Workplace Investigations

In internal investigations, the fundamental rights and freedoms of employees are at stake,  including the right to privacy, respect for the privacy of home life and correspondence, freedom of expression, and the obligation of loyalty in searching for evidence.

In principle, work emails and files can be reviewed, even without the employee's consent, prior knowledge or warning. This includes: work email accounts; files stored on a work computer or a USB key connected to a work computer; and SMS messages and files stored on a work mobile phone and documents stored in the workplace unless they are labelled as “personal”. On the other hand, it is not permissible for an employer (or an investigator) to review “personal” emails and files, such as documents or emails identified as “personal” by the employee, or personal email accounts (Gmail, Yahoo, etc), even if accessed from a work computer.

There are certain exceptions to the above principle. An employer is allowed to check “personal” emails or data in any of the following cases:

• if the employee is present during the review;
• if the employee is absent, but was duly notified and invited to be present;
• if there is a particularly serious “specific risk or event”;
• if the review is authorised by a judge (this means having to prove a legitimate reason justifying not informing the employee).

When documents or emails are not marked as “personal” but contain information of a personal nature, the employer may open and review the data but may not use such documents or emails to justify applying disciplinary measures to the employee or use such documents or emails as evidence in court if they indeed relate to the employee’s private life.

Special attention must be given to employee representatives who must be entirely free to carry out their duties.

The basic rule is that the employer may not search private data during internal investigations.

If there is a strong suspicion of criminal conduct on the part of the employee and a sufficiently strong justification exists, a search of private data may be justified.[1] The factual connection with the employment relationship is given, for example, in the case of a criminal act committed during working hours or using workplace infrastructure.[2]

The identity of the complainant must be kept confidential and cannot be disclosed. There are two exceptions: if the complainant consents to the disclosure; or if the employer is asked for this information by the judicial authorities.

As mentioned under Question 10, the employer’s duty of care (article 328, Swiss Code of Obligations) also entails the employer’s duty to respect and protect the personality (including confidentiality and privacy) and integrity of employees (article 328 paragraph 1, Swiss Code of Obligations) and to take appropriate measures to protect them.

However, in combination with the right to be heard and the right to be informed regarding an investigation, the accused also has the right that incriminating evidence is presented to them throughout the investigation and that they can comment on it. For instance, this right includes disclosure of the persons accusing them and their concrete statements. Anonymisation or redaction of such statements is permissible if the interests of the persons incriminating the accused or the interests of the employer override the accused’ interests to be presented with the relevant documents or statements (see question 11; see also article 9 paragraphs 1 and 4, Swiss Federal Act on Data Protection). However, a careful assessment of interests is required, and these must be limited to what is necessary. In principle, a person accusing another person must take responsibility for their information and accept criticism from the person implicated by the information provided.[1]