Workplace Investigations
Contributing Editors
Workplace investigations are growing in number, size and complexity. Employers are under greater scrutiny as of the importance of ESG rises. Regulated industries such as finance, healthcare and legal face additional hurdles, but public scrutiny of businesses and how they treat their people across the board has never been higher. Conducting a fair and thorough workplace investigation is therefore critical to the optimal operation, governance and legal exposure of every business.
IEL’s Guide to Workplace Investigations examines key issues that organisations need to consider as they initiate, conduct and conclude investigations in 29 major jurisdictions around the world.
Learn more about the response taken in specific countries or build your own report to compare approaches taken around the world.
Choose countries
Choose questions
Choose the questions you would like answering, or choose all for the full picture.
06. Can co-workers be compelled to act as witnesses? What legal protections do employees have when acting as witnesses in an investigation?
06. Can co-workers be compelled to act as witnesses? What legal protections do employees have when acting as witnesses in an investigation?
Australia
Australia
- at People + Culture Strategies
- at People + Culture Strategies
- at People + Culture Strategies
Co-workers can be interviewed as part of an investigation where they are witnesses to a complaint. If the employee refuses to attend the interview or is generally not cooperating with the investigation, the reasons for this will need to be considered carefully by the employer. Employers should consider whether there can be any amendments made to the interview process to accommodate the employee. However, an employer can make a reasonable and lawful direction to an employee to attend an interview. If an employee fails to comply with a lawful and reasonable direction, then it may constitute grounds for disciplinary action.
Witnesses who are employees are entitled to the legal protections that ordinarily attach to their employment, including not being bullied, discriminated against, or harassed and having their health and safety protected. Employers should also ensure that witnesses are not victimised as a result of participating in the investigation and that confidentiality is maintained.
Austria
Austria
- at GERLACH
- at GERLACH Rechtsanwälte
An essential part of an internal investigation is the questioning of employees. Their statements contribute significantly to clarifying possible violations. In particular, the legal principles that apply to criminal proceedings, including the right to refuse to testify, do not apply directly to internal investigations.
Employees do not legally have to participate in such interviews. Their duty to cooperate arises indirectly from other legal provisions, in particular from employees’ duties of loyalty and service under labour law.
Austrian law suggests there is a general principle of loyalty, which triggers a “duty to inform” under some circumstances; in principle, the employee and any witnesses are expected to provide information in the context of internal investigations. While the employee is not compelled to incriminate him or herself, he or she also may not withhold work-related information that the employer legitimately wishes to protect, for the sole reason that it might incriminate him or her. The decision as to whether the employee must disclose information depends on a balancing of interests in the specific case.
Investigators and employers must strictly adhere to the permissible limits. This requires compliance with labour law, criminal law and data protection law.
Belgium
Belgium
- at Van Olmen & Wynant
Employees cannot be forced by their employer to act as a witness. If they decide to nonetheless testify as a witness, they do not, in principle, have particular rights. If the employee puts himself in a difficult or even dangerous position to act as a witness, it is up to the employer to offer the necessary protection or take measures to prevent any harm (eg, by keeping the identity of the witness confidential or by planning the hearing at a place or time when the employees involved are not aware of it).
However, this is not the case for whistleblowing reports, where a witness might be seen as a “facilitator” who can receive protection against any retaliation by the employer.
Also, workers who were direct witnesses to official allegations of sexual harassment, violence or bullying at work are protected against retaliation by the employer. This also applies to witnesses in court.
Brazil
Brazil
- at CGM
- at CGM
Employees cannot be compelled to act as witnesses. Employers may have trouble enforcing internal policies stating that employees who refuse to participate in investigations will be disciplined (warned, suspended or have their contract terminated for cause), but can terminate their contract without cause.
There are no explicit legal protections for employees acting as witnesses, but it is common best practice to have witnesses’ identities protected to the extent necessary for the investigation, and to protect them from retaliation.
China
China
- at Jingtian & Gongcheng
- at Jingtian & Gongcheng
- at Jingtian & Gongcheng
- at Jingtian & Gongcheng
Article 75 of the Civil Procedure Law of the PRC (Amended in 2021) provides, "All entities and individuals that are aware of the circumstances of a case shall have the obligation to testify in court. The persons-in-charge of relevant entities shall support the witnesses to testify in court. "Article 193 of the Criminal Procedure Law of the PRC (Amended in 2018) provides, "Where, after the notification of a people's court, a witness refuses to testify in court without justified reasons, the people's court may compel the witness to appear in court, unless the witness is the spouse, a parent or a child of the defendant."
According to relevant provisions of the Civil Procedure Law of the PRC, only a court has the power to compel a witness to appear in court. Neither the employer nor any other individual may compel any colleague to act as a witness and testify in court. However, the employer may set forth in the employment contract or its internal rules and regulations that the employee shall cooperate with its internal investigation.
As for the legal system for witness protection, PRC's criminal procedure laws stipulate a relatively detailed legal system for witness protection, such as establishing a crime of retaliating against a witness; making public a witness's personal information such as name, address, employer and contact information for the purpose of protecting the personal safety of the witness; using assumed names in the indictments; and so on. However, there are relatively few legal provisions regarding the legal protection of witness in civil procedure, and provisions only regulate the expenses that may be incurred by the witness for testifying in court. For instance, Article 77 of the Civil Procedure Law of the PRC (Amended in 2021) provides, "The necessary expenses incurred by a witness in fulfilling his obligation to testify in court, including transportation, accommodation and meals, as well as the loss of salaries, shall be borne by the losing party. If a party applies for a witness to testify, the costs and expenses shall be advanced by the party; if the people's court notifies a witness to testify without the application by a party, the costs and expenses shall be advanced by the people's court. "
Finland
Finland
- at Roschier
- at Roschier
There is no legislation on a witness's role in investigations. However, the legislation on occupational safety requires that employees must report any irregularities they observe. Depending on the situation, participating in the investigation may also be part of the person's work duties, role or position, in which case the employer may require the employee to contribute to clarifying the situation. However, there is no formal obligation to act as a witness, and there is no legislation regarding the protection of witnesses. If a witness wishes, they may have, for example, an employee representative as a support person during the hearing.
France
France
- at Bredin Prat
- at Bredin Prat
Co-workers can spontaneously act as witnesses and provide statements to superiors before, during or after the interviews. Co-workers can also be interviewed as witnesses at the investigator’s request, although they are not under any obligation to answer the questions and they cannot be compelled to do so. The investigators have an absolute obligation of discretion during the investigation and cannot reveal any details of the information gathered.
Certain employees may benefit from whistleblower status, which implies that they may be exempt from potential criminal and civil liability relating to their report or testimony and they are protected from any retaliatory measures from the employer. “Facilitators” who helped the whistleblower and the individuals connected with the whistleblower and risk retaliatory measures by testifying as a witness may also benefit from this status, as of 1 September 2022.
Germany
Germany
- at Hengeler Mueller
- at Hengeler Mueller
- at Hengeler Mueller
Since there is no mandatory law (yet) that provides a framework for workplace investigation interviews, there are also no special protective regulations for employees acting as witnesses.
Employees have a contractual duty to participate in interviews – be it as a suspect or as a witness – as part of workplace investigations. The employee must provide truthful information based on his duty of loyalty if:
- the questions relate to his area of work;
- the employer has an interest worthy of protection in obtaining the information; and
- the requested information does not represent an excessive burden for the employee.
Whether such a burden can be assumed when the employee must make statements by which he may incriminate himself is disputed in German case law and legal literature. The German Federal Labour Court has not yet decided on this question. Since an internal workplace investigation interview is an interview under private law and not under criminal law, there are, in our view, good arguments that the employee must also make a true statement even if he incriminates himself, provided his area of work is concerned. However, some labour courts assume that in these cases such a statement could not be used in criminal proceedings.
Greece
Greece
- at Karatzas & Partners
- at Karatzas & Partners
- at Karatzas & Partners
- at Karatzas & Partners
Indirectly involved employees may be interviewed as witnesses in the context of the investigation, as the employee has a duty of loyalty towards the employer originating from the employment relationship. However, they cannot be forced to do so (in contrast with criminal procedures). Any harmful act that could be considered retaliation against witnesses in the context of violence or harassment or whistleblowing investigation is prohibited. In addition, the identity of any employees as witnesses is also covered by the principle of confidentiality.
Hong Kong
Hong Kong
- at Slaughter and May
- at Slaughter and May
- at Slaughter and May
Under Hong Kong law, the employee has an implied duty to obey lawful instructions from his or her employer and to serve the employer with fidelity and good faith during the term of his or her employment. A lawful instruction from an employer may include a reasonable request for the employee to participate and provide information in the workplace investigation. If the employee refuses to comply with such instruction or is obstructive or provides untrue or misleading information, it could constitute a ground for summary dismissal under the EO and at common law.
That said, in general terms, an employer should not compel any employee to testify against a co-worker, particularly if such a co-worker is a senior colleague, as evidence provided under compulsion may not be helpful to the investigation.
Employees who act as witnesses must be treated as per their contractual and statutory rights, including the right against self-incrimination. If the investigation involves allegations of discrimination on the ground of sex, race or disability, the employer should ensure that the witnesses will not be victimised or treated less favourably than other employees.
India
India
- at Trilegal
- at Trilegal
- at Trilegal
Yes, in matters pertaining to sexual harassment, the SH Act expressly stipulates that the IC holds the powers of a civil court to summon any person to be examined as a witness. In misconduct cases, the investigating authority can ask employees to appear and testify before it as witnesses and internal policies should have provisions for this. As a result, employees are duty-bound to fairly and honestly participate in any investigative or disciplinary proceedings relating to the workplace, including offering truthful evidence and testimony on matters they may have observed or experienced as an employee of the organisation. While employees don't have any express statutory protections when acting as witnesses, any such policy should be balanced and include necessary safeguards, such as assuring employees that any retaliation against them will not be tolerated and that the details of their participation will only be shared on a need-to-know basis.
Ireland
Ireland
- at Ogier
- at Ogier
Yes, but a qualified yes. To deny an employee who is the respondent to the complaint the right to cross-examine the complainant during a workplace investigation may amount to a breach of fair procedures. This does not mean in practice that a complainant or witness will have to physically or virtually attend a meeting to be subjected to cross-examination. What usually happens, in practice, is that specific questions of the respondent are put to the witness by the investigator for them to respond. On occasion and depending on the circumstances, the witnesses may respond in writing.
Generally, if witnesses do not wish to participate in workplace investigations and they are not the witnesses from whom the complaint originated, there is little that can be done. An employee may not want to be seen as going against a colleague, which impacts the wider issue of staff morale. An employer cannot force them to participate. Also an employee who is the respondent should be careful about seeking to compel witnesses to attend. While the respondent may request support from a colleague to act as a witness, that colleague may view things differently, which can lead to further issues.
In any event, employees cannot be victimised or suffer any adverse treatment for having acted as a witness.
Italy
Italy
- at BonelliErede
- at BonelliErede
In general, employees must cooperate with a workplace investigation (as it is part of their general duty of diligence, as provided under article 2104 of the Italian Civil Code), and this may also include a duty to act as a witness.
In this respect, it must be pointed out that, even if the employee has a contractual duty to provide information requested by the employer, one limit to this principle could be, for example, self-incrimination.
However, caution is necessary during the interviews both with the employee under investigation and with co-workers, to avoid the risk of transforming the interview into what could be considered the de facto start of a disciplinary procedure. In other words, during the interview, the employer should only gather information on certain facts, and not put forward charges against the employee; otherwise, this could prevent or limit the employer’s possibility to take disciplinary action regarding the same facts.
Furthermore, employees who cooperate within the workplace investigation must be protected against any retaliatory action directly or indirectly linked to their testimony (eg, as far as is possible, anonymity should be guaranteed, and disciplinary measures should apply to those who breach measures in place to protect the employee).
Apart from workplace investigations, employees are protected against retaliatory measures of any kind, which are always null and void and subject to appeal.
For a defensive criminal law investigation (see par. 4), the witness can refuse to testify; in this case, the criminal law lawyer may ask the prosecutor to interview the witness.
Japan
Japan
- at Mori Hamada & Matsumoto
Interviewing co-workers is often conducted in internal investigations. Company employees are generally required to cooperate with company investigations, especially those who are in a position to instruct and supervise employees, or those who are responsible for maintaining corporate order, since cooperation with an investigation is itself the fulfilment of their duty to the company. Other employees are not compelled to cooperate with such an investigation unless it is deemed necessary and reasonable. No specific legal protection is provided for testifying in an investigation.
Netherlands
Netherlands
- at De Brauw Blackstone Westbroek
- at De Brauw Blackstone Westbroek
- at De Brauw Blackstone Westbroek
There is no statutory regime for employee witnesses in internal (workplace) investigations and, hence, no specific statutory regime for legal protection. However, as part of the idea that employees have to act in line with good employment practices (section 7:611 DCC), employees, who potentially acquired knowledge in a work-related context on the subject matter of an investigation, are typically required vis-à-vis their employer to participate in such internal investigations. The required degree of cooperation will depend on the type and nature of the investigation and the matter that is being investigated. The principle of “good employment practices” in turn requires the employer to be guided by proportionality and subsidiarity considerations: which information is relevant to the investigation and what is the least burdensome means of collecting such information?
This may also impact the degree to which an employer can involve employee witnesses in an investigation. Increased prudence should be observed, among other things, if the relevant employee witnesses may themselves become implicated in the investigation or when the employer envisages sharing certain investigative findings with regulatory or criminal authorities, for instance as part of cooperation arrangements in an ongoing investigation. In such cases, the relevant employee should at least be allowed to retain legal counsel before continuing interview procedures.
Nigeria
Nigeria
- at Bloomfield LP
The employee’s contract, employee handbook or company policies typically mandate an employee to cooperate and participate in good faith in any lawful internal investigation undertaken by the company, and also protects an employee acting as a witness in an internal investigation. Some of the legal protections available to an employee acting as a witness during workplace investigations are freedom from intimidation, threats or the loss of employment.
Philippines
Philippines
- at Villaraza & Angangco
Neither the employer nor the employee subject of the investigation can compel co-workers to act as a witness. There is no specific law for whistleblowers or employees who act as witnesses during an investigation. Nevertheless, the employer can have its own whistleblower policy.
Poland
Poland
- at WKB Lawyers
- at WKB Lawyers
- at WKB Lawyers
In general, an employee may not be forced to act as a witness, but based on the provisions of the Polish Labour Code, an employee must act for the benefit of a working establishment or employer and perform work in line with the instructions of an employer. A lack of cooperation from an employee (eg, refusing to attend a hearing, hiding facts or even false testimony) may constitute a basis for the loss of an employer’s trust in the employee and, as a consequence, may constitute a valid reason for termination (in some specific situations, even without notice).
There is no formal protection for employees who act as witnesses. However, participation in an investigation cannot result in negative consequences (eg, no retaliation is allowed). Also, during an investigation, employees who are bound by professional secrecy are not required to provide information that would imply a breach of such secrecy.
Portugal
Portugal
- at Uría Menéndez - Proença de Carvalho
If the employer decides on an internal investigation to assess potential wrongful actions carried out within the company, employees must cooperate. However, employees are entitled to the privilege against self-incrimination established in the Portuguese Criminal Code, according to which individuals are not obliged to self-report.
An employee's refusal to cooperate with an internal investigation may be regarded as a breach of conduct by the employer and, ultimately, may lead to disciplinary sanctions.
Employees who act as witnesses in cases of harassment cannot be sanctioned unless they acted with wilful misconduct, and any sanction applied to an employee who acted as a witness in a harassment procedure will be presumed to be abusive.
Singapore
Singapore
- at Rajah & Tann Singapore
- at Rajah & Tann Singapore
- at Rajah & Tann
Singapore law does not impose any statutory or legal obligation on an employee to act as a witness in the investigation. Accordingly, an employer does not have the power to compel its employees to act as witnesses in an investigation.
Notwithstanding this, an employer may require an employee to assist in investigations pursuant to specific contractual obligations in the employee’s terms of employment (as may be contained in the employment contract, employee handbook or the employer’s internal policies and procedures in dealing with the investigations, etc). Further, a request for an employee to provide evidence of an event that he or she knows of may reasonably be deemed to be a lawful and reasonable directive from an employer.
Consequently, an employee’s refusal to act as a witness may amount to an act of insubordination that may attract disciplinary action by the employer.
Employers requiring employees to act as witnesses in an investigation must ensure that they comply with the expectations and norms set out by the Tripartite Guidelines on Fair Employment Practices and the TAFEP Grievance Handling Handbook.
South Korea
South Korea
- at Kim & Chang
- at Kim & Chang
- at Kim & Chang
- at Kim & Chang
While there are no laws to compel co-workers to act as witnesses, the company may have internal policies (eg, rules of employment, code of conduct) that require employees to cooperate with company actions such as a workplace investigation. That said, it would be difficult to enforce such policies even if the employee refuses to cooperate (eg, taking disciplinary action against an employee who refuses to act as a witness).
There may be instances when the company is required to provide certain legal protection to employees acting as witnesses in an investigation. For example, if a whistleblower falling under the WPA is required to act as a witness, they would be entitled to legal protections as discussed in question 1. The company may also have internal policies that provide protection to employees acting as witnesses in an investigation.
Spain
Spain
- at Uría Menéndez
- at Uría Menéndez
A company cannot force an employee to actively take part in a workplace investigation or to act as a witness. However, if a co-worker’s decision not to collaborate could be construed as an attempt to conceal evidence of wrongdoing, the company could then enforce disciplinary measures for this reason.
In our experience, employees tend to collaborate during workplace investigations and no retaliatory action can be taken against them for this reason. For example, if an employee provided evidence against his or her direct manager, the manager could not reprimand the employee or take any action that could be construed as such.
Sweden
Sweden
- at Mannheimer Swartling
- at Mannheimer Swartling
- at Mannheimer Swartling
In general, yes, employees in Sweden have a far-reaching duty of loyalty toward their employers. This includes, among other things, a duty to truthfully answer an employer’s questions and to inform the employer of events that may be of interest to the employer. An employee’s obligation to assist is, however, more limited when assistance would entail self-incrimination.
A person acting as a witness under an investigation governed by the Swedish Whistleblowing Act will be protected by confidentiality. Personal data and details that could reveal the identity of a witness may not be disclosed without authorisation.
Switzerland
Switzerland
- at Bär & Karrer
- at Bär & Karrer
Due to the employee's duty of loyalty towards the employer and the employer's right to give instructions to its employees, employees generally must take part in an ongoing investigation and comply with any summons for questioning if the employer demands this (article 321d, Swiss Code of Obligations). If the employees refuse to participate, they generally are in breach of their statutory duties, which may lead to measures such as a termination of employment.
The question of whether employees may refuse to testify if they would have to incriminate themselves is disputed in legal doctrine.[1] However, according to legal doctrine, a right to refuse to testify exists if criminal conduct regarding the questioned employee or a relative (article 168 et seq, Swiss Criminal Procedure Code) is involved, and it cannot be ruled out that the investigation documentation may later end up with the prosecuting authorities (ie, where employees have a right to refuse to testify in criminal proceedings, they cannot be forced to incriminate themselves by answering questions in an internal investigation).[2]
[1] Nicolas Facincani/Reto Sutter, Interne Untersuchungen: Rechte und Pflichten von Arbeitgebern und Angestellten, published on hrtoday.ch, last visited on 17 June 2022.
[2] Same opinion: Nicolas Facincani/Reto Sutter, Interne Untersuchungen: Rechte und Pflichten von Arbeitgebern und Angestellten, published on hrtoday.ch, last visited on 17 June 2022.
Thailand
Thailand
- at Chandler MHM
- at Chandler MHM
Normally, the work rules prescribe requirements for cooperation with investigations. An employer may instruct co-workers to give statements as witnesses as this would be a fair and legitimate order of the employer, because investigations are conducted to maintain a good working environment.
Witness protection measures in a workplace can vary as no minimum standard has been set and they are generally subject to work rules and regulations. However, some legislation, which may not relate to a workplace investigation conducted by an employer, also protects the witnesses who are helping authorities investigate violations under the relevant acts. For example, the Labor Relation Act B.E. 2518 (1975) prohibits an employer from terminating an employee or conducting any action that may result in the employee being unable to work because of filing a complaint or being a witness for the authorities, or providing information on issues related to labour protection laws to the authorities.
The employer may have a policy of non-retaliation for the protection of witnesses who have given statements and evidence for a workplace investigation.
Turkey
Turkey
- at Paksoy
- at Paksoy
- at Paksoy
- at Paksoy
Co-workers cannot be compelled to act as witnesses in a workplace investigation. Employees also have rights arising from the law that must be respected by the employers and investigators, such as the right to privacy or to remain silent, freedom of expression and communication. These rights must be protected during every step of the workplace investigation process.
United Kingdom
United Kingdom
- at Slaughter and May
- at Slaughter and May
Employees may be reluctant to be interviewed or act as witnesses as part of an investigation, perhaps due to fear of reprisals. The investigator should discuss any concerns with the employee and attempt to alleviate any fears.
In general terms, an employer should not compel any employee to provide a witness statement. There may be circumstances in which this could be seen as a reasonable management instruction (and any refusal to comply treated as a disciplinary matter), but these will be rare. Evidence that is compelled is unlikely to be particularly useful to the investigator.
It may be possible to establish an express or implied obligation for senior managers to report on another employee's misconduct – as a feature of either their employment contractual duties, their fiduciary duties or their implied duty of fidelity. However, it is unlikely, in the absence of an express obligation, that a junior employee would be compelled to give evidence against a colleague.
Employees who act as witnesses benefit from their usual employment protections, and must be treated as per their contractual and statutory rights, as well as any policy governing the investigation. If the investigation involves allegations which could involve discrimination, the EA 2010 extends protection from victimisation to “giving evidence or information in connection with proceedings under this Act”. Witnesses should therefore not be subject to any detrimental treatment because they have acted as a witness in this type of investigation. Witnesses may also be entitled to protection as whistleblowers if their evidence amounts to a protected disclosure (see question 9).
United States
United States
- at Cravath, Swaine & Moore
- at Cravath, Swaine & Moore
- at Cravath, Swaine & Moore
Yes. The investigator is empowered to decide which witnesses should be interviewed as a part of the fact-gathering process. In addition to interviewing the complainant, the investigation should include individual interviews with other involved parties, including the subject of the complaint, as well as individuals who may have observed the alleged conduct or may have other relevant knowledge, including supervisors or other employees. Many companies’ code of conduct, employee handbook or similar policy set forth the requirement for current employees to cooperate fully in any investigation by the company or its external advisors and also provide that failure to do so could result in disciplinary action, up to and including termination.
In the absence of contractual protections, employees may have no legal right to refuse to submit to an interview, even if their answers tend to incriminate them. That being said, when acting as a witness in an internal investigation, a current employee is usually afforded similar legal protections as the subject of an investigation, including the right to oppose unreasonable intrusions into his or her privacy and unreasonable workplace searches. For example, certain state laws prohibit an employer from questioning an employee regarding issues that serve no business purpose.
Vietnam
Vietnam
- at Le & Tran Law Corporation
- at Le & Tran Law Corporation
There are no provisions in Vietnamese law that impose any statutory or legal obligation on an employee to act as a witness in an investigation. Hence, an employer does not have the power to compel its employees to act as witnesses in an investigation. However, a request for an employee to provide evidence or give details of an event that he or she knows of may reasonably be deemed to be a lawful and reasonable directive from an employer. Consequently, an employee’s refusal to act as a witness may be tantamount to an act of insubordination, which may lead to disciplinary action by the employer. In any circumstances, if an employee refuses to attend an interview or is generally not cooperating with an investigation, the reasons for this will need to be considered carefully by the employer.
07. What data protection or other regulations apply when gathering physical evidence?
07. What data protection or other regulations apply when gathering physical evidence?
Australia
Australia
- at People + Culture Strategies
- at People + Culture Strategies
- at People + Culture Strategies
As part of an investigation, the investigator may want to collect evidence such as camera footage from CCTV, swipe card records, computer records, telephone records or recordings and GPS tracking. There are state-based workplace surveillance laws that operate in each jurisdiction in Australia. The laws recognise that employers are justified in monitoring workplaces for proper purposes, but this is balanced against employees’ reasonable expectations of privacy.
The Privacy Act 1988 (Cth) (Privacy Act) also regulates how certain organisations handle personal information, sensitive personal information and employee records. The Privacy Act contains 13 privacy principles that regulate the collection and management of information. Employers should familiarise themselves with the privacy principles before conducting any investigation to ensure they are not in breach when gathering evidence.
Austria
Austria
- at GERLACH
- at GERLACH Rechtsanwälte
All data processing must comply with the principles of article 5 GDPR (lawfulness, fairness, transparency, purpose limitation, data minimisation, accuracy, storage limitation and integrity). Personal data may only be collected and processed for specific, lawful purposes.
The admissibility of data processing depends on whether the suspicion relates to a criminal offence or another violation of the law. If the data processing is relevant to criminal law, article 10 GDPR or section 4(3) of the Austrian Data Protection Act (DSG) applies. If the investigations are exclusively to clarify violations under civil or labour law, such as an assertion of claims for damages or if they are general investigations to establish a criminal offence, the permissibility of data processing is based on article 6 or, for data covered by article 9 GDPR, on this provision.
Belgium
Belgium
- at Van Olmen & Wynant
Here, the investigation “collides” with the right to privacy of the persons involved.
First, the rules and principles of the GDPR will apply if personal data is involved. Therefore, the employer will have to find a data-processing ground, which could be his or her legitimate interest or the fact that the investigation could lead to legal proceedings, etc. The data processing should also be limited to what is proportionate and the data subjects should be informed. Due to this obligation, it is arguable that the GDPR policy already provides the necessary information for the employees not to jeopardise the investigation. In any case, data subjects should not be able to use their right to access data to ascertain the preliminary findings of the investigation (which are confidential) or any confidential identities involved (eg, in the whistleblower procedure, the identity of the report should be protected at all times).
Also, the employer should follow the procedure of Collective Bargaining Agreement No. 81 on searching the e-mails or computer files and internet searches of employees. This CBA limits the purposes for searches and lays down a double-phase procedure that needs to be followed if private data is involved. Next to this, the employer should also take into account the case law of the European Court of Human Rights, which only allows e-mail and computer searches based on the following:
- whether the employee has been notified of the possibility that the employer might take measures to monitor correspondence and the implementation of such measures;
- the extent of the monitoring and the degree of intrusion into the employee’s privacy (including a distinction between the monitoring of the flow or the content of the communications);
- whether the employer has provided legitimate reasons to justify monitoring of the communications and accessing of their actual content; and
- whether it would have been possible to establish a monitoring system based on less intrusive measures, the consequences of the monitoring for the employee who is subject to it, and whether the employee had been provided with adequate safeguards.
Next, if the employer wants to use camera images, the rules of Collective Bargaining Agreement No. 68 should have been followed when installing cameras. If not, the images might have been collected illegally.
Brazil
Brazil
- at CGM
- at CGM
The Brazilian General Data Protection Law (LGPD) does not have specific rules or principles that apply to internal investigations conducted within private organisations. Despite that, the general principles and obligations set forth by the LGPD apply to any processing of personal data carried out within the context of such investigations. As a result, the company must ensure the transparency of such processing activities through a privacy notice addressed to the data subjects; only process the personal data that is necessary for the investigation; define the lawful basis that applies to such processing activities (especially for sensitive data); and apply any other obligations established by the LGPD.
China
China
- at Jingtian & Gongcheng
- at Jingtian & Gongcheng
- at Jingtian & Gongcheng
- at Jingtian & Gongcheng
The Civil Code of the PRC, the Personal Information Protection Law of the PRC and other laws provide for the protection of employees' personal information and privacy. Employers are often involved in checking the information and materials stored in the computers, hard disks and other electronic office equipment provided to employees in internal investigation and are likely to access the employees' personal information including personal privacy information, such as the communication records stored in instant communication software such as WeChat, QQ or other instant communication software or to and from private email boxes. According to the Personal Information Protection Law of the PRC, employers are required to perform the obligation of informing and obtain the individuals' consent prior to the processing of personal information, i.e. the principle of informing + consent. Moreover, the Civil Code of the PRC stipulates that no organization or individual may process any person's private information, except as otherwise provided by law or with the explicit consent of the right holder.
Therefore, the legitimacy of obtaining data evidence can be enhanced and guaranteed only if it is explicitly stated in the relevant rules and regulations that the employer shall have the right to the work equipment provided to the employees or obtains the employees' personal consent.
Finland
Finland
- at Roschier
- at Roschier
Generally, the basic principles set out by the GDPR and the Finnish Data Protection Act apply to data processing in connection with investigations, including evidence gathering: there must be a legal basis for processing, personal data may only be processed and stored when and for as long as necessary considering the purposes of processing, etc.
Additionally, if physical evidence concerns the electronic communications (such as emails and online chats) of an employee, gathering evidence is subject to certain restrictions based on Finnish ePrivacy and employee privacy laws. As a general rule, an employee’s electronic communications accounts, including those provided by the employer for work purposes, may not be accessed and electronic communications may not be searched or reviewed by the employer. In practice, the employer may access such electronic correspondence only in limited situations stipulated in the Act on Protection of Privacy in Working Life (759/2004), or by obtaining case-specific consent from the employee, which is typically not possible in internal investigations, particularly concerning the employee suspected of wrongdoing.
However, monitoring data flow strictly between the employee and the employer's information systems (eg, the employee saving data to USB sticks, using printers) is allowed under Finnish legislation, provided that employee emails, chats, etc, are not accessed and monitored. If documentation is unrelated to electronic communications, it also may be reviewed by the employer. Laptops, paper archives and other similar company documentation considered "physical evidence" may be investigated while gathering evidence on the condition that any private documentation, communications, pictures or other content of an employee are not accessed.
France
France
- at Bredin Prat
- at Bredin Prat
GDPR principles fully apply to data gathering, as well as case law protecting the right to respect one’s private life and the secret of correspondence.
Germany
Germany
- at Hengeler Mueller
- at Hengeler Mueller
- at Hengeler Mueller
When collecting data (in physical or digital form), the employer must ensure compliance with the data protection principles according to the General Data Protection Regulation (DSGVO) and the German Data Protection Act (BDSG). These principles include, among other things, that data collection must be carried out lawfully (principle of legality) and transparently (transparency principle) and must be comprehensively documented – specifically concerning the purpose of the workplace investigation – to be able to prove compliance with data protection.
The principle of legality states that data may only be collected on a legal basis (ie, there must either be a law authorising this or the employee must have consented to the collection of his data).
The transparency principle may constitute a special challenge during workplace investigations. Under the transparency principle, the employee must be generally informed about the collection of his data. This includes information on who processes the data, the purposes for which it is processed and whether the data is made available to third parties. However, there may be a risk of collusion, particularly when electronic data has to be reviewed, and thus the success of the investigation may be jeopardised if the relevant employee is comprehensively informed in advance. Accordingly, the employer should check, with the assistance of the data protection officer, whether the obligation to provide information may be dispensed with. This may be the case if providing the information would impair the assertion, exercise or defence of legal claims and the interests of the employer in not providing the information outweigh the interests of the employee. The respective circumstances and employer's considerations should be well documented in each case.
Regardless of whether the employee is informed about the investigation, to prevent data loss, the employee should be sent a so-called hold notice (ie, a prohibition to delete data). Additionally, to prevent automatic deletion, blocking mechanisms should also be implemented.
When gathering evidence by searching the employee's possessions or files, the employee's privacy rights also need to be observed (see question 8).
Greece
Greece
- at Karatzas & Partners
- at Karatzas & Partners
- at Karatzas & Partners
- at Karatzas & Partners
GDPR and the provisions of L. 4624/2019 regulate the gathering of physical evidence from a data protection perspective, providing, among other things, that personal data should be processed with transparency and to the extent necessary for the investigation.
L.4990/2022 on the protection of persons who report breaches of Union law regulates data protection issues in the context of whistleblowing investigations, mainly to safeguard confidentiality throughout the investigations.
Hong Kong
Hong Kong
- at Slaughter and May
- at Slaughter and May
- at Slaughter and May
If physical evidence contains data relating to an individual, from which the identity of the individual can be ascertained,[1] the data would constitute personal data under the Personal Data (Privacy) Ordinance (Cap. 486) (PDPO). The PDPO sets out several data protection principles that the employer must comply with while processing personal data, including:[2]
- personal data must be collected for a lawful purpose related to a function or activity of the employer and should not be excessive for this purpose. An internal investigation would be regarded as a lawful purpose;
- personal data must be accurate and not kept longer than is necessary;
- personal data must not be used for a purpose other than the internal investigation (or other purposes for which the data was collected) unless the employee consents to a new use or the new use falls within one of the exceptions provided in the PDPO;
- personal data must be safeguarded against unauthorised or accidental access, processing or loss; and
- the employee whose personal data has been collected has the right to request access to and correction of his or her personal data retained by the employer.
If an employer wants to gather evidence through employee monitoring, it should ensure that the act of monitoring complies with the data protection principles of the PDPO if the monitoring activity would amount to the collection of personal data. The Privacy Commissioner for Personal Data has issued guidelines to employers on the steps they can take in assessing whether employee monitoring is appropriate for their businesses.[3] As a general rule, employee monitoring should be conducted overtly. Further, those who may be affected should be notified in advance of the purposes the monitoring is intended to serve, the circumstances in which the system will be activated, what personal data (if any) will be collected and how the personal data will be used.
Covert surveillance of employees should not be adopted unless it is justified by relevant special circumstances. Employers should consider whether there is reason to believe that there is an unlawful activity taking place and the use of overt monitoring would likely prejudice the detection or collection of evidence.[4] Even if covert monitoring is justified, it should target only those areas in which an unlawful activity is likely to take place and be implemented for a limited duration of time.
India
India
- at Trilegal
- at Trilegal
- at Trilegal
In India, the collection, disclosure, transfer and storage of personal data is regulated by the Information Technology (Reasonable Security Practices and Procedures and Sensitive Personal Data or Information) Rules, 2011 (SPD Rules). Accordingly, if during an investigation any sensitive personal information (such as information relating to passwords; financial information such as a bank account, credit or debit card or other payment instrument details; a physical, physiological or mental health condition; sexual orientation; medical history; and biometric information) is collected, then the requirements under the SPD Rules will need to be complied with. This would include obtaining an individual’s “informed consent” before collecting any sensitive personal data if such information is intended to be collected or stored in an electronic format.
Ireland
Ireland
- at Ogier
- at Ogier
Under the GDPR (General Data Protection Regulation), personal data must be processed lawfully, fairly and in a transparent manner in relation to the data subject. The Data Protection Commission published Data Protection in the Workplace: Employer Guidance in April 2023, which is a useful guide.
Employers should exercise caution when gathering physical evidence that may involve the use of CCTV or other surveillance practices. The Irish Court of Appeal in the case of Doolin v DPC examined the use by an employer of CCTV footage for disciplinary purposes and found such use constituted unlawful further processing. The original reason for processing the CCTV footage was to establish who was responsible for terrorist-related graffiti that was carved into a table in the staff tearoom. It subsequently transpired Mr Doolin, who was in no way connected to the graffiti incident, had accessed the tearoom for unauthorised breaks and a workplace investigation followed. The original reason for viewing the CCTV related to security, but further use of the CCTV footage in the disciplinary investigation was not related to the original reason. This case confirms that employers must have clear policies in place in compliance with both GDPR and the Data Protection Act 2018 specifying the purpose for which CCTV or any other monitoring system is being used. Not only that, but these policies must be communicated to employees specifying the use of such practices.
It is not only data about the investigation that must be processed fairly, but any retention of the data, which can only be further processed with good reason. It is a legitimate business reason to retain data to deal with any subsequent requests or appeals under various internal or statutory processes, provided employees have been advised of the relevant retention period.
Italy
Italy
- at BonelliErede
- at BonelliErede
Several legal and case-law principles may be relevant depending on the kind of investigation, including the following:
- gathering evidence through employee “physical inspections and inspections on the employee’s belongings”: according to article 6 of the Workers’ Statute, these inspections are generally prohibited. They are permitted only where necessary to protect company assets (in such cases, corporal inspections may be carried out, subject to trade union agreement or National Labour Inspectorate authorisation, provided that, for example, they are carried out outside the workplace, that employees are selected with an automatic selection tool, and that the dignity and confidentiality of employees are protected);
- gathering evidence through “audiovisual equipment and other instruments from which the possibility of remote control of employees’ activities arises”: according to article 4 of the Workers’ Statute, remote systems cannot be directly aimed at controlling employees’ activity, but can only be put in place for organisational, production, work safety or asset-protection needs (which may result in an indirect control over employees’ activity), and may be installed before a trade union agreement or with previous authorisation from the National Labour Inspectorate; however, these rules do not apply to working tools in an employee’s possession (see question 8) and, in any case, employees must be informed of the possibility of remote control;
- gathering physical evidence through so-called defensive controls: according to the most recent case law, “defensive controls” can be defined as investigations carried out by the company where it has a suspicion of unlawful conduct by its employees. These controls can be carried out within certain limits and restrictions provided by case law – even in the absence of the guarantees provided for in article 4 of the Workers’ Statute.
In addition, when gathering physical evidence, there may be other provisions of law not strictly related to employment law that must be followed, for example, regarding privacy regulations (eg, minimisation of the use of personal data, collection of data only for specific purposes, and adoption of safety measures).
Japan
Japan
- at Mori Hamada & Matsumoto
When collecting physical evidence that contains personal information, the Personal Information Protection Law and its related guidelines apply. In addition, when collecting physical evidence that contains privacy information or an employee's photograph, care must be taken to ensure that the right to privacy and the image rights are not violated.
Netherlands
Netherlands
- at De Brauw Blackstone Westbroek
- at De Brauw Blackstone Westbroek
- at De Brauw Blackstone Westbroek
Dutch data protection rules are based on the EU Data Protection Directive. The employer has to notify the Dutch Data Protection Authority when processing personal data as part of an internal investigation. Given that the notification can be accessed publicly, it is recommended that the employer give a sufficiently high-level description of the case. In addition, the description should be sufficiently broad to include the entire investigation, and any future expansions of the scope of the investigation. Often companies make filings for all future internal investigations, without referring to specific matters.
The employer has to notify employees whose personal data is being processed about – among other things – the purposes of the investigation and any other relevant information. According to the Dutch Data Protection Act, this information obligation may only be suspended on restricted grounds, i.e. if the purpose of the investigation is the prevention, detection and prosecution of crimes and postponement is necessary for the interests of the investigation (e.g., because there is a risk of losing evidence, or collusion by individuals coordinating responses before being interviewed)). These exceptions on the duty to inform involved persons must be interpreted very restrictively. As soon as the reason for postponement is no longer applicable (e.g., because the evidence has been secured), the individuals need to be informed.
Dutch data protection law does not require the consent of employees. Consent given by employees, however, also cannot compensate for a lack of legitimate purpose or unnecessary or disproportionate data processing, as the consent given by an employee to its employer is not considered to be voluntary given the inequality of power between them.
Furthermore, internal company policies may contain specific data protection rules.
Nigeria
Nigeria
- at Bloomfield LP
When gathering evidence, the person being investigated is protected by the Constitution, the Freedom of Information Act and the Nigerian Data Protection Regulation (NDPR), among others.
The Constitution, particularly section 37, guarantees the right of a person to privacy.
The NDPR is the main data protection regulation in Nigeria. It regulates the processing and transfer of personal data.
Further, the Freedom of Information Act, 2011 prohibits the disclosure of information gathered during an investigation to the public.
Philippines
Philippines
- at Villaraza & Angangco
The procedure for gathering physical evidence is governed primarily by company policy. Nevertheless, the Data Privacy Act of the Philippines protects all data subjects from unlawful processing of their personal information without consent.
Poland
Poland
- at WKB Lawyers
- at WKB Lawyers
- at WKB Lawyers
If personal data is involved – the rules and principles of the GDPR will apply. If the physical evidence includes e-mail correspondence, files, or an employee’s equipment and possessions, the Labour Code will apply (ie, as a general rule, to monitor it, a monitoring policy must be implemented at that working establishment). Such a policy must strictly determine the aim of the surveillance and an employer must only apply surveillance in situations that reflect this aim. Also, when it comes to monitoring correspondence, it must not infringe on the secrecy of the correspondence, which in practice means that the employer should not check employees’ private correspondence when checking their business mailboxes.
Portugal
Portugal
- at Uría Menéndez - Proença de Carvalho
Whenever employers process personal data in the course of an investigation, they need to comply with Regulation (EU) 2016/679 (the GDPR) and Law 58/2019, which implements the GDPR in Portugal (jointly the Data Protection Regulations). If the gathering of physical evidence includes the collection and processing of sensitive data (eg, related to the employee’s health or any other category outlined in article 9 of the GDPR), additional safety measures should be in place to safeguard the adequate and confidential nature of such information.
Singapore
Singapore
- at Rajah & Tann Singapore
- at Rajah & Tann Singapore
- at Rajah & Tann
The employer may collect the personal data of an individual without the individual’s consent or from a source other than the individual, where it is necessary for any investigation according to section 17(1) read with paragraph 4 of Part 3 of the Third Schedule of the Personal Data Protection Act 2012 (PDPA). Under section 2(1) of the PDPA, “investigation” means an investigation relating to:
- a breach of an agreement;
- a contravention of any written law, or any rule of professional conduct or other requirement imposed by any regulatory authority in the exercise of its powers under any written law; or
- a circumstance or conduct that may result in a remedy or relief being available under any law.
Under the Banking Act 1970, a bank and its officers cannot disclose customer information to third parties, subject to certain exceptions. An employer carrying out a workplace investigation does not fall within any of the exceptions.
South Korea
South Korea
- at Kim & Chang
- at Kim & Chang
- at Kim & Chang
- at Kim & Chang
It may be difficult for a company to search and collect physical items that personally belong to the employee.
While the company may search and gather electronic data, such as emails or files stored in work laptops or company servers, there are requirements and restrictions under the Criminal Code, the Personal Information Protection Act (PIPA), and the Act on Promotion of Information and Communications Network Utilisation and Information Protection, etc (Network Act), among other laws.
Article 316(2) of the Criminal Code states that accessing the contents of another person’s documents, pictures, special media records, etc, that are sealed or designated as secret using technical means may constitute the crime of accessing electronic records.
Under the PIPA, consent must be obtained from the information owner to collect or use personal information, or to provide such information to a third party. Consent must be separately obtained for sensitive information or unique identification information. There are strict requirements as to the format and contents of the consent forms under the PIPA.
The Network Act prohibits accessing an information and communications network without rightful authority or any intrusion that goes beyond the permitted authority for access. Although this may not be an issue if a company directly manages the email accounts at issue, if an employee’s email account is protected by a password or through other means, accessing emails from that account without obtaining the employee’s consent could constitute unlawful intrusion under the Network Act as well as under the Criminal Code as discussed above.
Spain
Spain
- at Uría Menéndez
- at Uría Menéndez
The General Data Protection Regulation and the Spanish Data Protection Law apply when gathering any type of evidence, including physical evidence. This means that companies may only process personal data when they have lawful grounds to do so and within the limits set forth for special categories of personal data (health, union affiliation, criminal records, etc.).
The Spanish Statute of Workers specifically states that employees and their possessions may be registered when it is necessary to protect the companies’ property (or the property of other co-workers). This registration must:
- be conducted in the workplace and during working hours;
- respect the employee’s privacy and dignity; and
- be performed in front of an employee representative or, if not possible, in the presence of another employee of the company.
Sweden
Sweden
- at Mannheimer Swartling
- at Mannheimer Swartling
- at Mannheimer Swartling
To the extent the gathering of physical evidence includes the processing of personal data, please see question 1.
Switzerland
Switzerland
- at Bär & Karrer
- at Bär & Karrer
The Swiss Federal Act on Data Protection applies to the gathering of evidence, in particular such collection must be lawful, transparent, reasonable and in good faith, and data security must be preserved.[1]
It can be derived from the duty to disclose and hand over benefits received and work produced (article 321b, Swiss Code of Obligations) as they belong to the employer.[2] The employer is, therefore, generally entitled to collect and process data connected with the end product of any work completely by an employee and associated with their business. However, it is prohibited by the Swiss Criminal Code to open a sealed document or consignment to gain knowledge of its contents without being authorised to do so (article 179 et seq, Swiss Criminal Code). Anyone who disseminates or makes use of information of which he or she has obtained knowledge by opening a sealed document or mailing not intended for him or her may become criminally liable (article 179 paragraph 1, Swiss Criminal Code).
It is advisable to state in internal regulations that the workplace might be searched as part of an internal investigation and in compliance with all applicable data protection rules if this is necessary as part of the investigation.
Thailand
Thailand
- at Chandler MHM
- at Chandler MHM
The basic premise is that all evidence is admissible unless it violates the law of admissibility and production of evidence, which may vary depending on the jurisdiction. In a criminal court, for example, evidence gathered in violation of the fruit of the poisonous tree doctrine would be typically inadmissible, yet in a civil court, this doctrine would not be an exclusionary rule.
The Personal Data Protection Act, BE 2562 (2019) (PDPA), which is the main data protection law in Thailand, applies when collecting, using, and disclosing pieces of evidence containing the personal data of employees. If the investigation requires sensitive information of the employee under investigation, for example, race, ethnic origin, political opinion, religious or philosophical beliefs, sexual behavior, criminal records, health data, disability, genetic data and biometric data, consent from the employee should be obtained.
Turkey
Turkey
- at Paksoy
- at Paksoy
- at Paksoy
- at Paksoy
The conditions applicable to gathering physical evidence mainly stem from the precedents of the Turkish Constitutional Court about employment disputes and the rules set forth under Turkish Law No. 6698 on the Protection of Personal Data (DPL). It is generally accepted that employers can gather physical evidence for certain legitimate purposes, such as disciplinary investigations, the prevention of bribery and corruption, fraud or theft, money laundering, and employee performance monitoring and compliance. In doing so, employers must, however, comply with the fundamental principles of the Turkish Constitutional Court as briefly described below:
- The grounds for the gathering of evidence must be legitimate. The definition of the legitimate interests of the employer may change depending on the characteristics of the business, workplace and employee job description, as well as the specific circumstances of the case. Therefore, it is advisable to carry out a balancing test between the legitimate interest the employer is seeking to protect and the employee’s interest in the protection of their privacy.
- The collection activities must be proportionate, in the sense that the measure implemented by the employer must be appropriate and reasonably necessary to achieve the legitimate purpose, without infringing upon the fundamental rights and freedoms of the employees. For instance, e-mail monitoring to collect evidence may not be proportionate if it is determined that e-mails that are not related to the incident subject to investigation are also accessed. To achieve this, certain keywords or algorithms can be used while monitoring e-mails during a disciplinary investigation.
- The collection process must be necessary to achieve the purpose. In other words, the collection of physical evidence must only be carried out to the extent there are no other measures allowing the employer to achieve its purpose, such as witness testimony, workplace records, or examining the results of projects. If the purpose can be achieved through less invasive means, the collection of physical evidence may not comply with the principles established by the decisions of the Constitutional Court.
Separately, depending on the type of physical evidence collected, the collection process may lead to the processing of the concerned employees’ personal data. Under the DPL, personal data collected in Turkey can only be processed if the explicit consent of the data subject is obtained; or the data is processed based on one of the exceptions to consent provided by the law. To the extent the data processing can be deemed to be based on the pursuit of a legitimate interest of the employer, it should also meet the following conditions:
- it should be the most convenient and efficient method to identify any employee wrongdoing to protect the legitimate interests of the company; and
- the data processing should not harm the fundamental rights and freedoms of the employees.
The employer should in any case comply with the obligation to inform employees before the processing of their data, through a privacy notice containing mandatory information required by the DPL.
In addition, as a general principle, the evidence-gathering process should always be conducted based on the assumption that the internal investigation can lead to litigation. Any evidence that will be used in litigation needs to have been gathered in compliance with the law. In both criminal and civil litigation, the courts will review each piece of evidence to confirm whether it was gathered through lawful methods and disregard any evidence that fails to comply with due process.
United Kingdom
United Kingdom
- at Slaughter and May
- at Slaughter and May
Most forms of workplace surveillance involve the processing of personal data that is regulated by the UK GDPR and DPA 2018. The UK GDPR requires that personal data must be processed lawfully, fairly and in a transparent manner; it also must be adequate, relevant and limited to what is necessary concerning the purposes for which it is processed.
Employers should ensure that they have undertaken a data protection impact assessment (DPIA) to document the lawful basis for processing data, and informed employees that their files may be searched before proceeding. They should also ideally have a clear policy on the use of electronic communications systems, detailing when, how and for what purpose they may be monitored by the employer. In Q3 2023 the ICO produced new guidance on monitoring workers (https://ico.org.uk/for-organisations/uk-gdpr-guidance-and-resources/employment/monitoring-workers/) and on email and security (https://ico.org.uk/for-organisations/uk-gdpr-guidance-and-resources/security/email-and-security/) which employers should bear in mind during investigations. Employers should also be prepared to make the data collected through employee monitoring available to employees, should the employee submit a data subject access request under the DPA 2018.
The IPA 2016 makes it unlawful in certain circumstances to intercept a communication (such as one on an employer’s telephone or computer network) in the course of its transmission in the UK. The IPA Regs 2018 set out the circumstances where, in a business context, such interception will be lawful. These include monitoring or recording communications without consent to: establish the existence of facts; ascertain compliance with the regulatory or self-regulatory practices or procedures relevant to the business; ascertain or demonstrate standards which are or ought to be achieved by persons using the system; and prevent or detect crime.
Covert surveillance can lead to a breach of an employee's right to privacy under the HRA 1998. The employer will need to consider if covert surveillance is proportionate, which will depend on the facts of each case. Employers should be careful not to use the investigation as an excuse to undertake a "fishing expedition", and should avoid gathering material that is obviously personal, such as private messages and diary entries (see question 8).
United States
United States
- at Cravath, Swaine & Moore
- at Cravath, Swaine & Moore
- at Cravath, Swaine & Moore
Documents and instruments that set out a company’s policies (eg, employee handbooks, code of conduct or other written guidelines) often contain provisions regarding employee data and document collection, workplace searches, communication monitoring, privacy, and confidentiality. As discussed below, state and federal constitutional, statutory and common law – and in some cases foreign data privacy regimes – may provide additional protections to protect employees from an unwarranted or unreasonable invasion of privacy during an internal investigation.
Vietnam
Vietnam
- at Le & Tran Law Corporation
- at Le & Tran Law Corporation
Decree No. 13/2023/ND-CP on personal data protection is the main data protection regulation in Vietnam. It regulates the processing of personal data, including the collection or gathering of data. If the physical evidence contains personal data of an individual, the gathering of physical evidence must comply with this decree.