Workplace Investigations

Subject to the employees’ reasonable expectation of privacy, gathering physical evidence within the premises of the workplace and through company-issued property has been upheld to be legally permissible in pursuit of the employer’s right to conduct work-related investigations. The search, however, should be limited to the alleged acts complained of and must not be used as a fishing expedition to find incriminating information about the erring employee.

The basic rule is that the employer may not search private data during internal investigations.

If there is a strong suspicion of criminal conduct on the part of the employee and a sufficiently strong justification exists, a search of private data may be justified.[1] The factual connection with the employment relationship is given, for example, in the case of a criminal act committed during working hours or using workplace infrastructure.[2]

Electronic information created during employment would generally be owned by the employer and would be the employer’s assets. If an employee is given a computer or laptop to use for work, the employer has the right to log into that device and take any data that is stored therein, provided that the data does not contain sensitive information of that employee and PDPA requirements are met.

To avoid any potential issues regarding physical data such as documents on the employee’s desk, it is advisable to search those areas with the subject employee to show good faith. In practice, the employee normally agrees to search those areas with the employer, or allows the employer to search alone.

The result of the workplace investigation must be kept private by the employer. These are confidential matters that should not be disclosed to people or entities who did not take part in the investigation. However, if the investigation findings show that a possibly unlawful or criminal activity has taken place, or is about to take place, the employer should share such findings with the authorities.

The employer is generally not required to disclose the final report, or the data obtained in connection with the investigation. In particular, the employer is not obliged to file a criminal complaint with the police or the public prosecutor's office.

Exceptions may arise, for example, from data protection law (see question 22) or a duty to release records may arise in a subsequent state proceeding.

Data voluntarily submitted in a proceeding in connection with the internal investigation shall be considered private opinion or party assertion.[1] If the company refuses to hand over the documents upon request, coercive measures may be used under certain circumstances.[2]

The investigation findings should be disclosed to a limited group of persons who are involved in the investigation, and for which the findings are useful. For example, an HR manager who needs to record the findings in the employee’s record, the police if the employer decides to proceed further with a criminal claim, the court if requested by that court, or if there is a court case related to the violations of the employee.

Interview records should be kept confidential and private. There is a risk of disclosure because the information in the records may be beneficial to one but damaging to others. If the interview records are leaked to others who are not involved in the investigation, it may affect the work environment in the workplace and the protection of witnesses.