Workplace Investigations

The circumstances in which an employer commences a workplace investigation may vary. However, it is common that an employer will consider it necessary to commence a workplace investigation upon receipt of a complaint concerning a fellow employee. Sometimes, the complaint may be made anonymously. If the employer considers there to be substance in the complaint, it may commence an investigation to find out the truth of the matter, resolve the complaint and, if necessary, improve its systems and controls to prevent the reoccurrence of any misconduct.

A workplace investigation may be warranted if the employer receives an enquiry from a regulator concerning its affairs or an employee’s conduct. The investigation findings could enable the employer to respond to the regulator (which could be a mandatory obligation) and at the same time assess its risk exposure.

Internal investigations are usually initiated after reports about possible violations of the employer's code of conduct, applicable laws or regulations have been submitted by employees to their superiors, the human resources department or designated internal reporting systems such as hotlines (including whistleblowing hotlines).

For an internal investigation to be initiated, there must be a reasonable suspicion (grounds).[1] If no such grounds exist, the employer must ask the informant for further or more specific information. If no grounds for reasonable suspicion exists, the case must be closed. If grounds for reasonable suspicion exist, the appropriate investigative steps can be initiated by a formal investigation request from the company management.[2]

The employer is generally not obliged to share the investigation report or the findings with the employee under Hong Kong law, absent any express obligations under the employment contract.

However, according to the PDPO, the content of the investigation report or meeting minutes related to the employee (including any findings and opinions expressed in such documents) are likely to constitute the personal data of the employee under investigation. In that case, the employee may have a right under the PDPO to obtain a copy of such documents by making a statutory data access request after the workplace investigation is completed. The employer’s obligation to comply with such request is subject to certain exemptions under Part 8 of the PDPO, which include (among others) an exemption on the provision of personal data held for the prevention, preclusion or remedying of unlawful or seriously improper conduct, and the disclosure of which would be likely to prejudice the said purpose or directly or indirectly identify the person who is the source of the data.[1] Therefore, where there is a parallel criminal proceeding or investigation that has not been concluded, the employer may reject an employee’s data access request on the basis that the requested disclosure may prejudice the prevention and remedy of the unlawful conduct. Further, any information protected by legal privilege is also exempt from disclosure under Part 8 of the PDPO.[2]

If the requested documents also contain the personal data of any other third parties (such as other co-workers of the employee who have also participated in the investigation), the employer should always redact or erase such data before providing the requested documents to the employee under investigation, unless the relevant third parties have consented to the disclosure of the data.

In principle, there is no obligation to disclose the final investigation report. Disclosure obligations may arise based on data protection law vis-à-vis the persons concerned (eg, the accused). Likewise, there is no obligation to disclose other documents, such as the records of interviews. The employee should be fully informed of the final investigation report, if necessary, with certain redactions (see question 22). The right of the employee concerned to information is comprehensive (ie, all investigation files must be disclosed to him).[1] Regarding publication to other bodies outside of criminal proceedings, the employer is bound by its duty of care (article 328, Swiss Code of Obligations) and must protect the employee as far as is possible and reasonable.[2]