Workplace Investigations

A complaint will be a whistleblowing complaint where a complainant has reasonable grounds to suspect that the information they are disclosing about the organisation concerns misconduct or an improper state of affairs or circumstances. The information can be about the organisation or an officer or employee of the organisation engaging in conduct that:

• breaches the Corporations Act 2001 (Cth);
• breaches other financial sector laws;
• breaches any other law punishable by 12 months’ imprisonment; or
• represents a danger to the public or the financial system.

Since 2020, all public companies, large proprietary companies and trustees of registrable superannuation entities in Australia are required to have a whistleblower policy. Employers conducting an investigation will need to follow the processes outlined in their policy.

One of the key differences when conducting an investigation that involves whistleblowing is identity protection and the ability of the whistleblower to disclose anonymously and remain anonymous.

The provisions of the Whistleblowing Directive must be respected. In Austria, these have been implemented through the Whistleblower Protection Act (HSchG). If the whistleblower or the persons concerned fall within the scope of the Directive, their identity must be protected. Only authorised persons may access the report. Retaliatory measures are invalid or must be reversed. Within a maximum of seven days, the whistleblower must receive a confirmation of his or her complaint. Feedback to the whistleblower must then be provided within a maximum of three months.

If the investigation is based on a whistleblower report that falls under the scope of the upcoming rules, the investigators are bound by a strict duty of confidentiality, especially regarding the identity of the report. The rules also provide some procedural deadlines for feeding back to the reporter. Within seven days of receiving the report through an internal reporting channel, the reporting manager needs to send a receipt to the whistleblower. From that moment, the reporting manager has three months to investigate the report and give feedback and an adequate follow-up to the report. Next, the rules offer strong protection against any retaliatory measures the reporter may experience. Regardless, these rules are mostly intended to offer the necessary protection for whistleblowers and to ensure that companies take necessary investigative steps following a report, but they do not include much information about the actual procedure of the investigation besides certain deadlines, nor do they deal with other employees involved (or under investigation).

If the investigation involves matters within the scope of a specific whistleblowing policy, the policy rules should prevail against the general investigation rules if there is a conflict.

In practice, the following factors to be considered will be: (1) verification of the informant's identity; (2) whether the informant has any conflict of interest with the reported employee or whether it will affect the objectivity of their reporting; (3) how to persuade the informant to provide more information or evidence, or to cooperate in court as a witness; (4) how to increase the admissibility of evidence when the informant refuses to cooperate in court as a witness or fails to provide original evidence; (5) how to improve the evidence chain and protect the informant from being attacked or retaliated by the informant, etc.

In respect of data protection, the processing of personal data in whistleblowing systems is considered by the Finnish Data Protection Ombudsman (DPO) as requiring a data protection impact assessment (DPIA).

Evidence obtained in the context of an investigation must specify who provided it and the date it was provided. No retaliatory measures may be taken against the whistleblower for the act of whistleblowing.

In certain cases, the whistleblower report must be forwarded to the judicial authorities (eg, when there is an obligation to assist persons in imminent danger, for serious offences or a disclosure that a vulnerable person is in danger (ie, minors under 15 or a person who is unable to protect themselves)).

In 2023, Germany has implemented the EU Whistleblowing Directive into national law with the German Whistleblower Protection Act (HinSchG).

The German Whistleblower Protection Act provides that companies with at least 50 employees must establish internal reporting channels as further set out in the law. Among other things, the confidentiality of the whistleblower as well as of the individuals affected by the report must be protected.

Further, whistleblowers must be protected from negative consequences that may arise from their reports. If the employment of a whistleblower were terminated or if the whistleblower were to be denied promotion after reporting a violation, the employer would have to prove that this was not related to the whistleblowing but was based on justified reasons.

Employers should  familiarise themselves with the provisions of the new law.

L. 4990/2022 includes specific requirements regarding, among other things, the procedure of receiving and investigating respective reports, confidentiality issues (especially regarding the identity of the whistleblower), data protection issues (including restrictions to the right of access) and the employer’s right to keep a record of the relevant complaint and investigation. Such provisions are expected to be further detailed by Ministerial Decisions in future.

Hong Kong does not have a comprehensive legislative framework relating to whistleblowing. Therefore, in general, employers are free to establish whistleblowing policies and procedures and confer such protections on whistleblowers as they see fit. That said, companies listed on the Main Board of the SEHK are expected to establish a whistleblowing policy and system for employees to voice concerns anonymously about possible improprieties in the companies’ affairs. If a listed issuer deviates from this practice, it must explain the deviation.[1]

When an investigation involves whistleblowing, the employer needs to comply with the relevant policy and system and provide the whistleblower with such protections as stated in the policy. The employer should not ignore a complaint simply because it was made anonymously, and should ascertain the substance of the complaint to decide whether a full-blown investigation is warranted.

In addition, the employer should seek to establish a secure communication channel with the whistleblower to gather more information about the complaint or misconduct while maintaining the confidentiality of his or her identity. If the complaint is serious, the employer may consider referring the complaint to a law enforcement agency or regulator as they would be better placed in protecting the anonymity of the whistleblower while proceeding with the investigation. That said, employers generally have no obligation to report internal wrongdoing to any external body (please see question 25 for exceptions). The employer may assess whether it is appropriate to do so on a case-by-case basis.

Indian labour legislation does not stipulate any additional considerations or requirements concerning whistleblower complaints in private organisations and these are only available if there are complaints against public servants. Further, under the Companies Act, 2013, certain companies are required to establish a “vigil mechanism” for directors and employees to report genuine concerns regarding the affairs of the company. The vigil mechanism should provide adequate safeguards against the victimisation of persons using it.

Most whistleblowing policies will include a section that provides for an initial assessment of the complaint as to whether it meets the definition of a protected disclosure. This assessment, which ought to be carried out by a designated person who has been appointed to deal with disclosures, is a useful tool as some matters which may be labelled as whistleblowing may fall under the grievance procedure.

Where there are grounds, an investigation will be commenced. Under the Protected Disclosures (Amendment) Act 2022, whistleblowers are protected from penalisation for having made a protected disclosure, under the Act.

Penalisation may include; suspension, lay-off or dismissal; demotion, loss of opportunity for promotion or withholding of promotion; transfer of duties, change of location or place of work; reduction in wages or change in working hours; the imposition or administering of any discipline, reprimand or other penalty (including a financial penalty); coercion, intimidation, harassment or ostracism; or discrimination, disadvantage or unfair treatment.

If an employee (which includes trainees, volunteers, and job applicants) alleges that they have suffered penalisation as a result of making a protected disclosure, they may apply to the Circuit Court for interim relief within 21 days of the date of the last act of penalisation by the employer.

A claim for penalisation may also be brought before the WRC within six months of the alleged act of penalisation. If an employee alleges that they were dismissed for having made a protected disclosure, the potential award that the WRC can make increases from the usual unfair dismissal cap of two years’ pay to up to five years’ gross pay, based on actual loss.

Where a complaint of whistleblowing is made, employers should ensure that they appoint investigators with the appropriate knowledge and expertise to deal with such a matter and comply with the time limits set by legislation.

The regulations on whistleblowing in the private sector were originally outlined in article 6 of Italian Legislative Decree No. 231 of 2001 (as amended by Law No. 179 of 2017), which state that the models of organisation must provide for one or more channels that allow persons in positions of representation, administration and management of the entity (and persons subject to their direction or supervision) to report unlawful conduct according to Italian Legislative Decree No. 231 of 2001 and violations of the entity’s organisational and management rules.

Currently, Italy has implemented Directive (EU) No. 1937 of 2019, which provides for the adoption of new standards of protection for whistleblowers, through the Italian Legislative Decree No. 24 of 2023 (WB Decree)[1].

In line with the Directive, the WB Decree states, inter alia, that[2]:

• an internal whistleblowing reporting channel must be put in place by all private legal entities (and legal entities in the public sector) that have employed, during the previous year, an average of 50 employees or, even below this threshold, operate in certain industries[3] or have adopted an organizational model in accordance with Legislative Decree no. 231 of 2001;
• the WB Decree prescriptions apply to reports concerning breaches of certain national/EU[4] legal provisions (varying depending on features such as the private or public nature of the employer and its dimensions), and not to claims or requests linked to interests of a personal nature of the reporting individuals (pertaining to their individual employment contracts or to relations with their superiors)[5];
• whistleblowers’ reporting may take place through:
  • the company’s internal reporting channels and internal reporting procedures (with the possibility – for entities employing up to 249 employees, even if not part of the same group – to share whistleblowing reporting channels); or
  • external reporting channels and external reporting procedures established by the member states’ competent authorities (in Italy, ANAC, i.e. the National Anticorruption Authority); or
  • in certain circumstances, public disclosure;
• whistleblowing systems must provide:
  • a duty of confidentiality regarding the whistleblowers’ identity (which generally may not be disclosed to persons other than those competent to receive or investigate on the reports, except in specific case and with the whistleblower’s consent; see also answer to question 12 below); and
  • ways of protecting collected data according to the GDPR, as well as tight deadlines for communication with whistleblowers[6]; and
  • an integrated system of protection of whistleblowers against any retaliatory action directly or indirectly linked to their reports or declarations, with a reversal of the burden of proof (meaning the employer must give proof of the non-retaliatory nature of measures adopted vis-à-vis whistleblowers); and
  • the procedures to be taken in case of anonymous whistleblowing report.

See question 4 regarding amendments to the Whistleblower Protection Act.

The person designated as a whistleblower response service employee must not divulge the name, employee ID number, or other information that would allow a whistleblower to be identified without a justifiable reason, and there is a criminal penalty of up to 300,000 yen for violating this duty of confidentiality.

The former Act on the House for Whistleblowers already provided for several preconditions that a whistleblowing procedure must meet. For example, internal reporting lines must be laid down, as well as how the internal report is handled, and an obligation of confidentiality and the opportunity to consult an advisor in confidence must be applied. Employers are obliged to share the whistleblowing policy with employees, including information about the employee's legal protection. The employee who reports a suspicion of wrongdoing in good faith may not be disadvantaged in their legal position because of the report (section17e/ea Act House of Whistleblowers).

The starting point is that an employee must first report internally, unless this cannot reasonably be expected. If the employee does not report internally first, the House for Whistleblowers does not initiate an investigation. The House for Whistleblowers was established on 1 July 2016 and has two main tasks: advising employees on the steps to take and conducting an investigation in response to a report.

The Act on the Protection of Whistleblowers, which entered into force in 2023, introduced several changes, of which the most relevant are:

• Abolition of mandatory internal reporting: the obligation to report internally first is abolished. Direct external reporting is allowed, such as to the House for Whistleblowers or another competent authority. When reporting externally, the reporter retains his protection. However, reporting internally first remains preferable and will be encouraged by the employer as much as possible.
• Expansion of prohibition on detriment: the prohibition on detriment already included prejudicing the legal position of the reporter, such as suspension, dismissal, demotion, withholding of promotion, reduction of salary or change of work location. It now also includes all forms of disadvantage, such as being blacklisted, refusing to give a reference, bullying, intimidation and exclusion. 
• Stricter time limit requirements for internal reporting: the reporter must receive an acknowledgement of receipt of the report within seven days and the reporter must receive information from the employer on the assessment of their report within a reasonable period, not exceeding three months.

• Extension of the circle of protected persons: not just employees, but third parties who are in a working relationship with the employer are now also protected, such as freelancers, interns, volunteers, suppliers, shareholders, job applicants and involved family members and colleagues.

Consideration must be given to the confidentiality or anonymity of the whistleblower, when an investigation involves whistleblowing.

Since there is no specific law that governs whistleblowing, matters that involve whistleblowing will be governed by company policy.

In principle, an internal investigation should be conducted in the same way, regardless of whether it is initiated following a whistleblowing report, an audit, or a monitoring result. This includes anything related to confidentiality, fairness, data privacy protection, etc.

If an internal investigation is initiated following a whistleblower report, the main characteristic that is imposed by the EU Directive on the protection of persons who report breaches of EU Law (Whistleblowers Directive) and that will also be available under the Draft Law is for the organisation (employer) to communicate (if practicable) the report to the whistleblower. Furthermore, the whistleblower should receive feedback as to whether follow-up actions were undertaken following the report and, if yes – what actions were taken – and if not – why the follow-up actions were not taken.

The treatment of whistleblowers and their reports is laid down in various specific laws in Portugal.

Law 93/2021

Under Law 93/2021, a whistleblower of work-related offences must not be retaliated against. Furthermore, imposing disciplinary penalties on the whistleblower within two years after their disclosure is presumed to be abusive. The whistleblower is entitled to judicial protection and may benefit from the witness protection programme within criminal proceedings. Additionally, reports will be recorded for five years and, where applicable, personal data that is not relevant for the handling of a specific report will not be collected or, if accidentally collected, will be deleted immediately.

Corruption and Financial Crime Law (Law 19/2008)

Under Law 19/2008, a whistleblower must not be hampered. Furthermore, the imposition of disciplinary penalties on a whistleblower within one year following the communication of the infraction is presumed to be unfair.

Additionally, whistleblowers are entitled to:

• anonymity until the pressing of charges;
• be transferred following the pressing of charges; and
• benefit from the witness protection programme within criminal proceedings (remaining anonymous upon the verification of specific circumstances).

Money Laundering and Terrorism Financing Law (Law 83/2017)

Law 83/2017, which sets forth the legal framework to prevent, detect and effectively combat money laundering and terrorism financing, applies to financial entities and legal or natural persons acting in the exercise of their professional activities (eg, auditors and lawyers)(collectively, obliged entities).

According to article 20 of Law 83/2017, individuals who learn of any breach through their professional duties must report those breaches to the company's supervisory or management bodies. As a result, the obliged entities must refrain from threatening or taking hostile action against the whistleblower and, in particular, unfair treatment within the workplace. Specifically, the report cannot be used as grounds for disciplinary, civil or criminal action against the whistleblower (unless the communication is deliberately and clearly unjustified).

Legal Framework of Credit Institutions and Financial Companies (RGICSF)

Credit institutions must implement internal-reporting mechanisms that must guarantee the confidentiality of the information received and the protection of the personal data of the persons reporting the breaches and the persons charged. Under article 116-AA of RGICSF, persons who, while working in a credit institution, become aware of:

• any serious irregularities in the management, accounting procedures or internal control of the credit institution; or
• evidence of a breach of the duties set out in the RGICSF that may cause any financial imbalance, must communicate those circumstances to the company's supervisory body.

These communications cannot, per se, be used as grounds for disciplinary, criminal or civil liability actions brought by the credit institution against the whistleblower.

Moreover, article 116-AB of the RGICSF establishes that any person aware of compelling evidence of a breach of statutory duties may report it to the Bank of Portugal. Such communications cannot, per se, be used as grounds for disciplinary, criminal or civil liability actions brought by the credit institution against the whistleblower, unless the report is clearly unfounded.

The Bank of Portugal must ensure adequate protection of the person who has reported the breach and the person accused of breaching the applicable duties. It must also guarantee the confidentiality of the persons who have reported breaches at any given time.

Portuguese Securities Code (CVM)

Article 382 of the CVM states that financial intermediaries subject to the supervision of the Portuguese Securities Market Commission (CMVM), judicial authorities, police authorities, or respective employees must immediately inform the CMVM if they become aware of facts that qualify as crimes against the securities market or the market of other financial instruments, due to their performance, activity, or position.

Additionally, according to article 368-A of the CVM, any person aware of facts, evidence, or information regarding administrative offences under the CVM or its supplementary regulations may report them to the CMVM either anonymously or with the whistleblower's identity. The disclosure of the whistleblower's identity, as well as that of their employer, is optional. If the report identifies the whistleblower, their identity cannot be disclosed unless specifically authorised by the whistleblower, by an express provision of law or by the determination of a court.

Such communications may not be used as grounds for disciplinary, criminal, or civil liability action brought against the whistleblower, and they may not be used to demote the employee.

According to article 368-E of the CVM, the CMVM must cooperate with other authorities within the scope of administrative or judicial proceedings to protect employees against employer discrimination, retaliation or any other form of unfair treatment by the employer that may be linked to the communication to the CMVM. The whistleblower may be entitled to benefit from the witness-protection programme if an individual is charged in criminal or administrative proceedings because of their communication to the CMVM.

Under the Prevention of Corruption Act 1960 and the Corruption, Drug Trafficking and Other Serious Crimes (Confiscation of Benefits) Act 1992 (CDSCA), in any civil or criminal proceeding, no witness is obliged to disclose the name or address of any informer, or disclose any information that might lead to his or her discovery concerning offences such as corruption, drug trafficking, and money laundering, save where:

• in any proceeding for the offence, the Court, after a full inquiry into the case, is of the opinion that the informer wilfully made, in his complaint, a material statement that he knew or believed to be false or did not believe to be true; or
• in any other proceeding, the court is of the opinion that justice cannot be fully done between the parties without the discovery of the informer.

In line with the above, employers should therefore keep the informer’s identity confidential upon receiving a complaint relating to corruption, drug trafficking, money laundering, and other serious offences prescribed in the second schedule of the CDSCA.

Aside from the legal obligations imposed on the company when dealing with a whistleblower who is subject to the WPA as discussed in question 1, there are also practical considerations the company should keep in mind when dealing with a whistleblower, regardless of whether the whistleblower falls under the WPA.

For example, there have been instances where an employee who raised allegations filed a complaint with Korean authorities (such as the Anti-Corruption and Civil Rights Commission (ACRC) or the Labour Office) that the company took retaliatory action against the whistleblower. The company should carefully review the legal risks before taking action, such as personnel action or civil or criminal action, against an employee who raises allegations if that employee was also involved in the wrongdoing.

Directive (EU) 2019/1937 of the European Parliament and of the Council, of 23 October 2019, on the protection of persons who report breaches of Union law, has been implemented in Spain through Law 2/2023 (Ley 2/2023, de 20 de febrero, reguladora de la protección de las personas que informen sobre infracciones normativas y de lucha contra la corrupción). This law limits the capacity of companies to retaliate or to take any action against employees who report workplace violations or breaches of the law. Any action taken against an employee in such a position would be considered null and void if challenged in court.

Spanish law allows anonymous reports to protect whistleblowers from retaliation.

If the Swedish Whistleblowing Act governs the investigation, additional considerations apply relating to who may investigate a reported irregularity (see question 4) and the duty of confidentiality and restrictions on access to and disclosure of personal data in investigations (see questions 6, 10 and 11), as well as the rights and protections of whistleblowers.

As regards the rights and protections of whistleblowers, the following can be noted. A person reporting in a reporting channel governed by the Swedish Whistleblowing Act is protected against retaliation and restrictive measures. Thus, companies are prohibited from preventing or trying to prevent a person from reporting, and retaliating against a person who reports. Furthermore, a reporting person will not be held liable for breach of confidentiality for collecting the reported information if the person had reasonable grounds to believe that it was necessary to submit the report to expose irregularities. Under the Swedish Whistleblowing Act, any person reporting irregularities in a reporting channel established under the Swedish Whistleblowing Act may also report irregularities to designated Swedish authorities.

If an employee complains to his or her superiors about grievances or misconduct in the workplace and is subsequently dismissed, this may constitute an unlawful termination (article 336, Swiss Code of Obligations). However, the prerequisite for this is that the employee behaves in good faith, which is not the case if he or she is (partly) responsible for the grievance.

It is down to the employer’s discretion and subject to the whistleblowing policy (if any) to commence the investigation resulting from a complaint from a whistleblower. Whistleblowers and those who cooperate with an investigation should be protected. Normally the employer would not try to identify the whistleblowers. Also, it is best not to reveal the identity of the witness or the source of information; otherwise, they may feel uncomfortable giving information or raising their concerns next time. Any allegations of retaliation that surface during the investigation should be treated as a new report of possible misconduct that could be subject to additional investigation.

Although there is no specific legislation in Turkish law on whistleblowing, necessary mechanisms need to be implemented to ensure that whistleblowers and the whistleblowing process are kept confidential. In addition, whistleblowers must be encouraged and supported to be open about raising their concerns in good faith. A whistleblowing activity, when it amounts to raising a concern in good faith, must not be mistreated by the employer. Employers should also put in place protection mechanisms against the mistreatment of whistleblowers or retaliation towards them by other employees.   

The employer should first identify which individuals may have protection as whistleblowers. This could be a current or former employee who raises the initial complaint, a co-worker who gives evidence as part of the investigation, or the accused employee.

In each case, consider whether a “protected disclosure” has been made (under Part IVA ERA 1996). This requires analysis of the subject matter of the disclosure, how it is made, and a reasonable belief that it is made in the public interest.

Employers must then ensure there is no detrimental treatment or dismissal of any worker on the grounds of their protected disclosure. Although the causation test for these purposes is not straightforward, as a general rule if the protected disclosure has a “material influence” on the decision to discipline or dismiss, there may be liability. Individual managers may be personally liable alongside the employer. Compensation for whistleblowing cases is uncapped, meaning businesses and individuals can face significant financial and reputational exposure.

What this means in practical terms is that the employer should promote a “speak-up” culture and, where protected disclosures are made, ensure they are handled by a team who are properly trained in how to do so.

Several federal, state, and local employment laws prohibit retaliation against employees who come forward with complaints or participate in corporate investigations. Employees who possess information regarding corporate misconduct may also be considered whistleblowers protected from retaliation under federal and state whistleblower laws, including but not limited to the Sarbanes-Oxley Act of 2002, the Dodd-Frank Wall Street Reform and Consumer Protection Act, and the Consumer Financial Protection Act of 2010.

An employee generally does not need to show that he or she was terminated or demoted to bring a retaliation claim; other actions on the part of the employer may qualify if they could be seen to discourage employees from raising complaints. To protect against a potential retaliation claim, employers should make clear at the outset of an investigation that retaliation will not be tolerated and require the complaining employee (and potentially his or her manager) to bring any instances of retaliation to the investigator’s attention immediately.

It is up to the employer to determine whether or not to open an investigation after a complaint from a whistleblower. It is very important that the identity of the whistleblower is protected and that the employer also should not reveal the identity of the witness or the source of information, as the sources and witnesses may fear retaliation and feel uncomfortable or hesitant in giving information or raising concerns again.

Investigation materials are not privileged and an employer may be required to disclose them in subsequent legal proceedings. If an employer is concerned about privilege attaching to an investigation, they should engage a legal practitioner to facilitate the investigation.

Employers who are concerned about privilege attaching to investigation materials should also consider the method of a lawyer’s engagement. The lawyer should be expressly engaged to investigate, report and to assist the employer by providing legal advice. Additional benefits can be achieved if the legal practitioner engages an external investigator to investigate the complaint and prepare the investigation report. Privilege will attach to the investigation materials because they are prepared for the lawyer to allow the lawyer to provide legal advice to the employer.

It is important that employers do not expressly or inadvertently waive privilege. For example, by disclosing the investigation report or substantial contents of the investigation report. It is a balance between providing information to the respondent and complainant about the outcome of the investigation and disclosing too much information.

If a lawyer is involved in the investigation, communication between the lawyer and client is subject to legal professional privilege. These communications must not be disclosed. Any documents collected by an internal audit can be seized and used. However, a document created by a lawyer can only be seized. The same applies to other professional representatives of parties, such as notaries and auditors, as potential holders of professional secrecy.

If the investigation is conducted by a prevention advisor, the investigation and the prevention advisor are bound and protected by a professional duty of confidentiality.

Privilege attaches to investigation materials when attorneys conduct interviews and take notes, and when they write reports and recommendations.

However, if other persons participate in an interview or write a report, and they are not attorneys, they can be required to testify about what they witnessed while participating in the interview or to discuss or disclose their investigation report.

For this reason, when starting an investigation, and depending on the matters to be investigated, it is important to determine whether it is convenient to allocate lawyers to certain roles to increase the company’s control of corporate confidentiality resulting from third-party involvement in the investigation.

Attorneys should also clearly state to participants of the investigation that they are attorneys representing the company and that their work papers fall under attorney-client privilege and will not be shared with them.

The employer has the property right over all its properties. When discovering employee's misconduct, the employer is entitled to conduct an investigation within a certain scope according to the relevant laws and regulations, as well as the management system of the employer. Generally speaking, the employer is not required to obtain consent of the employee when conducting an investigation of the space and objects owned by it. The employer has no right to directly conduct an investigation of the employee's private space, objects, bank accounts and stock trading accounts. The public security organ or other public authorities should be involved in the investigation. In principle, if the employee's private space or objects are mixed with the employer's private space or objects, the employer should obtain consent of the employee for an investigation. Meanwhile, the employer's investigation should be controlled within the reasonable and necessary limit, and the employer is not allowed to illegally use or disclose the investigation results, otherwise it may constitute infringement. In addition, we also recommend that the employer stipulate explicitly in the employment contract and the internal management system that the employer has the right to detain and inspect the articles or equipment distributed by the employer, so as to reduce the compliance risk of internal investigation.

The privilege of investigation materials concerns a rather limited amount of cases. In practice, materials may be considered privileged in connection with the litigation process under the Procedural Code (4/1734). For example, communications between a client and an attorney may attract protection against forcible public disclosure.

Privilege does not generally apply to internal investigation materials as the investigation does not constitute a relationship between a lawyer and their client, and even less so a judicial investigation. However, if a lawyer is appointed as an investigator, privilege may apply to materials exchanged between the lawyer and that client.

The legal situation regarding attorney-client privilege for investigation materials compiled by external advisors (in particular investigation reports) is unclear. In principle, there is no absolute protection against seizure by the public prosecutor in the relationship between client and lawyer. Such protection only exists in the relationship between the accused in a criminal proceeding and his criminal defence attorney.

In recent years, German courts have repeatedly issued different rulings on the question of whether investigation materials (at the company itself or a lawyer's office) may be seized. In 2018, the Federal Constitutional Court (BVerfG) ruled that the seizure of documents at the offices of an international law firm that is not based in Germany, and therefore can not invoke German constitutional rights, is lawful. However, the BVerfG did not comment on what would apply to seizures at law firms based in Germany.

For violations that could lead to the company itself being exposed to investigative proceedings at some point and possibly having to defend itself, there are, in our view, good arguments for investigation materials being subject to attorney-client privilege. Additionally, the lawyer's hand file, in which he usually keeps his notes on the case or minutes of conversations with his client, may also not be seized. In all other cases, under the current legal situation, there is a risk that the materials may be seized, even in the office of the company’s lawyer. From a practical point of view, it is nevertheless advisable to label investigative materials, especially interview protocols and investigation reports, with a notice that they are confidential documents subject to attorney-client privilege and to store them not at the company’s premises but in an attorney’s office.

Regarding L.4990/2022 for whistleblowers’ procedures, many categories of privilege may occur during an investigation, such as: attorney-client privilege; doctor-patient privilege; and court or other proceedings’ privilege deemed as classified. L.4990/2022 provides that its provisions do not affect any of these privileges and these privileges supersede[6].

Privilege may also be attached to investigation materials in investigations relating to workplace harassment and violence incidents; however, since L.4808/2021 does not offer a specific provision and criminal proceedings may also commence, the matter of privilege must be examined ad hoc.

Legal professional privilege may attach to investigation materials if they are generated for the sole or dominant purpose of giving or obtaining legal advice (legal advice privilege); or created with the sole or dominant purpose of either obtaining or giving advice about or obtaining evidence to be used in an actual or reasonably contemplated litigation (litigation privilege).[1] Legal advice privilege applies to confidential communications between lawyers and their clients, whereas litigation privilege may extend to communications between lawyers, clients and third parties. The employer may withhold disclosure of any materials that are subject to either legal advice or litigation privilege.

In the context of a workplace investigation, internal interview records are protected by legal advice privilege if the dominant purpose of creating those records is to seek legal advice on potential disciplinary action against the employee. Such interview records are protected by litigation privilege if they are created to obtain evidence in an actual or reasonably contemplated litigation.

It should be noted that the point in time at which the sole or dominant purpose is judged is when the document is created. In other words, a document is not covered by litigation privilege if it was not created for litigation purposes but was subsequently used to obtain legal advice for litigation.[2] On a practical point, if the employer would like to minimise disclosure of the investigation by claiming privilege over relevant materials, it may wish to limit the number of documents created and persons to which they are circulated to avoid potential waiver of privilege.

Professional advice given by an "advocate" to a client is protected as “privileged communication” and is not admissible as evidence in a court of law. Such privilege may not attach to advice or communications involving in-house lawyers as they are not licensed advocates (since they are expected to surrender their bar licences when they take on in-house roles). This is a grey area as there are conflicting judicial precedents on this. Hence, communications, documents or information gathered during an investigation conducted entirely internally may not be legally privileged and may be discoverable in a dispute. That said, companies generally mark sensitive communications with in-house attorneys as privileged and confidential in an attempt to protect the same.

For the above reasons, investigations conducted by external advocates have better chances of retaining legal privilege. However, the following will not be treated as privileged information:

• any correspondence about the commission of a crime or fraud by the client; and
• the observations of an attorney that would suggest that a crime or fraud will be committed by the client.

It would be difficult to assert privilege over materials that relate to the investigation itself.

Privilege may arise before the instigation of an investigation where an employer may seek legal advice from their legal advisors over the initial complaint and appropriate next steps. Subject to the relevant tests being met, Legal Advice Privilege arises in respect of a confidential communication that takes place between a professionally qualified lawyer and a client. Who the client is will be of significant importance as they must be capable of giving instructions to their lawyer, on behalf of the employer. Caution should be exercised by employers if advice to "the client" is disseminated further within the business to other members of management. If such a scenario arises, then there is a risk that privilege may be waived and such material could be disclosable under a data subject access request. Litigation privilege arises with respect to confidential communications that take place between a lawyer or a client and a third party for the dominant purpose of preparing for litigation, whether existing or reasonably contemplated.

It is also prudent to consider whether an external investigator should have access to their own independent legal advisor, and the funding arrangements for such advice would have to be considered by the employer.

In general, from an employment law perspective, workplace investigations made by corporate departments (eg, HR and legal counsel who do not operate in their function as lawyers) are not covered by privilege. Generally speaking, privilege covers correspondence and conversations between lawyers.

In defensive criminal law investigations, legal privilege applies.

There are no specific laws or rules for the provision of confidentiality privileges other than that provided by the Fair Trade Commission Rules, which allow companies that are the subject of investigations into cartels, bid rigging, etc, to treat communications with their lawyers as confidential. However, when a motion for an order to produce documents is filed in a court proceeding, if the requested documents are "documents exclusively for the use of the possessor of the documents", the obligation to produce the documents is not recognised. If the investigation materials fall under this category, it is possible to exclude them from the scope of the court order to produce documents.

If an attorney is engaged to provide legal advice or representation in respect of the (subject matter of the) investigation and as such also conducts (part of) the investigation, work products prepared by such an attorney will typically be subject to the legal privilege. Such work products may include, for example, interview minutes, investigation reports, investigation updates, attorney-client correspondence on the investigation, and legal advice rendered in connection with the (subject matter of the) investigation.

Privilege attaches to investigation materials when a legal practitioner facilitates the internal investigation. Documents prepared during a workplace investigation will not automatically attract legal professional privilege, unless the investigation is facilitated by a legal practitioner.

The employer’s internal policy can indicate that investigation materials must be kept confidential.

In general, findings made and documents established during an internal investigation, including the report thereof, are not covered by privilege per se. It can be claimed that they are covered by the employer’s commercial secrecy, but this secrecy is not very well protected from requests of law enforcement authorities. Hence, if prosecuting authorities find a report of an internal investigation or other documents established during an investigation relevant for criminal proceedings, they can ask for them. If they are not produced voluntarily, a search can be performed.

Legal privilege will, on the other hand, cover an internal investigation if it is entrusted to an independent lawyer. Specifically, client-attorney privilege will cover all documents that are established during the investigation by a lawyer.

Under Polish law there is no distinction between legal advice privilege and litigation privilege. Hence, legal privilege will cover the documentation of the internal investigation led by a lawyer regardless of whether the lawyer’s involvement is for the purpose of obtaining legal advice or because of ongoing or contemplated litigation.

If any sources of information used within an investigation include privileged data, they may be redacted to safeguard third parties' rights. However, where disclosure of that data is necessary for the employee to understand why he or she is being accused, it may be necessary to reveal those elements. Otherwise, the employee may argue that their rights were affected and, for that reason, the disciplinary procedure – and any possible sanction – should be deemed null and void.

Litigation privilege may attach to investigation materials if there was a reasonable prospect of litigation at the time of the creation of the materials, and the materials were created for the dominant purpose of a pending or contemplated litigation.

Legal advice privilege may attach to investigation materials if the materials were created to seek or obtain legal advice; or if the materials contain legal advice that is so embedded or has become such an integral part of the materials that the legal advice cannot be redacted from them. If the legal advice is separable from the materials, then only the parts of the materials containing legal advice will be protected by privilege.

No law recognises the common law concept of “attorney-client privilege” in Korea. However, communication with an attorney is protected to some extent under certain laws, such as the Constitution, the Attorney Act, the Criminal Procedure Act, and the Civil Procedure Act. This protection is based on the attorney’s confidentiality obligation, which prohibits an attorney from divulging confidential matters acquired in the course of representing clients, unless otherwise prescribed by law. This confidentiality obligation generally allows an attorney to refuse to testify or comply with document production orders for information or materials the attorney obtained in the course of his or her duties that relate to the confidential information of clients.

In addition, there could be instances where materials from an investigation conducted in Korea may become subject to discovery outside of Korea. It is, therefore, important to ensure investigation materials are privileged under the relevant non-Korean laws in the jurisdictions where attorney-client privilege is recognised (eg, the US).

As explained above, investigation materials are not protected by privilege per se. To protect the confidentially of these materials, it is advisable to enter into NDAs with the employees involved in the investigation.

Attorney-client privilege will apply to all communication and investigative material between a client and its law firm. Attorney-client privilege is, however, not without limitations. Regarding investigations into alleged employee misconduct, a law firm may have to report suspected money laundering to the authorities and under certain circumstances disclose information to the financial police.

Written material covered by attorney-client privilege generally may not be seized.

As outlined above, all employees generally have the right to know whether and what personal data is being or has been processed about them (article 8 paragraph 1, Swiss Federal Act on Data Protection; article 328b, Swiss Code of Obligations).

The employer may refuse, restrict or postpone the disclosure or inspection of internal investigation documents if a legal statute so provides, if such action is necessary because of overriding third-party interests (article 9 paragraph 1, Swiss Federal Act on Data Protection) or if the request for information is manifestly unfounded or malicious. Furthermore, a restriction is possible if overriding the self-interests of the responsible company requires such a measure and it also does not disclose the personal data to third parties. The employer or responsible party must justify its decision (article 9 paragraph 5, Swiss Federal Act on Data Protection).[1]

The scope of the disclosure of information must, therefore, be determined by carefully weighing the interests of all parties involved in the internal investigation.

Client-attorney privilege between qualified attorneys and the client (ie, an employer) begins once information is made available to the attorney, regardless of the form it takes.

Attorney-client privilege is attached at the time the attorney is hired as a legal representative. Attorney-client privilege, which is regulated under the Law of Criminal Procedure No. 5271 and the Attorney’s Act No. 1136, covers not only the investigation process, but also the legal advice and counselling received before and after the investigation. The importance of this privilege is especially present in cases where judicial or administrative authorities are involved in the process. Documents and correspondence benefiting from attorney-client privilege can be protected and fall outside the scope of preventive measures such as search and seizures due to the right of defence.

There are two limited types of privilege which may be relevant to investigations:

• Legal Advice Privilege (LAP), which protects communications between lawyers and their clients provided they are confidential and made for the dominant purpose of obtaining or giving legal advice; and
• Litigation Privilege (LP), which can extend to communications between a lawyer and client or third parties, but only where the dominant purpose of the communication is to prepare for or conduct existing or contemplated litigation.

If the relevant tests for privilege are met and apply to materials generated in the course of the investigation, the employer retains greater control over their subsequent disclosure to third parties. The materials would, for example, be protected against disclosure in any subject access request under the DPA 2018.

That said, privilege can be difficult to maintain in investigations, particularly where litigation is not active or in contemplation. Interview notes and witness statements may not attract privilege, particularly if these were conducted with employees who do not fall within the narrow definition of “the client” for LAP purposes (which is limited to employees who are capable of seeking and receiving advice on behalf of the employer).

If privilege applies to investigation materials, the investigator should keep tight control on what documents are created and how they are circulated, to avoid inadvertent disclosure and potential waiver of privilege.

Bear in mind that even if privilege applies to certain investigation materials, there may be a need to create disclosable documentation at a later stage, particularly if there is a decision to instigate disciplinary action.

For legal privilege to apply, a primary purpose of the investigation should be to provide legal advice to the company, including concerning non-lawyers working at the counsel’s direction, and legal privilege likely will not apply to internal investigations performed as part of the ordinary course of business or where the investigation is required by a state or federal regulatory regime (eg, post-incident investigations of operations governed by OSHA’s Process Safety Management Standards). It is, therefore, important to contemporaneously document the scope and purpose of the investigation and not risk waiving privilege by sharing privileged materials with unnecessary third parties.

Whereas attorney-client privilege includes only communications between an attorney and the client, work-product privilege is broader and includes materials prepared or collected by persons other than the attorney with an eye towards impending litigation. Examples of potential work products produced by attorneys in the context of an investigation include investigative work plans, interview outlines, memoranda summarising witness interviews and investigative reports.

As a practical matter, employees should be aware that communications with other employees or colleagues regarding the investigation are not privileged regardless of whether the colleague is also involved in the investigation or represented by the same counsel. Even if an employee believes he or she is sharing attorney communications with other employees who need to know the attorney’s advice and who also have attorney-client privilege with the same counsel because he or she is involved or implicated in the investigation and also represented by company counsel, it is always prudent to refrain from sharing privileged information. If an attorney’s communication is shared beyond those who need to know, attorney-client privilege may be destroyed.

Generally, privilege does not apply to internal workplace investigation materials as the investigation does not constitute a relationship between a lawyer and his or her client, and even less so a judicial investigation. However, if a lawyer is appointed to represent a specific party in an investigation, for example, as an investigator, the privilege may apply to materials exchanged between the lawyer and that client.