify the epithet “criminal” being applied to the employee's conduct.

Where the police are called in, they should not be asked to conduct any investigation on behalf of the employer, nor should they be present at any meeting or disciplinary meeting. The employer should, however, communicate with the police to see if they have a strong view about whether the internal process should be stayed, or whether they should interview witnesses first.