Workplace Investigations

A trade union does not have any right to be informed of, or involved in, an investigation by an employer. However, an employee may request that their support person is a trade union member or trade union representative. This is appropriate and should be permitted.

Employers should review the terms of an employment contract, policy or industrial instrument as this may contain terms regarding trade union involvement. In particular, heavily-unionised workplaces may contain enterprise agreements which contain relevant clauses.

The Austrian Labour Constitution Act (ArbVG) does not contain any provisions regarding workplace investigations. The employee has the right to address the works council but is not entitled to have the works council comply with his or her request.

The works council's opportunities for participation are conclusively regulated. Certain investigative or control measures may require the consent or co-determination of the works council.

Under section 96(1)3 ArbVG, the consent of the works council is required if the employer wishes to introduce and maintain control measures or technical systems for monitoring employees that affect human dignity, such as video surveillance or specific staff questionnaires. If there is no works council, the consent of each individual employee is required.

At the request of the involved employee, an employee can be assisted by a member of the trade union delegation, for example, during his or her hearing.

The works council should be informed of an investigation if there is a considerable impact on the company; this will only be the case if the investigation concerns a very serious, important or widespread issue. This information should be communicated as soon as possible and before measures are taken as a result of the investigation. This is only a right to information, not consultation. Moreover, members of the works council may be asked to respect their duty of confidentiality. However, as the enforcement of this duty of confidentiality is difficult, the timing of the information should be chosen wisely so it does not jeopardise the investigation.

No, there is no such right.

The relevant laws and regulations in the PRC have not expressly provided the employer’s obligation to inform the trade union of the internal investigation or the right of the trade union to participate in the employer's internal investigation. In practice, given the confidential nature of internal investigation, the employer usually does not voluntarily inform the trade union of such information. However, in accordance with Article 25 of the Measures for the Supervision of Labor Law by Trade Unions of the PRC, the trade union shall have the right to conduct an investigation if the employer has violated the labor laws and regulations or infringed the legitimate rights and interests of the employee. Therefore, it is still possible that the employer, in the course of the internal investigation, may be investigated by the trade union if it has violated the labor laws and regulations or infringed the legitimate rights and interests of the employee (e.g. being suspected of infringing personal information or privacy).

In addition, if the employer determines that the employee has committed a serious disciplinary offence based on the result of the internal investigation and thus decides to terminate the employment contract unilaterally, it shall notify the trade union of the reasons for termination in advance. If the employer has violated the laws, administrative regulations or the provisions of the employment contract, the trade union is entitled to request the employer to make corrections.

A works council or a trade union does not have a role in the investigation.

Neither the works council nor the trade unions have any right to be informed or involved in the investigation. It is the employer who is responsible for carrying out the investigation. However, when the investigation is triggered due to a works council issuing an alert relating in particular to a “serious and imminent danger”, one member of the works council must be involved in the investigation process.

The works council does not have a general right of co-determination on whether and in what way a workplace investigation is carried out. However, workplace investigations may trigger co-determination rights of the works council in specific cases, as outlined below. If co-determination rights come into consideration, the employer must inform the works council about the investigation to put the works council in a position to assess whether or not co-determination rights are affected.

In connection with workplace investigations, the works council may have a co-determination right in the following cases:

• If e-mail accounts and data are screened by using technical devices that are suitable to monitor the behaviour or performance of employees (section 87 paragraph 1 no. 6, BetrVG).
• If, for example, the employer instructs all or a large group of employees to participate in interviews, the co-determination right of the works council regarding the rules of operation of the establishment and the conduct of employees in the establishment (section 87 paragraph 1 no. 1, BetrVG) may be affected.
• If standardised questionnaires are used in employee interviews, provided they are used for a large group of interviewed employees (section 94, BetrVG).

If co-determination rights exist in the specific case, the works council has the right to co-determine the type and structure of the specific investigative measures used (ie, the relevant investigative measure cannot be carried out without the works council's consent). To avoid any conflicts, the employer should set up, together with the works council, general rules about workplace investigations well ahead of any investigation.

Trade unions have no right of co-determination in workplace investigations.

L.4990/2022 explicitly states that the exercise of employee rights that refer to consulting from representatives or trade unions and protection against any detrimental measure that results from those consultations does not affect the implementation of any legal provisions. The autonomy of social partners and their right to enter into collective agreements regardless of the level of protection provided by L.4990/2022[7] is also unaffected.

Under L.4808/2021, legal persons and associations of persons, including trade unions, that have a legitimate interest in doing so may, with the consent of the complainant, bring an action in the complainant’s name before the competent administrative or judicial authorities. They may also intervene in their defence[8].

Unless the employment contract or the relevant internal policies specify otherwise, there is no automatic right under Hong Kong law for a works council or trade union to be informed or involved in a workplace investigation.

No.

There is no specific requirement to constitute a works council for most industries or inform the trade union about an investigation or disciplinary inquiry.

It is common, however, for individuals to share details of the matter with trade union representatives and seek their support. Further, if an employee has the right to be represented or supported by a colleague (for example, if the establishment is covered by the SO Act), the individual may request trade union representatives to support them during inquiry proceedings.

This will depend on the agreement with the works council or trade union. The employee who is the respondent to the investigation may have views on their trade union being informed, aside from any agreement, which should be taken into account under GDPR provisions.

Generally speaking, a workplace investigation does not require the involvement of a trade union (on the assumption that no specific union agreement has been reached at a company level to entitle trade unions to specific forms of consultation or involvement in workplace investigations, which is not common).

According to section 4 of the Workers’ Statute, as stated above, the involvement of the trade union is necessary regarding the installation and use of specific equipment (such as cameras, switchboards, software) that potentially allows the employer to remotely monitor working activity, and which can be done only with prior agreement of the unions (or authorised by the labour inspectorate).  The union agreement must be made before the installation of the system, and therefore would normally be already in place when an investigation starts.

Pursuant to the WB Decree (Art. 4), union representatives (or external unions) should be “heard” before the employer activates a WB reporting channel[1].

A labour union has no legal right to be involved in the investigation. However, if there is a provision in the collective bargaining agreement between the company and the labour union that allows the labour union to be involved in an investigation conducted by the company or to receive disclosure of the results of an investigation, then such a provision should be followed.

There is, in principle, no role for the works council in an "isolated or single" internal investigation. When it comes to structural forms of employee monitoring to measure behaviour (such as video surveillance), the proposed decision to implement such a monitoring system in principle requires the prior approval of the works council.

In addition, according to the Act on the Protection of Whistleblowers,  an employer who is not obliged to set up a works council needs the consent of more than half of the employees when adopting the internal reporting procedure under theAct, unless the substance of the procedure has already been laid down in a collective bargaining agreement.

The law is silent on whether a member of a trade union has the right to be informed or involved in the investigation. Typically, this is dependent on the employee’s contract, handbook or other policies of the employer.

Except if provided expressly under a collective bargaining agreement, the union does not have the right to be involved in the investigation. Given that the investigation is between the employee and the company, it follows that the union does not have any right to participate in the investigation proceedings.

There is no such obligation, unless it is provided for in an internal procedure or, for example, in the applicable collective bargaining agreement. It is neither a recognised practice nor recommended that such persons participate in the investigation.

However, in the event of violations that justify the termination of an employment contract with the employee, the employer should consult with that employee’s union about their intention to immediately terminate any employment contract concluded with that person or to terminate, with notice, the employment contract agreed with him or her for an indefinite term, or apply for consent to terminate the employment contract with an employee who is protected by a union.

Employee representative bodies are not entitled to be informed about or to participate in the preliminary investigation. The works council is only entitled to participate in disciplinary proceedings after a formal accusation has been made against the employee.

A copy of the accusation should be sent to the works council (if any) and if the employee is a trade union member, to the respective trade union. After the instruction phase of the procedure has ended (where the employer has to hear the witnesses identified by the employee in his written defence and file any other sources of information that have been requested), the employer should provide a copy of the disciplinary procedure to the works council (if any) and the respective trade union, if the employee is a member. These employees’ representatives will then have five business days to issue their opinion on the matter.

Finally, a copy of the final decision must also be sent to these bodies.

There is no legal right for the interviewee to be assisted by a representative from the works council.

An employee who is a member of a works council or trade union has the right to seek assistance from the works council or trade union representative (whichever is applicable) and have the works council or trade union involved in resolving the grievances.

For unionised companies, the grievance procedure and the role of the union representative are usually set out in the collective agreement entered into between the company and the works council or trade union. In some organisations, the employee handbook or grievance policy will also state when the trade union representative will be involved in the investigation process.

While a labour union does not have a legal right under Korean law to be informed or involved in the investigation, unless otherwise required under the relevant collective bargaining agreement, there have been instances where the labour union raised complaints that the company did not properly investigate an employee, who is a member of the labour union, particularly if the company took disciplinary action against that employee based on the findings of the investigation. The company should consider such a practical risk when conducting a workplace investigation.

If the investigation was conducted based on a claim filed by an employee to the Grievance Handling Committee (which is a sub-committee of a works council), the members of that committee have a right to be informed of the results of the investigation.

As explained in question 15, employees are not entitled to representation during an investigation. However, if a disciplinary procedure starts as a result of the investigation, employee representatives may be entitled to be informed of the disciplinary procedure and its outcome.

The degree and timing of when employee representatives must be involved will depend on several factors such as:

• the employee’s affiliation to a union;
• if the employee is an employee representative;
• the seriousness of the potential sanction to be imposed; and
• the information rights that the applicable collective bargaining agreement acknowledges regarding employee representatives.

No, but if the employee under investigation is unionised it is appropriate to inform the union about the investigation. If the employer chooses to take action against the employee during, or after, the investigation, the trade union generally needs to be consulted before any final decisions are made.

If the Swedish Whistleblowing Act applies, the employer is not authorised to inform a works council or trade union about the investigation, as it may be in violation of the duty of confidentiality (see question 10).

In general, works councils and trade unions are not very common in Switzerland and there are no statutory rules that would provide a works council or trade union a right to be informed or involved in an ongoing internal investigation. However, respective obligations might be foreseen in an applicable collective bargaining agreement, internal regulations or similar.

Thai labor laws do not require a workplace investigation to involve participation from trade unions or labour unions. However, it is possible for labour unions established under the Labor Relation Act BE. 2518 (1975) to submit a demand for a collective bargaining agreement (CBA) with employers to get a seat at the table. There was a case where a management union made a CBA with the employer wherein the president of the management union would be involved in any investigation of any manager, who is a union member, under investigation. In that case, the employer must comply with the CBA by informing the president and allowing the president to participate in the investigations.

An authorized trade union, if any, may have the right to be informed or involved in the investigation, depending on the terms of the collective bargaining agreement in place. Even in the absence of such a provision in the collective bargaining agreement, it would still be recommended to inform the trade union of the investigation as a courtesy. We do not have works councils under Turkish employment law.

Aside from the statutory right to be accompanied (see question 15), any further involvement by the works council or trade union would depend on the terms of the relevant works council or trade union recognition agreement.

Employers generally have no obligation to inform employees of their right to union representation or to ask if they would like a union representative present during the interview. Union employees may insist, however, that a union representative attend any investigatory interview that could lead to the employee’s punishment, although the union representative may not interfere with the interview.

In Vietnam, the “trade union” is the only organisation solely dedicated to protecting employees’ legitimate rights and interests. Under the 2012 Labor Code, the term referring to trade unions was changed to “grassroots-level representative organisation of employees”. But the essence of this organisation remained and was later defined as “the executive committee of a grassroots trade union or the executive committee of the immediate upper-level trade union in a non-unionised company”. As such, it could be said that it was old wine in a new bottle.

As required under article 70.1 of Decree No. 145/2020/ND-CP, which serves as a guide to the Labor Code on working conditions and labour relations, when suspecting that an employee has committed a violation of labour discipline, the employer has to make a record of the violation at the time and notify the grassroots-level representative organisation of employees of which the employee is a member, or the legal representative of the employee if they are under 15 years of age. If the employer detects a violation after it has occurred, it will collect evidence to prove it. In this instance, the employer has no obligation to inform or involve the trade union or grassroots-level representative organisation of employees during the workplace investigation stage.

Also, an employee who is a member of the trade union or organisation has the right to seek assistance from this organisation and may authorise the trade union’s representative to represent and get involved in the workplace investigation.

The outcome of the investigation must be disclosed to the complainant and respondent. If there is a concurrent police or regulatory investigation, they may request a copy of the investigation report. Employers should generally cooperate with regulatory authorities, but should be careful about disclosing the investigation report as this may be privileged and privacy obligations must be considered. Employers should consider only disclosing the investigation findings and interview records if compelled to do so by regulators or police.

Interview reports, the investigation report and communications about the investigation should be kept in a separate file. The file should be marked confidential and access to the file should be restricted.

If proceedings are commenced, the investigation materials may be subject to disclosure unless legal professional privilege can be asserted, see above.

It is up to management to decide which results should be disclosed and to whom. It is important to know who the persons concerned are and who has an interest in disclosure.

From a legal perspective, disclosure must follow the GDPR. Internal policies can specify how the results are to be handled. Works Council Agreements (WCAs) may also contain regulations on how to deal with internal investigations and the disclosure of results.

There is no requirement to publish the results of the investigation, but it may be advisable to cooperate with the authorities. This is particularly the case if the employer has suffered damage or is himself threatened with prosecution. The release of investigation results can be compelled through the courts.

If the investigated acts constitute a crime, the authorities or the police should be informed. In certain cases, not doing so could lead to the company being accused of concealing a crime or becoming jointly responsible for it. However, if the company is the only victim of the crime and it is minor, the company may choose not to inform the authorities. For example, there is an enormous difference between a bank employee stealing large amounts of money from clients and an employee who is stealing toilet paper from the company. As stated above, the interview records could be at risk of disclosure if the authorities or police seize them for their investigation.

There are no legal requirements for the company to share the investigation findings with any party, including the reporter and the investigated party, so the employer must carefully consider the pros and cons of doing so on a case-by-case basis. Interview records can generally be kept private if interviews were conducted by an attorney.

If the relevant investigation authorities or regulatory authorities require the employer to provide the investigation findings and the interview records of its employee's illegal activities, the employer is usually obliged to cooperate with the authorities and make disclosures according to the requirements of the law. Meanwhile, according to Article 110 of the Criminal Procedure Law of the PRC, any entity or individual who has found out facts of a crime or a criminal suspect has both the right and the duty to report the case or provide information to the public security authority, the people's procuratorate or the people's court. Therefore, if the investigation findings show that the employee is suspected of a crime, the employer should disclose the information to the relevant investigation authorities including the public security authority. For some special industries, for example, the investigation findings against the banking industry usually also need to be reported to the higher-level banking supervisory authorities. Although the relevant investigation staff and supervisory staff are usually required to comply with the confidentiality obligations according to the laws or regulations, the risk of leakage of the reported information due to the expansion of the scope of persons who are aware of the investigation findings cannot be completely excluded.

In addition, an employer may decide whether to disclose the results of an investigation (mainly including the violation of disciplines and the disciplinary punishment) to other employees at its own discretion, but has to disclose the relevant information among employees to the extent that it is "minimum and necessary", so as to avoid infringing on the employee's personal information or privacy or even right of reputation.

In general, investigation materials, including findings, that includes personal data should only be processed by the personnel of the organisation who are responsible for internal investigations. However, it may in some situations be required by applicable legislation that findings are disclosed to competent authorities for the performance of their duties, such as conducting investigations in connection with malpractice and violations of the law.

The findings must be submitted to the employer or management, but there is no obligation to disclose them to anybody else. The only exception is if a judicial investigation has been opened. In this case, the entire report must be provided to the authorities if the judge requests this. Normally the investigators only take written notes and there is no audio or video recording, unless the employee consents. Whether or not to make a voluntary disclosure of wrongdoing is a tactical decision for companies. Disclosure may mitigate fines and penalties or even help the employer avoid liability entirely. However, the downsides of disclosure include increased costs, the possibility of a follow-on government investigation and exposure to penalties. Thus, most companies assess their options on a case-by-case basis to determine what steps would be in the best interests of the company.

At the end of the workplace investigation, the results are presented to the company's management bodies so that they can make a decision. This may be a mere summary of the facts, or it may contain a legal assessment and recommendation for action.

There is no general obligation to report compliance violations to the police or public prosecutor's office. For some violations, there are statutory disclosure requirements. For example, data protection violations must be reported to the responsible supervisory authority (article 33 and 34, DSGVO), violations in connection with money laundering must be reported to the Central Office for Financial Transaction Investigations (section 43, Anti-Money Laundering Act), unlawful claiming of subventions must be disclosed to the subsidy-providing authority (section 3, Subventions Act), and incorrect information in the tax declaration must be reported to the tax authority (section 153, Tax Code). Additionally, in listed companies, criminal acts may constitute insider information in individual cases, and this must be disclosed within the framework of ad hoc publicity following market abuse regulations.

Also, there may be cases where reporting to the authorities should be considered for corporate policy and tactical reasons (eg, to avoid or mitigate negative consequences for the business).

Pursuant to section 17 paragraph 2, HinSchG, feedback will need to be provided to the whistleblower within three months of confirmation of receipt of the report or, if the receipt has not been confirmed to the whistleblower, within three months and seven days after receipt of the report. This includes the communication of planned and already taken follow-up measures as well as their reasons. Feedback to the whistleblower may only be provided to the extent that it does not affect the workplace investigation and does not prejudice the rights of the persons who are the subject of the report or who are named in the report.

For the question of whether internal investigations reports and material need to be shared with or can be seized by the public prosecutor, please see question 14.

In principle, there is no specific obligation for investigating persons to disclose their findings. For proceedings before a court that have been initiated or investigated by the police or competent regulatory bodies, the relevant findings may be communicated under strict conditions and provided that the personal data of the parties involved are not publicly disclosed.

More specifically, under L. 4490/2022, in the context of whistleblowing procedures, personal data and any information that leads, directly or indirectly, to the identification of the complainant are not disclosed to anyone other than employees involved in the investigation, unless the complainant consents. The identity of the complainant and any other information may only be disclosed in the context of investigations by competent authorities or judicial proceedings, to the extent necessary for the protection of the employee under investigation’s rights of defence. Confidentiality obligations govern the procedure for revealing trade secrets to police and regulatory bodies, especially in the framework of L.4990/2022.

As mentioned in questions 21, 22 and 23, under Hong Kong law, the employer is generally not obliged to actively disclose the findings of a workplace investigation to any party.

Having said that, the employer should be aware of certain statutory disclosure requirements that may become applicable as a result of the matters revealed during the workplace investigation. For example, if the investigation reveals or gives rise to any knowledge or suspicion that any property represents the proceeds of an indictable offence[1], drug trafficking[2], or terrorism[3], the employer is required to report its knowledge or suspicion, together with any matter on which that knowledge or suspicion is based, to the JFIU as soon as is reasonably practicable (even where the investigation has not yet been concluded). Employers who are licensed corporations must also provide the SFC with information about whether departing licensed employees were the subject of an internal investigation in the six months prior to his/her departure. If the internal investigation commences after the departure of the licensed employee, the licensed corporation should notify the SFC as soon as practicable[4].

In any event, as in question 14, if any documents related to the investigation are protected by legal professional privilege, they can generally be kept confidential and would not be subject to disclosure even if the employer is subject to a mandatory reporting or disclosure obligation.

Please see question 22.

For SH complaints, the report would normally contain a complete record of interviews conducted, evidence provided and other associated artefacts.

While investigation reports for other forms of misconduct may be kept private (subject to observations in the prior response relating to disciplinary inquiries), whether or not the investigative report should be disclosed to external agencies such as the police or other regulators would be a subjective decision. Disclosure may be necessary where a demand is made by the external agency as per powers it enjoys under the law (to seek production of necessary documents or personnel Rules of legal privilege may also be important to assess if any information can be withheld based on client-attorney privilege.

Depending on the nature of the subject matter of the investigation, it may be appropriate to notify the Garda Siochana or a specific government body such as Revenue. Also, if the employee occupies a regulated position, it may be necessary to inform the relevant regulator. Again, compliance with GDPR obligations should be borne in mind.

Generally speaking, even if the investigation leads to evidence of a criminal offence, the employer does not have to inform public authorities (citizens and private entities do not have an obligation to report crimes they discover). The existence of any obligations to report to regulatory authorities (eg, banking and insurance regulatory authorities) should be investigated on a case-by-case basis.

The internal procedures of the company – as adopted by the company in the framework of legislation on the administrative or quasi-criminal vicarious liability of legal entities – may require the findings to be disclosed to certain internal bodies or committees.

As said above, the police or public prosecutors (and possibly other public authorities) may have, within their investigatory powers, and in certain circumstances, the power to access internal investigation outcomes (but a case-by-case analysis would be necessary).

If it is information related to a crime, and if it is necessary to report it to the supervisory authority, it is necessary and possible to report it even if the content relates to personal information. There is no obligation to report to the police even if one is aware of a criminal fact. However, it is possible to use the results of an investigation to file a complaint or charge with the police. It is also possible to use the results of the investigation to realise the company's rights (eg, to claim damages based on tortious behaviour).

The fundamental right to a fair hearing entails that the investigation findings must be disclosed to the employee under investigation at least once, so that they are given the opportunity to respond to them. Under Dutch administrative or criminal law, there are no general provisions requiring disclosure of investigative findings to regulators or criminal authorities. Certain specific provisions, however, apply, for example, in reportable incidents at financial institutions or certain HSE incidents that need to be disclosed to relevant regulatory authorities. Regulatory and criminal authorities, however, do have broad investigative powers enabling them to order the provision of data from subjects or involved parties in investigations they are conducting. Such information may also comprise investigation findings and underlying documents, such as interview records. If such interview records are subject to legal privilege (see question 14), they are typically not subject to disclosure to the relevant authorities.

Under Dutch civil law, a party that possesses certain records (such as investigation findings and underlying documents) is generally not required to disclose those to other parties for inspection. Parties are, in principle, not required to share information with third parties, other than relevant authorities (see above).

An exception to this rule is section 843a Dutch Code of Civil Procedure. Under section 843a, a party can be required to produce specific exhibits, if:

• the requesting party has a legitimate interest;
• the request concerns specific and well-defined records or information (ie, no fishing expeditions); and
• the documents pertain to a legal relationship (e.g., a contract or alleged tort; the requested party does not need to be a party to the relevant legal relationship).

If these requirements are met, the requestee should, in principle, disclose the requested information, except for specific exceptions. Such exceptions, which can also be relevant in the context of internal (workplace) investigations, could include confidentiality arrangements and privacy protection, to the extent that this would qualify as a compelling interest. To establish such a compelling interest, the relevant interest should outweigh the requesting party's legitimate interest regarding the requested information. This is a balancing act. Documents that are subject to legal privilege are protected against disclosure.

Investigation findings may be disclosed to the employee and every other person having an interest in the investigation. Where it is discovered that a crime has been committed, the investigation findings may be disclosed to the regulators or police.

Typically, interview records are kept private and will not be disclosed unless it is interest of justice.

The result of the workplace investigation must be kept private by the employer. These are confidential matters that should not be disclosed to people or entities who did not take part in the investigation. However, if the investigation findings show that a possibly unlawful or criminal activity has taken place, or is about to take place, the employer should share such findings with the authorities.

It depends on the matter. In general, there is no obligation to disclose the report. In some instances, there is an obligation to notify a suspected offence (for example, a terrorist attack or a political assassination). This, however, does not mean there is an obligation to file a report from the internal investigation, but to provide the law enforcement authority with the facts and evidence at the notifier’s disposal. In other instances of criminal offences, for example corruption, there is no obligation to notify law enforcement authorities. Therefore, it is up to the organisation to decide whether it will file a notification for a suspected offence.

At the same time, presenting a report from an internal investigation can constitute an element of defence for an organisation if a regulatory authority initiates proceedings regarding a failure by the organisation to comply with regulatory obligations.

Records of interviews do not need to be produced for the case file provided the law enforcement authority does not ask for them.

The investigation findings must be disclosed to the employee when an accusation is brought against him or her and to the works council (if any) or trade union, if the employee is a member.

Regulators or police authorities may also notify the employer if any investigations were brought against a particular employee (as regards regulators, this could occur within the scope of fit and proper procedures), in which case the employer must cooperate and disclose any investigation findings.

A summary of the investigation’s findings should be disclosed to the employee who lodged the grievance and the employee under investigation.

If there are parallel criminal or regulatory investigations, the investigation findings should also be disclosed to the authorities.

Interview records or transcripts should be kept private unless disclosure is required by a court order or at the direction of the authorities.

There is generally no obligation to report violations to the Korean authorities, subject to limited exceptions (eg, financial institutions are required to report certain types of wrongdoing to the financial regulator; if there was a leak of an industrial technology developed through a national research and development project or a national core technology, this leak should be reported to the Ministry of Trade, Industry and Energy and the National Intelligence Service). However, even in the absence of a self-reporting obligation, the company may consider strategically deciding to make a voluntary report. For example, there have been instances where the police or prosecutors’ investigations were conducted in a more limited manner where the company filed a voluntary report and cooperated with the investigation. Also, for certain types of violations (eg, cartel activities), self-reporting to the relevant authority may entitle the company to leniency provided under the law.

In certain instances, the company may also consider reporting violations to the relevant foreign authorities, in addition to, or instead of, the Korean authorities. For example, if the company found potential violations of US law such as sanctions law or the Foreign Corrupt Practice Act, the company may want to self-report these violations to the relevant authorities such as the Office of Foreign Assets Control, or the US Department of Justice.

Companies may only disclose the outcome of an investigation to employees or officers of the company who are empowered to adopt the measures that are necessary because of the investigation’s results (see question 4).

This disclosure obligation does not extend to authorities: while there is a general obligation to report criminal or administrative offences to the competent authorities, this obligation must be read in line with the companies’ right not to self-report themselves. What a company must not do is cover up, aid or otherwise become an accessory to the offence.

Findings may have to be handed over to the police or the regulator – there is no separate legal protection for material in employer investigations related to authorities. If the investigation has been carried out by a law firm, see question 14 on attorney-client privilege.

The employer is generally not required to disclose the final report, or the data obtained in connection with the investigation. In particular, the employer is not obliged to file a criminal complaint with the police or the public prosecutor's office.

Exceptions may arise, for example, from data protection law (see question 22) or a duty to release records may arise in a subsequent state proceeding.

Data voluntarily submitted in a proceeding in connection with the internal investigation shall be considered private opinion or party assertion.[1] If the company refuses to hand over the documents upon request, coercive measures may be used under certain circumstances.[2]

The investigation findings should be disclosed to a limited group of persons who are involved in the investigation, and for which the findings are useful. For example, an HR manager who needs to record the findings in the employee’s record, the police if the employer decides to proceed further with a criminal claim, the court if requested by that court, or if there is a court case related to the violations of the employee.

Interview records should be kept confidential and private. There is a risk of disclosure because the information in the records may be beneficial to one but damaging to others. If the interview records are leaked to others who are not involved in the investigation, it may affect the work environment in the workplace and the protection of witnesses.

Investigation reports may be disclosed in potential lawsuits or judicial proceedings. Therefore, the investigation report must demonstrate that a detailed and objective investigation has been carried out. Courts may also request that the interview records be disclosed to them, failing which, the courts may resort to an adverse inference in civil proceedings. Criminal courts can also ask the interview records to be disclosed if this would be necessary for reaching the truth. Failure to disclose may entail criminal responsibility under certain conditions.

Primarily, the investigation findings are disclosed to the employer and the employee under investigation. In scenarios involving allegations of a breach of regulatory duty or criminal law, the authorities may have the power to compel disclosure of any non-privileged materials generated in the investigation. Powers of compulsion do not apply to privileged materials.

Once fact-finding is complete, the investigator should discuss his or her notes with in-house or outside counsel and prepare a summary of the process, high-level findings, and a proposed resolution at the counsel’s direction. This report should not include subjective commentary and should also avoid including excessive detail, and generally be treated confidentially during and after the investigation. If the report is requested by regulators or the police, the company should discuss with in-house counsel, and preferably also with outside counsel, how to respond to the request and whether any steps need to be taken to protect any applicable legal privilege.

Generally, the employer does not have to actively disclose the findings of a workplace investigation to any party.

Notwithstanding this, the employer should be aware of certain statutory disclosure requirements that may apply as a result of the matters revealed during the workplace investigation, if the said investigation reveals any knowledge or suspicion of an indictable offence that has been committed.

Interview records should be kept private unless disclosure is required by the authorities.

It is important for employers to conduct procedurally fair investigations that result in a fair outcome. Failure to do so may expose the employer to various claims by an employee. The most common type of claim following an investigation is an unfair dismissal claim. If a respondent’s employment is terminated because of an investigation, they may be eligible to bring an unfair dismissal claim in the FWC alleging their dismissal was harsh, unjust or unreasonable.

An employee may also bring a bullying, discrimination or general protections claim. These claims may be made even where the investigation does not result in the employee’s dismissal.

If an employer has departed from the procedures set out in their policies, or they have not followed the terms of an employee’s employment contract or another applicable industrial instrument then an employee may bring a claim for breach of contract.

Australia has also recently introduced the “Respect@Work” legislation which places a positive obligation on employers to take reasonable and proportionate measures to eliminate sex discrimination, sexual harassment and victimisation, as far as possible. Accordingly, an employer who is not perceived to have taken a proactive and fair approach to these workplace issues faces significant legal exposure.

Failure to conduct an investigation properly (or a failure to conduct an investigation in circumstances where it is needed) can also cause significant reputational and financial risk.

This relates to the severity of the error. Data protection violations can lead to fines by the data protection authority or claims for damages. If consequences under labour law, such as dismissal, have taken place due to erroneous investigations or incorrect results, the employee concerned can assert claims under labour law or seek damages.

Furthermore, there may be consequences under criminal law. This is particularly the case if documents have been falsified in the course of the investigation. It is, therefore, crucial that employers exercise diligence and due process in internal investigations. Investigations must be conducted transparently and lawfully.

In general, abusive investigations could lead to a legal claim regarding the abuse of rights. During an investigation, an employer should be guided by principles of due diligence and not take disproportionate action. If the investigation causes unnecessary damage, involved employees could file for compensation (eg, before the labour court). Next, the employer is also responsible for following the mandatory procedure for official complaints regarding sexual harassment, bullying and violence at work and investigations of whistleblower reports. In the first case, an employer who does not follow the procedure or obstructs the procedure can be liable for penal or administrative fines (maximum 8,000 euro) or, if the employer has not taken necessary measures to mitigate the risks for the employee and the employee suffers damage to their health, they may be liable for a fine of a maximum of 48,000 euro and imprisonment for between six months and three years. In the second case (whistleblower procedure), if an employer did not follow or has obstructed the procedure, they can be fined up to 5% of the annual revenue of the preceding year.

If the complaints involve allegations of sexual harassment, violence or bullying at work, the employer might risk an investigation of the inspection on supervision and well-being at work. If the prevention advisor finds out, before giving his advice, that the employer did not take any suitable protective measures after they were recommended, the prevention advisor is obliged to call an inspection on supervision and well-being at work.

The employer’s legal exposure resulting from errors during the investigation depends on the error and the victim or victims affected. It may range from paying damages to a witness who was harassed because the company did not prevent retaliation from occurring; to the reversal of a termination for cause if a court determines that the evidence collected during the investigation did not meet the legal threshold to uphold it; to indemnification for a violation of privacy; or criminal prosecution because of unauthorised access to private communications.

It is inevitable that the investigation involves the employee's personal information, and once the investigation is mishandled, the employer may face the following legal risks:

Civil liability: Both the Civil Code of the PRC and the Personal Information Protection Law of the PRC, clearly provide the civil liability for infringement of privacy and illegal processing of personal information. Therefore, the investigated employee or relevant organizations such as the people's procuratorate have the right to claim or file a public interest lawsuit on the employer's improper collection of evidence, requiring the employer to bear the liability for infringement. In addition, the evidence obtained by an employer through infringing the employee's privacy and personal information rights and interests, in violation of the law, cannot be used as the valid evidence for the employer's unilateral termination of the employment contract or requiring the employee to compensate for losses.

Administrative liability: Article 66 of the Personal Information Protection Law of the PRC provides that, where personal information is processed in violation of regulations, administrative penalties imposed by the department performing duties of personal information protection may be up to revoking the business license, and the person directly in charge and other directly liable persons may be fined up to one million yuan and prohibited from practicing within a time limit. Meanwhile, Article 67 of the Personal Information Protection Law of the PRC provides that relevant illegal acts shall be recorded in the employer's credit files and disclosed to the public.

Criminal liability: if an employer illegally sells or provides to others the personal information obtained during the internal investigation, and the circumstance is serious enough, the judicial authority has the right to hold the employer, the managers directly in charge and other directly liable persons criminally liable in accordance with the crime of "infringement of citizens' personal information" under Article 253A of the Criminal Law of the PRC.

It should be noted that a compliance investigation may also involve the employer's communication and investigation reporting with overseas authorities, or overseas institutions' direct access to information from the employer's domestic systems. If the employer conducts cross-border transmission of such personal information, it shall also meet one of the conditions set out in Article 38 of the Personal Information Protection Law of the PRC (i.e. passing the security assessment organized by the national cyberspace administration authority, obtaining certification from a professional institution concerning the protection of personal information or entering into a standard contract with an overseas recipient). Violations of the above provisions may result in civil, administrative and even criminal liability.

There are no regulations regarding the actual investigation process. Therefore, the employer cannot be accused of procedural errors as such. However, once the matter has been adequately investigated, the employer must decide whether or not misconduct has taken place. If the employer considers that misconduct has taken place, the employer must take adequate measures for remedying the situation. Failure to adequately conduct the investigation could result in criminal sanctions being imposed on the employer as an organisation or the employer’s representative, or damages.

Within the context of an investigation following a whistleblower alert, any violation of the confidentiality obligation is punishable by two years’ imprisonment and a €30,000 fine.

If the employer fails to comply with its obligation to protect its employees’ safety, the employer will be liable for damages resulting from any failings during the investigation (eg, if sexual harassment is reported and no action is taken by the employer)

Different consequences may result from mistakes made by the employer (or its advisors) in the course of the workplace investigation. For example, if the employer has violated the data protection provisions of the DSGVO or BDSG, this may result in fines. This may also result in claims for damages by the employee. The employee may also have a claim for damages if it turns out that the suspicion of misconduct on the part of the employee is not confirmed and the employer has arbitrarily conducted workplace investigations without sufficient cause.

The employee can contest the decisions of disciplinary councils before the courts and request their annulment. 

Moreover, in the framework of L.4990/2022, a monetary penalty and prison sentence (to be defined by an implementing Ministerial Decision) may be imposed on any person violating confidentiality obligations concerning the identity and personal data of employees or third parties included in the investigation procedure, while monetary penalties are also provided for legal entities[15].

Moreover, administrative fines may also be imposed if the employer does not comply with the legal requirements concerning the prevention of violence and harassment in the workplace.

Furthermore, the employee under investigation may initiate proceedings before the courts under tort law, by claiming compensation for moral damages suffered if the company did not comply with its confidentiality obligations after the incident (eg, due to the spread of rumours in the workplace). This may also be linked with criminal law proceedings against the persons responsible for dealing with the investigation (and not against the legal person, since under Greek law there is no criminal liability for legal persons).

On the other hand, the employer may also be exposed to liability vis-à-vis the complainant, witnesses or facilitators, for breach of confidentiality or other obligations prescribed in the respective legal provisions, or if there are retaliation measures.

If the employer failed to comply with a requirement that is expressly stipulated in the employment contract or employee handbook (such as a procedural requirement to hold a disciplinary hearing or to provide certain information to the employee), the employer could be liable for breaching an express term in the employment contract.

Even where the employment contract does not contain express provisions for the conduct of an internal investigation, the employer is under an implied obligation of trust and confidence under common law (as discussed in question 11), which requires it to conduct the investigation and reach its findings reasonably and rationally in accordance with the evidence available and in good faith.[1] If the employer reached a decision that no reasonable employer would have reached, the conduct of the investigation may be in breach of the employer’s implied obligation of trust and confidence.

If the error in the investigation has led to a termination of employment (whether by way of summary dismissal or termination by notice), the employee may be able to bring a statutory claim for wrongful dismissal, unlawful dismissal or dismissal without a valid reason (as applicable).[2] If such a claim is successful, in addition to ordering the employer to pay monetary compensation, the court or tribunal may also make a reinstatement order (an order that the employee shall be treated as if he had not been dismissed) or re-engagement order (an order that the employee shall be re-engaged in employment on terms comparable to his or her original terms of employment) for the affected employee.

The employer may also be liable for unlawful discrimination under Hong Kong law if the investigation has been conducted in a discriminatory manner or the outcome of the investigation reflects differential and less favourable treatment of the employee concerned based on grounds of sex, marital status, disability, family status or race.

The risk an employer may face would be quite subjective. For example, if an individual is suspended without pay, the individual may attempt to argue that the entire investigation should be set aside, as non-payment of salary affects an individual’s ability to properly represent themselves. Material errors in disciplinary proceedings or not adhering to the rules of natural justice may result in disciplinary action being set aside, and potentially also orders for reinstatement of the employee with back pay (if the individual is protected by local labour laws) if the dismissal is found to be unfair or disproportionate to the gravity of the misconduct.

In addition to the above risks, in SH matters, if the IC constitution is incorrect or there are allegations of bias against a committee member, the whole investigation may be set aside and the organisation ordered to conduct a fresh inquiry through a properly constituted committee.

A failure to follow fair procedures in the investigation can have significant consequences.

Although the exception rather than the rule, an employee could challenge the investigation through injunctive proceedings if there is a breach of fair procedures. Such action would be taken before the High Court. Injunction proceedings may be brought while the investigation is ongoing, or just before its conclusion to prevent publication of a report making specific findings against an employee. A successful injunction may curtail any subsequent attempt to investigate the matter as allegations of penalisation, prejudice and delay may arise.

Errors during the investigation can also give rise to a complaint of constructive dismissal, with allegations that flaws in the procedure have fundamentally breached the implied term of mutual trust and confidence.

A flawed investigation can also undermine any disciplinary process and sanction that is imposed as a result. This commonly occurs when an employee has been dismissed following a disciplinary process launched on foot of the investigation. While dismissal may be an appropriate sanction, the dismissal can still be found to be unfair if there is a failure to follow fair procedures. An employee may challenge their dismissal before the WRC and the employer should be alive to not only an unfair dismissal complaint, but allegations of discrimination and penalisation.

Overall, to carry out a successful workplace investigation, an employer should consider taking advice at the earliest opportunity to ensure that the investigation can withstand challenges.

It depends on the kind of error or breach. For example:

• a breach of privacy laws (eg, acquiring data from working instruments in lack of due requirements) would lead to the application of privacy law sanctions (including monetary fines); and
• breach of provisions regarding “remote” control of employees would lead to criminal sanctions and to the inadmissibility, for disciplinary purposes, of the data collected (and thus potentially to the unlawfulness of a dismissal based on such data).

Furthermore, if the employee has suffered damages as a result of the employer’s errors or breaches (and can specifically prove such damages and their amount), the employer may be held liable in court.

If the company deviates from appropriate social rules in its investigative methods and means, it will be liable for tortious behaviour. If disciplinary action or dismissal is taken based on erroneous investigation results, the validity of such action or dismissal will be denied, the employee will be able to claim for back wages, and, in some cases, claim for compensation.

The employee can request compensation for violation of the right to a fair hearing or reputational damage. If the employee is suspended during the investigation, , the employee can request the court to order the employer to allow them to resume their work and request rehabilitation.

In termination proceedings (or after the termination of the employment agreement by the employer), the employee can claim an equitable compensation from the employer if the employer has shown serious culpable behaviour. Such compensation, if granted, is usually based on loss of income by the employee due to the behaviour of the employer.

• Violation of Fundamental Rights of the Employee
• Breach of Contract of Employment or wrongful termination

An employer may be liable for illegal termination if a dismissal is made based on wrong information collected during the investigation. Thus, the data and information gathered during the investigation stage must be correct and accurate. Further, investigations should be conducted in a manner that is fair and reasonable to the employee under investigation. Otherwise, the employee may treat the investigation as harassment on the part of the employer, which may subject the employer to a potential lawsuit.

If any untrue allegations were made by an employer against an employee without checking them beforehand, there is a risk that such an employee would claim damages eg, for infringement of personal rights or even filing a private indictment for defamation or outrage.

Certainly, an employer must be aware that one must never behave in a way that, for example, in the employee's opinion, could constitute a form of blackmailing or deprivation of liberty. A problem may also arise when accessing the employee's correspondence, especially when access is made to documents or private correspondence. The Draft Law provides for several criminal offences related to, for example, preventing reporting, using retaliatory measures against a whistleblower or disclosing personal data of a whistleblower).

If the disciplinary procedure recommends an employee's dismissal

Should a company dismiss an employee that has breached legal requirements, the latter may take action against the company within 60 days of the date of termination of their employment agreement.

If this action results in a ruling of unfair dismissal, the employee will be entitled:

• to receive all the payments they should normally have earned (back pay, including salary, holidays, legal subsidies, etc), from the month preceding the commencement of the lawsuit and until the final ruling of the court, minus any amounts they may have received during the same period and they would otherwise not have received; and
• to be reinstated in their former position or at the employee’s choice, to receive an indemnity that the court will calculate as between 15 and 45 days of base salary (and service bonuses) for each full year of service or fraction thereof, with a minimum limit of three months’ compensation.

This graduation will depend on the amount of the base salary (the lower the base salary, the higher the indemnity) and the severity of the company’s conduct. Additionally, the employee is entitled to claim an indemnity for further damages.

There are, however, two exceptions to the above: the first relates to high-ranking employees (ie employees carrying out management duties); the second refers to micro-companies (ie, a company that registered an average number of employees in the preceding calendar year below 10). In these two cases, the employer may oppose the employee’s option for reinstatement, arguing that it would be gravely harmful to the company's activity. From a practical perspective, opposition to reinstatement is not commonly decided by the courts.

Finally, should the court rule that the grounds for dismissal were valid, but the investigation was found to have been irregular, the dismissal will be deemed valid, but the employee will still be entitled to an indemnity of 7.5 to 22.5 days of base salary (plus service bonuses, if any) per year of service.

If the disciplinary procedure does not recommend dismissal, but the application of a conservatory sanction

In this event, the employee can challenge the application of the sanction through the filing of a lawsuit against the company. Although the law is not entirely clear, there are court rulings stating that the employee has one year to bring a lawsuit, but others consider that the statute of limitation to challenge a conservatory disciplinary sanction is also one year from the termination of the employment agreement when a pecuniary penalty or suspension was applied to the employee.

Moreover, according to article 331(3) of the Portuguese Labour Code, the employer who applies an unjustified conservatory penalty should compensate the worker under the terms set out in paragraphs 5 and 6 of said article. The imposition of an abusive penalty is also considered a very serious administrative offence as per article 331(7). Please note that the Portuguese Labour Code considers a penalty to be unjustified if its imposition is motivated by the following:

• the employee lawfully complaining about their labour conditions;
• the employee lawfully disobeying unlawful orders from a superior;
• the employee being a member of any employee representative structure or having been a candidate for such a position; and
• the employee exercising or invoking their rights and guarantees.

Furthermore, any penalty imposed within six months of any instance listed above (or within one year if the invoked rights are related to equality and non-discrimination) is presumed to be abusive.

The employer may be exposed to legal action for a failure to properly conduct the investigation, including having such portions of the investigation set aside or held to be void by the courts, and be made to pay damages to the affected employee; or face investigation and administrative penalties by regulatory authorities such as the MOM.

In addition, after the Workplace Fairness Legislation comes into force, breach of its requirements may also expose the employer or culpable persons to potential statutory penalties. The Tripartite Committee on Workplace Fairness recommended, among other things, for the Workplace Fairness Legislation to provide for a range of penalties including corrective orders, work pass curtailment and financial penalties against employers or culpable persons, depending on the severity of the breach. It is thus expected that employers or culpable persons may be exposed to potential statutory penalties if the requirements of the Workplace Fairness Legislation are not complied with.

As mentioned in question 19, employees may potentially raise claims, such as that the company violated data privacy laws in reviewing employee data, committed defamation, coerced the employee to comply with the investigation, and that witnesses or the company committed defamation in violation of the Criminal Code or disciplined the employee without just cause.

Errors during an investigation are normally linked to the breach of the employees’ privacy or their personal data rights (see question 1). Breaching these rights might expose employers to:

• Fines from the Labour Inspectorate and the Spanish Data Protection Authority.
• A court awarding damages to the employee.
• Any disciplinary measures adopted by the company as a result of the investigation could be considered null and void.
• The evidenced obtained during the investigation being disregarded by a court.
• In some very serious cases, criminal liability might arise for the individuals who conducted the investigation and breached the employees’ rights.

Errors resulting in terminations can be unlawful and, if they lead to employees terminating their employment as a result of the employer’s missteps, could be seen as constructive dismissal. Constructive dismissal is generally equivalent to an unlawful dismissal. Unlawful terminations generally result in an obligation to pay financial and general damages to the affected employees.

Failure to fulfil the obligations under the Swedish Discrimination Act may lead to an obligation to pay financial and general damages.

If an employer does not fulfil its obligations according to work environment legislation, there is a risk that the Swedish Work Environment Authority will issue injunctions or prohibitions against the employer. If an employer omits to meet its work environment related obligations, and that in turn results in a work related accident, e.g. self-harm in connection with an internal investigation, it may also, in a worst case scenario, lead to criminal liability.

The Swedish Work Environment Authority is also responsible for monitoring compliance with the provisions of the Swedish Whistleblowing Act. The Swedish Work Environment Authority may, if necessary to ensure compliance with the Swedish Whistleblowing Act, order an operator to comply with the obligations and requirements of the Swedish Whistleblowing Act. Employers violating the Swedish Whistleblowing Act may also be liable to pay damages to the affected employees.

If personal data is processed in a way that violates the GDPR, the authorised supervisory authority may issue warnings or reprimands to the data controller, order the controller to comply with the GDPR, impose a ban on processing, or impose an administrative fine on the controller. Companies violating the GDPR may also be liable to pay damages to data subjects.

As there are no specific regulations for internal investigations, the usual legal framework within which the employer must act towards the employee derives from general rules such as the employer's duty of care, the employee's duty of loyalty and the employee's data protection rights.

But, for example, unwarranted surveillance could conceivably result in criminal liability (article 179 et seq, Swiss Criminal Code) for violations of the employee's privacy. Furthermore, errors made by the employer could have an impact on any later criminal proceedings (eg, in the form of prohibitions on the use of evidence).[1]

Evidence obtained unlawfully may only be used in civil proceedings if there is an overriding interest in establishing the truth (article 152 paragraph 2, Swiss Civil Procedure Code). Consequently, in each case, a balance must be struck between the individual’s interest in not using the evidence and in establishing the truth.[2] The question of the admissibility of evidence based on an unlawful invasion of privacy is a sensitive one – admissibility in this case is likely to be accepted only with restraint.[3] Since the parties in civil proceedings do not have any means of coercion at their disposal, it is not necessary, in contrast to criminal proceedings, to examine whether the evidence could also have been obtained by legal means.[4]

Unlawful action by the employer may also have consequences on future criminal proceedings: The prohibitions on exploitation (article 140 et seq, Swiss Criminal Procedure Code) apply a priori only to evidence obtained directly from public authorities. Evidence obtained unlawfully by private persons (ie, the employer) may also be used if it could have been lawfully obtained by the authority and if the interest in establishing the truth outweighs the interest of the individual in not using the evidence.[5] Art. 140 paragraph 1 Swiss Criminal Procure Code remains reserved: Evidence obtained in violation of Art. 140 paragraph 1 Swiss Criminal Procure Code is subject to an absolute ban on the use of evidence (e.g. evidence obtained under the use of torture[6]).[7]

The Thai Supreme Court has ruled that the termination of an employee was unfair due to an investigation being conducted contrary to requirements in the company’s work rules. As such, employers may be liable for damages to employees if there are errors made during investigations, or where investigations are not conducted properly.

The Supreme Court has also ruled that in cases of unfair termination, the underlying cause of the termination should be the determining factor, rather than other issues, including investigative procedures.

The nature of legal exposure is very much dependent on the legal action the employer has taken after the investigation. The employer may be subject to a wrongful termination lawsuit to be filed by the employee, which may result in the payment of compensation to the employee of between eight and 12 months’ salary, if the court concludes that the termination is wrongful. This may also include monetary and moral damages claims. If no termination has taken place, the employee may terminate his or her employment with just cause if the employer has erred in its neutral fact-finding mission and this affects the employee. The employee may also file a criminal complaint to the extent that the investigation findings incriminate the employee in error.

A reasonable investigation is a key component of a fair disciplinary process. Errors in the investigation could therefore expose the employer to liability for unfair dismissal under ERA 1996.

Failure to follow the ACAS Code does not automatically make an employer liable in any proceedings taken against it. However, an employment tribunal will take the ACAS Code into account when deciding whether an employer has behaved fairly, and has the power to increase awards by up to 25% where it believes an employer has unreasonably failed to follow the ACAS Code's provisions.

There may be liability for breach of the employee’s contract of employment if the employer breaches aspects of the investigation policy that are contractual, any contractual provisions relating to suspension, or otherwise conducts the investigation in a manner that breaches the implied term of trust and confidence.

There may be liability under the EA 2010 if the investigation is conducted in a discriminatory manner, which could include not making reasonable adjustments to the process for disabled employees.

Where the investigation involves protected disclosures, there may be liability under the whistleblowing provisions of ERA 1996 if the whistleblower is subjected to detriment or dismissal on the grounds of their protected disclosures.

Improper evidence gathering or processing may be actionable under the DPA 2018, IPA 2016 or the IP Regs 2018.

Finally, there may be common law claims in some circumstances (for example where reports need to be made to regulators, which in turn may affect the relevant employee’s future employment prospects) for defamation, or, more unusually, for stress-related personal injury.

The subject of the investigation, the complainant, or a government agency investigating the same alleged misconduct could subject the employer to legal exposure. It is, therefore, helpful for a company to prepare a contemporaneous report of the investigation that summarises: the incident or issues investigated, including dates; the parties involved; key factual and credibility findings; employer policies or guidelines and their applicability to the investigation; specific conclusions; the party (or parties) responsible for making the final determination; issues that could not be resolved through the internal investigation; and employer actions taken.

The employer should also maintain a clear record of the steps taken to investigate the alleged misconduct and any findings, as well as all evidence gathered during the investigation, including documents collected and reviewed, any work done to identify systemic issues or patterns of behaviour, and notes from all interviews, which should be limited to the facts gathered, dated and should indicate the duration and location of the interview.

The employer may be exposed to legal action for its failure to conduct the investigation properly, such as a lawsuit for labour disputes or sanctions for its failure to protect personal data as required under personal data protection regulations. For instance, if there were errors during the investigation which led to erroneous results for the investigation and consequently, the employee was dismissed, the employee may file a claim for illegal dismissal against the employer.