Workplace Investigations

A complaint will be a whistleblowing complaint where a complainant has reasonable grounds to suspect that the information they are disclosing about the organisation concerns misconduct or an improper state of affairs or circumstances. The information can be about the organisation or an officer or employee of the organisation engaging in conduct that:

• breaches the Corporations Act 2001 (Cth);
• breaches other financial sector laws;
• breaches any other law punishable by 12 months’ imprisonment; or
• represents a danger to the public or the financial system.

Since 2020, all public companies, large proprietary companies and trustees of registrable superannuation entities in Australia are required to have a whistleblower policy. Employers conducting an investigation will need to follow the processes outlined in their policy.

One of the key differences when conducting an investigation that involves whistleblowing is identity protection and the ability of the whistleblower to disclose anonymously and remain anonymous.

The provisions of the Whistleblowing Directive must be respected. In Austria, these have been implemented through the Whistleblower Protection Act (HSchG). If the whistleblower or the persons concerned fall within the scope of the Directive, their identity must be protected. Only authorised persons may access the report. Retaliatory measures are invalid or must be reversed. Within a maximum of seven days, the whistleblower must receive a confirmation of his or her complaint. Feedback to the whistleblower must then be provided within a maximum of three months.

If the investigation is based on a whistleblower report that falls under the scope of the upcoming rules, the investigators are bound by a strict duty of confidentiality, especially regarding the identity of the report. The rules also provide some procedural deadlines for feeding back to the reporter. Within seven days of receiving the report through an internal reporting channel, the reporting manager needs to send a receipt to the whistleblower. From that moment, the reporting manager has three months to investigate the report and give feedback and an adequate follow-up to the report. Next, the rules offer strong protection against any retaliatory measures the reporter may experience. Regardless, these rules are mostly intended to offer the necessary protection for whistleblowers and to ensure that companies take necessary investigative steps following a report, but they do not include much information about the actual procedure of the investigation besides certain deadlines, nor do they deal with other employees involved (or under investigation).

If the investigation involves matters within the scope of a specific whistleblowing policy, the policy rules should prevail against the general investigation rules if there is a conflict.

In practice, the following factors to be considered will be: (1) verification of the informant's identity; (2) whether the informant has any conflict of interest with the reported employee or whether it will affect the objectivity of their reporting; (3) how to persuade the informant to provide more information or evidence, or to cooperate in court as a witness; (4) how to increase the admissibility of evidence when the informant refuses to cooperate in court as a witness or fails to provide original evidence; (5) how to improve the evidence chain and protect the informant from being attacked or retaliated by the informant, etc.

In respect of data protection, the processing of personal data in whistleblowing systems is considered by the Finnish Data Protection Ombudsman (DPO) as requiring a data protection impact assessment (DPIA).

Evidence obtained in the context of an investigation must specify who provided it and the date it was provided. No retaliatory measures may be taken against the whistleblower for the act of whistleblowing.

In certain cases, the whistleblower report must be forwarded to the judicial authorities (eg, when there is an obligation to assist persons in imminent danger, for serious offences or a disclosure that a vulnerable person is in danger (ie, minors under 15 or a person who is unable to protect themselves)).

In 2023, Germany has implemented the EU Whistleblowing Directive into national law with the German Whistleblower Protection Act (HinSchG).

The German Whistleblower Protection Act provides that companies with at least 50 employees must establish internal reporting channels as further set out in the law. Among other things, the confidentiality of the whistleblower as well as of the individuals affected by the report must be protected.

Further, whistleblowers must be protected from negative consequences that may arise from their reports. If the employment of a whistleblower were terminated or if the whistleblower were to be denied promotion after reporting a violation, the employer would have to prove that this was not related to the whistleblowing but was based on justified reasons.

Employers should  familiarise themselves with the provisions of the new law.

L. 4990/2022 includes specific requirements regarding, among other things, the procedure of receiving and investigating respective reports, confidentiality issues (especially regarding the identity of the whistleblower), data protection issues (including restrictions to the right of access) and the employer’s right to keep a record of the relevant complaint and investigation. Such provisions are expected to be further detailed by Ministerial Decisions in future.

Hong Kong does not have a comprehensive legislative framework relating to whistleblowing. Therefore, in general, employers are free to establish whistleblowing policies and procedures and confer such protections on whistleblowers as they see fit. That said, companies listed on the Main Board of the SEHK are expected to establish a whistleblowing policy and system for employees to voice concerns anonymously about possible improprieties in the companies’ affairs. If a listed issuer deviates from this practice, it must explain the deviation.[1]

When an investigation involves whistleblowing, the employer needs to comply with the relevant policy and system and provide the whistleblower with such protections as stated in the policy. The employer should not ignore a complaint simply because it was made anonymously, and should ascertain the substance of the complaint to decide whether a full-blown investigation is warranted.

In addition, the employer should seek to establish a secure communication channel with the whistleblower to gather more information about the complaint or misconduct while maintaining the confidentiality of his or her identity. If the complaint is serious, the employer may consider referring the complaint to a law enforcement agency or regulator as they would be better placed in protecting the anonymity of the whistleblower while proceeding with the investigation. That said, employers generally have no obligation to report internal wrongdoing to any external body (please see question 25 for exceptions). The employer may assess whether it is appropriate to do so on a case-by-case basis.

Indian labour legislation does not stipulate any additional considerations or requirements concerning whistleblower complaints in private organisations and these are only available if there are complaints against public servants. Further, under the Companies Act, 2013, certain companies are required to establish a “vigil mechanism” for directors and employees to report genuine concerns regarding the affairs of the company. The vigil mechanism should provide adequate safeguards against the victimisation of persons using it.

Most whistleblowing policies will include a section that provides for an initial assessment of the complaint as to whether it meets the definition of a protected disclosure. This assessment, which ought to be carried out by a designated person who has been appointed to deal with disclosures, is a useful tool as some matters which may be labelled as whistleblowing may fall under the grievance procedure.

Where there are grounds, an investigation will be commenced. Under the Protected Disclosures (Amendment) Act 2022, whistleblowers are protected from penalisation for having made a protected disclosure, under the Act.

Penalisation may include; suspension, lay-off or dismissal; demotion, loss of opportunity for promotion or withholding of promotion; transfer of duties, change of location or place of work; reduction in wages or change in working hours; the imposition or administering of any discipline, reprimand or other penalty (including a financial penalty); coercion, intimidation, harassment or ostracism; or discrimination, disadvantage or unfair treatment.

If an employee (which includes trainees, volunteers, and job applicants) alleges that they have suffered penalisation as a result of making a protected disclosure, they may apply to the Circuit Court for interim relief within 21 days of the date of the last act of penalisation by the employer.

A claim for penalisation may also be brought before the WRC within six months of the alleged act of penalisation. If an employee alleges that they were dismissed for having made a protected disclosure, the potential award that the WRC can make increases from the usual unfair dismissal cap of two years’ pay to up to five years’ gross pay, based on actual loss.

Where a complaint of whistleblowing is made, employers should ensure that they appoint investigators with the appropriate knowledge and expertise to deal with such a matter and comply with the time limits set by legislation.

The regulations on whistleblowing in the private sector were originally outlined in article 6 of Italian Legislative Decree No. 231 of 2001 (as amended by Law No. 179 of 2017), which state that the models of organisation must provide for one or more channels that allow persons in positions of representation, administration and management of the entity (and persons subject to their direction or supervision) to report unlawful conduct according to Italian Legislative Decree No. 231 of 2001 and violations of the entity’s organisational and management rules.

Currently, Italy has implemented Directive (EU) No. 1937 of 2019, which provides for the adoption of new standards of protection for whistleblowers, through the Italian Legislative Decree No. 24 of 2023 (WB Decree)[1].

In line with the Directive, the WB Decree states, inter alia, that[2]:

• an internal whistleblowing reporting channel must be put in place by all private legal entities (and legal entities in the public sector) that have employed, during the previous year, an average of 50 employees or, even below this threshold, operate in certain industries[3] or have adopted an organizational model in accordance with Legislative Decree no. 231 of 2001;
• the WB Decree prescriptions apply to reports concerning breaches of certain national/EU[4] legal provisions (varying depending on features such as the private or public nature of the employer and its dimensions), and not to claims or requests linked to interests of a personal nature of the reporting individuals (pertaining to their individual employment contracts or to relations with their superiors)[5];
• whistleblowers’ reporting may take place through:
  • the company’s internal reporting channels and internal reporting procedures (with the possibility – for entities employing up to 249 employees, even if not part of the same group – to share whistleblowing reporting channels); or
  • external reporting channels and external reporting procedures established by the member states’ competent authorities (in Italy, ANAC, i.e. the National Anticorruption Authority); or
  • in certain circumstances, public disclosure;
• whistleblowing systems must provide:
  • a duty of confidentiality regarding the whistleblowers’ identity (which generally may not be disclosed to persons other than those competent to receive or investigate on the reports, except in specific case and with the whistleblower’s consent; see also answer to question 12 below); and
  • ways of protecting collected data according to the GDPR, as well as tight deadlines for communication with whistleblowers[6]; and
  • an integrated system of protection of whistleblowers against any retaliatory action directly or indirectly linked to their reports or declarations, with a reversal of the burden of proof (meaning the employer must give proof of the non-retaliatory nature of measures adopted vis-à-vis whistleblowers); and
  • the procedures to be taken in case of anonymous whistleblowing report.

See question 4 regarding amendments to the Whistleblower Protection Act.

The person designated as a whistleblower response service employee must not divulge the name, employee ID number, or other information that would allow a whistleblower to be identified without a justifiable reason, and there is a criminal penalty of up to 300,000 yen for violating this duty of confidentiality.

The former Act on the House for Whistleblowers already provided for several preconditions that a whistleblowing procedure must meet. For example, internal reporting lines must be laid down, as well as how the internal report is handled, and an obligation of confidentiality and the opportunity to consult an advisor in confidence must be applied. Employers are obliged to share the whistleblowing policy with employees, including information about the employee's legal protection. The employee who reports a suspicion of wrongdoing in good faith may not be disadvantaged in their legal position because of the report (section17e/ea Act House of Whistleblowers).

The starting point is that an employee must first report internally, unless this cannot reasonably be expected. If the employee does not report internally first, the House for Whistleblowers does not initiate an investigation. The House for Whistleblowers was established on 1 July 2016 and has two main tasks: advising employees on the steps to take and conducting an investigation in response to a report.

The Act on the Protection of Whistleblowers, which entered into force in 2023, introduced several changes, of which the most relevant are:

• Abolition of mandatory internal reporting: the obligation to report internally first is abolished. Direct external reporting is allowed, such as to the House for Whistleblowers or another competent authority. When reporting externally, the reporter retains his protection. However, reporting internally first remains preferable and will be encouraged by the employer as much as possible.
• Expansion of prohibition on detriment: the prohibition on detriment already included prejudicing the legal position of the reporter, such as suspension, dismissal, demotion, withholding of promotion, reduction of salary or change of work location. It now also includes all forms of disadvantage, such as being blacklisted, refusing to give a reference, bullying, intimidation and exclusion. 
• Stricter time limit requirements for internal reporting: the reporter must receive an acknowledgement of receipt of the report within seven days and the reporter must receive information from the employer on the assessment of their report within a reasonable period, not exceeding three months.

• Extension of the circle of protected persons: not just employees, but third parties who are in a working relationship with the employer are now also protected, such as freelancers, interns, volunteers, suppliers, shareholders, job applicants and involved family members and colleagues.

Consideration must be given to the confidentiality or anonymity of the whistleblower, when an investigation involves whistleblowing.

Since there is no specific law that governs whistleblowing, matters that involve whistleblowing will be governed by company policy.

In principle, an internal investigation should be conducted in the same way, regardless of whether it is initiated following a whistleblowing report, an audit, or a monitoring result. This includes anything related to confidentiality, fairness, data privacy protection, etc.

If an internal investigation is initiated following a whistleblower report, the main characteristic that is imposed by the EU Directive on the protection of persons who report breaches of EU Law (Whistleblowers Directive) and that will also be available under the Draft Law is for the organisation (employer) to communicate (if practicable) the report to the whistleblower. Furthermore, the whistleblower should receive feedback as to whether follow-up actions were undertaken following the report and, if yes – what actions were taken – and if not – why the follow-up actions were not taken.

The treatment of whistleblowers and their reports is laid down in various specific laws in Portugal.

Law 93/2021

Under Law 93/2021, a whistleblower of work-related offences must not be retaliated against. Furthermore, imposing disciplinary penalties on the whistleblower within two years after their disclosure is presumed to be abusive. The whistleblower is entitled to judicial protection and may benefit from the witness protection programme within criminal proceedings. Additionally, reports will be recorded for five years and, where applicable, personal data that is not relevant for the handling of a specific report will not be collected or, if accidentally collected, will be deleted immediately.

Corruption and Financial Crime Law (Law 19/2008)

Under Law 19/2008, a whistleblower must not be hampered. Furthermore, the imposition of disciplinary penalties on a whistleblower within one year following the communication of the infraction is presumed to be unfair.

Additionally, whistleblowers are entitled to:

• anonymity until the pressing of charges;
• be transferred following the pressing of charges; and
• benefit from the witness protection programme within criminal proceedings (remaining anonymous upon the verification of specific circumstances).

Money Laundering and Terrorism Financing Law (Law 83/2017)

Law 83/2017, which sets forth the legal framework to prevent, detect and effectively combat money laundering and terrorism financing, applies to financial entities and legal or natural persons acting in the exercise of their professional activities (eg, auditors and lawyers)(collectively, obliged entities).

According to article 20 of Law 83/2017, individuals who learn of any breach through their professional duties must report those breaches to the company's supervisory or management bodies. As a result, the obliged entities must refrain from threatening or taking hostile action against the whistleblower and, in particular, unfair treatment within the workplace. Specifically, the report cannot be used as grounds for disciplinary, civil or criminal action against the whistleblower (unless the communication is deliberately and clearly unjustified).

Legal Framework of Credit Institutions and Financial Companies (RGICSF)

Credit institutions must implement internal-reporting mechanisms that must guarantee the confidentiality of the information received and the protection of the personal data of the persons reporting the breaches and the persons charged. Under article 116-AA of RGICSF, persons who, while working in a credit institution, become aware of:

• any serious irregularities in the management, accounting procedures or internal control of the credit institution; or
• evidence of a breach of the duties set out in the RGICSF that may cause any financial imbalance, must communicate those circumstances to the company's supervisory body.

These communications cannot, per se, be used as grounds for disciplinary, criminal or civil liability actions brought by the credit institution against the whistleblower.

Moreover, article 116-AB of the RGICSF establishes that any person aware of compelling evidence of a breach of statutory duties may report it to the Bank of Portugal. Such communications cannot, per se, be used as grounds for disciplinary, criminal or civil liability actions brought by the credit institution against the whistleblower, unless the report is clearly unfounded.

The Bank of Portugal must ensure adequate protection of the person who has reported the breach and the person accused of breaching the applicable duties. It must also guarantee the confidentiality of the persons who have reported breaches at any given time.

Portuguese Securities Code (CVM)

Article 382 of the CVM states that financial intermediaries subject to the supervision of the Portuguese Securities Market Commission (CMVM), judicial authorities, police authorities, or respective employees must immediately inform the CMVM if they become aware of facts that qualify as crimes against the securities market or the market of other financial instruments, due to their performance, activity, or position.

Additionally, according to article 368-A of the CVM, any person aware of facts, evidence, or information regarding administrative offences under the CVM or its supplementary regulations may report them to the CMVM either anonymously or with the whistleblower's identity. The disclosure of the whistleblower's identity, as well as that of their employer, is optional. If the report identifies the whistleblower, their identity cannot be disclosed unless specifically authorised by the whistleblower, by an express provision of law or by the determination of a court.

Such communications may not be used as grounds for disciplinary, criminal, or civil liability action brought against the whistleblower, and they may not be used to demote the employee.

According to article 368-E of the CVM, the CMVM must cooperate with other authorities within the scope of administrative or judicial proceedings to protect employees against employer discrimination, retaliation or any other form of unfair treatment by the employer that may be linked to the communication to the CMVM. The whistleblower may be entitled to benefit from the witness-protection programme if an individual is charged in criminal or administrative proceedings because of their communication to the CMVM.

Under the Prevention of Corruption Act 1960 and the Corruption, Drug Trafficking and Other Serious Crimes (Confiscation of Benefits) Act 1992 (CDSCA), in any civil or criminal proceeding, no witness is obliged to disclose the name or address of any informer, or disclose any information that might lead to his or her discovery concerning offences such as corruption, drug trafficking, and money laundering, save where:

• in any proceeding for the offence, the Court, after a full inquiry into the case, is of the opinion that the informer wilfully made, in his complaint, a material statement that he knew or believed to be false or did not believe to be true; or
• in any other proceeding, the court is of the opinion that justice cannot be fully done between the parties without the discovery of the informer.

In line with the above, employers should therefore keep the informer’s identity confidential upon receiving a complaint relating to corruption, drug trafficking, money laundering, and other serious offences prescribed in the second schedule of the CDSCA.

Aside from the legal obligations imposed on the company when dealing with a whistleblower who is subject to the WPA as discussed in question 1, there are also practical considerations the company should keep in mind when dealing with a whistleblower, regardless of whether the whistleblower falls under the WPA.

For example, there have been instances where an employee who raised allegations filed a complaint with Korean authorities (such as the Anti-Corruption and Civil Rights Commission (ACRC) or the Labour Office) that the company took retaliatory action against the whistleblower. The company should carefully review the legal risks before taking action, such as personnel action or civil or criminal action, against an employee who raises allegations if that employee was also involved in the wrongdoing.

Directive (EU) 2019/1937 of the European Parliament and of the Council, of 23 October 2019, on the protection of persons who report breaches of Union law, has been implemented in Spain through Law 2/2023 (Ley 2/2023, de 20 de febrero, reguladora de la protección de las personas que informen sobre infracciones normativas y de lucha contra la corrupción). This law limits the capacity of companies to retaliate or to take any action against employees who report workplace violations or breaches of the law. Any action taken against an employee in such a position would be considered null and void if challenged in court.

Spanish law allows anonymous reports to protect whistleblowers from retaliation.

If the Swedish Whistleblowing Act governs the investigation, additional considerations apply relating to who may investigate a reported irregularity (see question 4) and the duty of confidentiality and restrictions on access to and disclosure of personal data in investigations (see questions 6, 10 and 11), as well as the rights and protections of whistleblowers.

As regards the rights and protections of whistleblowers, the following can be noted. A person reporting in a reporting channel governed by the Swedish Whistleblowing Act is protected against retaliation and restrictive measures. Thus, companies are prohibited from preventing or trying to prevent a person from reporting, and retaliating against a person who reports. Furthermore, a reporting person will not be held liable for breach of confidentiality for collecting the reported information if the person had reasonable grounds to believe that it was necessary to submit the report to expose irregularities. Under the Swedish Whistleblowing Act, any person reporting irregularities in a reporting channel established under the Swedish Whistleblowing Act may also report irregularities to designated Swedish authorities.

If an employee complains to his or her superiors about grievances or misconduct in the workplace and is subsequently dismissed, this may constitute an unlawful termination (article 336, Swiss Code of Obligations). However, the prerequisite for this is that the employee behaves in good faith, which is not the case if he or she is (partly) responsible for the grievance.

It is down to the employer’s discretion and subject to the whistleblowing policy (if any) to commence the investigation resulting from a complaint from a whistleblower. Whistleblowers and those who cooperate with an investigation should be protected. Normally the employer would not try to identify the whistleblowers. Also, it is best not to reveal the identity of the witness or the source of information; otherwise, they may feel uncomfortable giving information or raising their concerns next time. Any allegations of retaliation that surface during the investigation should be treated as a new report of possible misconduct that could be subject to additional investigation.

Although there is no specific legislation in Turkish law on whistleblowing, necessary mechanisms need to be implemented to ensure that whistleblowers and the whistleblowing process are kept confidential. In addition, whistleblowers must be encouraged and supported to be open about raising their concerns in good faith. A whistleblowing activity, when it amounts to raising a concern in good faith, must not be mistreated by the employer. Employers should also put in place protection mechanisms against the mistreatment of whistleblowers or retaliation towards them by other employees.   

The employer should first identify which individuals may have protection as whistleblowers. This could be a current or former employee who raises the initial complaint, a co-worker who gives evidence as part of the investigation, or the accused employee.

In each case, consider whether a “protected disclosure” has been made (under Part IVA ERA 1996). This requires analysis of the subject matter of the disclosure, how it is made, and a reasonable belief that it is made in the public interest.

Employers must then ensure there is no detrimental treatment or dismissal of any worker on the grounds of their protected disclosure. Although the causation test for these purposes is not straightforward, as a general rule if the protected disclosure has a “material influence” on the decision to discipline or dismiss, there may be liability. Individual managers may be personally liable alongside the employer. Compensation for whistleblowing cases is uncapped, meaning businesses and individuals can face significant financial and reputational exposure.

What this means in practical terms is that the employer should promote a “speak-up” culture and, where protected disclosures are made, ensure they are handled by a team who are properly trained in how to do so.

Several federal, state, and local employment laws prohibit retaliation against employees who come forward with complaints or participate in corporate investigations. Employees who possess information regarding corporate misconduct may also be considered whistleblowers protected from retaliation under federal and state whistleblower laws, including but not limited to the Sarbanes-Oxley Act of 2002, the Dodd-Frank Wall Street Reform and Consumer Protection Act, and the Consumer Financial Protection Act of 2010.

An employee generally does not need to show that he or she was terminated or demoted to bring a retaliation claim; other actions on the part of the employer may qualify if they could be seen to discourage employees from raising complaints. To protect against a potential retaliation claim, employers should make clear at the outset of an investigation that retaliation will not be tolerated and require the complaining employee (and potentially his or her manager) to bring any instances of retaliation to the investigator’s attention immediately.

It is up to the employer to determine whether or not to open an investigation after a complaint from a whistleblower. It is very important that the identity of the whistleblower is protected and that the employer also should not reveal the identity of the witness or the source of information, as the sources and witnesses may fear retaliation and feel uncomfortable or hesitant in giving information or raising concerns again.

The investigator should prepare a written report setting out whether the allegations are substantiated, unsubstantiated or cannot be determined due to insufficient evidence. This report should be used for internal purposes only. Accordingly, the report should not be shared with the complainant, respondent or witnesses unless required by law, the employer’s policies or another industrial instrument. It is particularly important not to share the investigation report should the employer wish to maintain privilege in respect of the report.

The employer should determine the intended recipients and format of the report in advance. In many cases, it may be advisable to publish only the results of the investigation to protect the privacy and reputation of the individuals concerned, as this may help to minimise any potential negative impact on them.

However, under certain circumstances or due to legal requirements, full disclosure of the investigation report may be required, especially if transparency and disclosure are necessary to maintain public or investor confidence.

It is recommended to limit the communication to the findings and details of the report that are necessary for the employee to fully understand the outcome. This is especially true if the investigation is bound by a duty of confidentiality (eg, under the whistleblowing rules), as the employee should not be allowed access to the full report.

There is no legal requirement or recommendation for the company to share the full or partial report or findings. It is also not a recommended measure. Therefore, unless the internal rules determine that the company must do it, any answer to queries should be limited to the fact that the investigation was concluded, and the company took the appropriate action.

For the employee: As mentioned in our response to question 22, the relevant laws and regulations in the PRC do not impose any obligation on an employer to share investigation report (including the findings) with its employee, unless otherwise expressly provided in its internal rules and regulations that the employer may share with its employee any investigation report or findings that do not involve trade secrets or another person's privacy or personal information. Therefore, the employer has the discretion to decide whether and to what extent to share the investigation report based on its business management needs.

For the police/regulatory authorities: In general, an employer shall provide a complete report according to the law as required by the authority handling the case. It is recommended that the employer should conduct a detailed review of the investigation authority and the information contained in the evidence collection documents issued by the authority, and communicate with the authority to specify the scope of assistance and evidentiary materials to be provided. Although the employer cannot refuse to provide relevant evidentiary materials to the investigation authority on the grounds that such evidentiary materials involve trade secret or personal privacy, it still needs to carefully assess the relevance of the evidentiary materials to the facts of the case and timely communicate with the authority to confirm and narrow the scope of providing evidence as much as possible. If necessary, the employer can consult professional lawyers to provide professional opinions. In addition, we suggest that the employer may also try to require the investigation officer to sign a confidentiality letter, and file the investigation materials involving trade secret or personal privacy, the reasons thereof, etc., for the purpose of reducing legal risks faced by the employer.

The employee under investigation may only be informed of the conclusions.

There is no obligation to share the investigation report. The findings, or a summary of them without revealing any confidential information, may be disclosed, but it is the employer’s responsibility to keep the identity of every person interviewed confidential.

Generally, general data protection regulations apply. This means that, after the investigation, the information described in question 22 must only be provided if the employee requests it.

Whether, in the context of such a request, the full report needs to be shared is disputed in Germany. Some legal scholars and labour courts argue that a summary of the content of the report is sufficient. Others state that the employee should be presented with the full report, whereby passages that do not concern him should be redacted. In practice, it is highly uncommon to share the full report with the employee.

There is no explicit legal provision stating the whole report must be communicated with the employee under investigation. The legal framework (L.4990/2022 and L.4808/2021) is governed by strict confidentiality obligations and obligations to protect the complainant’s data. From a data protection regulation perspective, it could be argued that the right of the person under investigation to know the identity of the complainant, witnesses or sources of information should be limited to protect the rights of such persons.

However, if the outcome of the investigation leads to the imposition of disciplinary measures, the right of the employee under investigation to request the whole investigation report, to aid in their defence is enhanced. Moreover, if a complaint is made in bad faith or is unfounded, it may be supported that the employee under investigation is entitled to receive full documentation so he or she can seek adequate legal protection or file an action before the courts.

The employer is generally not obliged to share the investigation report or the findings with the employee under Hong Kong law, absent any express obligations under the employment contract.

However, according to the PDPO, the content of the investigation report or meeting minutes related to the employee (including any findings and opinions expressed in such documents) are likely to constitute the personal data of the employee under investigation. In that case, the employee may have a right under the PDPO to obtain a copy of such documents by making a statutory data access request after the workplace investigation is completed. The employer’s obligation to comply with such request is subject to certain exemptions under Part 8 of the PDPO, which include (among others) an exemption on the provision of personal data held for the prevention, preclusion or remedying of unlawful or seriously improper conduct, and the disclosure of which would be likely to prejudice the said purpose or directly or indirectly identify the person who is the source of the data.[1] Therefore, where there is a parallel criminal proceeding or investigation that has not been concluded, the employer may reject an employee’s data access request on the basis that the requested disclosure may prejudice the prevention and remedy of the unlawful conduct. Further, any information protected by legal privilege is also exempt from disclosure under Part 8 of the PDPO.[2]

If the requested documents also contain the personal data of any other third parties (such as other co-workers of the employee who have also participated in the investigation), the employer should always redact or erase such data before providing the requested documents to the employee under investigation, unless the relevant third parties have consented to the disclosure of the data.

Please see question 22.

The investigation report should be shared in full, unless there is some specific reason for not doing so. One example is where there is a possibility of a criminal investigation; in that instance, it may be appropriate not to share the full report. Occasionally, there may be several respondents involved in the complaint, and each respondent may only be entitled to the report that relates to them.

There is no general obligation of the employee to share an investigation report with the employee: only if and when disciplinary action is brought against the employee, the latter must be informed precisely of the allegations (but, once again, without being entitled to review the investigation report). In court, employees may ask for an exhibition of documents, including the investigation report, if not already filed by the employer, to use in its defence (but such request is not necessarily automatically granted by the court, as certain requirements must be met.

There is no legal obligation to share reports of findings. Therefore, the company may share only the summary or the entire report at its discretion.

Employers are typically not required to share the investigation report with implicated persons or other employees involved in an investigation. Depending on the nature and subject of the investigation, the principle of due care may require an employer to share (draft) investigative findings before concluding on such findings.

The employer needs to balance the interests of the employee investigated, and the interests of other persons involved in the investigation such as the complainant and witnesses. Thus, the employer may either share the findings of the investigation or the full investigation report, provided that the identities of all other persons involved in the investigation are kept confidential.

The employer is not compelled to share its investigation report with the employee. However, it would be ideal for the company to keep in its records a comprehensive report that details the findings of the investigation. This would be useful during the administrative disciplinary process when the employee requests to be informed of the substantive grounds for his or her eventual termination.

It does not need to be shared with the employees at all. It may be shared only to the extent such a disclosure will not violate any law, including personal data protection law or personal rights.

If the employee is accused by the employer, they will be entitled to consult the entire investigation report and not just the findings, as well as the witnesses' depositions, which should be in writing, and any other sources of information that were used by the employer

Even though the law is silent in this respect, courts have ruled that if this is not complied with, the employee’s right of defence would be deemed to be disrespected.

It would suffice for a summary of the investigation’s findings to be shared with the complainant and the respondent employees.

As discussed in question 22, when taking disciplinary action against an employee based on the outcome of an investigation, the company would need to disclose sufficient detail on the employee’s wrongdoing. However, this does not mean that the full investigation report would need to be shared with the employee to be disciplined. Key details of the investigation findings that apply to the relevant employee due to be disciplined should be shared, and not other findings concerning other persons.

There is also no requirement under Korean law for a company to disclose the investigation report or investigation findings to the whistleblower. If the company discloses the personal identity of the target employees, such disclosure could constitute a violation of the PIPA , libel or defamation under the Criminal Code. If the whistleblower strongly requests that the company share the investigation report or the findings, the company may consider providing a summary of the key findings concerning the allegations that the whistleblower raised, without disclosing personal information.

Since workplace investigations are not regulated in Spain, there are no clear rules as to the amount of information on the investigation that would need to be shared with an employee if the company was compelled to disclose the enquiry (see questions 11 and 22). A good rule of thumb is that an employee should have access to all the information that is relevant to be in a position to oppose the alleged breaches.

Moreover, if the disciplinary measures taken were challenged before a Labour Court – employees in Spain tend to challenge these types of measures – the plaintiff could request the Labour Court to order the company to produce all of the investigation details, including the findings and the full investigation report.

Finally, companies will normally have an interest in producing a report that clearly states the moment in which the fact-finding exercise was concluded and the company had a full picture of the facts. This is because the statute of limitations to sanction employment breaches, which ranges from 10 to 60 days depending on the seriousness of the misconduct, starts to count when the company has a comprehensive view of the events (which would coincide with the date the investigation report was issued).

There is no obligation to share the investigation report, neither in full nor key findings, with the involved parties. An assessment needs to be made in each case of what is appropriate to share and with whom.

When sharing an investigation report, certain data protection considerations must be made. A purpose and legal basis for the sharing must be established and, in principle, documented.

If the Swedish Whistleblowing Act applies, the duty of confidentiality and the restrictions on access to and disclosure of personal data must be considered (see question 10).

In principle, there is no obligation to disclose the final investigation report. Disclosure obligations may arise based on data protection law vis-à-vis the persons concerned (eg, the accused). Likewise, there is no obligation to disclose other documents, such as the records of interviews. The employee should be fully informed of the final investigation report, if necessary, with certain redactions (see question 22). The right of the employee concerned to information is comprehensive (ie, all investigation files must be disclosed to him).[1] Regarding publication to other bodies outside of criminal proceedings, the employer is bound by its duty of care (article 328, Swiss Code of Obligations) and must protect the employee as far as is possible and reasonable.[2]

It depends on with whom the investigation report should be shared. If there is a court case or criminal case to be further investigated by police, the investigation report should be shared in full as this would be used as documentary evidence to make a case stronger. On the contrary, if the investigation report is requested by the employee under investigation, employers are entitled to use their discretion as to what information to share.

There is no legal requirement for the disclosure of the investigation report in full. If the investigation report needs to be submitted to the court, public institutions or other third parties, measures may need to be taken to protect confidentiality or to comply with the confidentiality requests of the persons participating in the investigation.

The answer to this depends on whether or not privilege attaches to the report, as well as whether criminal proceedings are contemplated – if so, there may be a danger of waiver of privilege, or witness evidence being contaminated if they have an opportunity to read each other’s evidence as part of the report. This could inhibit the fairness of any subsequent criminal trial.

Only the findings should be shared with the complainant and the subject of the complaint.

There is no obligation to share the investigation report or the findings unless the employer and employee agree to do so.

However, under Decree No. 13/2023/ND-CP on personal data protection, the contents of the investigation report or findings related to the employee are likely to constitute the personal data of the employee under investigation. In that case, the employee may have a right under the said Decree to obtain copies of such documents by making a statutory data access request after the workplace investigation is completed. Where the employer is required to provide such documents to the employee under Decree No. 13/2023/ND-CP but the requested documents also contain the personal data of any other third parties (such as the employee’s co-workers who participated in the interview during the investigation), the employer should first redact or erase such data before providing the requested documents, unless the relevant third parties have consented to the disclosure of their personal data.