Workplace Investigations

The starting position is that there is no general right for an employer to search an employee’s possessions. However, an employer may be able to undertake a search in circumstances where:

• the employee consents to the search;
• there is a “right to search” contained in a contract, policy, procedure or industrial instrument; or
• the request to search constitutes a lawful and reasonable direction.

If an employee agrees to a search of their possessions, this consent should be confirmed in writing. If the employee does not consent then the employer can issue a direction to the employee. If the direction is lawful and reasonable, and the employee does not comply, then disciplinary action may be considered.

In general, it is advisable to back up data, documents, emails and other records promptly to prevent their deletion. Admissibility depends on whether the data originates from personal or professional records and whether they are legally relevant. If internal investigations are carried out based on a specific suspicion of a criminal offence, it is the processing of legally relevant data. In general, the processing of professional emails or documents is permissible. If there is no professional connection, access to private files and documents is only permitted in exceptional cases.

If, for example, using a business email account for private purposes is not allowed, the employer can usually assume that the data processed is only "general" data within the meaning of article 6 GDPR and that such data processing is justified by a balancing of interests. However, if private use is allowed, the data may still be part of a special category within the meaning of article 9 GDPR. In such cases, the justification for its use must be based on one of the grounds explicitly mentioned in article 9(2) GDPR.

The employer must protect the employee's rights under section 16 of the ABGB and must consider the proportionality of the interference. Only the least restrictive means – the method that least interferes with the employee's rights – may be used to obtain the necessary information. The employer's interest in obtaining the information must outweigh the employee's interest in protecting his or her rights. The implementation or initiation of controls by the employer does not automatically constitute an interference with personal rights, as being subject to the employer's rights of control is part of the position as an employee.

The employer is, in principle, not entitled to search the employee’s private possessions, except with the explicit consent of the employee. Digital files on the computer or laptop of an employee can be searched under the rules of CBA No. 81 (see question 7) and other privacy rules.  

No; employers are only generally allowed to search the work tools they provide to employees, such as company mobile phones, electronic files, and company email and other electronic communications. However, they may also request that employees turn over any company documents in their possession.

Searches of employees’ private possessions or files during an investigation can only occur with the verifiable consent of the employee.   

Article 13 of the Constitution of the PRC provides that the lawful private property of the citizens shall not be violated. Therefore, during the process of investigation, without the employees' consent, the employer has no right to search the employees' personal possessions or files. If it is necessary to search the employees' personal possessions or files, the employer may require the employees to sign a Letter of Informed Consent before searching; or the employer may call the police and the search will be conducted under the escort of the public security authorities or directly by the public security authorities.

Only the police can search employees' possessions (assuming that the prerequisites outlined in the legislation are met).

In internal investigations, the fundamental rights and freedoms of employees are at stake,  including the right to privacy, respect for the privacy of home life and correspondence, freedom of expression, and the obligation of loyalty in searching for evidence.

In principle, work emails and files can be reviewed, even without the employee's consent, prior knowledge or warning. This includes: work email accounts; files stored on a work computer or a USB key connected to a work computer; and SMS messages and files stored on a work mobile phone and documents stored in the workplace unless they are labelled as “personal”. On the other hand, it is not permissible for an employer (or an investigator) to review “personal” emails and files, such as documents or emails identified as “personal” by the employee, or personal email accounts (Gmail, Yahoo, etc), even if accessed from a work computer.

There are certain exceptions to the above principle. An employer is allowed to check “personal” emails or data in any of the following cases:

• if the employee is present during the review;
• if the employee is absent, but was duly notified and invited to be present;
• if there is a particularly serious “specific risk or event”;
• if the review is authorised by a judge (this means having to prove a legitimate reason justifying not informing the employee).

When documents or emails are not marked as “personal” but contain information of a personal nature, the employer may open and review the data but may not use such documents or emails to justify applying disciplinary measures to the employee or use such documents or emails as evidence in court if they indeed relate to the employee’s private life.

Special attention must be given to employee representatives who must be entirely free to carry out their duties.

Files and documents that are purely business-related – whether in physical or digital form – may, in principle, be inspected by the employer without restriction. The employee has no right to refuse inspection.

When searching business laptops, computers, phones and e-mail accounts, a distinction must be made as to whether private use is permitted (or at least tolerated) or not: if the employee is allowed to use the items exclusively for business purposes, the employer may monitor and control them. If private use is permitted, the employee's right to privacy must be observed for private files, as must the protection of the secrecy of correspondence. Accordingly, the employer must avoid accessing private documents, files and e-mails. However, a review of private documents, files and e-mails may be permissible in the event of particularly serious violations if the employer's interest in the review outweighs the employee's interest in safeguarding his right to privacy. Generally, employers should allow private use of electronic devices only if employees have previously consented to the terms of use (including searches in certain cases).

A search of the employee's workplace by the employer is, in principle, permissible. However, a search of personal items (eg, bags, clothes, personal mobile phone) is generally only permissible with the employee's consent. Similarly to the review of digital personal data, a search of personal items may be permitted, however, in the event of particularly serious violations if the employer's interest in the search outweighs the employee's right to privacy.

As a first step, the employer should ask for the employee’s permission to access their possessions and files. Employment contracts and internal labour regulations may include provisions regarding an employer’s access to employees’ documents created and kept for business purposes or related to business activity.

As part of an investigation, an employer may search objects or files that are the company’s property (eg, electronic devices given by the employer for business purposes and emails or messages stored on the company’s server) without prior notice and the employee’s consent is not needed. The employer, however, has no right to search an employee’s possessions (eg, a private smartphone) without the employee’s consent.

To avoid arguments as to who a particular object belongs to, employers may specify in internal policies what is to be regarded as a corporate asset and could be subject to a search in a workplace investigation.

Concerning an employee’s possessions, even if he or she consents to a search, it is good practice for the employer to conduct the search in the presence of the employee or an independent third party who can act as a witness to the search. If the employer suspects that a criminal offence has been committed and that a search of the employee’s possessions would reveal evidence, the employer should consider reporting its suspicion to the police, as they have wider legal powers to search.[1]

Yes, an employer can search its employees’ official possessions and files as part of an investigation. It may be difficult, however, to seize personal assets or possessions of an employee (such as the individual’s mobile phone or personal laptop).

Employers should expressly create policies that address key issues associated with employee surveillance, forensic searches and investigations, such as:

• whether or not the official assets and infrastructure of the company can be used for personal purposes by employees;
• the organisation's right to monitor, surveil or search any authorised or unauthorised use of its corporate assets; and
• that the employee should not have any expectation of privacy when using the companies’ resources, etc.

Any forensic review of digital data must be carried out with due regard to Indian rules of evidence to avoid situations where such evidence becomes unreliable in a future legal claim or dispute.

The first consideration here is what constitutes "employees' possessions". More often than not, employees will be using employer property and there should be clear policies in place that specify company property.

The difficulty arises if an employee is using personal equipment such as a mobile phone for work purposes. While there may be specific applications dealing with work-related matters that are accessible by the employer remotely, some applications may be device-specific and that is where issues may arise. In such instances, it is not unreasonable to ask the employee to provide such information or consent to a search of their personal property. However, this is the exception rather than the rule and all other legitimate avenues of obtaining such information should be explored first. Further, such requests for information should not be a fishing expedition as an employee has a reasonable expectation of privacy at work, which must be balanced against the rights of the employer to run their business and protect the interests of their organisation.

A search of physical items such as a desk or drawers should only be conducted in exceptional circumstances, even where there is a clear, legitimate justification to search and the employee should be present at the search.

In light of the legal and case-law principles as outlined above:

• see question 7 regarding employee “physical inspections and inspections on the employee’s belongings”;
• regarding “audiovisual equipment and other instruments from which the possibility of remote control of employees’ activities also arises”, article 4 of the Workers’ Statute provides for:
  • the prohibition of the use of audiovisual equipment and instruments of “direct” remote control (ie, whose sole purpose is to verify the manner, quality and quantity of working performance (eg, a camera installed in an office to film employees’ working activities, without any other purpose));
  • the possibility of carrying out controls through audiovisual equipment and “indirect” remote instruments (ie, instruments that serve different needs (organisational, production, work safety or company assets’ protection), but which indirectly monitor working activities (eg, a camera installed in a warehouse to prevent theft, but which indirectly monitors the activity of warehouse workers), which may only be installed with a trade union agreement (or National Labour Inspectorate authorisation);
  • the possibility of carrying out checks using working tools in the employee’s possession (e.g., PCs, tablets, mobile phones, e-mail), which may be carried out even in the absence of any trade union agreement, provided that the employee is given adequate information on how to use the tools and how checks may be carried out on their use (according to privacy law strictly related to the employment relationship).

Furthermore, based on case law, the employer can carry out so-called defensive controls (ie, actions carried out in the absence of the guarantees provided for in article 4, to protect the company and its assets from any unlawful conduct by employees). These “defensive controls” can be carried out if:

• they are intended to determine unlawful behaviour by the employee (ie, not simply to verify his or her working performance);
• there is a “well-founded suspicion” that an offence has been committed;
• they take place after the conduct complained of has been committed; and
• adequate precautions are nevertheless put in place to guarantee a proper balancing between the need to protect company assets and safeguarding the dignity and privacy of the employee.

Since inspections of personal belongings may potentially undermine employees' fundamental human rights, they would not become lawful simply because they are conducted under employment regulations.

Inspections of personal belongings must be conducted uniformly among employees in the workplace based on reasonable grounds, in a generally reasonable manner and to a generally reasonable degree, and based on the work rules, etc.

When inspections of personal belongings are conducted under employment regulations, etc, employees must agree to the inspection except in special circumstances, such as the method or degree of the inspection being unreasonable.

On the other hand, an investigation of information stored on a company network system may constitute an infringement of the right to privacy. If there is a provision in the employment regulations regarding the use of the internet and monitoring, it is possible to investigate under such a provision. A Japanese court case on the illegality of reading e-mails in the absence of a monitoring provision stated that private use of e-mails also carries a certain right to privacy, but also stated that "considering the fact that the system is maintained and managed by the company, the protection of the employee's privacy can only be expected within a reasonable range according to the specific circumstances of the system," and that the act of reading e-mails was not illegal because the extent of private use of e-mails was beyond the limit, which was outside the reasonable range of socially accepted ideas. The court also ruled that the monitoring of the employee's abusive private use of e-mail, which was discovered in the course of an investigation of slanderous e-mails within the company, was not illegal because even if the monitoring was conducted without notice, there was suspicion of a violation of the duty of devotion to duty and corporate order. The court also stated that the investigation was necessary and that the scope of the investigation did not exceed its limit.

When conducting an internal investigation (which must have a legitimate purpose), the employer must act in accordance with the principles of proportionality and subsidiarity. In line with these principles, the means of collecting and processing personal data during an internal investigation as well as the data that is searched, collected or processed, should be adequate, relevant and not excessive given the purposes for which the data is being collected or subsequently processed. These principles can be complied with by, for example, using specific search terms when searching electronic data, limiting the investigation’s scope (subject matter, period, geographic locations) and, in principle, excluding an employee's private data.

The employer is, in principle, allowed to access documents, emails and internet connection history saved on computers that were provided to the employees to perform their duties, provided the requirements of proportionality and subsidiarity are taken into account. In other words, reading the employee's emails or searching electronic devices provided by the employer must serve a legitimate purpose (e.g. tracing suspected irregularities or abuse) and the manner of review or collecting and processing the data contained in such emails should be in accordance with the principles of proportionality and subsidiarity.

The employer can ask the employee to hand over an employee's USB stick for an investigation. Depending on company policies and (individual or collective) employment agreements, an employee is, in principle, not obliged to comply with such a request. A refusal from an employee, when there is a strong indication that this USB stick contains information that is relevant to an investigation into possible irregularities, may be to the disadvantage of an employee, for example in a dismissal case.

The following factors, which derive from the Bărbulescu judgment of the European Court of Human Rights, are relevant to the question of whether an employee's e-mail or internet use can be monitored:

• whether the employee has been informed in advance of (the nature of) the possible monitoring of correspondence and other communications by the employer;
• the extent of the monitoring and the seriousness of the intrusion into the employee's privacy;
• whether the employer has put forward legitimate grounds for justifying the monitoring;
• whether a monitoring system using less intrusive methods and measures would have been possible;
• the consequences of the monitoring for the employee; and
• whether the employee has been afforded adequate safeguards, in particular in the case of intrusive forms of monitoring.

These requirements can sometimes create a barrier for employers, as seen in a ruling by the District Court Midden-Nederland (16 December 2021, ECLI:NL:RBMNE:2021:6071) in which the employer had used information obtained from the employee's e-mail as the basis for a request for termination of the employment contract. In the proceedings, the employee argued that his employer did not have the authority to search his e-mail.

According to the District Court, it was unclear whether the employer had complied with the requirements of Bărbulescu regarding searching the employee's e-mail. The regulations submitted by the employer only described the processing of data flows within the organisation in general. Therefore, the District Court found that the employer did not have a (sufficient) e-mail and internet protocol and the employee was not properly informed that his employer could monitor him. In addition, according to the District Court, it was unclear what exactly prompted the employer to search the employee's e-mail, as the employer did not provide any insight into the nature and content of the investigation. As a result, the District Court was unable to determine whether the employer had legitimate grounds to search the employee's e-mail. On this basis, the District Court disregarded the (possibly) illegally obtained evidence and ruled against the employer's termination request.

Yes, an employer can search the possessions or files of an employee as part of an investigation where the employee’s contract or handbook authorises such a search and there is a reasonable suspicion of wrongdoing.

Subject to the employees’ reasonable expectation of privacy, gathering physical evidence within the premises of the workplace and through company-issued property has been upheld to be legally permissible in pursuit of the employer’s right to conduct work-related investigations. The search, however, should be limited to the alleged acts complained of and must not be used as a fishing expedition to find incriminating information about the erring employee.

It depends on whether the employer implemented rules of personal control at the workplace. If yes, such rules are applicable. If not, in our opinion if there is suspicion of a serious violation, it is possible to carry out an ad hoc inspection but its scope should be limited only to necessary activities and should not concern an employee’s private files or correspondence, so as not to infringe on personal rights. If there is an ad hoc inspection, an employee should be informed in advance, and it should take place in the presence of the employee or employee’s representative, observing the rules of fairness and equity.

The employer is allowed to search an employee’s possessions or files, provided that they are work instruments or of a professional nature.

When performing these searches, employers should consider the specific provisions of the Data Protection Regulations as well as Resolution No. 1638/2013 of the Portuguese Data Protection Authority (CNPD), which contains rules on monitoring phone calls, e-mail and internet usage by employees. The CNPD understands that for the employer to access the employees’ professional data (e-mails, documents and other information stored on electronic devices), the latter should be present during the monitoring, to identify any information of a personal nature that should not be accessed by the employer (the employer must comply with these directions and should not access that email). In addition, review of the data should respect specific protocols to avoid potential access to personal data (eg, review of subject, recipients, data flow and type of files attached).

Body searches or the seizure of personal belongings or documents belonging to the employee are not permitted within the scope of a disciplinary procedure.

The employer is not allowed to search employees’ personal possessions or files as part of an investigation without the employee’s consent. However, such consent may be explicitly provided for in the terms of employment (as may be contained in the employment contract, employee handbook or the employer’s internal policies and procedures in dealing with the investigations, etc). The employer may, however, search the employees’ company email accounts and files if these are stored on the company’s internal systems or devices.

As discussed in question 7, it may be difficult for a company to search an employee’s personal possessions. The company may search and gather electronic data stored in work laptops or company servers, subject to legal requirements and restrictions (eg, obtaining consent). 

The PIPA provides specific guidance on the requirements for obtaining consent. Under the PIPA, to collect or use an individual’s personal information, the information holder must be informed of and consent to:

• the purpose of the collection or use;
• the personal information that will be collected;
• the period of retention and use; and
• his or her right to refuse to provide consent and any disadvantages that may result from such refusal.

There are separate requirements for obtaining consent to provide an individual’s personal information to a third party. Also, consent must be obtained separately for the collection, use or provision of sensitive or unique identification information.

Under limited circumstances, personal information may be collected, used, or provided to third parties without obtaining the consent of the information holder. For instance, a company may collect and use personal information without obtaining consent where obtaining the information is necessary to achieve the company’s “legitimate interests”, which clearly exceed the information holder’s right to his or her personal information, and the collection and use are carried out within reasonable bounds. The term “legitimate interests” in this context is generally understood as a concept similar to “justifiable act” under the Criminal Code. The Korean Supreme Court has held that under exceptional circumstances such as the following, the company’s collection and review of employee data may constitute a “justifiable act” under the Criminal Code:

1. the company had specific and reasonable suspicion that the employee had committed a crime and the company had an urgent need to verify the facts;
2. the scope of the company’s review was limited to the suspected crime through the use of keywords, etc;
3. the employee had signed an agreement stating that he or she would not use work computers in an unauthorised manner and that all work products would belong to the company; and
4. the company’s review uncovered materials that could be used to verify whether the employee committed the alleged crime.

Please see question 7.

An employer can search an employee’s personal possessions (eg, handbag, pockets and locker) if the employer has a legitimate interest in a search. This could, for example, include a reasonable suspicion of theft of employer property. Furthermore, an employer may search, but not continually monitor, an employee’s computer and email provided that it is in accordance with GDPR requirements. For the processing to be lawful under the GDPR, the employer has to establish a purpose and a legal basis for the processing of personal data. Furthermore, data subjects must have received information on the legal basis for and purpose of the processing of personal data beforehand. If the data subjects have not received such information, the employer’s right to process their data is limited. However, if the employer has reasonable grounds to believe that trade secrets or similar has been copied and stolen, no such requirements would typically apply.

Investigations into an employee's possessions may, under certain circumstances, also be carried out by the Swedish authorities.

The basic rule is that the employer may not search private data during internal investigations.

If there is a strong suspicion of criminal conduct on the part of the employee and a sufficiently strong justification exists, a search of private data may be justified.[1] The factual connection with the employment relationship is given, for example, in the case of a criminal act committed during working hours or using workplace infrastructure.[2]

Electronic information created during employment would generally be owned by the employer and would be the employer’s assets. If an employee is given a computer or laptop to use for work, the employer has the right to log into that device and take any data that is stored therein, provided that the data does not contain sensitive information of that employee and PDPA requirements are met.

To avoid any potential issues regarding physical data such as documents on the employee’s desk, it is advisable to search those areas with the subject employee to show good faith. In practice, the employee normally agrees to search those areas with the employer, or allows the employer to search alone.

There is no explicit answer to this question. However, it is important to make a distinction between employees’ possessions and files that are strictly personal and employees’ possessions and files that are found on devices or files provided for company use. For the first category, the employer does not have the right to search employees’ possessions and files. For the latter category though, justifications need to be established, by observing the requirements explained in question 7. Furthermore, the employers must also ensure that employees are fully and explicitly informed in advance of the monitoring operations, either through a provision included in the employment agreement, or in a separate notice or employee policy, the receipt of which should be duly acknowledged by the employee.

It may sometimes be difficult to draw a clear distinction between the property of the employer and employees’ personal property, both physical and electronic, particularly where employees are increasingly working from home. Employers should ideally have a clear policy to delineate what is the employer’s property.

Employees typically have a reasonable expectation of privacy at work, although how far this extends will depend on the circumstances of each case and the employer’s policies.

When it comes to employees’ personal possessions, a search should only be conducted in exceptional circumstances where there is a clear, legitimate justification. The employer should always consider whether it is possible to establish the relevant facts through the collection of other evidence. Even if the employee’s contract specifies that it is permitted, employers would usually require explicit employee consent for the search to be lawful. The employee should be invited to be present during the search; if this is not feasible, another independent third party (such as a manager) should be present.  

If the employee refuses to consent to a search of their personal possessions, their refusal should not be used to assume guilt; the investigator should explore why the employee has refused and seek to resolve their concerns if possible.

If the employer believes that a criminal offence has been committed it should consider involving the police, since they have wider powers to search individuals and their possessions. 

As there is no unified data protection regime, privacy protections stem from a patchwork of federal and state privacy laws which impose limits on the extent to which an employer can collect information from its employees in connection with an internal investigation. Whether specific conduct violates an employee’s rights is a very fact-specific inquiry requiring the application of relevant state laws and a regulatory regime. 

In most circumstances, an employer is free to conduct searches of its workplace and computer systems in the course of investigating potential wrongdoing. Such searches are generally not protected by personal privacy laws because workspaces, computer systems and company-issued electronic devices are often considered company property. Many companies explicitly address this in written corporate policies and employment agreements. Employees who use their own electronic devices for work should be aware that work-related data stored on those devices is generally considered to belong to the employer (as a matter of best practice, employers should generally prohibit or at least advise employees against using personal devices for work and to maintain separate work devices, where possible).

These broad investigatory powers notwithstanding, the ability of an employer to conduct searches in furtherance of an internal investigation is not unlimited. For example, if an employer seeks to obtain or review work-related data from an employee’s personal device, the employer must be careful to exclude any personal data. Certain states also prohibit an employer from requiring an employee to disclose passwords or other credentials to his or her personal email and social networking accounts, but permit an employer to require employees to share the content of personal online accounts as necessary during an interview while investigating employee misconduct.

As part of an investigation, an employer may search the objects or files that are part of the company’s property (eg, company or employers’ laptops or phones for business purposes and emails or messages stored on the company’s servers) without prior notice and without the need of the consent of the employee. However, the employer has no right to search an employee’s personal possessions without consent.

To further avoid arguments or conflicts as to the right of ownership of a particular object or property, employers may specify in their internal policies, labour contracts, and handover documents what is to be regarded as the company’s assets and subject to a search in a workplace investigation.

To ensure procedural fairness, the allegations must be put to the respondent in writing in advance of the investigation interview. The allegations must be specific, but the respondent does not need to be provided with a copy of the original complaint. The respondent should also be informed that if the allegations are substantiated they may result in disciplinary action up to and including the termination of the employee’s employment.

The purpose of internal investigations would be jeopardised by fully informing a suspected employee beforehand, as it would allow him or her to hide or destroy possible evidence, plan his testimony or coordinate with other employees.

There is no legal requirement to inform the employee of the allegations or suspicions.

In general, the employee should be informed that there is an ongoing investigation (unless this could jeopardise the investigation, in which case disclosure could be postponed until this is no longer the situation). Next, before imposing measures or sanctions, the employee should be allowed to be heard or to give his or her version of the facts. Of course, the employee can only do this if he or she is aware of the facts being investigated. It is not necessary to give the employee a full insight into the investigation, only the necessary facts that allow him or her to offer a defence are sufficient.

There is no obligation to inform an employee under investigation that this is the case, and it should not happen automatically.

While some policies require that the investigated employee be informed about the allegations against them at the beginning of the investigation, from a local perspective it is recommended that the accused employee be notified about the existence of the allegations if, after a reasonable review, there are elements that suggest that the accusation may be material.

In this context, the employee should be informed about the accusation and be allowed to confirm, deny, provide further context or justify each reported or identified event; offer evidence; and indicate persons or sources of information that could corroborate his or her defence. Information about the accusation must be focused on facts rather than on how the company obtained the information.

If the accusation is found to be groundless after initial review, involving the accused employee at the beginning of the process may have triggered unjust and unnecessary stress and a disruption in the employment relationship that may not be satisfactorily repaired by a determination that the accusation was void. This may result in a legal liability for the company or HR issues that could otherwise have been avoided.

Although there are no explicit provisions of law or policy requiring employers to provide specific information of allegations to investigated employees, in practice, at the early stage of investigation, in order to avoid alerting the investigated employee and reduce the possibility that the investigated employee may destroy the relevant evidence, the employer usually will not disclose the information of allegations to the investigated employee at the beginning of investigation. At the later stage of an investigation, when the employer has already obtained main evidence, the employer usually will properly disclose to the investigated employee the allegations that are clearly known by the employer and have sufficient evidence, and listen to the counterparty's opinions or argument, for the purpose of obtaining more information or getting the employee's confession.

The process must be transparent and impartial, and therefore all the information that may influence the conclusions made during the investigation should be shared with the employee.

According to the French data protection authority, the employee under investigation must be informed of the name of the person in charge of the investigation, the alleged facts that have led to the whistleblowing alert and their rights to access and rectify data collected about them. This information must be given as soon as the data collection starts, before the interviews, as per GDPR principles.

In principle, the employer does not have to inform the employees about the investigation. Furthermore, there is no obligation to inform the "suspect" about the specific content of the workplace investigation itself and the allegations against him.

However, if personal data relating to the employee is collected and reviewed, the employee must be informed under German data protection principles (see question 7).

If the employer considers issuing a notice of termination based on the suspicion of wrongdoing, the employee must be allowed to comment on the allegations against him before receiving the termination notice. This requires that the employee be properly informed about the allegations and evidence against him. However, until the time of such a hearing, which usually follows the workplace investigation, there is no obligation on the part of the employer to inform the employee concerned about ongoing investigations.

As a matter of general principle, employees under investigation must have access to the necessary information to be able to defend themselves, in the context of their fundamental right to a fair trial and hearing.

Moreover, from a data protection perspective, they may be entitled to access their personal data in the respective files.

The above rights must be balanced with confidentiality and the need to safeguard the completion of the investigation and to protect the complainant from retaliation.

According to L.4990/2022, all data and information as well as the identity of the complainant are confidential, and any disclosure is only permitted where required by the EU or national legislation or during court proceedings, and only if it is necessary for the protection of the defence rights of the employee under investigation. The section of L.4808/2021 for the elimination of workplace violence and harassment does not regulate this specifically but provides a general obligation for confidentiality.

An employer’s internal policies or the employment contract may provide that an employee under investigation should be given certain information concerning the allegations raised against him or her. Such policies or terms should be followed and failure to do so may result in a claim for breach of contract or constructive dismissal by the employee. Even where there are no express provisions, the employer still owes an implied obligation of trust and confidence towards the employee at common law, which requires the employer not to, without reasonable and proper cause, conduct itself in a manner calculated and likely to destroy or seriously damage the relationship of confidence and trust between itself and the employee.[1] In the context of an internal investigation, the implied duty would require the employer to conduct the investigation and reach its findings reasonably and rationally following the evidence available and in good faith. This would normally require that sufficient information about the allegations made against the employee be provided to him or her such that he or she has the opportunity to properly respond to the allegations before any disciplinary action is taken or any decision about his or her employment is made.

As mentioned earlier, workplace investigations are normally a precursor to the actual disciplinary process against an employee. If the individual is being suspended during the investigation, the employer is only expected to inform the individual that they are being suspended on account of an ongoing investigation along with the broad nature of allegations or concerns, and does not need to disclose specific details about the allegations until the appropriate time. Further details may be provided at the investigation stage itself when the employee may be interviewed, or at the subsequent disciplinary inquiry.

Where a disciplinary process is necessary and initiated (after the investigation), the employee will have to be given a charge sheet or notice setting out the allegations against the individual in detail and be provided with an opportunity to submit an explanation. 

In sexual harassment investigations, the SH Act mandatorily requires the IC to submit a copy of the complaint to the accused. Further, the accused should be informed of the requirement to file his or her reply to the complaint along with a list of supporting documents, evidence, names and addresses of witnesses, etc, and the timelines for submitting his response in defence.

Under the fair procedures outlined above, details of the allegations or complaints against the employee should be put to them to enable them to fully respond to the allegations raised. The employee should also be provided with any relevant policies pertaining to the allegations against them, along with all documentary evidence of the allegations and the specific terms of reference that define the scope of the investigation. The employee should also be informed of their right to be represented, see question 15.

From an employment law perspective, our legal system does not provide a specific duty for an employer to inform employees that a workplace investigation is in progress.

In addition, disclosing such information could put at risk the outcome of the workplace investigation (eg, destruction of evidence), and it would therefore be arguable that no information should be provided to employees.

On the other hand, if, upon completion of the investigation, the employer decides to bring disciplinary action against the employee, then the latter must be informed of the complaints with a letter stating the procedure (see questions 3 and 12).

There are no specific legal stipulations or requirements regarding information, etc, that must be provided to employees who are the subject of an investigation.

An implicated person is typically provided with a summary description of the scope of the investigation and, hence, the allegations against such an employee (if any). This is usually done in the interview invite sent to the relevant interviewee, which also provides an opportunity to prepare for an interview and (if relevant) seek legal advice.

An employee must be given the full details of the allegations against him or her to enable the employee to make adequate representations against the complaints made against him or her.

During the fact-finding stage of the investigation, the employees under investigation are not generally entitled to information concerning the conduct of the investigation. It is the prerogative of management to involve the employee under investigation during the fact-finding stage. When, however, the employer determines that an administrative disciplinary process must proceed, the employee’s right to due process attaches. As such, due process includes the right to be informed of the grounds relied upon by the employer and the opportunity to be heard. The first notice or notice to explain should specifically inform the employee of the charge against him or her.

There is no specific mandatory information that should be given to an employee who is the subject of an internal investigation. However, it is common practice that he or she must know what the allegations against them are, on what grounds these allegations are formulated and be given a right to discuss these allegations and the evidence or grounds for these allegations.

If, before taking disciplinary action, the employer decides to open a preliminary investigation phase, the employee does not have to be informed.

Only when the preliminary investigation leads to a formal accusation will the employee be entitled to know that enquiries were carried out and the source of the facts (eg, witnesses, documents).

However, if an employer does not need to open a formal preliminary investigation phase, it only has to serve the accusation notice to the employee.

As a rule, employees will only know that they are being investigated if they are suspended or when they are notified of the accusation.

There is no specific list of information about the allegations against the employee under investigation that must be provided to the employee under investigation. However, the information provided to the employee must be sufficiently clear and specific so that the employee understands the case being made against him or her and can respond to it. The employee should also be made aware of the evidence against him or her and be given a reasonable opportunity to respond.

There is no requirement to notify an employee under investigation concerning the allegations against him or her when requesting cooperation with a workplace investigation (eg, requesting the employee’s consent to review electronic data, or requesting an interview).

However, the company may strategically consider explaining the general purpose of the investigation before requesting consent to review electronic data or when requesting an interview. This may help increase the likelihood of cooperation and also reduce the risk of the employee raising objections to the company’s findings from the investigation by saying he or she was not properly informed of the purpose of the investigation, or that the investigation was conducted in a coercive manner.

It is not necessary to inform an investigated employee about an enquiry or of the allegations made against him or her. The obligation to disclose would only arise when:

• interviewing the employee would be the least intrusive means to investigate the facts; or
• if disciplinary measures are implemented as a result of the investigation. Since employees are entitled to challenge all disciplinary measures against them, they could request a court of law to disclose all the findings of the investigation, to assess if these findings could be useful to challenge the disciplinary measure.

According to article 14 of the GDPR, no information must be provided. The exemption in article 14.5(b) applies to the extent the obligation to provide such information is likely to render impossible or seriously impair the objectives of the processing of the personal data of the employee under investigation (ie, to diligently investigate the suspected irregularity).

If the Swedish Whistleblowing Act applies, information about where the personal data processed originates from may not be provided under article 14 of the GDPR, as the personal data must remain confidential subject to obligations under the Swedish Whistleblowing Act.

In addition to the above, an investigation should, to the extent possible and suitable, be characterised by the principles in ECHR (particularly articles 6 and 8). The employee under investigation should, among other things, be presented with sufficient information to safeguard his or her interests and be allowed to respond to the allegations. The investigation must also be compliant with the work environment responsibilities that the employer has concerning the involved parties (see questions 17 and 20).

As a result of the employer's duty of care (article 328, Swiss Code of Obligations), employees under investigation have certain procedural rights. These include, in principle, the right of the accused to be heard. In this context, the accused has the right to be informed at the beginning of the questioning about the subject of the investigation and at least the main allegations and they must be allowed to share their view and provide exculpatory evidence.[1] The employer, on the other hand, is not obliged to provide the employee with existing evidence, documents, etc, before the start of the questioning.[2]

Covert investigations in which employees are involved in informal or even private conversations to induce them to provide statements are not compatible with the data-processing principles of good faith and the requirement of recognisability, according to article 4 of the Swiss Federal Act on Data Protection.[3]

Also, rights to information arise from the Swiss Federal Act on Data Protection. In principle, the right to information (article 8, Swiss Federal Act on Data Protection) is linked to a corresponding request for information by the concerned person and the existence of data collection within the meaning of article 3 (lit. g), Swiss Federal Act on Data Protection. Insofar as the documents from the internal investigation recognisably relate to a specific person, there is in principle a right to information concerning these documents. Subject to certain conditions, the right to information may be denied, restricted or postponed by law (article 9 paragraph 1, Swiss Federal Act on Data Protection). For example, such documents and reports may also affect the confidentiality and protection interests of third parties, such as other employees. Based on the employer's duty of care (article 328, Swiss Code of Obligations), the employer is required to protect them by taking appropriate measures (eg, by making appropriate redactions before handing out copies of the respective documents (article 9 paragraph 1 (lit. b), Swiss Federal Act on Data Protection)).[4] Furthermore, the employer may refuse, restrict or defer the provision of information where the company’s interests override the employee’s, and not disclose personal data to third parties (article 9 paragraph 4, Swiss Federal Act on Data Protection). The right to information is also not subject to the statute of limitations, and individuals may waive their right to information in advance (article 8 paragraph 6, Swiss Federal Act on Data Protection). If there are corresponding requests, the employer must generally grant access, or provide a substantiated decision on the restriction of the right of access, within 30 days (article 8 paragraph 5, Swiss Federal Act on Data Protection and article 1 paragraph 4, Ordinance to the Federal Act on Data Protection).

The subject employee(s) should be informed of the details of the allegations, such as the details of wrongdoing or violations, made against them. This creates a fair opportunity for them to clarify themselves and defend against such allegations properly. Also, if there is any evidence that needs clarification from the employee, it should be shown to the employee.

Informing the employee under investigation on the subject, purpose and possible consequences of the investigation need to be evaluated by the investigation team before the interview. As a general principle, the interviewer is expected to share the information he obtained on the case with the employee, and ask for confirmation or clarification on these matters. The employee under investigation may be subject to an interview to gain information or as a confrontation if there is concrete evidence. If the evidence in hand is not based on concrete and material grounds, it would be more appropriate not to lead the interview to a confession, but inform the employee of the possible allegations. However, if the available evidence is based on concrete and material grounds, the interviewer may confront the interviewee by sharing the information that was gathered during the investigation in an attempt to obtain a confession.

The employee must be able to effectively challenge the allegations against them. They should be given the terms of reference for the investigation, and any relevant documentary evidence, including copies of witness statements.

The investigator must disclose to the employee under investigation the purpose of the investigation and, where the investigator is in-house or outside counsel, he or she should disclose that the company is the client.

There is no legal requirement as to what particular information should be stated in the allegations; however, such information must be provided to the employee under investigation. The information provided by the employer to the employee must be sufficiently clear and specific so that the latter understands the case or alleged issues against him or her and can respond to it.

It is not uncommon for respondents to an investigation to take personal or carer’s leave (sick leave) claiming that they are suffering from stress or anxiety. If this occurs, employers need to act appropriately, but this does not necessarily involve stopping the investigation process.

Employers should:

• assess the medical evidence to ascertain the respondent’s condition and determine how long they are likely to be unwell;
• avoid exacerbating the condition;
• determine whether the employee is unfit to attend the investigation meeting;
• take into consideration the evidence of other witnesses;
• consider delaying the investigation for a short period; and
• consider conducting the interviews in other ways, for example, in writing.

While all efforts should be made to accommodate an employee who has taken personal or carer’s leave during an investigation, if the respondent does not participate in the investigation, the investigation report may be prepared based on the available evidence.

The involved employee's sick leave does not affect the internal investigation. Most investigative measures can be carried out without the employee's presence.

If this occurs, there is a risk that any measure resulting from the investigation (eg, a dismissal) can be (wrongly) interpreted as discrimination based on the illness of the employee. However, if the employer can prove that the measure is not related to the illness but solely related to the investigation (which is also not related to the illness), there may be no discrimination. The sickness of the employee may prevent the continuation of the investigation because, for example, it becomes impossible to hear from the employee. In this instance, the investigation can be suspended, postponed or extendeded until the employee returns. If it is a long-term absence, this could lead to a disproportionate amount of time to complete the investigation. Therefore, the employer should take any necessary steps to invite the ill employee to a hearing anyway (eg, through digital means). If the employee unreasonably refuses (several) of these invitations, it could be argued that the employee is wilfully boycotting the investigation and therefore forfeits his or her opportunity to be heard.

Sick leave suspends the employment agreement, and as a rule the employee should not be contacted during such a suspension. The investigation may continue without the participation of the investigated employee while that employee is absent, have its conclusion suspended while he or she is on leave, and resume once the employee returns to work.

During the investigation, the employer should fully respect the basic labor rights of the employee. According to the relevant provisions of Labor Contract Law of the PRC, if an employee is sick during the investigation, the employer should permit him/her to take sick leave provided that he/she provides the medical certificate issued by the medical institution and performs the medical leave application procedure as required by the employer. Therefore, the employer usually needs to request the employee to cooperate with the investigation after the sick leave, and cannot force the investigation by means of coercion or violence.

However, for the contents that can be investigated by the employer alone, such as the information publicized by the employee on social media and the employee's relevant information publicized on official website, since the investigation of such information is not affected by the employee's physical condition, the employer may adjust the investigation plan and conduct such part of the investigation first.

As a general rule, sick leave does not prevent an investigation from progressing. Depending on the nature of the sickness, the employee can attend hearings and take part in the procedure. If the sickness prevents the employee from participating, the employer can put the process on hold temporarily.

The investigation will likely be able to continue with the other employees and, as soon as the employee under investigation returns from sick leave, they will be able to be interviewed.

However, as disciplinary sanctions are time-barred after two months from the moment the misconduct was committed or from when the employer becomes aware of it, if the sick leave lasts for the whole of that period, the investigation must be conducted anyway. In this instance, the investigator can ask the employee to attend the interview despite being on sick leave or arrange for the interview to take place using other means (eg, conference call). As a last resort, a questionnaire can be sent to the employee, but the pros and cons must be assessed as this is a way of information gathering that carries a certain amount of risk, could be less reliable and is of less probative value.

Workplace investigations that do not require the presence or active cooperation of the employee may also start or continue during the employee's absence due to illness. If the employee's cooperation is required, for example for an interview, the employer can only instruct the employee to participate despite an existing illness if certain narrow conditions are met:

Regarding staff meetings at the company, the German Federal Labour Court has ruled that the employer can only instruct the employee to attend the staff meeting during illness if

• there is an urgent operational reason for doing so, which does not allow the instruction to be postponed until after the end of the incapacity to work; and
• the employee's presence at the company is urgently required and can be expected of him.

Similar rules are likely to apply to the employee's presence for workplace investigations.

Urgent operational reasons that cannot be postponed could exist, for example, if during the employee's absence due to illness, there is a risk that evidence will be lost (eg, where only the employee affected has access to certain files or data) or there is a risk of significant damage to the employer if workplace investigations are stopped until after the employee's return.

In principle, the health of an ordinary employee would not prevent the investigation procedure from taking place (eg, interviews with witnesses or the collection of evidence would not be postponed or suspended). However, if the employee under investigation is unwell and they can't participate in the procedure, the investigation may be suspended or postponed until the employee can take part. Bearing in mind the majority of company internal policies and regulations governing workplace investigations provide for a specific framework and timetable for the whole procedure to be completed, the long-term sickness of an employee under investigation may impede the completion of the procedure in the prescribed time. As a result, the person conducting the investigation may seek alternative measures to facilitate participation (eg, teleconferencing).

On a related note, if sickness occurs after the investigation is completed and the employer decides upon the imposition of disciplinary measures against the said employee and the initiation of a relevant procedure, the decision should be duly and timely communicated to the employee, irrespective of whether his or her presence in the workplace is not possible because of the illness.

If the employee under investigation goes off sick, the employer should ascertain the medical condition of the employee and when he or she is likely to return to fitness. If the employee is unlikely to return to work for a reasonable time, the employer should consider what adjustments can be made to the investigation process to continue with the investigation. If the employee’s input is necessary for the conclusion of the investigation, the employer may invite the employee to provide information by way of a written questionnaire or to attend a virtual meeting. However, the employee may not necessarily agree to these proposals, especially if he or she is unwell. In such circumstances, the employer may not be able to conclude the investigation in the absence of the employee.

The approach to be adopted would be fact-specific but the investigation itself can normally continue, even in the absence of the accused employee. Where it is critical to speak with the employee as part of the investigative process, delays on account of the employee's sickness may need to be accommodated. At the same time, the employer would normally be justified in seeking necessary evidence of the authenticity of the employee's illness and anticipated duration of absence. An accused individual's participation would be more crucial in a disciplinary inquiry to formally respond to the written charges or present their side before the inquiry officer, and absences due to genuine health concerns may need to be reasonably accommodated. Significantly long periods of absence for health reasons may itself be valid grounds to terminate employment under Indian law, subject to the terms and conditions of employment.

If an employee goes off sick during the investigation, it is reasonable to adjourn the investigation until the employee is fit to return to work. Difficulties arise if it is a prolonged absence. The absence may necessitate a referral to an occupational health expert and it may be necessary to seek medical advice as to whether the employee can continue to participate in the investigation. It may be that reasonable accommodations should be considered to ensure that the employee can continue to participate. Such situations may impinge on the investigator's ability to conclude the investigation. In that instance, it would be prudent for the investigator to document all attempts to involve the employee in the investigation and to assess whether it can be concluded without the further involvement of the employee.

Although there are no specific rules stating an investigation must be suspended if the employee under investigation goes off sick, practically speaking, this may slow down the process. Indeed, the employer would not be in the position to “force” the employee, while he or she is absent from work, to physically attend meetings, although they may ask for the employee’s availability to attend remote interviews (eg, via videoconference).

There is case law regarding an employee’s sickness during a disciplinary procedure (i.e. the procedure described above in point 3): according to certain rulings, if an employee, as per his or her rights, asks to submit an oral defence, but then falls sick, this does not prevent the employer from completing the procedure (and taking disciplinary action), unless the employee proves that his or her sickness prevents him or her from physically attending the meeting (being said that, above all if the procedure ends with a dismissal, a case-by-case analysis on how to manage such situations is highly recommended).

The company will seek a physician's diagnosis and opinion and determine whether to proceed with the investigation. If an employee’s mental health suffers because of the investigation, the company may be charged with a violation of its duty of care.

If the employee under investigation goes off sick during the investigation, they will generally be treated as a regular employee on sick leave, meaning they are entitled to continued salary payment and that both employer and employee have a reintegration obligation. This entails regular consults with the company doctor to determine how recovery progresses and when the employee can return to work. If the employer suspects that the employee is merely calling in sick to delay the investigation and such suspicion is not confirmed by the company doctor, the employer can ask the Employees Insurance Agency (UWV) to give a second opinion. When it is determined that the employee is in fact fit for work, the employer can oblige the employee to return to work and cooperate with the investigation. If the employee fails to comply, the employer can – after due warning – suspend the employee's salary payment.

The investigation would be suspended until the employee returns from sick leave. The investigation will immediately restart upon the return of the employee.

Since neither consent nor the presence of the employee is material to the conduct of the investigation, his or her absence would not, in practice, imperil the conduct of the investigation.

As previously discussed, because the employer exercises a wide latitude of discretion in conducting workplace investigations, the employer may choose to proceed with the investigation despite the absence of the employee being investigated. Since the proceeding is only in the investigation phase, the statutory right of the employee to be heard is not violated, even if the investigation takes place without his or her participation.

This may prolong the investigation, as the employee may be unable to participate for a time (if the employee is not able to work, in many cases he or she will not be able to participate in proceedings that requires some level of engagement and psychophysical ability). Also, an employee is protected against termination of an employment contract with notice during sick leave. During such a period, the employer may only terminate his or her employment contract without notice (with immediate effect).

The employer will be able to proceed with the investigation or disciplinary procedure regardless, although if it is necessary to hear the employee and they are unable to attend the interview, either the employer waits for their return or it could also send a written questionnaire for the employee to complete.

If the employee under investigation has already responded to the allegations made against him or her and his or her participation is no longer required at this stage in the investigation, the employer may proceed with the investigation even while the employee is off sick.   

However, if the employee under investigation has not responded to the allegations made against him or her and his or her participation is still required in the investigation, the company may exercise its discretion to pause the investigation until the employee can assist in the investigations.  To prevent an employee from using a medical condition as an excuse to delay or avoid the investigation, the company may require the employee to provide specific medical documentation to address the issue of the employee’s ability to participate in the investigation and to adjust the investigation process accordingly. For instance, instead of scheduling an in-person interview, the company may send a list of written questions for the employee to answer, and may also extend timelines for responding, etc.   

If the employee is unable to return to work for the foreseeable future, the employer may consider reaching a provisional outcome based on the available evidence, which would be subject to change when the employee under investigation can return to work.

The company should review whether the employee under investigation is requesting sick leave under appropriate procedures and for a legitimate reason and may consider ways to persuade the employee to cooperate with the investigation. If the employee applies for sick leave following company policy, the company would need to grant such sick leave and suspend the investigation during the sick leave.

Like in the case of grievances (see question 19), the deciding factor will be assessing whether sick leave is related to the investigation or not.

If there is no link between the investigation and the sick leave, then the leave is not relevant from the point of view of the investigation. However, if the sick leave was a result of the investigation (for instance, an employee taking sick leave due to anxiety related to the investigation), then the convenience of pursuing the investigation or of temporarily suspending it should be evaluated to avoid any liability for the company.

The employer is responsible for the employee’s work environment during the investigation. The employer must assess the situation and the impact on the employee’s health and may, depending on the situation, have to postpone certain investigative measures, such as interviewing the employee in question. The investigation may even have to be completed without the employee participating.

The time spent on the internal investigation by the employee should be counted as working time[1]. The general statutory and internal company principles on sick leave apply. Sick leave for which the respective employee is not responsible must generally be compensated (article 324a paragraph 1 and article 324b, Swiss Code of Obligations). During certain periods of sick leave (blocking period), the employer may not ordinarily terminate the employment contract; however, immediate termination for cause remains possible.

The duration of the blocking period depends on the employee's seniority, amounting to 30 days in the employee's first year of service, 90 days in the employee's second to ninth year of service and 180 days thereafter (article 336c paragraph 1 (lit. c), Swiss Code of Obligations).

If the absence is anticipated to be brief, the employer may wait until the employee's return before concluding the investigation. If the employee's absence is expected to be prolonged, the investigator may alter the time of meetings or request that the employee submits a witness statement. The key point would be that all necessary measures should be taken to give the employee a chance to participate.

The employee’s participation in the investigation is vital for a fair assessment and to ensure that the employee has been allowed to defend himself or herself against the allegations. As such, every reasonable effort must be made by the employer to adjust the investigation process so that the employee can take part in the investigation. For example, if the employee goes off sick and thus cannot attend the investigation interviews or disciplinary hearings, the investigation should be carried out as much as possible without resorting to the employee in question, by initially exhausting the other available options (such as conducting interviews or disciplinary hearings with other available witnesses). However, if the employee’s absence takes longer than is reasonably expected or the matter at hand must be dealt with urgently, the employer may consider concluding the investigation and determining the next steps based on the information at hand. In such a case, it is recommended to explain in the investigation report the reasons why the employee could not take part in the investigation process (ie, why an interview or disciplinary hearing, etc, could not have been arranged with the employee) along with supporting documentation evidencing the employer’s efforts to involve the employee in the investigation process and the employee’s excuse for not participating interviews or disciplinary hearings.

This is a relatively common occurrence. It would usually be appropriate to suspend the investigation temporarily, to determine how serious the health issue is and when the employee may be fit to return. The investigator should consider what adjustments or allowances can be made to progress the investigation despite the employee’s absence. If their evidence has not yet been gathered, the employee may be invited to provide a written statement instead of attending an investigation meeting, or the meeting could be held remotely or at a neutral location. If none of this is possible, it may be difficult to fully conclude the investigation.  

If an employee who is the subject of a workplace investigation becomes sick during the investigation, the investigator should complete as much of the process as possible in the employee’s absence, for example by conducting interviews with the complainant and other witnesses and collecting and reviewing relevant documentation. Where the employee’s absence is expected to be short-term, the employer can postpone completing the investigation until the employee returns to work and can be interviewed. Where a lengthy absence is expected, the investigator should take steps to ensure that the employee nevertheless has a fair chance to participate in the process, for example by providing the employee with flexibility in scheduling his or her interview or by offering other accommodations such as conducting the interview by video conference instead of requiring an in-person interview, or alternatively meeting in a neutral place instead of the office. It is important to maintain records of the steps taken to accommodate the employee to show that the process was reasonable and fair. 

Workplace investigations do not require the presence or active cooperation of the employee under investigation. Thus, the investigation may start or continue in the employee’s absence due to illness.

If the employee’s presence is necessary for the conclusion of the investigation, the employer may invite the employee to provide information either by submitting his or her answers to a written questionnaire or attending a virtual meeting. However, the employee may not accede to the employer’s requests and proposals, especially if the employee has an illness. As a result, the employer may not be able to conclude the investigation due to the absence of the involved employee.