Workplace Investigations

GDPR principles fully apply to data gathering, as well as case law protecting the right to respect one’s private life and the secret of correspondence.

If physical evidence contains data relating to an individual, from which the identity of the individual can be ascertained,[1] the data would constitute personal data under the Personal Data (Privacy) Ordinance (Cap. 486) (PDPO). The PDPO sets out several data protection principles that the employer must comply with while processing personal data, including:[2]

• personal data must be collected for a lawful purpose related to a function or activity of the employer and should not be excessive for this purpose. An internal investigation would be regarded as a lawful purpose;
• personal data must be accurate and not kept longer than is necessary;
• personal data must not be used for a purpose other than the internal investigation (or other purposes for which the data was collected) unless the employee consents to a new use or the new use falls within one of the exceptions provided in the PDPO;
• personal data must be safeguarded against unauthorised or accidental access, processing or loss; and
• the employee whose personal data has been collected has the right to request access to and correction of his or her personal data retained by the employer.

If an employer wants to gather evidence through employee monitoring, it should ensure that the act of monitoring complies with the data protection principles of the PDPO if the monitoring activity would amount to the collection of personal data. The Privacy Commissioner for Personal Data has issued guidelines to employers on the steps they can take in assessing whether employee monitoring is appropriate for their businesses.[3] As a general rule, employee monitoring should be conducted overtly. Further, those who may be affected should be notified in advance of the purposes the monitoring is intended to serve, the circumstances in which the system will be activated, what personal data (if any) will be collected and how the personal data will be used.

Covert surveillance of employees should not be adopted unless it is justified by relevant special circumstances. Employers should consider whether there is reason to believe that there is an unlawful activity taking place and the use of overt monitoring would likely prejudice the detection or collection of evidence.[4] Even if covert monitoring is justified, it should target only those areas in which an unlawful activity is likely to take place and be implemented for a limited duration of time.

The Swiss Federal Act on Data Protection applies to the gathering of evidence, in particular such collection must be lawful, transparent, reasonable and in good faith, and data security must be preserved.[1]

It can be derived from the duty to disclose and hand over benefits received and work produced (article 321b, Swiss Code of Obligations) as they belong to the employer.[2] The employer is, therefore, generally entitled to collect and process data connected with the end product of any work completely by an employee and associated with their business. However, it is prohibited by the Swiss Criminal Code to open a sealed document or consignment to gain knowledge of its contents without being authorised to do so (article 179 et seq, Swiss Criminal Code). Anyone who disseminates or makes use of information of which he or she has obtained knowledge by opening a sealed document or mailing not intended for him or her may become criminally liable (article 179 paragraph 1, Swiss Criminal Code).

It is advisable to state in internal regulations that the workplace might be searched as part of an internal investigation and in compliance with all applicable data protection rules if this is necessary as part of the investigation.

Apart from being informed of any facts and data concerning them being collected during the investigation, employees involved in the investigation do not have any specific rights. Some companies choose to use external firms specializing in psychosocial risk management, not only to conduct internal investigations, but also to provide additional psychological support for their employees, as part of the employer's safety obligation.

It could be stressful for employees to be involved in a workplace investigation, whether as the victim, the subject of an investigation or a witness. More transparency in the process would help reduce stress. This could be achieved by providing the relevant employees with the timeline for different stages of the investigation and regular updates.

The employer may also consider providing mental health support to the employees concerned, for example in the form of counselling services or medical consultations. Where appropriate, the employer may also consider making reasonable adjustments to the employee’s workload and work schedule to facilitate his participation in the investigation.

The employer does not generally need to provide specific support for employees that are subject to an internal investigation. The employer may, however, allow concerned employees to be accompanied by a trusted third party such as family members or friends.[1] These third parties will need to sign separate non-disclosure agreements before being involved in the internal investigation.

In addition, a company may appoint a so-called lawyer of confidence who has been approved by the employer and is thus subject to professional secrecy. This lawyer will not be involved in the internal investigation but may look after the concerned employees and give them confidential advice as well as inform them about their rights and obligations arising from the employment relationship.[2]