Workplace Investigations

Employers will generally take steps to treat complaints sensitively and confidentially. However, because of the obligations employers have, confidentiality cannot be guaranteed as part of the investigation and the complainant, respondent and witnesses should be made aware of this.

Understandably, the complainant or witnesses may wish to remain anonymous. However, because the details of the allegations need to be put to the respondent so that they can provide an informed response or explanation, the source of the information will often need to be disclosed.  

Employers can take steps to “ringfence” the investigation by asking employees to sign a confidentiality agreement. This will protect the interests of the participants of the investigation and uphold the integrity of the investigation.

When dealing with reports and persons covered by the HSchG, the provisions on identity protection must be followed. In all internal investigations, only authorised persons should receive information.

If the complainant made use of an internal whistleblowing procedure, confidentiality regarding the identity of a reporter is mandatory. Also, in other cases and for other involved persons (witnesses), it is recommended to keep their identity confidential to prevent the risk of intimidation or other negative consequences.

In complaints due to sexual harassment, violence or bullying at work, if the prevention adviser heard or took written statements from persons that were considered useful for the evaluation, these persons may remain anonymous.

The employee must, nevertheless, receive sufficient information to be able to offer a defence concerning the facts of which he or she is accused.

Yes, the identity of the complainant, witnesses and sources of information for the investigation should be kept confidential.

At the level of criminal procedure in PRC, only the Criminal Procedure Law of PRC provides that pseudonyms may be used in the indictment as a substitute for the disclosure of a witness's personal information, such as name, address, employer and contact information, to protect the personal safety of the witness. However, there are no relevant provisions on whether the identity of the complainant, the witness in civil litigation and the provider of information shall be kept confidential during an investigation.

During the course of an investigation, in order to protect the privacy of relevant personnel and avoid the risk of infringement, the employer usually keeps the identity of the complainant or the provider of investigation information confidential. However, at the civil litigation stage, the witness is unavoidably required to testify in court, and must truthfully identify himself/herself to the court.

See question 11, there is no protection of anonymity as the process must be transparent to the parties involved.

The identity of the complainant must be kept confidential and cannot be disclosed. There are two exceptions: if the complainant consents to the disclosure; or if the employer is asked for this information by the judicial authorities.

There is no general obligation on the part of the employer to disclose to the employee concerned the identity of the complainant, witnesses or other sources of information during the workplace investigation.

However, as described in question 11, the employee must be sufficiently informed of the allegations before a termination based on suspicion of wrongdoing is issued. This may also require disclosing the complainant's or witnesses' identity or other sources of information. In addition, the employer would have the burden of proof in the context of a legal dispute (eg, termination protection proceedings or proceedings about the legality of certain investigation measures) and may have to name witnesses and disclose sources of information.

According to express provisions of L.4990/2020, in principle personal data and any other information that may lead directly or indirectly to the identification of the complainant must not be disclosed to anyone other than the investigating individuals unless the complainant gives consent[4] and that is why pseudonyms should be used. The witnesses and third persons that aid the complainant are deemed as “mediators” by the Law and their contribution to the procedure should be confidential[5].

L.4808/2021 does not indicate when such disclosures are permitted; however, it is obvious that this is a matter of cost-benefit analysis where the public interest and the fundamental rights of the involved persons should be considered in a balanced way to ensure the best results. From a data protection perspective, it could be argued that the person under investigation’s right to know the identity of the complainant, witnesses or sources of information should be limited to protect the rights of these persons.

Subject to any internal policies and terms of the employment contract, an employer would have discretion as to whether the identity of the complainant, witnesses or sources of information for the investigation should be kept confidential. In general, the employer should consider how the confidential treatment or its absence would affect the conduct and outcome of the investigation. The disclosure of the identity of the complainant in some cases may be necessary for the employee under investigation to respond in a meaningful way. On the other hand, both the complainant and witnesses may be more forthcoming in providing information if he or she is assured that his or her identity will not be made known to the person under investigation (especially if the latter is senior management personnel). A balance should be struck between the interests of the complainant or witnesses in maintaining confidentiality and the need for the employee under investigation to make a proper response to the allegations made. In any case, the employer should follow its whistleblowing policy if there is one (as discussed in question 9), and take into account practical and statutory considerations relating to confidentiality (as discussed in question 10).

The response and approach to this would be very fact-specific.

Under the SH Act, an individual cannot file an anonymous complaint and, therefore, the name of the complainant cannot be kept confidential. The same would go for details of witnesses, if any.

For other types of misconduct, the name of the complainant could potentially be kept confidential, depending on the nature of the allegations. For example, if an individual observes another colleague or employee committing inappropriate conduct (such as fraud or bribery) and reports this, the name of the complainant may not necessarily have to be disclosed to the accused employee, especially where the company is independently able to gather evidence substantiating the allegations. The names of witnesses generally cannot be kept confidential, since doing so may prove prejudicial to the accused employee. Further, as part of the disciplinary inquiry process, the accused has the right to cross-examine witnesses.

Notwithstanding the above, the approach to this issue should be assessed on a case-by-case basis by looking at the underlying sensitivities and risks involved. Courts have, in limited circumstances, permitted non-disclosure of the names of witnesses or complainants.

Failure by an employer to provide the identity of the complainant, witnesses or sources of information seriously impinges upon the employee's right to fair procedure and could result in a flawed investigation.

Yes, in principle the identity of the complainant, witnesses or sources of information for the investigation can be kept confidential.

On the other hand, if the employer – after having concluded the investigation – brings disciplinary action against the employee, the employer must send a letter to the employee in which the facts are described in detail, objectively and in a precise way, identifying when and where they have taken place, to allow a proper defence for the employee.

Even at this stage, however, the employer has no obligation to provide the employee with the evidence underlying the facts ascribed to him (ie, the employer has no obligation to specify the identity of the individuals through which they gained knowledge of the facts reported in the disciplinary letter).

However, if the employee subsequently challenges the disciplinary sanction before a judge, the employer bears the burden of proof, which may mean having to call the individuals interviewed within the internal investigation to stand as witnesses in court.

Moreover, in case of whistleblowing reports falling within the scope of the WB Decree, the employer is requested to generally keep the whistleblower’s identity confidential (according to art. 12 of the WB Decree). More specifically: (i) if the disciplinary charges are grounded on investigations which are different and additional to the whistleblowing report (although arising as a consequence of the report), the whistleblower’s identity may not be disclosed; (ii) if the disciplinary charges are grounded, in whole or in part, on the whistleblowing report, and knowing the identity of the whistleblower is indispensable for the defendant, such report may be used for the purpose of the disciplinary proceeding only if the whistleblower gives consent to his/her identity being revealed.

For whistleblowing investigations, whistleblower protection is required (see question 9).

Witnesses and other sources of information are not protected by the Whistleblower Protection Act.

In addition, as a response to a report of harassment, the Ministry of Health, Labour and Welfare guidelines require that necessary measures be taken to protect the privacy of the reporter, the offender, and others, and that these measures be announced to the company.

Such information can usually be kept confidential in an internal investigation, subject to potential disclosure obligations (see question 25). As indicated in question 10, depending on the nature and subject matter of an investigation, the identity of employees involved and investigative findings shall be shared with an employer on a need-to-know basis only. Specific requirements apply to the protection of the identity of whistleblowers since the Whistleblower Directive was implemented into Dutch law.

Typically, the identities of the complainant, witnesses and sources of information for the investigation are kept confidential.

The identity of the complainant, witnesses and sources of information may be kept confidential under the employer’s policies.

Yes.

An employee served a notice of accusation is entitled to assess all information that was gathered within the scope of the investigation and disciplinary procedure (notably the identity of the complainant, witnesses heard, other sources of information, etc), otherwise his right of defence may be jeopardised.

Where a preliminary investigation does not lead to an accusation against the employee, no disclosure has to be made by the employer.

Such information can be kept confidential, subject to questions 10 and 11. However, disclosure may nevertheless be compelled in court or arbitration proceedings as well as by disclosure requests or directions by the police or statutory authorities, including the MOM.

As discussed in question 1, if the whistleblower falls under the WPA, the whistleblower’s identity should be kept confidential. Even if the WPA does not apply, the company may wish to keep the identity of the whistleblower and other key witnesses confidential to the greatest extent possible.

As in question 10, the identity of the complainant or other employees involved in the investigation may be kept confidential and companies do not have to share their identity with investigated employees. Anonymous complaints are expressly allowed under Spanish law (see question 9).

Companies may have to produce this information and share it with the investigated employees if it is necessary to allow them to defend themselves from disciplinary measures taken against them. Similarly, in the context of litigation, an employee or plaintiff could request a Labour Court to order the company to disclose the details of the investigation.

If the Swedish Whistleblowing Act applies, their identity must be kept confidential under the duty of confidentiality. If the Swedish Whistleblowing Act does not apply, their identity can to a large extent be kept confidential.

It can also be noted that a workplace investigation carried out in the public sector will often (eventually) become an official document, which means that the document can be requested by the public. There are, however, provisions on secrecy that may restrict the right to gain access to official documents. These provisions are found in the Public Access to Information and Secrecy Act (2009:400).

As mentioned under Question 10, the employer’s duty of care (article 328, Swiss Code of Obligations) also entails the employer’s duty to respect and protect the personality (including confidentiality and privacy) and integrity of employees (article 328 paragraph 1, Swiss Code of Obligations) and to take appropriate measures to protect them.

However, in combination with the right to be heard and the right to be informed regarding an investigation, the accused also has the right that incriminating evidence is presented to them throughout the investigation and that they can comment on it. For instance, this right includes disclosure of the persons accusing them and their concrete statements. Anonymisation or redaction of such statements is permissible if the interests of the persons incriminating the accused or the interests of the employer override the accused’ interests to be presented with the relevant documents or statements (see question 11; see also article 9 paragraphs 1 and 4, Swiss Federal Act on Data Protection). However, a careful assessment of interests is required, and these must be limited to what is necessary. In principle, a person accusing another person must take responsibility for their information and accept criticism from the person implicated by the information provided.[1]

It is generally possible to keep the identity of the complainant, witnesses, or information sources confidential. There is no mandatory rule to disclose the identity of a complainant, witnesses, or sources of information. If the complainant, witnesses, or sources of information for the investigation know that their identities would not be disclosed, they will be more confident in cooperating with and supporting the investigations.

It is possible to keep such information confidential. If this is the case, the investigation team should conduct the interview outside the workplace of the company. This is actually good practice applicable to all internal investigations, unless there is a particular reason that requires the meetings to be held at the company.

Only in exceptional circumstances, such as where there is a genuine risk of retaliation. Anonymising a complaint puts the employee under investigation at a significant disadvantage, as they may be unable to properly challenge the evidence against them. It can also impair the effectiveness of the investigation. Employers should, therefore, not provide any guarantees of confidentiality to complainants or to employees who are to act as witnesses. That said, employers should think carefully about any necessary disclosure of names or facts. This can be particularly relevant where the witness is subordinate to the employee being investigated.

In general, except as provided above, depending on the seriousness of the complaint and investigation, the only persons who should be aware of it are the relevant individual in human resources or legal, and where different, the persons assigned to investigate. Although it may not be feasible to maintain absolute confidentiality in conducting an investigation depending on the nature of the allegations, investigators should exercise discretion at all times and, where possible, avoid identifying complainants, the subject of the investigation or witnesses by name where it is not necessary, and where doing so could be detrimental to the fact-finding process.

The identity of the complainant and witnesses must be kept confidential and cannot be disclosed to anyone, unless both the complainant and witnesses consent to its disclosure or if the employer is asked to disclose this information by the competent authorities under Vietnamese law.

There are legal requirements related to the time you must keep certain employee records in Australia, such as pay slips and time sheets. However, there are no laws concerning disciplinary records.

Employers can rely on previous misconduct to justify an employee’s termination of employment where it can be shown it is part of a course of conduct. Accordingly, if complaints have been substantiated, and disciplinary action has been taken, these records should be maintained. However, if a significant period has elapsed since the misconduct, an employer should carefully consider whether it is appropriate to rely on this past behaviour to justify future disciplinary action for similar conduct.

Data protection law requires that personal data should not be kept longer than necessary for the purpose it was collected. Once the purpose of the internal investigation is fulfilled and the data is no longer needed, it should be deleted or anonymised. Regulations regarding this matter may also be subject to WCAs or internal policies. In any case, it is advisable to keep the results for as long as they may be needed in possible subsequent administrative or judicial proceedings.

According to the GDPR, personal data should only be stored for a proportionate amount of time. Usually, this means that it can be stored as long as it is relevant for the employment contract, and even afterwards, if there is a risk of legal proceedings (ie, regarding the dismissal of the employee).

The existence of the investigation should be kept on file for at least five years from the date of its conclusion. All information related to the investigation should be kept on file for the same period, but not on the employee’s record, to avoid the risk of accidental access by unauthorised individuals.

The relevant laws and regulations in the PRC have not clarified the retention period of the investigation findings. According to Article 19 of the Personal Information Protection Law of the PRC, unless otherwise required by laws or administrative regulations, the retention period of personal information shall be the shortest period necessary to achieve the purpose of handling the information. Since the employee's personal information is very likely to be involved in the investigation findings, such report should be retained for the shortest period necessary to achieve the purpose of handling the information. In general, once the investigation is completed, the purpose of the internal investigation has been achieved or it is no longer necessary to achieve the purpose, and the employer may, in accordance with Article 22 of the Administrative Regulations of the PRC on Network Data Security (Draft for Comments), delete or anonymize the personal information within fifteen (15) working days. If it is technically difficult to delete the personal information, or it is difficult to do so within fifteen (15) working days due to business complexity or other reasons, the employer shall not conduct any processing other than storing the personal information and adopting necessary security measures, and shall give reasonable explanations to the employee.

Please see question 7. The outcome of the investigation involving personal data may be retained only for as long as is necessary considering the purposes of the processing. In general, the retention of investigation-related data may be necessary while the investigation is still ongoing and even then the requirements of data minimization and accuracy should be considered. The data concerning the outcome of an investigation should be registered to the employee's record merely to the extent necessary in light of the employment relationship or potential disciplinary measures. In this respect, the applicable retention time depends on labour law-related rights and limitations, considering eg, the applicable periods for filing a suit.

If the outcome of the internal investigation has led to the sanctioning of an employee, this sanction may no longer be invoked to support a new sanction after three years. Moreover, under the GDPR principles, the duration of retention must be proportional to the use of the data. Therefore, the data must be retained only for a period that is “strictly necessary and proportionate”. If the employer wants to keep information about the investigation in the longer term, it is possible to archive the employee’s record even though the employer will no longer be able to use it against the employee after three years.

If there is no special statutory storage period (which is the case for investigative reports and findings), personal data may only be stored for as long as is necessary for the purposes for which they are collected. As soon as the data is no longer required, it must be deleted. In connection with workplace investigations, the question arises as to how this obligation to delete personal data relates to the company's corporate interests. From the company's perspective, there may well be legitimate interests that speak in favour of retaining existing data for as long as possible. Under the data protection regulations of the DSGVO and the BDSG, data can be stored for as long as it is required for the assertion, exercise or defence of (civil) legal claims. This means that the data can, in any event, be saved at least as long as any measures related to the workplace investigation have not yet been completed and any legal disputes have not yet been concluded.

Under the General Data Protection Regulation, employees’ personal details and information must be kept in the business records for as long as is necessary for the purposes of the employment relationship. Otherwise, stored data must be deleted. However, under L.4990/2022[14], reports remain in the relevant record for a reasonable and necessary time, and in any case until the completion of investigations or proceedings before the courts that have been initiated as a consequence of a complaint against the employee under investigation, the complainant or any third parties.

There is no legal requirement in Hong Kong on this. However, since the investigation records will likely contain personal data, employers should be mindful of the requirement under the PDPO that personal data should not be kept for longer than necessary.[1]

According to the Code of Practice on Human Resources Management published by the Privacy Commissioner for Personal Data, generally, employment data about an employee can be kept for the entire duration of his or her employment, plus a recommended period of no more than seven years after the employee leaves employment unless there is a subsisting reason that justifies a longer retention period. A longer retention period may be justified where there is ongoing litigation or a parallel investigation. Even where it is deemed necessary to retain the outcome of the investigation concerning a departed employee, the employer should ensure that other personal data on the employee’s record (that is unrelated to the purpose of retention) are erased after the expiry of the recommended retention period.

There is no statutory guidance on this. It is common for employers to retain details of disciplinary proceedings on an employee's record for the entire duration of their employment.

It is also advisable to retain the details of any investigations or disciplinary proceedings for at least three years after an individual has been dismissed on account of such proceedings, as this is the general limitation period for raising claims of unfair dismissal. In labour matters, courts in India often allow delays in filing suit after the limitation period, meaning organisations sometimes make a practical call to retain details of investigations and disciplinary proceedings for longer.

Irrespective of the outcome of the investigation, the fact that an employee was subject to an investigation is not the key issue. The key concern is whether any further action was taken as a result of the investigation. If a disciplinary process ensued, then it is the outcome of that disciplinary record and any subsequent appeal that would or would not be noted on an employee's record. If a disciplinary sanction were imposed then the length of time the sanction remains on the employee's record would depend on what is specified in the disciplinary policy.

The employer would normally keep the outcomes of the investigation for the entire duration of the employment relationship with the involved employee.

After the termination of the employment relationship, it appears reasonable to conclude that the employer would be entitled to retain this information for the time necessary to exercise its defence rights in litigation (taking into account that 10 years is the statute of limitations for contractual liability). Further requirements or restrictions under general privacy laws (and particularly the GDPR) should also be checked.

According to Art. 14 WB Decree, internal and external whistleblowing reports (including related documents) must be kept for as long as necessary for report processing, but no more than five years from the date of transmission of the procedure's final outcome.

Records related to responses to whistleblowing must be kept for an appropriate period, but there is no legal stipulation on the retention period. Each entity is required to set an appropriate period after considering the need for evaluation and inspection, and the handling of individual cases. There is no legally stipulated retention period for other investigation results.

The outcomes are usually kept in the records until termination of the employment agreement and only deleted when personal records are deleted.

The law does not provide for the time the outcome of the investigation may remain on the employee’s record. However, this will depend on the employer’s record-retention policies, which must comply with applicable data protection laws.

The outcome of the investigation should only remain on the employee’s record for as long as is necessary, but shall not be less than three years as this is the record-keeping requirement under the Philippine Labor Code. If circumstances deem that such a report ceases to have any purpose whatsoever, it should be struck out of the employee’s record.

Neither Polish law nor the Draft Law specifically provide for a mandatory period during which the outcome of the investigation should be kept on the employee’s record.

At the same time, the Draft Law indicates that the register of whistleblowing reports, which should also contain information about follow-up actions undertaken as a result of the report, should be kept for 15 months starting from the end of the calendar year in which the follow-up actions have been completed, or the proceedings initiated by those actions have been terminated.

Also, while determining how long the outcome of an internal investigation should be kept, additional legal considerations can be taken into account, especially data privacy.

The GDPR does not specify precise storage time for personal data. The employer must assess what will be an appropriate time for storage of the data, taking into consideration the necessity of keeping personal data concerning the purpose of the processing in question. Employees' personal data should be kept for the period necessary for the performance of the employment relationship and may be kept for a period appropriate for the statute of limitations for claims and criminal deeds. A longer retention period may result from applicable laws. Following the Regulation of the Minister of Family, Labour and Social Policy on employee documentation, the employer may keep a copy of the notice of punishment and other documents related to the employee’s incurring of disciplinary responsibility in the employee record.

There are different retention periods for the data contained in employee files:

• 10 years if the employee was hired on or after 1 January 2019;
•  if the employment relationship began between 1 January 1999 and 1 January 2019, the retention period is 50 years, but may be reduced to 10 years if the employer provides the Polish Social Insurance Institution with certain mandatory information; and
•  for 50 years if the employee was hired before 1 January 1999. It does not matter whether the person is still working or not.

There are no specific rules in the Portuguese Labour Code on this matter.

However, article 332 of the PLC states that the employer should keep an updated record of disciplinary sanctions, so the competent authorities can easily verify compliance with applicable provisions. Accordingly, it is advisable to maintain a record of disciplinary sanctions during the entire employment relationship.

Also, please note that some collective bargaining agreements state that the disciplinary register must be deleted from the employee’s record periodically.

This depends on the company’s internal disciplinary policy and the severity of the offence. For instance, a written warning issued against an employee for minor misconduct is usually kept in the respondent employee’s file for one year and if the employee does not commit any further breaches during this time, the written warning will be expunged. However, if there is a finding of serious misconduct, particularly if such a determination results in the dismissal of the employee, these records are generally kept in the employee’s file for the duration of time such records are statutorily required to be maintained.  

There is no legal requirement on how long the records of the investigation (eg disciplinary action) should be maintained by the company. Many companies maintain a record of disciplinary action throughout the employment period.

The outcome of the investigation will contain personal data of the affected employee. For this reason, this information should only be kept for as long as a legal obligation or liability in connection with the information could arise for the company. Since the general statute of limitations for employment liability is one year, this is a good guideline.

In addition to the above, two specific rules apply:

• once the information becomes irrelevant for the purpose for which it was obtained and processed, the information should no longer be stored on the employee’s record or elsewhere; and
• the employees’ information (including those of the reporter and the affected employees) should only be stored in whistleblower systems during the time that is necessary to decide on whether the facts need to be investigated or not and, in any case, for a maximum period of three months.

Under the GDPR personal data may not, according to the general principle on storage limitation, be retained for longer than is necessary for the purposes for which the personal data are processed. The GDPR does not stipulate a generally applicable storage limitation period. Such a regulation is, on the other hand, included in the Swedish Whistleblowing Act. If the Swedish Whistleblowing Act applies, the outcome of the investigation and all personal data should be retained for as long as necessary, but not for longer than two years after the investigation has been closed.

From an employment law point of view, there is no statute of limitations on the employee's violations. Based on the specific circumstances (eg, damage incurred, type of violation, basis of trust or the position of the employee), a decision must be made as to the extent to which the outcome should remain on the record.

From a data protection point of view, only data that is in the interest of the employee (eg, to issue a reference letter) may be retained during the employment relationship. In principle, stored data must be deleted after the termination of the employment relationship. Longer retention may be justified if rights are still to be safeguarded or obligations are to be fulfilled in the future (eg, data needed regarding foreseeable legal proceedings, data required to issue a reference letter or data in relation to a non-competition clause).[1]

There is no period required by law for keeping the outcome of the investigation on the employee’s record. However, if termination of employment is the outcome of the investigation, an employer should keep details of the investigation for at least 10 years, in line with the prescribed period for an employee to file an unfair dismissal claim against an employer. An employer may use the details of an investigation to defend such a claim. For other disciplinary action, the retention of investigation details on the employee’s record is at the employer’s discretion.

There is no provision in the legislation setting forth a specific duration for keeping the outcome of the investigation findings in personnel files. However, based on general principles, the outcome of the investigation can remain on the employee’s personnel files as long as the employer has a lawful interest in such processing without unnecessarily harming the privacy rights of the employee.

The investigation outcome may not need to be noted on the accused employee’s record at all. Usually only the outcome of any subsequent disciplinary or grievance process would be noted, rather than the prior investigation.

The employer should keep the investigation report for as long as it remains relevant. This would usually be no longer than six years, unless regulatory obligations dictate otherwise. The report along with all documentation and witness statements gathered during the investigation should be retained securely and confidentially but for no longer than is absolutely necessary under the requirements of the DPA 2018 and the employer's data protection policies and procedures. There may be additional retention requirements in a regulated context; the position for each particular business and employee should be checked.

There is no requirement for the results of a workplace investigation to remain on an employee’s record for any specific period. It is often helpful, however, for information relating to the outcome of such an investigation (regardless of whether the allegations are substantiated) to be accessible to the human resources or legal functions such that during the initial complaint intake process described above, any prior complaints and investigations relating to the same individual or group of individuals can be taken into account to identify any recurring issues or systemic violations.

Vietnamese law does not provide for a period during which the outcome of the investigation should remain on the employee’s records and files. However, this will depend on the employer’s record-retention policies, which must comply with applicable data protection laws.

It is important for employers to conduct procedurally fair investigations that result in a fair outcome. Failure to do so may expose the employer to various claims by an employee. The most common type of claim following an investigation is an unfair dismissal claim. If a respondent’s employment is terminated because of an investigation, they may be eligible to bring an unfair dismissal claim in the FWC alleging their dismissal was harsh, unjust or unreasonable.

An employee may also bring a bullying, discrimination or general protections claim. These claims may be made even where the investigation does not result in the employee’s dismissal.

If an employer has departed from the procedures set out in their policies, or they have not followed the terms of an employee’s employment contract or another applicable industrial instrument then an employee may bring a claim for breach of contract.

Australia has also recently introduced the “Respect@Work” legislation which places a positive obligation on employers to take reasonable and proportionate measures to eliminate sex discrimination, sexual harassment and victimisation, as far as possible. Accordingly, an employer who is not perceived to have taken a proactive and fair approach to these workplace issues faces significant legal exposure.

Failure to conduct an investigation properly (or a failure to conduct an investigation in circumstances where it is needed) can also cause significant reputational and financial risk.

This relates to the severity of the error. Data protection violations can lead to fines by the data protection authority or claims for damages. If consequences under labour law, such as dismissal, have taken place due to erroneous investigations or incorrect results, the employee concerned can assert claims under labour law or seek damages.

Furthermore, there may be consequences under criminal law. This is particularly the case if documents have been falsified in the course of the investigation. It is, therefore, crucial that employers exercise diligence and due process in internal investigations. Investigations must be conducted transparently and lawfully.

In general, abusive investigations could lead to a legal claim regarding the abuse of rights. During an investigation, an employer should be guided by principles of due diligence and not take disproportionate action. If the investigation causes unnecessary damage, involved employees could file for compensation (eg, before the labour court). Next, the employer is also responsible for following the mandatory procedure for official complaints regarding sexual harassment, bullying and violence at work and investigations of whistleblower reports. In the first case, an employer who does not follow the procedure or obstructs the procedure can be liable for penal or administrative fines (maximum 8,000 euro) or, if the employer has not taken necessary measures to mitigate the risks for the employee and the employee suffers damage to their health, they may be liable for a fine of a maximum of 48,000 euro and imprisonment for between six months and three years. In the second case (whistleblower procedure), if an employer did not follow or has obstructed the procedure, they can be fined up to 5% of the annual revenue of the preceding year.

If the complaints involve allegations of sexual harassment, violence or bullying at work, the employer might risk an investigation of the inspection on supervision and well-being at work. If the prevention advisor finds out, before giving his advice, that the employer did not take any suitable protective measures after they were recommended, the prevention advisor is obliged to call an inspection on supervision and well-being at work.

The employer’s legal exposure resulting from errors during the investigation depends on the error and the victim or victims affected. It may range from paying damages to a witness who was harassed because the company did not prevent retaliation from occurring; to the reversal of a termination for cause if a court determines that the evidence collected during the investigation did not meet the legal threshold to uphold it; to indemnification for a violation of privacy; or criminal prosecution because of unauthorised access to private communications.

It is inevitable that the investigation involves the employee's personal information, and once the investigation is mishandled, the employer may face the following legal risks:

Civil liability: Both the Civil Code of the PRC and the Personal Information Protection Law of the PRC, clearly provide the civil liability for infringement of privacy and illegal processing of personal information. Therefore, the investigated employee or relevant organizations such as the people's procuratorate have the right to claim or file a public interest lawsuit on the employer's improper collection of evidence, requiring the employer to bear the liability for infringement. In addition, the evidence obtained by an employer through infringing the employee's privacy and personal information rights and interests, in violation of the law, cannot be used as the valid evidence for the employer's unilateral termination of the employment contract or requiring the employee to compensate for losses.

Administrative liability: Article 66 of the Personal Information Protection Law of the PRC provides that, where personal information is processed in violation of regulations, administrative penalties imposed by the department performing duties of personal information protection may be up to revoking the business license, and the person directly in charge and other directly liable persons may be fined up to one million yuan and prohibited from practicing within a time limit. Meanwhile, Article 67 of the Personal Information Protection Law of the PRC provides that relevant illegal acts shall be recorded in the employer's credit files and disclosed to the public.

Criminal liability: if an employer illegally sells or provides to others the personal information obtained during the internal investigation, and the circumstance is serious enough, the judicial authority has the right to hold the employer, the managers directly in charge and other directly liable persons criminally liable in accordance with the crime of "infringement of citizens' personal information" under Article 253A of the Criminal Law of the PRC.

It should be noted that a compliance investigation may also involve the employer's communication and investigation reporting with overseas authorities, or overseas institutions' direct access to information from the employer's domestic systems. If the employer conducts cross-border transmission of such personal information, it shall also meet one of the conditions set out in Article 38 of the Personal Information Protection Law of the PRC (i.e. passing the security assessment organized by the national cyberspace administration authority, obtaining certification from a professional institution concerning the protection of personal information or entering into a standard contract with an overseas recipient). Violations of the above provisions may result in civil, administrative and even criminal liability.

There are no regulations regarding the actual investigation process. Therefore, the employer cannot be accused of procedural errors as such. However, once the matter has been adequately investigated, the employer must decide whether or not misconduct has taken place. If the employer considers that misconduct has taken place, the employer must take adequate measures for remedying the situation. Failure to adequately conduct the investigation could result in criminal sanctions being imposed on the employer as an organisation or the employer’s representative, or damages.

Within the context of an investigation following a whistleblower alert, any violation of the confidentiality obligation is punishable by two years’ imprisonment and a €30,000 fine.

If the employer fails to comply with its obligation to protect its employees’ safety, the employer will be liable for damages resulting from any failings during the investigation (eg, if sexual harassment is reported and no action is taken by the employer)

Different consequences may result from mistakes made by the employer (or its advisors) in the course of the workplace investigation. For example, if the employer has violated the data protection provisions of the DSGVO or BDSG, this may result in fines. This may also result in claims for damages by the employee. The employee may also have a claim for damages if it turns out that the suspicion of misconduct on the part of the employee is not confirmed and the employer has arbitrarily conducted workplace investigations without sufficient cause.

The employee can contest the decisions of disciplinary councils before the courts and request their annulment. 

Moreover, in the framework of L.4990/2022, a monetary penalty and prison sentence (to be defined by an implementing Ministerial Decision) may be imposed on any person violating confidentiality obligations concerning the identity and personal data of employees or third parties included in the investigation procedure, while monetary penalties are also provided for legal entities[15].

Moreover, administrative fines may also be imposed if the employer does not comply with the legal requirements concerning the prevention of violence and harassment in the workplace.

Furthermore, the employee under investigation may initiate proceedings before the courts under tort law, by claiming compensation for moral damages suffered if the company did not comply with its confidentiality obligations after the incident (eg, due to the spread of rumours in the workplace). This may also be linked with criminal law proceedings against the persons responsible for dealing with the investigation (and not against the legal person, since under Greek law there is no criminal liability for legal persons).

On the other hand, the employer may also be exposed to liability vis-à-vis the complainant, witnesses or facilitators, for breach of confidentiality or other obligations prescribed in the respective legal provisions, or if there are retaliation measures.

If the employer failed to comply with a requirement that is expressly stipulated in the employment contract or employee handbook (such as a procedural requirement to hold a disciplinary hearing or to provide certain information to the employee), the employer could be liable for breaching an express term in the employment contract.

Even where the employment contract does not contain express provisions for the conduct of an internal investigation, the employer is under an implied obligation of trust and confidence under common law (as discussed in question 11), which requires it to conduct the investigation and reach its findings reasonably and rationally in accordance with the evidence available and in good faith.[1] If the employer reached a decision that no reasonable employer would have reached, the conduct of the investigation may be in breach of the employer’s implied obligation of trust and confidence.

If the error in the investigation has led to a termination of employment (whether by way of summary dismissal or termination by notice), the employee may be able to bring a statutory claim for wrongful dismissal, unlawful dismissal or dismissal without a valid reason (as applicable).[2] If such a claim is successful, in addition to ordering the employer to pay monetary compensation, the court or tribunal may also make a reinstatement order (an order that the employee shall be treated as if he had not been dismissed) or re-engagement order (an order that the employee shall be re-engaged in employment on terms comparable to his or her original terms of employment) for the affected employee.

The employer may also be liable for unlawful discrimination under Hong Kong law if the investigation has been conducted in a discriminatory manner or the outcome of the investigation reflects differential and less favourable treatment of the employee concerned based on grounds of sex, marital status, disability, family status or race.

The risk an employer may face would be quite subjective. For example, if an individual is suspended without pay, the individual may attempt to argue that the entire investigation should be set aside, as non-payment of salary affects an individual’s ability to properly represent themselves. Material errors in disciplinary proceedings or not adhering to the rules of natural justice may result in disciplinary action being set aside, and potentially also orders for reinstatement of the employee with back pay (if the individual is protected by local labour laws) if the dismissal is found to be unfair or disproportionate to the gravity of the misconduct.

In addition to the above risks, in SH matters, if the IC constitution is incorrect or there are allegations of bias against a committee member, the whole investigation may be set aside and the organisation ordered to conduct a fresh inquiry through a properly constituted committee.

A failure to follow fair procedures in the investigation can have significant consequences.

Although the exception rather than the rule, an employee could challenge the investigation through injunctive proceedings if there is a breach of fair procedures. Such action would be taken before the High Court. Injunction proceedings may be brought while the investigation is ongoing, or just before its conclusion to prevent publication of a report making specific findings against an employee. A successful injunction may curtail any subsequent attempt to investigate the matter as allegations of penalisation, prejudice and delay may arise.

Errors during the investigation can also give rise to a complaint of constructive dismissal, with allegations that flaws in the procedure have fundamentally breached the implied term of mutual trust and confidence.

A flawed investigation can also undermine any disciplinary process and sanction that is imposed as a result. This commonly occurs when an employee has been dismissed following a disciplinary process launched on foot of the investigation. While dismissal may be an appropriate sanction, the dismissal can still be found to be unfair if there is a failure to follow fair procedures. An employee may challenge their dismissal before the WRC and the employer should be alive to not only an unfair dismissal complaint, but allegations of discrimination and penalisation.

Overall, to carry out a successful workplace investigation, an employer should consider taking advice at the earliest opportunity to ensure that the investigation can withstand challenges.

It depends on the kind of error or breach. For example:

• a breach of privacy laws (eg, acquiring data from working instruments in lack of due requirements) would lead to the application of privacy law sanctions (including monetary fines); and
• breach of provisions regarding “remote” control of employees would lead to criminal sanctions and to the inadmissibility, for disciplinary purposes, of the data collected (and thus potentially to the unlawfulness of a dismissal based on such data).

Furthermore, if the employee has suffered damages as a result of the employer’s errors or breaches (and can specifically prove such damages and their amount), the employer may be held liable in court.

If the company deviates from appropriate social rules in its investigative methods and means, it will be liable for tortious behaviour. If disciplinary action or dismissal is taken based on erroneous investigation results, the validity of such action or dismissal will be denied, the employee will be able to claim for back wages, and, in some cases, claim for compensation.

The employee can request compensation for violation of the right to a fair hearing or reputational damage. If the employee is suspended during the investigation, , the employee can request the court to order the employer to allow them to resume their work and request rehabilitation.

In termination proceedings (or after the termination of the employment agreement by the employer), the employee can claim an equitable compensation from the employer if the employer has shown serious culpable behaviour. Such compensation, if granted, is usually based on loss of income by the employee due to the behaviour of the employer.

• Violation of Fundamental Rights of the Employee
• Breach of Contract of Employment or wrongful termination

An employer may be liable for illegal termination if a dismissal is made based on wrong information collected during the investigation. Thus, the data and information gathered during the investigation stage must be correct and accurate. Further, investigations should be conducted in a manner that is fair and reasonable to the employee under investigation. Otherwise, the employee may treat the investigation as harassment on the part of the employer, which may subject the employer to a potential lawsuit.

If any untrue allegations were made by an employer against an employee without checking them beforehand, there is a risk that such an employee would claim damages eg, for infringement of personal rights or even filing a private indictment for defamation or outrage.

Certainly, an employer must be aware that one must never behave in a way that, for example, in the employee's opinion, could constitute a form of blackmailing or deprivation of liberty. A problem may also arise when accessing the employee's correspondence, especially when access is made to documents or private correspondence. The Draft Law provides for several criminal offences related to, for example, preventing reporting, using retaliatory measures against a whistleblower or disclosing personal data of a whistleblower).

If the disciplinary procedure recommends an employee's dismissal

Should a company dismiss an employee that has breached legal requirements, the latter may take action against the company within 60 days of the date of termination of their employment agreement.

If this action results in a ruling of unfair dismissal, the employee will be entitled:

• to receive all the payments they should normally have earned (back pay, including salary, holidays, legal subsidies, etc), from the month preceding the commencement of the lawsuit and until the final ruling of the court, minus any amounts they may have received during the same period and they would otherwise not have received; and
• to be reinstated in their former position or at the employee’s choice, to receive an indemnity that the court will calculate as between 15 and 45 days of base salary (and service bonuses) for each full year of service or fraction thereof, with a minimum limit of three months’ compensation.

This graduation will depend on the amount of the base salary (the lower the base salary, the higher the indemnity) and the severity of the company’s conduct. Additionally, the employee is entitled to claim an indemnity for further damages.

There are, however, two exceptions to the above: the first relates to high-ranking employees (ie employees carrying out management duties); the second refers to micro-companies (ie, a company that registered an average number of employees in the preceding calendar year below 10). In these two cases, the employer may oppose the employee’s option for reinstatement, arguing that it would be gravely harmful to the company's activity. From a practical perspective, opposition to reinstatement is not commonly decided by the courts.

Finally, should the court rule that the grounds for dismissal were valid, but the investigation was found to have been irregular, the dismissal will be deemed valid, but the employee will still be entitled to an indemnity of 7.5 to 22.5 days of base salary (plus service bonuses, if any) per year of service.

If the disciplinary procedure does not recommend dismissal, but the application of a conservatory sanction

In this event, the employee can challenge the application of the sanction through the filing of a lawsuit against the company. Although the law is not entirely clear, there are court rulings stating that the employee has one year to bring a lawsuit, but others consider that the statute of limitation to challenge a conservatory disciplinary sanction is also one year from the termination of the employment agreement when a pecuniary penalty or suspension was applied to the employee.

Moreover, according to article 331(3) of the Portuguese Labour Code, the employer who applies an unjustified conservatory penalty should compensate the worker under the terms set out in paragraphs 5 and 6 of said article. The imposition of an abusive penalty is also considered a very serious administrative offence as per article 331(7). Please note that the Portuguese Labour Code considers a penalty to be unjustified if its imposition is motivated by the following:

• the employee lawfully complaining about their labour conditions;
• the employee lawfully disobeying unlawful orders from a superior;
• the employee being a member of any employee representative structure or having been a candidate for such a position; and
• the employee exercising or invoking their rights and guarantees.

Furthermore, any penalty imposed within six months of any instance listed above (or within one year if the invoked rights are related to equality and non-discrimination) is presumed to be abusive.

The employer may be exposed to legal action for a failure to properly conduct the investigation, including having such portions of the investigation set aside or held to be void by the courts, and be made to pay damages to the affected employee; or face investigation and administrative penalties by regulatory authorities such as the MOM.

In addition, after the Workplace Fairness Legislation comes into force, breach of its requirements may also expose the employer or culpable persons to potential statutory penalties. The Tripartite Committee on Workplace Fairness recommended, among other things, for the Workplace Fairness Legislation to provide for a range of penalties including corrective orders, work pass curtailment and financial penalties against employers or culpable persons, depending on the severity of the breach. It is thus expected that employers or culpable persons may be exposed to potential statutory penalties if the requirements of the Workplace Fairness Legislation are not complied with.

As mentioned in question 19, employees may potentially raise claims, such as that the company violated data privacy laws in reviewing employee data, committed defamation, coerced the employee to comply with the investigation, and that witnesses or the company committed defamation in violation of the Criminal Code or disciplined the employee without just cause.

Errors during an investigation are normally linked to the breach of the employees’ privacy or their personal data rights (see question 1). Breaching these rights might expose employers to:

• Fines from the Labour Inspectorate and the Spanish Data Protection Authority.
• A court awarding damages to the employee.
• Any disciplinary measures adopted by the company as a result of the investigation could be considered null and void.
• The evidenced obtained during the investigation being disregarded by a court.
• In some very serious cases, criminal liability might arise for the individuals who conducted the investigation and breached the employees’ rights.

Errors resulting in terminations can be unlawful and, if they lead to employees terminating their employment as a result of the employer’s missteps, could be seen as constructive dismissal. Constructive dismissal is generally equivalent to an unlawful dismissal. Unlawful terminations generally result in an obligation to pay financial and general damages to the affected employees.

Failure to fulfil the obligations under the Swedish Discrimination Act may lead to an obligation to pay financial and general damages.

If an employer does not fulfil its obligations according to work environment legislation, there is a risk that the Swedish Work Environment Authority will issue injunctions or prohibitions against the employer. If an employer omits to meet its work environment related obligations, and that in turn results in a work related accident, e.g. self-harm in connection with an internal investigation, it may also, in a worst case scenario, lead to criminal liability.

The Swedish Work Environment Authority is also responsible for monitoring compliance with the provisions of the Swedish Whistleblowing Act. The Swedish Work Environment Authority may, if necessary to ensure compliance with the Swedish Whistleblowing Act, order an operator to comply with the obligations and requirements of the Swedish Whistleblowing Act. Employers violating the Swedish Whistleblowing Act may also be liable to pay damages to the affected employees.

If personal data is processed in a way that violates the GDPR, the authorised supervisory authority may issue warnings or reprimands to the data controller, order the controller to comply with the GDPR, impose a ban on processing, or impose an administrative fine on the controller. Companies violating the GDPR may also be liable to pay damages to data subjects.

As there are no specific regulations for internal investigations, the usual legal framework within which the employer must act towards the employee derives from general rules such as the employer's duty of care, the employee's duty of loyalty and the employee's data protection rights.

But, for example, unwarranted surveillance could conceivably result in criminal liability (article 179 et seq, Swiss Criminal Code) for violations of the employee's privacy. Furthermore, errors made by the employer could have an impact on any later criminal proceedings (eg, in the form of prohibitions on the use of evidence).[1]

Evidence obtained unlawfully may only be used in civil proceedings if there is an overriding interest in establishing the truth (article 152 paragraph 2, Swiss Civil Procedure Code). Consequently, in each case, a balance must be struck between the individual’s interest in not using the evidence and in establishing the truth.[2] The question of the admissibility of evidence based on an unlawful invasion of privacy is a sensitive one – admissibility in this case is likely to be accepted only with restraint.[3] Since the parties in civil proceedings do not have any means of coercion at their disposal, it is not necessary, in contrast to criminal proceedings, to examine whether the evidence could also have been obtained by legal means.[4]

Unlawful action by the employer may also have consequences on future criminal proceedings: The prohibitions on exploitation (article 140 et seq, Swiss Criminal Procedure Code) apply a priori only to evidence obtained directly from public authorities. Evidence obtained unlawfully by private persons (ie, the employer) may also be used if it could have been lawfully obtained by the authority and if the interest in establishing the truth outweighs the interest of the individual in not using the evidence.[5] Art. 140 paragraph 1 Swiss Criminal Procure Code remains reserved: Evidence obtained in violation of Art. 140 paragraph 1 Swiss Criminal Procure Code is subject to an absolute ban on the use of evidence (e.g. evidence obtained under the use of torture[6]).[7]

The Thai Supreme Court has ruled that the termination of an employee was unfair due to an investigation being conducted contrary to requirements in the company’s work rules. As such, employers may be liable for damages to employees if there are errors made during investigations, or where investigations are not conducted properly.

The Supreme Court has also ruled that in cases of unfair termination, the underlying cause of the termination should be the determining factor, rather than other issues, including investigative procedures.

The nature of legal exposure is very much dependent on the legal action the employer has taken after the investigation. The employer may be subject to a wrongful termination lawsuit to be filed by the employee, which may result in the payment of compensation to the employee of between eight and 12 months’ salary, if the court concludes that the termination is wrongful. This may also include monetary and moral damages claims. If no termination has taken place, the employee may terminate his or her employment with just cause if the employer has erred in its neutral fact-finding mission and this affects the employee. The employee may also file a criminal complaint to the extent that the investigation findings incriminate the employee in error.

A reasonable investigation is a key component of a fair disciplinary process. Errors in the investigation could therefore expose the employer to liability for unfair dismissal under ERA 1996.

Failure to follow the ACAS Code does not automatically make an employer liable in any proceedings taken against it. However, an employment tribunal will take the ACAS Code into account when deciding whether an employer has behaved fairly, and has the power to increase awards by up to 25% where it believes an employer has unreasonably failed to follow the ACAS Code's provisions.

There may be liability for breach of the employee’s contract of employment if the employer breaches aspects of the investigation policy that are contractual, any contractual provisions relating to suspension, or otherwise conducts the investigation in a manner that breaches the implied term of trust and confidence.

There may be liability under the EA 2010 if the investigation is conducted in a discriminatory manner, which could include not making reasonable adjustments to the process for disabled employees.

Where the investigation involves protected disclosures, there may be liability under the whistleblowing provisions of ERA 1996 if the whistleblower is subjected to detriment or dismissal on the grounds of their protected disclosures.

Improper evidence gathering or processing may be actionable under the DPA 2018, IPA 2016 or the IP Regs 2018.

Finally, there may be common law claims in some circumstances (for example where reports need to be made to regulators, which in turn may affect the relevant employee’s future employment prospects) for defamation, or, more unusually, for stress-related personal injury.

The subject of the investigation, the complainant, or a government agency investigating the same alleged misconduct could subject the employer to legal exposure. It is, therefore, helpful for a company to prepare a contemporaneous report of the investigation that summarises: the incident or issues investigated, including dates; the parties involved; key factual and credibility findings; employer policies or guidelines and their applicability to the investigation; specific conclusions; the party (or parties) responsible for making the final determination; issues that could not be resolved through the internal investigation; and employer actions taken.

The employer should also maintain a clear record of the steps taken to investigate the alleged misconduct and any findings, as well as all evidence gathered during the investigation, including documents collected and reviewed, any work done to identify systemic issues or patterns of behaviour, and notes from all interviews, which should be limited to the facts gathered, dated and should indicate the duration and location of the interview.

The employer may be exposed to legal action for its failure to conduct the investigation properly, such as a lawsuit for labour disputes or sanctions for its failure to protect personal data as required under personal data protection regulations. For instance, if there were errors during the investigation which led to erroneous results for the investigation and consequently, the employee was dismissed, the employee may file a claim for illegal dismissal against the employer.