Corporate Internal Investigations: A Systematic Overview of 13 jurisdictions 9781472561404, 9781849464840

Citation preview

Reemers Publishing Services GmbH O:/Beck/Spehl_Gruetzner/3d/Preface.3d from 06.03.2013 09:21:40 3B2 9.1.580; Page size: 160.00mm  240.00mm

Preface As so often, U.S. law was ahead of the curve. The first U.S. book on “Corporate Internal Investigations” was published in the early ’90s. Publications about the international aspects of internal investigations were rare simply due to the rarity of international internal investigations themselves. This has changed over the last several years. As in the field of M&A or Corporate Finance there is not only the linguistic but also conceptual dominance of U.S. law. However, national laws in sensitive areas like employment, criminal and privacy law often play a dominant role and can make internal investigations in many countries a complex task and in some cases may hinder a global internal investigation law/practice for quite some time. Two of the reasons for the complexity of an internal investigation in a single country are the interrelation of the different areas of law and that most laws and courts provide insufficient guidance on the appropriately conducting an internal investigation. Naturally, these complexities are exponentially magnified when several countries and nationalities are involved in the case of a global internal investigation. The purpose of this book is sensitizing the reader that despite the need for a uniform global investigation the local differences must be observed in many jurisdictions. The book covers 25 of the key questions on internal investigations related to (i) the initiation of internal investigations, (ii) the admissibility of individual measures within the scope of internal investigations, (iii) employee interviews, (iv) sanctions imposed on employees, (v) the use of information obtained through an internal investigation and (vi) the following-up that occurs after an internal investigation is concluded. These 25 key questions are answered from the perspectives in 13 different jurisdictions (i.e., Austria, Brazil, China, France, Germany, Great Britain, Indonesia, Italy, Mexico, Russia, Spain, Switzerland, the United States). The book describes the situation in the various jurisdictions as of autumn 2012. We would like to thank all of the authors, as well as Juliana Walsh and Christine Schneemann. We would in particular like to thank Hildgund Kulhanek for her diligent work in finalizing the manuscript. We were very fortunate that we had her as an editor. We take responsibility for all errors and omissions. Please feel free to make us aware about errors and omissions by sending us an email to the following email-addresses: [email protected] and [email protected].

Munich, December 2012

Stephan J. Spehl Thomas Gruetzner

V

Reemers Publishing Services GmbH O:/Beck/Spehl_Gruetzner/3d/Preface.3d from 06.03.2013 09:21:40 3B2 9.1.580; Page size: 160.00mm  240.00mm

Reemers Publishing Services GmbH O:/Beck/Spehl_Gruetzner/3d/List_of_Abbreviations.3d from 06.03.2013 09:22:16 3B2 9.1.580; Page size: 160.00mm  240.00mm

List of Abbreviations and Acronyms ABA.................... ABGB................. ADR ................... ADS.................... AG ...................... AIM.................... AMF................... AngG.................. AnwBl. ............... ArbVG ............... ARD ................... ArG .................... Art./Arts. ........... ¨ rzteG ............... A ASoK.................. AVG................... AVRAG ............. AWG.................. BAG ................... BAO ...................

American Bar Association Allgemeines Bu¨rgerliches Gesetzbuch (Austrian Civil Code) Alternative Dispute Resolution American Depository Shares Aktiengesellschaft (company limited by shares) Alternative Investment Market Autorite´ des Marche´s Financiers (French financial markets authority) Angestelltengesetz (Austrian Law concerning employees) Anwaltsblatt (German law journal) Arbeitsverfassungsgesetz (Austrian Law on labour relations) Aktuelles Recht zum Dienstverha¨ltnis (Austrian law journal) Arbeitsgesetz (Swiss labour law) Article/Articles ¨ rztegesetz (Austrian Law on doctors) A Arbeits- und SozialrechtsKartei (German law journal) Allgemeines Verwaltungsverfahrensgesetz (Austrian General Administrative Procedure Act) Arbeitsvertragsrechts-Anpassungsgesetz (Austrian Law amending the labour contract law) Außenwirtschaftsgesetz (Foreign Trade Law)

BWG ..................

Bundesarbeitsgericht (Federal Labour Court) Bundesabgabenordnung (Federal Fiscal Code in Germany and Austria) Betriebs-Berater (German law journal) Binding Corporate Rules Bundesdatenschutzgesetz (Federal Data Protection Act) Betriebsverfassungsgesetz (Works Constitution Act) Bu¨rgerliches Gesetzbuch (German Civil Code) Bundesgesetzblatt (Federal Law Gazette in Germany and Austria) Leitentscheidungen des schweizerischen Bundesgerichts (Leading cases of the Swiss Federal Courts) Basler Kommentar (law commentary) ¨ berwachung des Post- und FernBundesgesetz betreffend die U meldeverkehrs (Swiss federal law on the monitoring of the correspondence by station and telecommunication) Bundesverfassung der Schweizer Eidgenossenschaft vom 18. April 1999 (Swiss Federal Constitution) Bankwesengesetz (Austrian Banking Act)

CC ...................... CCTV ................

Civil Code/Competition Commission Closed Circuit Television

BB ....................... BCRs .................. BDSG ................. BetrVG .............. BGB.................... BGBl................... BGE .................... BSK..................... ¨ PF.................. BU BV.......................

IX

Reemers Publishing Services GmbH O:/Beck/Spehl_Gruetzner/3d/List_of_Abbreviations.3d from 06.03.2013 09:22:17 3B2 9.1.580; Page size: 160.00mm  240.00mm

List of Abbreviations and Acronyms

CCZ.................... CEO.................... CFTC ................. CHF.................... CHSCT .............. CIPA .................. CIS...................... CLA.................... CLT .................... CNIL .................. CO ...................... Co. ...................... COB ................... Consob .............. D&O................... DB ...................... Decree 231........ DoJ ..................... DPA ................... DPA ................... DRdA................. DSAV.................

Corporate Compliance Zeitschrift (German law journal) Chief Executive Officer U.S Commodities Futures Trading Commission Schweizer Franken Comite´ d’hygie`ne, de se´curite´ et des conditions de travail (French committee on workplace health, hygiene, security and working conditions) Comissa˜o Interna de PrevenÅa˜o de Acidentes (internal committee for the prevention of accidents) Commonwealth of Independent States Collective Labor Agreement ConsolidaÅa˜o das Leis do Trabalho (consolidation of labour laws [Brasilian labour law]) Commission nationale de l’informatique et des liberte´s (French Administrative Authority for implementation and enforcement of data privacy laws) Code of Obligations company Commission des Ope´rations de Bourse (French Securities and Exchange Commission) Commissione Nazionale per la Societa` e la Borsa (Italian Securities and Exchange Commission)

DSG 2000.......... DSK .................... DTC ...................

Directors and Officers Der Betrieb (German law journal) Legislative Decree no. 231 of July 2001 U.S. Department of Justice Data Protection Act 1998 Data Protection Agencies Das Recht der Arbeit (Austrian law journal) Datenschutzangemessenheits-Verordnung (regulation concerning adequacy of data protection) Datenschutzgesetz (Austrian Act concerning data protection) Datenschutzkommission (Data Protection Commission) Disclosure and Transparency Rule

EC....................... ECHR................. EEA .................... EFI ...................... e.g. ...................... EIT Law............. et. seq................. et. seqq............... EU....................... EuGH.................

European Commission/European Community European Convention on Human Rights European Economic Area Employee fidelity insurance for example (exempli gratia) Electronic Information and Transaction Law and the following (et sequens) of sequential things and those which follow (et sequentia) European Union Europa¨ischer Gerichtshof (Court of Justice of the EU)

X

Reemers Publishing Services GmbH O:/Beck/Spehl_Gruetzner/3d/List_of_Abbreviations.3d from 06.03.2013 09:22:18 3B2 9.1.580; Page size: 160.00mm  240.00mm

List of Abbreviations and Acronyms

EuRAG/EIRAG

¨ ................... EVU EWCA ............... EWHC ............... FCPA ................. FIEs .................... FINMA .............. FINMASA......... FinStrG .............. FLL ..................... FLPDI ................ FMG................... fn. ...................... F.R.D. ................. FSA..................... FSMA................. GATS ................. GCG ................... GesbR................. GewO................. GmbH................ GPS..................... GWG..................

Bundesgesetz u¨ber den freien Dienstleistungsverkehr und die ¨ sterreich Niederlassung von europa¨ischen Rechtsanwa¨lten in O (Austrian law concerning free services and settlement of european lawyers practising in Austria) Europa¨isches Schuldvertragsu¨bereinkommen (European Convention on the law applicable to contractual obligations) Court of Appeal of England and Wales High Court of England and Wales Foreign Corrupt Practices Act Foreign-Invested Enterprises Eidgeno¨ssische Finanzmarktaufsicht (Swiss Financial Market Authority) Financial Market Supervisory Act Finanzstrafgesetz (Austrian Financial Criminal Law) Federal Labor Law Federal Law on Protection of Personal Data in Possession of Individuals Fernmeldegesetz (Swiss Telecommunications Act) footnote Federal Rules Decisions Financial Services Authority Financial Services and Markets Act 2000 General Agreement of Trade in Services Good Corporate Governance Gesellschaft bu¨rgerlichen Rechts (Partnership under the [German] Civil Code) Gewerbeordnung (Trade Regulation Act) Gesellschaft mit beschra¨nkter Haftung (company with limited liability) Global Positioning System Geldwa¨schegesetz (German Act on money laundering)/ Geldwa¨schereigesetz (Swiss Act on money laundering)

HR ......................

Human Resource

ICO..................... id......................... i.e. ....................... Inc. .................... infra.................... IP ........................ IRC ..................... ISVAP................

Information Commissioner’s Office the same person (idem) that is/in other words (id est) Incorporated see below Intellectual Property Industrial Relations Court Istituto di Vigilanza sulle assicurazioni private e di interesse collettivo (Italian Insurance Regulatory Authority) Information Technology

IT ........................

XI

Reemers Publishing Services GmbH O:/Beck/Spehl_Gruetzner/3d/List_of_Abbreviations.3d from 06.03.2013 09:22:19 3B2 9.1.580; Page size: 160.00mm  240.00mm

List of Abbreviations and Acronyms

KAKuG.............. KG ......................

Bundesgesetz u¨ber Krankenanstalten und Kuranstalten (Austrian law concerning hospitals and spas) Kommanditgesellschaft (Partnership limited by shares)

LAG.................... LR .......................

Landesarbeitsgericht (Regional Labour Court in Germany) Listing Rules

MAC .................. MedienG ........... MitwG................ MMR..................

Media Access Control Mediengesetz (Austrian Media Act) Mitwirkungsgesetz (Swiss Law on labour participation) Multimedia und Recht (German law journal)

NCPC................. NJOZ.................. NJW ................... no. ..................... NO......................

Nouveau Code de Proce´dure Civile (New Civil Procedure Code) Neue Juristische Online Zeitschrift (German law journal) Neue Juristische Wochenschrift (German law journal) number Notariatsordnung (Law concerning the notarial profession in Austria) Neue Zeitschrift fu¨r Arbeitsrecht (German law journal) Neue Zeitschrift fu¨r Gesellschaftsrecht (German law journal)

NZA ................... NZG ................... OAB ................... ¨ BA ................... O OBDK ................ OFAC................. OG...................... OGH .................. OHG .................. OLG ................... OR ...................... OSCE ................. OWiG ................

Ordem dos Advogados do Brasil (Brazilian Bar Association) Zeitschrift fu¨r das gesamte Bank- und Bo¨rsenwesen (Austrian law journal) Oberste Berufungs- und Disziplinarkommission (Highest Appeals and Disciplinary Comission in Austria) Office of Foreign Assets Control Offene Gesellschaft (specific kind of company in Austria) Oberster Gerichtshof (Austrian Supreme Court) Offene Handelsgesellschaft (general partnership in Austria and Germany) Oberlandesgericht (Higher Regional Court in Germany) Obligationsrecht (Swiss law on obligations) Organization for Security and Co-operation in Europe Gesetz u¨ber Ordnungswidrigkeiten (Law concerning administrative offences in Germany)

p./pp................... para./paras. ....... PatAnwG........... PC....................... PIPEDA............. POCA ................ PostG ................. PR ....................... PRC ....................

page/pages paragraph/paragraphs, margin number(s) Patentanwaltsgesetz (Law concerning patent attorneys) Penal Code Personal Information Protection and Electronic Documents Act Proceeds of Crime Act 2002 Postgesetz (German postal law) Public Relations People’s Republic of China

RAO ...................

Rechtsanwaltsordnung (Order concerning the lawyers’ profession in Austria)

XII

Reemers Publishing Services GmbH O:/Beck/Spehl_Gruetzner/3d/List_of_Abbreviations.3d from 06.03.2013 09:22:20 3B2 9.1.580; Page size: 160.00mm  240.00mm

List of Abbreviations and Acronyms

RdA .................... RdM ................... RdW................... RF ....................... RIPA .................. RIS ...................... RIW....................

Recht der Arbeit (German law journal) Recht der Medizin (German law journal) Das Recht der Wirtschaft (German law journal) Russian Federation Regulation of Investigatory Powers Act 2000 Regulatory Information Service Recht der Internationalen Wirtschaft (German law journal)

SCC .................... SEC..................... SFO..................... SISTRI................ SOCA................. SOX .................... StGB ................... StPO ................... StV...................... SUP .................... supra ..................

Standard contractual clauses Securities Exchange Commission Serious Fraud Office System of Control and Traceability of Waste Serious Organized Crime Agency Sarbanes Oxley Act Strafgesetzbuch (Penal Code in Austria, Germany and Switzerland) Strafprozessordnung (Penal Procedure Code in Austria, Germany and Switzerland) Strafverteidiger (German law journal) Supervision Manual see above

TCA.................... Three Pillars ..... TKG ................... TST.....................

Telecommunication Act Three Pillars of Partnership Telekommunikationsgesetz (Telecommunication Act) Tribunal Superior do Trabalho (Regional Labor Court)

UKHL ................ USAM................ U.S.C. ................. UWG .................

United Kingdom House of Lords United States Attorney’s Manual US. Code Gesetz gegen den unlauteren Wettbewerb (Act against unfair competition)

VAG................... VbVG.................

Versicherungsaufsichtsgesetz (German Insurance Supervision Law) Verbandsverantwortlichkeitsgesetz (Austrian law concerning the responsibilities of associations) Virtual Private Network Vermo¨genssteuergesetz (Law concerning wealth tax) Verwaltungsgerichtshof (Higher Regional Administrative Court)

VPN ................... VStG................... VwGH ............... WBS ................... WTBG ...............

Whistleblowing System Wirtschaftstreuhandberufsgesetz (Austrian Act on professions in the field of public accounting)

ZAS .................... ZGB.................... ZPO....................

Zeitschrift fu¨r Arbeits- und Sozialrecht (German law journal) Zivilgesetzbuch (Swiss civil code) Zivilprozessordnung (Civil Procedure Code in Austria, Germany and Switzerland) Ziviltechnikergesetz (Austrian Civil Engineers Act)

ZTG....................

XIII

Reemers Publishing Services GmbH O:/Beck/Spehl_Gruetzner/3d/List_of_Abbreviations.3d from 06.03.2013 09:22:20 3B2 9.1.580; Page size: 160.00mm  240.00mm

Reemers Publishing Services GmbH O:/Beck/Spehl_Gruetzner/3d/List_of_Contributors.3d from 06.03.2013 09:22:24 3B2 9.1.580; Page size: 160.00mm  240.00mm

List of Contributors (List in alphabetical order) v. Ancken, Camila: Trench, Rossi e Watanabe advogados, associated with Baker & McKenzie International, Av. Dr. Chucri Zaidan, 920 – 13º andar, Market Place Tower I, Sa˜o Paulo, SP, 04583-904, Brazil, Phone: +55 11 30486800, Email: [email protected] Charlot, David: Baker & McKenzie SCP, 1 rue Paul Baudry, 75008 Paris, France, Phone: +33 1 44175300, Email: [email protected] Dallais, Nade`ge: Baker & McKenzie SCP, 1 rue Paul Baudry, 75008 Paris, France, Phone: +33 1 44175300, Email: [email protected] De Guillebon, Cle´mentine: Baker & McKenzie SCP, 1 rue Paul Baudry, 75008 Paris, France, Phone: +33 1 44175300, Email: [email protected] Desoutter, Laetitia: Baker & McKenzie SCP, 1 rue Paul Baudry, 75008 Paris, France, Phone: +33 1 44175300, Email: [email protected] Di Garbo, Gianfranco: Baker & McKenzie, 3 Piazza Filippo Meda, 20121 Milan, Italy, Phone: +39 02 762311, Email: [email protected] Diaz, David: Baker & McKenzie Madrid S.L.P., Paseo de la Castellana 92, 28046 Madrid, Spain, Phone: +34 91 2304500, Email: [email protected] Flesch, Esther M.: Trench, Rossi e Watanabe advogados, associated with Baker & McKenzie International, Av. Dr. Chucri Zaidan, 920 – 13º andar, Market Place Tower I, Sa˜o Paulo, SP, 04583–904, Brazil, Phone: +55 11 30486800, Email: [email protected] Fonseca, Andre G.: Trench, Rossi e Watanabe advogados, Av. Dr. Chucri Zaidan, 920 – 13º andar, Market Place Tower I, Sa˜o Paulo, SP, 04583–904, Brazil, Phone: +55 11 30486800, Email: [email protected] Garfield, Henry: Baker & McKenzie LLP, 100 New Bridge Street, EC4V 6JA London, United Kingdom, Phone: +44 20 79191000, Email: [email protected] Gaudino, Francesca: Baker & McKenzie, 3 Piazza Filippo Meda, 20121 Milan, Italy, Phone: +39 02 762311, Email: [email protected] Godard, Fernando: Baker & McKenzie Abogados, S.C. Edificio Scotiabank ´ vila Camacho No. 1 – Piso 12, Me´xico, D.F. 11009, Me´xico, Inverlat, Blvd. M. A Phone: +52 55 5279 2954, Email: [email protected] Gon, Michelle: Baker & McKenzie LLP, Unit 1601, Jin Mao Tower, 88 Century Avenue, Pudong Shanghai, 200121, People’s Republic of China, Phone: +86 21 61058558, Email: [email protected] Gru¨tzner, Thomas: Baker & McKenzie, Theatinerstrasse 23, 80333 Munich, Germany, Phone: +49 89 552380, Email: [email protected] Heckh, Norman: Deloitte Abogados y Asesores Tributarios, Pza. Pablo Ruiz ~a, Phone: +34915820900, Email: Picasso, 1, Torre Picasso, 28020 Madrid, Espan [email protected]

XV

Reemers Publishing Services GmbH O:/Beck/Spehl_Gruetzner/3d/List_of_Contributors.3d from 06.03.2013 09:22:25 3B2 9.1.580; Page size: 160.00mm  240.00mm

List of Contributors

Hirdarisvita, Reno: Hadiputranto, Hadinoto & Partners, The Indonesia Stock Exchange Building Tower II, 21st Floor, Jalan Jend. Sudirman Kav 52–53, 12190 Jakarta, Indonesia, Phone: +62 21 5155090, Email: [email protected] Ibarra, Adriana: Baker & McKenzie Abogados, S.C. Edificio Scotiabank Inverlat, ´ vila Camacho No. 1 – Piso 12, Me´xico, D.F. 11009, Me´xico, Phone: Blvd. M. A +52 55 5279 2947, Email: [email protected] Kent, Robert: Baker & McKenzie LLP, 300 East Randolph Street, Suite 5000, 60601 IL, Chicago, USA, Phone: +1 312 8618000, Email: [email protected] Kobrin, Ekaterina: Baker & McKenzie – CIS, Limited, Sadovaya Plaza, 12th Floor, 7 Dolgorukovskaya Street, 127006 Moscow, Russia, Phone: +7 495 7872700, Email: [email protected] Krakow, Georg: Baker & McKenzie – Diwok Hermann Petsche Rechtsanwa¨lte GmbH, Schottenring 25, 1010 Vienna, Austria, Phone: +43 1 24250, Email: [email protected] Lebeau-Marianna, Denise: Baker & McKenzie SCP, 1 rue Paul Baudry, 75008 Paris, France, Phone: +33 1 44175300, Email: [email protected] Lima, Fabio C.: L.O. Baptista Schmidt Valois Miranda Ferreira Agel, Av. Paulista, 1294, 8º andar, Sa˜o Paulo, SP, 01310 – 100, Brazil, Phone: +55 11 31 47 0800, Email: [email protected] Livschitz, Mark: Baker & McKenzie Zurich, Holbeinstrasse 30, 8008 Zurich, Switzerland, Phone: +41 44 3841414, Email: [email protected] Ludlam, Joanna: Baker & McKenzie LLP, 100 New Bridge Street, EC4V 6JA London, United Kingdom, Phone: +44 20 79191000, Email: [email protected] Maeda, Bruno C.: Trench, Rossi e Watanabe advogados, associated with Baker & McKenzie International, Av. Dr. Chucri Zaidan, 920 – 13º andar, Market Place Tower I, Sa˜o Paulo, SP, 04583–904, Brazil, Phone: +55 11 30486800, Email: [email protected] Mancuso, Enrico Maria: Baker & McKenzie, 3 Piazza Filippo Meda, 20121 Milan, Italy, Phone: +39 02 762311, Email: [email protected] Masso´, Marı´a: Baker & McKenzie Madrid S.L.P., Paseo de la Castellana 92, 28046 Madrid, Spain, Phone: +34 91 2304500, Email: [email protected] Petsche, Alexander: Baker & McKenzie – Diwok Hermann Petsche Rechtsanwa¨lte GmbH, Schottenring 25, 1010 Vienna, Austria, Phone: +43 1 24250, Email: [email protected] Spehl, Stephan: Baker & McKenzie, Theatinerstrasse 23, 80333 Munich, Germany, Phone: +49 89 552380, Email: [email protected] Sukirno, Timur: Hadiputranto, Hadinoto & Partners, The Indonesia Stock Exchange Building Tower II, 21st Floor, Jalan Jend. Sudirman Kav 52–53, 12190 Jakarta, Indonesia, Phone: +62 21 5155090, Email: [email protected] Tomas, Jerome: Baker & McKenzie LLP, 300 East Randolph Street, Suite 5000, 60601 IL, Chicago, USA, Phone: +1 312 8618000, Email: jerome.tomas@baker mckenzie.com Vasile, Mila: Baker & McKenzie, 3 Piazza Filippo Meda, 20121 Milan, Italy, Phone: +39 02 762311, Email: [email protected]

XVI

Reemers Publishing Services GmbH O:/Beck/Spehl_Gruetzner/3d/List_of_Contributors.3d from 06.03.2013 09:22:25 3B2 9.1.580; Page size: 160.00mm  240.00mm

List of Contributors

Vizcarra, Reynaldo: Baker & McKenzie Abogados, S.C. Edificio Scotiabank ´ vila Camacho No. 1 – Piso 12, Me´xico, D.F. 11009, Me´xico, Inverlat, Blvd. M. A Phone: +52 55 5279 2908, Email: [email protected] Zheng, Ping: Baker & McKenzie LLP, Unit 1601, Jin Mao Tower, 88 Century Avenue, Pudong Shanghai, 200121, People’s Republic of China, Phone: +86 21 61058558, Email: [email protected]

Reemers Publishing Services GmbH O:/Beck/Spehl_Gruetzner/3d/List_of_Contributors.3d from 06.03.2013 09:22:25 3B2 9.1.580; Page size: 160.00mm  240.00mm

Reemers Publishing Services GmbH O:/Beck/Spehl_Gruetzner/3d/01_Austria.3d from 06.03.2013 09:23:26 3B2 9.1.580; Page size: 160.00mm  240.00mm

§ 1. Austria Para. A. Introduction . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 1 B. The 25 key questions in connection with internal investigations . . . . 4 I. Initiation of internal investigations . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 4 1. When and to what extent should internal investigations be initiated? . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 4 2. Should the internal investigations be of an open or covert nature? . 8 3. Is it advisable to involve external investigators? . . . . . . . . . . . . . . . . . . . . 10 4. Is it permitted that foreign attorneys conduct internal investigations in Austria? . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 14 5. When should national authorities be called in? . . . . . . . . . . . . . . . . . . . . . 15 II. Admissibility and implementation of individual measures within the scope of internal investigations . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 18 1. What measures are admissible within the scope of internal investigations? . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 18 a) § 16 ABGB – authority to exercise control and personal rights . . . 21 b) Individual protection under the Austrian Data Protection Act 2000 . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 29 c) Access to paper files and electronic files . . . . . . . . . . . . . . . . . . . . . . . . . 36 aa) Files and records . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 36 bb) Private files/data and records . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 38 d) Employee questionnaires . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 40 e) Employee interviews . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 44 f) Email screening . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 49 g) Monitoring the use of the Internet . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 56 h) Video surveillance of employees . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 59 i) Telephone surveillance at the workplace . . . . . . . . . . . . . . . . . . . . . . . . . 67 aa) Business-related telephone conversations – data surveillance 69 bb) Private telephone conversations . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 71 cc) Recording of and eavesdropping on conversations . . . . . . . . . . 72 j) Whistleblowing hotlines . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 74 2. Must employees‘ representatives such as the works council be involved in internal investigations? . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 77 a) Right to information . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 77 b) Right of consent . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 78 aa) Control measures . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 80 bb) Affecting human dignity . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 82 cc) Control measures requiring the works council’s consent . . . 84 dd) Employee interviews . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 85 ee) Telephone systems . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 89 ff) Video surveillance . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 90 gg) Email and internet . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 92 hh) Whistleblowing hotlines . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 97 c) Companies without a works council . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 100 3. Summary . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 101 III. Employee interviews . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 103 1. May an employee refuse to provide information if this information incriminates himself/herself? . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 103 2. Is an employee obliged to provide information on any misconduct of or criminal offence committed by other employees? . . . . . . . . . . . . . 107 3. May an employee refuse to answer a question if he/she has already answered it within the scope of a previous interview? . . . . . . . . . . . . . . . 111

Krakow/Petsche

Reemers Publishing Services GmbH O:/Beck/Spehl_Gruetzner/3d/01_Austria.3d from 06.03.2013 09:23:26 3B2 9.1.580; Page size: 160.00mm  240.00mm

2

§ 1. Austria Para. 4. Is an employee entitled to have a member of the works council or an attorney present during the interview? . . . . . . . . . . . . . . . . . . . . . . . . . . 112 a) Is an employee entitled to have of a member of the works council present during the interview? . . . . . . . . . . . . . . . . . . . . . . . . . . . . 112 b) Is an employee entitled to have an attorney present during the interview? . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 114 5. Is an employee entitled to read the record of his/her interview? . . . . 115 6. Is the employer entitled to request that the employee signs the record of the interview? . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 117 7. Can the employer instruct an employee to treat the content of his/ her interview as confidential? . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 120 IV. Sanctions imposed on employees . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 125 1. What are the sanctions under employment law that can be imposed on employees refusing to cooperate in internal investigations? . . . . . 125 a) Reasons for an employee’s duty to cooperate . . . . . . . . . . . . . . . . . . . . 125 aa) Obligation to work . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 126 bb) Duty of loyalty . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 130 b) Cutback in remuneration . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 138 aa) Disciplinary measure . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 139 bb) Withdrawal of remuneration as a disciplinary measure . . . . . 143 c) Warning . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 146 d) Termination of the employment relationship . . . . . . . . . . . . . . . . . . . . 148 aa) Introduction . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 148 bb) Disloyalty . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 152 cc) Lack of trustworthiness . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 155 2. Is the suspicion of a criminal offence or a severe violation of duty sufficient for an extraordinary dismissal? . . . . . . . . . . . . . . . . . . . . . . . . . . . 159 3. During which period of time must an extraordinary notice of dismissal be given to employees whose misconduct has been revealed by the internal investigations? . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 163 4. Must an employee cooperate in an internal investigation even after he/she has been given notice of dismissal? . . . . . . . . . . . . . . . . . . . . . . . . . . 168 V. Use of the obtained information . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 178 1. Is it permissible to disclose the findings and information obtained within the scope of any internal investigation to other group companies? . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 178 a) Definitions . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 178 aa) Controller . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 179 bb) Data subject . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 180 cc) Personal data . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 181 dd) Sensitive data . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 183 ee) Non-sensitive data with increased protection . . . . . . . . . . . . . . . 184 ff) Use of data . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 185 b) Transmission of data to group companies in Austria . . . . . . . . . . . . 186 aa) Controller’s registered office located in Austria . . . . . . . . . . . . . 186 bb) Controller’s registered office located in a member state of the EC . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 187 cc) Permissibility of the transmission of data . . . . . . . . . . . . . . . . . . . 189 dd) Summary . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 196 c) Transmission of data to group companies in Europe and to countries with “adequate” data protection . . . . . . . . . . . . . . . . . . . . . . . 199 d) Transmission of data to group companies outside Europe . . . . . . 202 2. Is it obligatory, permissible and advisable to forward the findings and information obtained within the scope of any internal investigations to public authorities? . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 210 a) Obligation to transmit personal data to public authorities . . . . . . . 210 b) Is it advisable to voluntarily disclose data to public authorities? . . 215

Krakow/Petsche

Reemers Publishing Services GmbH O:/Beck/Spehl_Gruetzner/3d/01_Austria.3d from 06.03.2013 09:23:26 3B2 9.1.580; Page size: 160.00mm  240.00mm

§ 1. Austria

3

Para. 3. Are the findings made in the scope of internal investigations subject to the attorney-client privilege? . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 217 a) No right to refuse to give evidence of in-house counsels who are involved in internal investigations . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 217 b) The right to refuse to give evidence of external advisers . . . . . . . . . 219 4. Does the attorney client privilege also apply to foreign attorneys? . . . 223 VI. Following-up on internal investigations . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 227 1. What is to be observed during the follow-up of internal investigations? . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 227 2. May an employer pay its employee’s legal fee if he/she is being prosecuted under criminal law? . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 231 VII. Miscellaneous . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 233 1. Costs of the control measure . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 233 2. Use of illegally obtained evidence in legal proceedings . . . . . . . . . . . . . 235 C. Summary of key results . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . Bibliography: Apathy, Besprechung zu OGH 30.3.1982, 4 Ob 98/81, DRdA 1984, 10; Beck-Mannagetta, Besprechung zu OGH 20.11.1991, DRdA 1992, 289; Blum, Videou¨berwachung im Betrieb, infas 2006, 121; Brodil, Die Registrierung von Vermittlungsdaten im Arbeitsverha¨ltnis, ZAS 2004, 4; Brodil, Die Kontrolle der Nutzung neuer Medien im Arbeitsverha¨ltnis – Kontrollbefugnisse des Arbeitgebers zwischen Datenschutz und Perso¨nlichkeitsrechten, ZAS 2004, 28; Brodil, Kontrolle und Datenschutz im Arbeitsrecht, ZAS 2009, 21; Brodil, OGH 25.10.2001, 8 Ob A 218/01 v, ZAS 2002, 16; Dellisch, Private Email- und Internetnutzung am Arbeitsplatz, ASoK, 2001, 316; Dittrich/Tades, Arbeitsrecht (2008); Dusak, Die arbeitsrechtliche Relevanz außerdienstlichen Verhaltens, RdW 1988, 355; Eichmeyer, Internetsucht am Arbeitsplatz und rechtliche Mo¨glichkeiten des Arbeitgebers, RdW 2009, 41; Fasching, Zivilprozessordnung1, III (1966); Fasching/Konecny, Kommentar zu den Zivilprozessgesetzen (2011); Feil/Wennig, Anwaltsrecht, 3rd ed. (2004); Fenyves, Besprechung zu OGH 25.9.1979, 4 Ob 78/79, DRdA 1981, 299; Firlei, Besprechung zu OGH 18.12.1979, 4 Ob 123/79, DRdA 1980, 395; Freudhofmeier, Aspekte der Privatnutzung des Internet durch den Arbeitnehmer, taxlex 2006, 41; Fuchs/Ratz, Wiener Kommentar zur Strafprozessordnung (2009); Gerhartl, Datenschutz im Arbeitsrecht, ASoK 2008, 147; Gerhartl, Zur Zula¨ssigkeit der Arbeitnehmerbeurteilung, Reichweite der Mitwirkung des Betriebsrates, ASoK 2009; Goricnik, OGH 12.7.2006, 9 Ob A 129/05 v, RdA 2007, ¨ berblick (2004); Griehser, Das Unternehmensstrafrecht in der Praxis 35; Graf, Datenschutzrecht im U mit Hinblick auf das Vergabe- und Arbeitsrecht, RdW 2007, 12; Grillberger, Kommentar zu OGH 25.9.1984, 4 Ob 83/83, ZAS 1986, 49; Hagen, Besprechung zu OGH 6.9.1977, 4 Ob 97/77, DRdA ¨ berwachung und Datenschutz im Arbeitsverha¨ltnis, infas 2009, 139; Herz, Zur 1978, 139; Heilegger, U Verschwiegenheitspflicht des ausla¨ndischen Rechtsanwaltes, AnwBl. 1962, 68; Hiele, OGH 13.6.2002, 8 Ob A 288/01 p, wbl 2002/353; Jabornegg/Resch/Strasser, Arbeitsrecht (2002); Jud, Rechtsberatung durch Wirtschaftstreuha¨nder und mo¨gliche Haftungsfolgen, AnwBl 2008, 433; Kittelberger, External ¨ BA 2007, 90; Kneihs, Betriebliches Disziplinarrecht und Reporting als Pflicht zum Whistleblowing?, O Verfassung, RdA 2005, 136; Knyrim, Datenschutzrecht (2003); Knyrim/Bartlma¨, Big Brother im Unternehmen. Datenanwendungen, ihre Rechtsprobleme und deren Lo¨sung, ecolex 2007, 740; Knyrim/Kurz/Haidinger, Whistleblowing-Hotlines: Mitarbeiter “verpfeifen” zula¨ssig?, ARD 5681/5/ ¨ berwachung der Internet-Kommunikation am Arbeitsplatz. Ein Diskus2006; Kotschy/Reimer, Die U sionsbeitrag aus datenschutzrechtlicher Sicht, ZAS 2004, 29; Kuderna, Das Entlassungsrecht (1994); Ku¨rner, Besprechung zu OGH 28.10.1994, 9 Ob A 192/94, ZAS 1996, 21; Lachmann, Verschwiegenheitspflicht/-recht von Psychotherapeuten sowie rechtsberatender Berufe, AnwBl. 2002, 421; Laimer/ Mayr, Rechtsprobleme bei der Internetnutzung am Arbeitsplatz, ecolex 2003, 113; Laimer/Mayr, Zum Spannungsverha¨ltnis von Arbeitgeber- und Arbeitnehmerinteressen rund um die EDV-Nutzung, RdA 2003, 410; Leissler, Und die Daten fließen u¨ber den Atlantik …, ecolex 2007, 747; Leissler, “Whistleblowing” in sterreich – die ersten Schritte …, ecolex 2009, 361; Lçschnigg, Arbeitsrecht, 10th ed. (2003); Lçschnigg, Datenermittlung im Arbeitsverhltnis (2009); Lçschnigg, Datenschutz und Kontrolle im Arbeitsrecht, DRdA 2006, 459; Mayer-Schçnberger/Brandl, Datenschutzgesetz 2000 (1999); Mayr, OGH 23.11.2006, 8 Ob A 69/06 i, RdA 2008, 14; Mazal/Risak, Das Arbeitsrecht – System und Praxiskommentar (2008); Mengel, Compliance und Arbeitsrecht (2009); Nowotny, Ist das Aufzeichnen eines geschftlichen Telefonates verboten?, RdW 1989, 214; Obereder, Email- und Internetnutzung aus arbeitsrechtlicher Sicht, RdA 2001, 75; Pfarl, Gefunden! LBS im Mobilfunknetz-

Krakow/Petsche

Reemers Publishing Services GmbH O:/Beck/Spehl_Gruetzner/3d/01_Austria.3d from 06.03.2013 09:23:27 3B2 9.1.580; Page size: 160.00mm  240.00mm

§ 1. Austria

4

bereich, ecolex 2005, 569; Rabanser, Interessensabwgung beim Fragerecht des Arbeitgebers, ecolex 1993, 179; Rauch, Der Detektiv im Arbeitsrecht. Kosten des Detektivs sind im Wege des Schadenersatzes vom Arbeitnehmer zu ersetzen, ASoK 2001, 111; Rauch, Zur privaten Nutzung des PC und des Telefons im Arbeitsverhltnis, ASoK 2007, 169; Reis, Zur Zulssigkeit von Whistleblowing-Hotlines, RdW 2009, 396; Riesenkampff, Die arbeitsrechtliche Zulssigkeit der Installation von Videokameras in Ladenlokalen, ecolex 2007, 743; Risak, Besprechung zu OGH 29.8.1996, 8 Ob A 2113/96 k, ZAS 1997, 81; Risak, Die Suspendierung von rzten, RdM 2006, 174; Rummel, Kommentar zum Allgemeinen Brgerlichen Gesetzbuch (2002); Sacherer, Internet am Arbeitsplatz als zustimmungspflichtige Kontrollmaßnahme?, RdW 2005, 714; Schrank, Anmerkung zu OGH 25.9.1979, 4 Ob 78/ 79, ZAS 1981, 100; Schuiff, Grenzen und Zulssigkeit der berwachung von Arbeitnehmern am Arbeitsplatz, MeDV 2006, 100; Schur, Die anwaltliche Verschwiegenheitspflicht in der çsterreichischen Rechtsordnung, AnwBl. 2009/257; Sonntag, Die vorzeitige Auflçsung aus wichtigem Grund im Lichte der Judikatur, ZAS 2008, 9; Strasser, Besprechung zu OGH 28.10.1994, 9 Ob A 192/94, DRdA 1995, 309; Strigl, Besprechung zu OBDK 14.10.1991, Bkd 92/89, AnwBl. 1993/4477; Strigl, Besprechung zu OBDK 24.1.1994, Bkd 65/90, AnwBl. 1994/4831; Thiele, Einfhrung eines elektronischen Telefonkontrollsystems, wbl 2002/353; Thiele, Internet am Arbeitsplatz. Erste arbeitsrechtliche Konfliktflle, ecolex 2001, 613; Thiele, OGH 13.6.2002, 8 Ob A 288/01 p, wbl 2002/353, 518; Tomandl, Rechtsprobleme bei der Einfhrung und Anwendung von Kontrollmaßnahmen, ZAS 1982, 163; Tomandl, Kommentar OGH 29.1.1974, 4 Ob 104/73, ZAS 1974, 181; Walter/Mayer/KucskoStadlmayer, Bundesverfassungsrecht, 10th ed. (2007).

A. Introduction Over the past years, various cases have become public where criminal activities were detected within renowned and well-established companies. In some cases, the management itself was aware of these activities, while in other cases, violations of the law occurred within the company because employees were not controlled appropriately. From a public perception, it is almost irrelevant whether the criminal actions were performed by the management itself or by the employees. This is because the resulting damage to the company’s reputation was and remains enormous and will be remembered for years. Internal investigations are indispensable to avoid such damage right from the beginning and to remove any serious deficiencies within the group before they become public. 2 For years, internal investigations conducted by and within companies have been a popular and much-used instrument of U.S. companies‘ management to uncover violations of law committed by managers and employees alike. In the strict sense, an investigation is an inquiry within a company intended to clarify breaches of duties by the management; with accounting, supervisory and insider law issues usually being the subject matter of the inquiry.1 In the broader sense, investigations can serve to inquire into systematic or individual misconduct of executives. Such investigations are often carried out by law firms because they are familiar with the legal framework of the investigation and able to evaluate the determined facts and circumstances from a legal perspective. In addition, the company is protected by the confidentiality obligation to which the attorneys are subject.2 3 Determining the relevant facts and circumstances is the most important part of an investigation which, in typical cases of breaches of duties under accounting and supervisory law, requires the detection of structural deficiencies that have existed 1

1 2

Mengel, Compliance und Arbeitsrecht, 110. Id. at 110.

Krakow/Petsche

Reemers Publishing Services GmbH O:/Beck/Spehl_Gruetzner/3d/01_Austria.3d from 06.03.2013 09:23:27 3B2 9.1.580; Page size: 160.00mm  240.00mm

B. The 25 key questions in connection with internal investigations

5

for years. The structuring, handling and evaluation of such masses of facts requires specific know-how and special preparation efforts in each phase. In particular, corporate, accounting and professional law aspects must be considered if internal investigations are conducted by external advisors. An investigation will also raise individual or collective employment law issues.3 The following deals with the 25 most frequently asked questions in the context of internal investigations.

B. The 25 key questions in connection with internal investigations I. Initiation of internal investigations 1. When and to what extent should internal investigations be initiated? The main purpose of conducting internal investigations is to uncover serious deficiencies within the company or criminal actions in order to avoid any (further) damage and reduce the damage already incurred. Misconduct by either the management itself or by employees that eventually becomes public will consequentially harm the reputation of the respective company. By initiating or conducting internal investigations, the company can demonstrate not only internally but also vis-a`-vis third parties that it does not tolerate any misconduct. Depending on where criminal actions or serious deficiencies are suspected, internal investigations may be conducted with respect to individual departments, individual persons, or the entire company. Moreover, internal investigations should be conducted with the necessary persistence and seriousness as well as with appropriate partners, to prevent national investigative authorities, who might conduct investigations at a later point in time, from uncovering actions that qualify as criminal offences and thus create the impression that the company’s management was involved in these activities.

4

5

6

7

2. Should the internal investigations be of an open or covert nature? The decision on how internal investigations should be conducted depends on 8 which employee or which group of employees is suspected of having committed criminal acts. In the case of acts relating to theft, corruption, bribery and similar offences, the internal investigations should initially be conducted in a covert manner to prevent suspects from destroying evidence beforehand or taking cover-up actions. In case of deficiencies relating to the safety of the employees in the broadest 9 sense, internal investigations should be of an open nature in order to demonstrate within the company that safety will be ensured. 3. Is it advisable to involve external investigators? The involvement of external investigators depends on the circumstances of the 10 individual case, the suspects, and the potential violation of law.

3

Id. at 111.

Krakow/Petsche

Reemers Publishing Services GmbH O:/Beck/Spehl_Gruetzner/3d/01_Austria.3d from 06.03.2013 09:23:27 3B2 9.1.580; Page size: 160.00mm  240.00mm

§ 1. Austria

6

A main argument in favor of having internal investigations conducted by, for instance, the legal department is the lower costs. Moreover, such internal investigators are familiar with the company’s procedures and generally know most of the employees, and may therefore enjoy a higher degree of trust. 12 In most cases, however, internal investigators do not have the necessary qualification or know-how to conduct such investigations. In addition, most external investigators have a right to refuse to give evidence (Zeugnisverweigerungsrecht) in any subsequent legal proceedings. They are not obliged to disclose client-related information. Moreover, most external investigators are subject to a confidentiality obligation as a result of which they may not disclose to third parties the serious deficiencies uncovered in the course of the internal investigations (this topic will be dealt with below). It can also be assumed that investigations conducted by external investigators are more credible to the public. 13 Accordingly, external investigators should always be involved if managing directors or members of the management are under suspicion. 11

4. Is it permitted that foreign attorneys conduct internal investigations in Austria? 14

Foreign attorneys may conduct internal investigations in Austria. Pursuant to § 8 (2) Austrian Bar Act (Rechtsanwaltsordnung – “RAO”), attorneys reserve the exclusive right to the professional representation of a party (berufsma¨ßige Parteienvertretung). The measures required for conducting internal investigations do not qualify as a professional representation of a party within the meaning of the RAO. Accordingly, foreign attorneys do not have to be admitted to the Austrian Bar to conduct internal investigations.4 5. When should national authorities be called in?

The question of when national investigative authorities should be involved in internal investigations cannot be answered on the basis of legal considerations. Instead, the respective management will make this decision at its own discretion. 16 An involvement of national investigative authorities at a very early stage has the advantage of conveying the impression that the concerned company is interested in a comprehensive and thorough investigation of any criminal actions within the company. 17 However, in the event that investigations conducted by national investigative authorities should not reveal anything, a great stir is caused for nothing, in particular for companies on the public scene. Owing to these considerations, an internal investigation should be conducted before involving national investigative authorities. As soon as sufficient indications for potential violations of law have been revealed, the national investigative authorities should be involved. 15

4

Feil/Wennig, 54 et seqq.

Krakow/Petsche

Reemers Publishing Services GmbH O:/Beck/Spehl_Gruetzner/3d/01_Austria.3d from 06.03.2013 09:23:28 3B2 9.1.580; Page size: 160.00mm  240.00mm

B. The 25 key questions in connection with internal investigations

7

II. Admissibility and implementation of individual measures within the scope of internal investigations 1. What measures are admissible within the scope of internal investigations? Protection of information or secrets and the prevention of corruption or the 18 detection of other criminal activities within the company have always been an issue in the context of employment contracts. Due to the basic structure of the employment contract alone, this issue entails many problems because of the legal nature of the personal dependency of the employee – an essential characteristic of a genuine employment contract (echter Arbeitsvertrag).5 Apart from the employee’s personal obligation to work, the essential characte- 19 ristics of the employee’s personal dependency consist of the employee being subject to instructions both on a factual and on a personal level, the integration into the company’s internal hierarchy, the economic dependency, the employee being subject to control as well as the related disciplinary responsibility. This comprehensive possibility of external control enables the employer to orga- 20 nize its typically structured production processes in a sufficiently efficient manner, while, at the same time, the employer’s organizational discretion also includes a comprehensive authority to exercise control over its employees.6 However, the exact boundaries between this subjection to control and the employees’ privacy are very unclear. a) § 16 ABGB – authority to exercise control and personal rights aa) In addition, during the time in which a person is obliged to work within the 21 scope of an employment relationship, such a person has a right inter alia, to, the integrity of his/her intimate sphere, freedom from unauthorized imaging, and respect for his/her value as a human being. The intensity and/or admissibility of control measures are primarily governed by the personal rights set forth in § 16 Austrian Civil Code (Allgemeines Bu¨rgerliches Gesetzbuch – “ABGB”). The obligation to respect an employee’s privacy must also be considered a central part of an employer’s duty of care.7 In connection with the implementation of internal investigations and the related introduction of control measures, the employer’s interests in collecting information are in conflict with the employee’s personal rights, which are entitled to protection. bb) Control alone does not violate an employee’s personal right, because – as stated 22 above – the fact that an employee subjects himself/herself to the employer’s control is an essential characteristic of the employment relationship.8 Even if the control exercised does not affect the personal rights of an employee, 23 personal rights can still be affected in particular if the intensity of the control exceeds the scope necessary to achieve the respective purpose. Thus, the intensity of 5

Tomandl, Wesensmerkmale des Arbeitsvertrages, 68 et seqq. Brodil, Kontrolle und Datenschutz im Arbeitsrecht, ZAS 2009, 121 et seq. 7 Krejci, in: Rummel, ABGB, (3rd ed.), § 1157. 8 OGH 13.6.2002, 8 Ob A 288/01 p. 6

Krakow/Petsche

Reemers Publishing Services GmbH O:/Beck/Spehl_Gruetzner/3d/01_Austria.3d from 06.03.2013 09:23:28 3B2 9.1.580; Page size: 160.00mm  240.00mm

§ 1. Austria

8

the control is relevant, whereby the determining factors are the type, the duration, the scope of control, and the collected data. If the control is disproportionately intense and exceeds the extent as is typical and necessary for employment relationships of this kind,9 the personal rights of the employee are affected. Accordingly, when evaluating the respective control measure, it is necessary to clarify whether the personal rights of the employees are affected by the implementation/action/ measure in question in any way or whether they are not affected at all. 24 If the control measure introduced does not affect an employee’s personal rights at all, it is permitted. In this context, a comprehensive consideration of the interests of all parties must take place.10 The interests of the employer, who has a general right to control the employee within the scope of the employment relationship and who wants to protect and safeguard its property, must be balanced against the interests of the employee in safeguarding his/her personal rights.11 25 The principle of proportionality has a regulatory function to the effect that personal rights may only be restricted to the extent necessary due to a legitimate control interest of the employer. The employer must choose the least drastic control measure which can still deliver the desired result.12 Accordingly, a determination of the admissibility of control measures taken in the course of internal investigations must always include a proportionality assessment. 26 The employee’s personal rights worth protecting will be balanced against the employer’s interests in obtaining information and exercising control. The fundamental right to respect the private and family life as set forth in Article 8 of the European Convention on Human Rights (“ECHR”), as well as the fundamental right to the protection of personal data are relevant in this context.13 Between legal persons governed by private law, personal rights have either a direct effect under § 1 Austrian Data Protection Act (Datenschutzgesetz – “DSG 2000”) or an indirect third-party effect under § 16 ABGB.14 The comprehensive obligation to respect the employee’s privacy must also be considered a central part of the employer’s duty of care.15 Accordingly, data protection must be considered a part of the employee’s privacy, protected by the employer’s duty of care within the scope of the employment relationship and by § 16 ABGB. The protection granted under the DSG 2000 is part of the protection of personal rights within the scope of the employment relationship (see next section). 27 cc) The assessment of interests is carried out exclusively on the basis of objective

criteria which apply in particular to the definition of the employer’s interests. It must be evaluated if, under objective criteria, and in consideration of the specific prospective or agreed employment contract, the employer needs the information to be disclosed in order to reasonably execute its contractual rights. Such a collection of information or such control is only possible in those cases in which the employer’s identifiable interest in the information outweighs the employee’s interests 9

OGH 20.12.2006, 9 Ob A 109/06 d. OGH 20.12.2006, 9 Ob A 109/06 d. 11 Brodil, Die Kontrolle der Nutzung neuer Medien im Arbeitsverha ¨ltnis, ZAS 2004, 156, 158. 12 OGH 20.12.2006, 9 Ob A 109/06 d. 13 § 1 DSG 2000. 14 Aicher, in: Rummel, ABGB (3rd ed.), § 16. 15 OGH 25.10.2001, 8 Ob A 218/01 v, ZAS 2002, 16 (Brodil). 10

Krakow/Petsche

Reemers Publishing Services GmbH O:/Beck/Spehl_Gruetzner/3d/01_Austria.3d from 06.03.2013 09:23:28 3B2 9.1.580; Page size: 160.00mm  240.00mm

B. The 25 key questions in connection with internal investigations

9

worth protecting. Even if this is the case, however, the employer must not encroach upon the employee’s personal rights in a random and arbitrary manner. Instead, the control must be exercised in accordance with the principle of proportionality, which means that the employer may only take proportionate measures, i. e. the least drastic measures with the least possible interference, to collect information.16 dd) In addition, the works council’s rights to information and co-determination, in 28 particular the required co-determination when introducing control measures affecting human dignity, must be observed pursuant to § 96 (1) no. 3 Labour Constitution Act (Arbeitsverfassungsgesetz – “ArbVG”) (section 2). b) Individual protection under the Austrian Data Protection Act 2000 aa) Personal data within the meaning of the legal definition in § 4 no. 1 DSG 2000, or 29 information relating to data subjects who are identified or identifiable, are collected by means of intended control measures, e.g., detailed logging of Internet access. The Data Protection Act 2000, which is applicable to employment relationships, is based on the requirements under Community Law set forth in the Data Protection Directive 95/46/ EC.17 Owing to its comprehensive scope of protection, the DSG 2000, is to be applied to any and all use of information within the scope of an employment relationship whereas data protection has always been a part of the protection of the employee’s privacy within the employment relationship under the employer’s duty of care and § 16 ABGB (see previous section). Accordingly, the protection granted under the DSG 2000 is rather extensive, but nevertheless still a part of the protection of personal rights within the scope of the employment relationship.18 bb) First, reference has to be made to a basic principle of the use of data, namely 30 the principle of fair use (§§ 6 and 7 DSG 2000). The entire scope of the DSG is restrictive and comprehensively protects the interests of those whose data are being used. This fair use of data includes the obligation of a controller or user of the data to use the data only for clear and legitimate purposes or to inform the data subject in accordance with § 24 DSG 2000. cc) Each and every use of personal data – unless it relates to generally available or 31 indirect personal data – constitutes an interference with the fundamental right to data protection and is only admissible if – the consent of all data subjects has been obtained, or – the use is of vital interest to a data subject, or – the use is necessary due to an overriding legitimate interest of another person. If one of these requirements is fulfilled, the use of the data is admissible, however only to the extent that it is proportionate in relation to the purpose of the use,

16

Brodil, Kontrolle und Datenschutz im Arbeitsrecht, ZAS 2009, 122 et seq. Directive 95/46/EC of the European Parliament and of the Council of 24 October 1995 on the protection of individuals with regard to the processing of personal data and on the free movement of such data, OJ L 1995/281, 31. 18 Brodil, Kontrolle und Datenschutz im Arbeitsrecht, ZAS 2009, 122 et seqq. 17

Krakow/Petsche

Reemers Publishing Services GmbH O:/Beck/Spehl_Gruetzner/3d/01_Austria.3d from 06.03.2013 09:23:29 3B2 9.1.580; Page size: 160.00mm  240.00mm

§ 1. Austria

10

and provided that the least drastic measure which renders the desired result is to be applied.19 32 dd) § 24 DSG 2000 requires the data subject to be informed in all cases of an

admissible use of data since the data subject must be in a position to learn of the existence of a data processing operation and, where data is collected from a data subject, he/she must be given full and accurate information on the circumstances of the collection.20 33 This duty to provide information always exists irrespective of applicable labour constitutional laws. Employees must therefore, be informed of potential and performed controls with regard to the company’s internet access. In case of internet use, a screening of the traffic data is always admissible from a data protection law perspective, i. e. also in the case of private use. The principles of fair use are not deemed violated in case of a use of data, if the employee is aware of this use of data and can adjust his/her work-related and private behaviour to it.21 Claims under data protection law, however, can only be asserted by the individual employee concerned; the works council is not entitled to assert such claims on behalf of employees.22 34 In summary, it must be stated that within the scope of § 16 ABGB as well as in the DSG 2000, the principle of proportionality must be observed. In addition to the comprehensive notification and information obligation, the balance of the interests of all parties is also one of the components of the principle of fair use of data in accordance with the DSG 2000.23 35 The following constitutes an overview of the individual measures that may be taken in the course of internal investigations in consideration of the above statements. c) Access to paper files and electronic files aa) Files and records Within the scope of internal investigations, a large-scale access to files and other records of the employer kept by the employee is necessary for a determination of facts. These records are business-related documents for the employee and not private or personal documents. The employer’s access right is not to be balanced against the employee’s personal rights in such a case. Such control measures correspond with the lawful performance of the employment contract. The exercised control, however, must pass a proportionality assessment, i. e. the employer may only take the least drastic measure with the least possible interference to collect information.24 37 The same would also apply to files and records in electronic form owned by the employer, because these files and records are also business-related documents. The material form of the documents is irrelevant to their qualification as businessrelated documents.25 36

19

Kotschy/Reimar, ZAS 2004, 29. Brodil, Die Kontrolle der Nutzung neuer Medien im Arbeitsverha¨ltnis, ZAS 2004, 28. 21 Brodil, Kontrolle und Datenschutz im Arbeitsrecht, ZAS 2009, 125 et seq. 22 OGH 29.6.2006, 6 Ob A 1/06 z. 23 Brodil, Die Registrierung von Vermittlungsdaten im Arbeitsverha ¨ltnis, ZAS 2004, 4. 24 Brodil, Kontrolle und Datenschutz im Arbeitsrecht, ZAS 2009, 122 et seq. 25 OGH 25.10.2001, 8 Ob A 218/01 v, ZAS 2002, 16 (Brodil). 20

Krakow/Petsche

Reemers Publishing Services GmbH O:/Beck/Spehl_Gruetzner/3d/01_Austria.3d from 06.03.2013 09:23:29 3B2 9.1.580; Page size: 160.00mm  240.00mm

B. The 25 key questions in connection with internal investigations

11

bb) Private files/data and records Access is excluded in those cases in which there is no factual relationship to the 38 work owed under the employment contract in the broadest sense or no legitimate control interest. Therefore, access to private data/files/information is generally not permitted from the perspective of protection of personal rights. The same generally applies to the content of private briefcases and other cases used for private files, correspondence and other documents brought along.26 In this context, however, there are exceptions which must be evaluated in the individual case and after having carried out a proportionality assessment. For example, in the case of a reasonable suspicion that an employee committed a 39 criminal offence, the employer’s interest will be predominant and the employer will be entitled to inspect these documents, as well.27 d) Employee questionnaires The use of employee questionnaires constitutes another measure to collect information in the course of internal investigations. Employee questionnaires are documents that contain questions relating to the employee and which must be answered by the employee.28 Employee questionnaires containing only general personal information (e.g. date of birth, first name and last name, home address, marital status, school education, previous job(s), professional education) are always admissible and do not depend on the consent of the respective employee or, if applicable, the necessary co-determination of the works council. Employee questionnaires that contain more than just general personal information are so-called qualified questionnaires (personality, intelligence and aptitude tests, questions relating to the cooperation of employees, workload, and optimization of the deployment of employees).29 Such qualified questionnaires have the purpose of providing the employer with information on personal circumstances or opinions of an individual employee, which this employee might normally want to keep secret.30 The introduction of qualified questionnaires is subject to the necessary co-determination of the works council.31 The questions asked in the course of the introduction and use of qualified questionnaires must in turn pass a proportionality assessment. This is because qualified questionnaires are, notwithstanding the works council’s consent, not permitted if they violate the employee’s personal rights or intimate sphere.32 Questions relating to an existing pregnancy or family planning are generally inadmissible.33 Questions relating to the membership in associations such as political parties, labour unions or religious communities will also usually be difficult to justify and would fail the required proportionality assessment. Questions relating to 26

Brodil, Die Kontrolle der Nutzung neuer Medien im Arbeitsverha¨ltnis, ZAS 2004, 28. Brodil, Kontrolle und Datenschutz im Arbeitsrecht, ZAS 2009, 124. 28 Lo ¨ schnigg, Arbeitsrecht, 705. 29 Lo ¨ schnigg, Datenermittlung im Arbeitsverha¨ltnis, 226. 30 OGH 15.12.2004, 9 Ob A 114/04 m. 31 § 96 (1) no. 2 ArbVG. 32 Lo ¨ schnigg, Arbeitsrecht, 705. 33 EuGH 4.10.2001, Rs C-109/00, Tele Danmark. 27

Krakow/Petsche

40

41

42

43

Reemers Publishing Services GmbH O:/Beck/Spehl_Gruetzner/3d/01_Austria.3d from 06.03.2013 09:23:29 3B2 9.1.580; Page size: 160.00mm  240.00mm

12

§ 1. Austria

previous criminal sentences served34 are likewise inadmissible as are questions regarding the employee’s financial situation.35 e) Employee interviews 44

45

46

47

48

Employee interviews are one of the most efficient measures within the scope of the internal investigation process to reveal potential deficiencies or violations of law. A personal conversation with an employee is essential to evaluate his/her credibility and to obtain an overall impression of the employee. First, it must be clarified whether and to what extent the employees are subject to an obligation to report and provide information within the scope of employee interviews. Applicable law does not provide for a general obligation of the employee to report or provide information. To the extent that answering questions is necessary for instructions relating to the performance of work based therein, this constitutes a specification of the obligation to work. In such a case, the obligation to answer the questions is directly based on the employment contract. With regard to admissible questions that do not primarily relate to the performance of work, reference is to be made to the employee’s duty of loyalty (Treuepflicht).36 An employee’s loyalty duties cannot be defined conclusively. The position in the company determines the type and scope of the duty of loyalty, because it must be assumed that the more qualified an employee’s position is, the more extensive his/her insider knowledge is.37 An obligation of an employee to take a positive action resulting from his/her duty of loyalty must be acknowledged if it is about warning the employer against imminent damage or contributing to the removal of occurred damage.38 In compliance with this duty of loyalty, an employee is obliged to answer questions that are asked in the course of the interview, in order to reveal deficiencies or detect criminal activities within the company of which the employee became aware of and which may harm or have already harmed the employer. As mentioned, in connection with the employee questionnaires, however, questions asked by the employer must not violate the employee’s personal rights: in particular his/her intimate sphere. If an employee’s personal rights are merely affected, a proportionality assessment must be carried out. In case of suspected criminal offences, the outcome of this proportionality assessment will be in favour of the employer, and the employee as a result will be obliged to answer even those questions that are not exclusively related to his/her job and work performance. f) Email screening

49

Communication by email and the use of the internet have strongly increased over the years. Today, almost all companies have accelerated the transfer of information by using electronic mail, are present online, or at least have access to the internet. Besides the professional advantages, internet and email are also interesting to the employee for private use, e.g. for private research on the internet, correspondence 34

Gerhartl, Fragerecht im Bewerbungsgespra¨ch, PVInfo 2008 H 12, 38. Lo¨schnigg, Arbeitsrecht, 705. 36 Lo ¨ schnigg, Datenermittlung im Arbeitsverha¨ltnis, 113. 37 Lo ¨ schnigg, Arbeitsrecht, 256. 38 Id. at 257. 35

Krakow/Petsche

Reemers Publishing Services GmbH O:/Beck/Spehl_Gruetzner/3d/01_Austria.3d from 06.03.2013 09:23:30 3B2 9.1.580; Page size: 160.00mm  240.00mm

B. The 25 key questions in connection with internal investigations

13

with public authorities, accessing the websites of daily newspapers or email correspondence with friends, to name only a few. In this context, the question arises as to what extent the employer can control the correspondence of its employees. If provisions on individual use of the email accounts are already set forth in the employment contract, it is also possible to stipulate that the use of private email accounts is completely prohibited. The only restrictions, to which the employer is subject to when drafting the respective provisions in the employment contract, are the violation of moral principles and the prohibition of chicanery.39 It is admissible for an employer to issue instructions according to which private use is entirely prohibited.40 If an employer decides to generally prohibit private use, the consent of the affected employee is not required under data protection law. A notification by the employer that detailed logs are being kept and analyzed by the employer (if necessary) is sufficient because in case of a prohibition of use, the employer as the owner of the work equipment, must be entitled to make sure that it is used exclusively for business purposes.41 If the private use of emails is permitted and if, upon disclosure of the email account, a distinction was made between a private and a business email account, merely business-related contents may be controlled after prior notification in any event. However, the inspection must be restricted to business-related emails, i. e. to communication on behalf of the employer.42 A control of private emails is not permitted.43 If an email account is used both for business and private purposes and if it is suspected that an email is of a private nature, the employer should first try to make an external distinction, e.g. on the basis of specific criteria such as recipient, subject etc. If this is to no avail, the employee should be interrogated to the extent possible, or, if it obvious that the email is of a private nature, further inspection must be stopped. An infringement of these protected areas will only be possible in case of specific suspicions. For example, the employer is entitled to exercise control to protect its business secrets and data files. In this context, a control of the contents is possible if it is required for trouble-shooting purposes or for a misuse control, which would in any event apply to the reasonable suspicion of criminal offences or severe breaches of contract.44 In such cases, the employer must have the possibility to obtain clarity by conducting appropriate investigations if there are sufficient suspicions that an employee acted in breach of contract and in opposition to the employer’s interests.45 In such situations, the inspection of the contents of private emails is conceivable, admissible and covered by a relevant overriding interest of the employer.46 Furthermore, it must be taken into account that, when introducing a corresponding system, the control measure is subject to the consent of the works council in accordance with § 96 (1) no. 3 ArbVG (section 2). 39

Dellisch, ASoK 2001, 316. Freudhofmeier, taxlex 2006, 41. 41 Dellisch, ASoK 2001, 316. 42 Brodil, Die Kontrolle der Nutzung neuer Medien im Arbeitsverha ¨ltnis, ZAS 2004, 28. 43 See id. 44 Brodil, Die Kontrolle der Nutzung neuer Medien im Arbeitsverha ¨ltnis, ZAS 2004, 28. 45 OGH 10.3.1987, 14 Ob A 25/87. 46 Brodil, Die Kontrolle der Nutzung neuer Medien im Arbeitsverha ¨ltnis, ZAS 2004, 28. 40

Krakow/Petsche

50

51

52

53

54

55

Reemers Publishing Services GmbH O:/Beck/Spehl_Gruetzner/3d/01_Austria.3d from 06.03.2013 09:23:30 3B2 9.1.580; Page size: 160.00mm  240.00mm

§ 1. Austria

14

g) Monitoring the use of the Internet If an employer intends to monitor the use of the internet by its employees, a distinction between business-related and private use is not necessary because it is difficult to determinate whether the collected data is of business-related or private nature. 57 If the private use of the internet is entirely prohibited by an employer, consent of the employees for such a control measure is not required under data protection law. In such a case, the employer, in its capacity as the owner, must have the possibility to control the exclusively business-related use47 by means of random controls or, in case of a specific suspicion of misuse, by means of a control of the PC workstation of the respective employee.48 Any further control, e.g., the recording of all log files relating to the respective employee, would constitute a disproportionate interference with the employee’s rights and trigger the requirement of approval from the works council, unless the measure is unlawful. Such a measure would be unlawful for reasons of a violation of the human dignity, because a recording of the accessed web sites allows conclusions to be drawn as to the employee’s personal likings, attitude, dispositions and intentions.49 58 If the private use of the internet is admissible, an employer may only collect and record data in an indirectly personal manner, which means that the recorded data sets must not be personalized right from the beginning. Data collected can thus be easily controlled or analyzed as a matter of routine for any employee actions which are contrary to law or the employment contract. This is because the data is not directly attributable to an employee and there is no direct interference with privacy or human dignity.50 The respective data sets may only be assigned to a specific employee and the facts and circumstances may only be investigated in more detail in the event of a specific suspicion. In such a case, the employee must be informed accordingly.51 Such a procedure would not trigger the obligation to obtain the works council’s consent pursuant to § 96 (1) no. 3 ArbVG (section 2). For the above reasons, except in case of the last-mentioned approach, it is advisable to conclude a corresponding works agreement or if, there is no works council, to obtain the corresponding declaration of consent of the employee when installing systems monitoring the use of the internet.52 56

h) Video surveillance of employees It is, however, possible to use cameras not only to monitor customers in shops but also to monitor the employees while they perform their work. As a result, the pictures are not only used to detect thefts but also to control employees. 60 Generally speaking, the surveillance of employees has become more and more popular over the past years. The advantages of video surveillance are obvious. In contrast to the subjective view of the human eye, a camera is not restricted in any way as regards to its perception and memory capacity, and is able to provide an overall 59

47

Freudhofmeier, taxlex 2006, 41. Sacherer, RdW 2005, 214. 49 Dellisch, ASoK 2001, 316. 50 Sacherer, RdW 2005, 627. 51 Id. at 627. 52 Id. at 627. 48

Krakow/Petsche

Reemers Publishing Services GmbH O:/Beck/Spehl_Gruetzner/3d/01_Austria.3d from 06.03.2013 09:23:30 3B2 9.1.580; Page size: 160.00mm  240.00mm

B. The 25 key questions in connection with internal investigations

15

picture of the recorded person, his/her actions, behaviour as well as the respective situation. Observations can be stored and kept for an almost unlimited period of time.53 Video surveillance, like any other surveillance of an employee, may conflict with the protection of a person’s right to privacy. Owing to the direct third-party effect, the scope of protection under § 16 ABGB as set forth in the DSG 2000 also applies to legal relations under civil law. This means that video surveillance may be inadmissible if it interferes with personal rights in a disproportionate manner.54 Video surveillance always affects a person’s protected privacy. In case of such an interference with the privacy of employees, it must be verified within the scope of the proportionality assessment, both with respect to the customers and the employees, whether the employer’s interests in the surveillance measure prevail. In this context, the principle of data economy applies: The stronger the interference of the protected right to privacy, the higher the requirements for the assessment of legitimacy. If less burdensome measures render the same results as camera surveillance with or without recording, the latter is to be considered disproportionate and thus illegitimate.55 This, however, must always be evaluated on a case by case basis. Certain video surveillance systems are generally inadmissible under labor constitution laws because they violate the human dignity of an employee, e.g. – video surveillance in restrooms, – video surveillance in lavatories, – video cameras that are permanently pointed at an employee’s workplace and serve only to control the employee.56 There are only very few exceptions, e.g. in the case of particularly endangered institutions, such as banks and bank note or share certificate printing institutions.57 However, if the primary purpose of the surveillance systems is for the early detection of or avoidance of dangers, and if the control of employees is merely a secondary aspect of this avoidance of danger, it is assumed that human dignity is minimally affected and as a result, such systems are deemed admissible upon the works council’s consent.58 In this context, the introduction of video surveillance systems is always subject to the consent of the works council pursuant to § 96 (1) no. 3 ArbVG, because not only does surveillance for security purposes affect the dignity of the employee but an interference is already deemed to exist if a camera has been installed even if not yet in operation.59 In addition, video surveillance systems require prior authorization by the Data Protection Commission (Datenschutzkommission) under data protection laws if the pictures are recorded. This is due to the fact that, according to the current opinion, the obligation to obtain prior authorization is triggered because it is likely that the

53

Riesenkampff, ecolex 2007, 743. Riesenkampff, ecolex 2007, 743 et seq. 55 Riesenkampff, ecolex 2007, 746. 56 Knyrim/Bartlma ¨ , ecolex 2007, 741. 57 Riesenkampff, ecolex 2007, 746. 58 Knyrim/Bartlma ¨ , ecolex 2007, 741. 59 OGH 14.5.1997, 7 Ob 89/97 g. 54

Krakow/Petsche

61

62

63

64

65

66

Reemers Publishing Services GmbH O:/Beck/Spehl_Gruetzner/3d/01_Austria.3d from 06.03.2013 09:23:30 3B2 9.1.580; Page size: 160.00mm  240.00mm

16

§ 1. Austria

recorded data contains data that are relevant under criminal law (e.g. theft) (§ 18 (2) no. 2 DSG).60 i) Telephone surveillance at the workplace In the case of the surveillance of telecommunications, the right to respect private life, privacy and data protection as well as an employees‘ telecommunication privacy is in conflict with the employer’s property right and the protection of the established and conducted business of the employer.61 68 In this context, it must be differentiated between the use for business purposes and private use on the one hand, and between the surveillance of transferred data and access to the contents of the communication on the other. 67

aa) Business-related telephone conversations – data surveillance Telephone conversations held by an employee on behalf of his/her employer qualify as a communication of the employer in the broad sense. Comparable to business-related correspondence, which undoubtedly may (must) be reviewed, inspected and filed by the employer. Telephone conversations constituting acts specific to the employment contract are also accessible to control and registration of the traffic data.62 Accordingly, the mere recording and registration of traffic data of business-related telephone conversations does not affect an employee’s right to protection of his/her privacy of with respect to telecommunications. This does not constitute an excessive control measure if the employee has been informed. Due to this fact the employee can adjust his/her behavior accordingly. Furthermore, the mere registration of telephone numbers dialed for business purposes does not constitute a measure requiring the consent of the works council in accordance with § 96 ArbVG. This is because business-related communication does not qualify as personal data. As a result, the personal right to be protected in the case of business-related telephone conversations consists only in the intimacy of the spoken word. The external traffic and connection data is not part of the employee’s strictly personal communication.63 70 Accordingly, the covert listening in on business-related telephone conversations is generally considered inadmissible.64 Listening in is only legitimate in exceptional cases; namely if the person holding the telephone conversation is directly made aware of the listening in by means of a visual or acoustic signal.65 69

bb) Private telephone conversations 71

As already stated above, the covert listening in on telephone conversations of employees is generally inadmissible even if the employee is not allowed to hold private telephone conversations. If, however, private telephone conversations are

60

Knyrim/Bartlma¨, ecolex 2007, 740. OGH 13.6.2002, 8 Ob A 288/01 p. 62 Brodil, Die Kontrolle der Nutzung neuer Medien im Arbeitsverha ¨ltnis, ZAS 2004, 28. 63 Brodil, Die Registrierung von Vermittlungsdaten im Arbeitsverha ¨ltnis, ZAS 2004, 4. 64 Aicher, in: Rummel, ABGB, § 16, margin no. 26. 65 Obereder, DRdA 2001, 75. 61

Krakow/Petsche

Reemers Publishing Services GmbH O:/Beck/Spehl_Gruetzner/3d/01_Austria.3d from 06.03.2013 09:23:31 3B2 9.1.580; Page size: 160.00mm  240.00mm

B. The 25 key questions in connection with internal investigations

17

permitted, even noticeable listening in would be inadmissible. The interruption of a telephone conversation however would not be inadmissible.66 cc) Recording of and eavesdropping on conversations § 16 ABGB is the so called sedes materie for the protection of the right to the 72 spoken word. A covert tape recording of private conversations is unlawful as is a covert tape recording of business-related conversations if the recording does not serve the customary facilitation of the ordinary course of business.67 Furthermore, the tape recording of a business meeting held between two persons is unlawful without the consent of the participants.68 Listening in on conversations by means of secret witnesses also constitutes an unlawful interference with the employee’s personal rights.69 In summary, it can be said that systems registering calls made from a telephone 73 system by recording the number of the extension which made or received the call, the costs as well as date and time of the call, may be installed without the consent of the works council or the employees, as applicable. j) Whistleblowing hotlines Under the Sarbanes Oxley Act (SOX),70 which was adopted by U.S. Congress in 74 2002 as a reaction to the corporate accounting scandals, U.S. groups are required to establish so-called “whistleblowing hotlines.” This is also the case in their European subsidiaries in order for irregularities to be reported directly to the group management.71 The term “Whistleblowing” stands for a company’s internal control system. Its 75 purpose is to prevent and remove deficiencies and irregularities, in particular, in connection with billing, bookkeeping and accounting.72 These whistleblowing hotlines are based on the idea that nobody is more familiar with or can better evaluate the internal processes of a company than the individual employees in the respective department. By establishing such a hotline, employers rely on their employees‘ insider knowledge and willingness to actually use this knowledge either anonymously or by giving their name to reveal deficiencies.73 As such hotlines are customized to the respective company, it is not possible from a legal perspective to speak of whistleblowing hotlines in general. Instead, each hotline must be examined individually with regards to its legal admissibility.74 Usually, whistleblowing hotlines do not affect the employee’s personal rights. Here, 76 the employer’s main interest is not that employees blow the whistle on colleagues, but rather to uncover serious misconduct. Such hotlines lack the objective suitability to control employees. When evaluating legal interests, the possibly impaired fundamenAicher, in: Rummel, ABGB, § 16, margin no. 26. Aicher, in: Rummel, ABGB, § 16, margin no. 22. 68 OGH 21.10.1992, 9 Ob A 215/92. 69 OGH 21.10.1992, 9 Ob A 215/92. 70 Cf. Sec 301 and 806 of Public Law 107–204 – July 30, 2002 available under www.sec.gov/about/ laws/soa2002.pdf. 71 Knyrim/Kurz/Haidinger, ARD 5681/5/2006. 72 Leissler, “Whistleblowing” in O ¨ sterreich, ecolex 2009, 361. 73 Id. at 361. 74 Reis, RdW 2009, 396. 66 67

Krakow/Petsche

Reemers Publishing Services GmbH O:/Beck/Spehl_Gruetzner/3d/01_Austria.3d from 06.03.2013 09:23:31 3B2 9.1.580; Page size: 160.00mm  240.00mm

18

§ 1. Austria

tal rights of the employee must be balanced against the interest of the employer in having proper accounting while preventing criminal offences. The latter interest will most likely prevail.75 2. Must employees‘ representatives such as the works council be involved in internal investigations? a) Right to information 77

One of the works council’s central rights is to be fully informed by the employer on all activities involving the automated recording, processing and transmission of personal employee data in accordance with § 91 (2) ArbVG. In this regard, the works council may review both the types of data itself and the technological bases. Depending on the structure and configuration of the system, the activities are either not subject to the works council’s consent or corresponding works agreements are concluded in accordance with § 96 ArbVG. b) Right of consent

Pursuant to § 96 (1) ArbVG, certain measures carried out by the employer require the consent of the works council in order to be legally valid. With regard to internal investigations, § 96 (1) no. 3 ArbVG must be especially mentioned. This section stipulates that the introduction of control measures and technical systems to control the employees requires the works council’s consent if these measures (systems) affect human dignity. This is all provided that the respective company has a works council. 79 In order to determine whether a measure introduced by the employer qualifies as a control measure requiring the works council’s consent, the individual requirements of the applicability of § 96 (1) no. 3 ArbVG must first be reviewed in detail and summarized. 78

aa) Control measures Control measures are regulations provided by an employer setting forth when, under what circumstances and in what manner employees are being controlled while performing their work or, more generally, while being present in the company for any purpose.76 81 The term “control measure” does not only comprise of a control by way of technical means. Control exercised by other employees may require the works council’s consent, too. The same applies to external surveillance institutions.77 80

bb) Affecting human dignity Control measures that affect an employee’s human dignity are another example of control measures requiring the works council’s consent in order to be introduced. 83 For an interpretation of the term “human dignity”, reference is usually made to fundamental rights and personal rights. In general, human dignity is affected by 82

75

Reis, RdW 2009, 399; other opinion Knyrim/Kurz/Haidinger, ARD 5681/5/2006, 8. Lo¨schnigg, Arbeitsrecht, 714. 77 Lo ¨ schnigg, Arbeitsrecht, 714. 76

Krakow/Petsche

Reemers Publishing Services GmbH O:/Beck/Spehl_Gruetzner/3d/01_Austria.3d from 06.03.2013 09:23:31 3B2 9.1.580; Page size: 160.00mm  240.00mm

B. The 25 key questions in connection with internal investigations

19

technical control systems or other control measures if this control extends to the employee’s privacy within the company. Such privacy constitutes a personal right. Control measures that violate human dignity are generally inadmissible (i. e. even upon consent of the works council or the employee, as applicable) while measures that merely affect human dignity require the consent of the works council or the employee, as applicable. Control measures that regularly affect personal rights include, inter alia, permanent television surveillance, work sampling cameras, telephone tapping equipment, microphones, glass panes that are transparent from one side only, as well as entrance controls and body searches.78 cc) Control measures requiring the works council’s consent Whether or not a control measure is subject to the consent of the works council 84 must in any event – with the exception of video surveillance – be determined in each individual case and a legal review must be carried out according to the circumstances in each case. Thus, only individual examples are listed below. dd) Employee interviews Under certain conditions, employee interviews could be subject to a co-determina- 85 tion obligation in accordance with § 96 ArbVG because, as already stated above, control exercised by other employees may require the works council’s consent as well. The same applies to external surveillance institutions.79 However, employee interviews do not constitute a permanent control measure and only permanent control measures are subject to the works council’s consent. Individual ad hoc measures80 – provided that they are admissible in the first place – do not require the works council’s consent.81 If, however, employee interviews are intended to be of a permanent nature, i. e., if 86 they are to be conducted at regular intervals (e.g. semi-annually), a permanent control measure can be assumed, which triggers the co-determination obligation of the works council. In order to prevent employee interviews being later dismissed on grounds of 87 violating personal rights, any questions which employees will have to answer should be determined in advance. Owing to the fact that employee interviews are intended to uncover potential criminal activities within a company, questions should be asked which reveal the financial background or financial situation of an employee or reveal whether he/she is currently involved in (cost-intensive) divorce proceedings or other situations which allow conclusions to be drawn as to his/her beliefs, attitude or membership in political movements in order to find a possible motive for criminal actions. 78

EA Wien 16.3.1981, Arb 9955. Lo¨schnigg, Arbeitsrecht, 714. 80 Lo ¨ schnigg, however, assumes that even ad hoc measures require the works council’s consent. He believes that neither the wording of the provision containing the very broad term “control measure”, nor the purpose of the provision give reason to exclude temporary control measures taken for a specific purpose from the necessary co-determination of the works council. Lo¨schnigg, Datenermittlung im Arbeitsverha¨ltnis, 231 et seq. 81 Kocher, Vorsicht Kamera – Mitarbeiteru ¨ berwachung im Betrieb, PVInfo 2008 H 5, 22; EA Wien 16.3.1981, III Re 373/80. 79

Krakow/Petsche

Reemers Publishing Services GmbH O:/Beck/Spehl_Gruetzner/3d/01_Austria.3d from 06.03.2013 09:23:32 3B2 9.1.580; Page size: 160.00mm  240.00mm

20 88

§ 1. Austria

Employee interviews do not require the works council’s consent. They can, therefore, only be deemed inadmissible on grounds of violating the employees‘ personal rights. ee) Telephone systems

As mentioned above, the mere recording and registration of traffic data of business-related telephone conversations do not affect an employee’s right to protection of his/her privacy of telecommunications. If the employee has been informed of such, there is no excessive control measure due to the fact that the employee can adjust his/her behavior accordingly. Furthermore, the mere registration of telephone numbers dialed for business purposes, does not constitute a measure requiring the consent of the works council in accordance with § 96 ArbVG. This is because business-related communication does not qualify as personal data.82 89a The situation is different if the employee also uses the telephone for private purposes. In this context, the Austrian Supreme Court (Oberster Gerichtshof, OGH) found, inter alia, that the introduction of an electronic telephone surveillance system, that systematically registers the complete numbers of the persons called and attributes them to the respective extensions, affects human dignity even if, by pushing a key on the telephone, the last digits of the numbers are blocked in the system. As a result, the introduction of such a control measure requires the consent of the works council or the respective employees, as applicable.83 89

ff) Video surveillance As regards to video surveillance of employees, the introduction of this control measure is always subject to the consent of the works council because it is not only surveillance for security purposes that affects the dignity of the persons working there, but an interference is also already deemed to be given if a camera has been installed but not yet operated.84 91 There are some exceptions, e.g. the video surveillance of the loading of trucks if the employees are only filmed during their loading activity and only during part of their total working time.85 90

gg) Email and internet To what extent the control of new information and communication technologies is subject to the works council’s co-determination can only be determined in each case individually. This is due to the numerous possible forms of such systems. Therefore, only a few selected examples will be described below. 93 In this context, the intensity of the control is the decisive factor. Reading an employee’s emails without prior notice constitutes a violation of the employee’s human dignity by the employer and would be inadmissible even if the works council gave its consent.86 92

82

Brodil, Die Registrierung von Vermittlungsdaten im Arbeitsverha¨ltnis, ZAS 2004, 4. OGH 13.6.2002, 8 Ob A 288/01 p. 84 OGH 14.5.1997, 7 Ob 89/97 g. 85 EA Wien 24.4.1986, II Re 61/86. 86 Lo ¨ schnigg, Arbeitsrecht, 713. 83

Krakow/Petsche

Reemers Publishing Services GmbH O:/Beck/Spehl_Gruetzner/3d/01_Austria.3d from 06.03.2013 09:23:32 3B2 9.1.580; Page size: 160.00mm  240.00mm

B. The 25 key questions in connection with internal investigations

21

An inspection of the contents of an individual employee’s screen upon prior 94 notice requires the consent of the works council as does the recording of access and transaction data within the scope of the internet use. This is the case if use is carried out comprehensively and almost unlimited. If, however, an employer uses encoding software to ensure the anonymity of the data, the consent of the works council is not required.87 In sum, the control of an employee’s internet surfing habits by the employer, e.g. 95 by recording the accessed websites in so-called log files, already triggers the obligation to obtain the works council’s consent. The works council’s consent will also be required if the private use of the internet is prohibited because a differentiation between private and business-related use is only possible by means of evaluating the contents of the accessed websites.88 The employer would only be entitled to control, if control was restricted to those 96 sites whose access for private reasons had been proven – in whatever way – because this would not constitute a control of the business-related use but only a monitoring of the prohibition of private use.89 hh) Whistleblowing hotlines There are different opinions in the available literature on this topic, as to whether 97 and when whistleblowing hotlines are subject to the co-determination obligation of the works council. Knyrim/Kurz/Haidinger,90 for instance, assume that whistleblowing hotlines are generally subject to the co-determination obligation of the works council because such hotlines enable employees to defame colleagues in an often anonymous, undifferentiated and permanent manner and for that reason affect human dignity. Reis puts forward different arguments.91 The mere fact that such hotlines enable a 98 surveillance of employees that exceeds the usual extent is not sufficient to assume a co-determination obligation of the works council. Such a hotline does not result in a permanent control of the employees. Instead, these hotlines constitute ad hoc control measures (see supra para. 85 et seq.). Furthermore, the central aspect is not that employees blow the whistle on colleagues, but that the employer’s interest in uncovering serious misconduct is served. These hotlines lack the objective suitability to control employees. In addition, Reis states that such hotlines do not affect the employees‘ human dignity because, if the data transmitted in this way is restricted to reports of deficiencies in connection with the so-called SOX-relevant requirements, there is hardly any specific risk of a violation of the affected employee’s personal rights. When evaluating the legal interests in this case, Reis believes that the interest of the employer in a proper accounting and the prevention of criminal offences outweigh the possibly impaired fundamental rights of the employees.

87

Id. at 713. Laimer/Mayer, Zum Spannungsverha¨ltnis von Arbeitgeber- und Arbeitnehmerinteressen, DRdA 2003, 410. 89 Id. at 410. 90 Knyrim/Kurz/Haidinger, ARD 5681/5/2006, 8. 91 Reis, RdW 2009, 399. 88

Krakow/Petsche

Reemers Publishing Services GmbH O:/Beck/Spehl_Gruetzner/3d/01_Austria.3d from 06.03.2013 09:23:33 3B2 9.1.580; Page size: 160.00mm  240.00mm

§ 1. Austria

22 99

Apparently, the Austrian Supreme Court of Justice has not yet rendered any decisions on the issue of whistleblowing hotlines. To be on the safe side, the consent of the works council should, therefore, be obtained when establishing such a hotline. c) Companies without a works council

100

Pursuant to § 10 Employment Contract Law Adaptation Act (Arbeitsvertragsrechts-Anpassungsgesetz, AVRAG), the introduction and application of control measures and technical installations is generally inadmissible in companies that do not have a works council in place unless the consent of the employees has been obtained. The employees, however, may withdraw their consent at any time and without notice if there is no written agreement with the employer in regard to the duration of the control measures. 3. Summary

The following table provides a general overview and summarizes the results of the above questions and the participation rights of the works council. All items were discussed in detail in the respective sections above. 102 The following is only a broad overview. The respective specifics can be found in the corresponding chapters. 101

Measure

Admissibility

Works council’s participation rights

1.

Employee interviews

generally admissible

no right of co-determination

2.1

Handover, review and processing of business-related documents, files and letters

generally admissible

no right of co-determination

2.2

Handover, review and processing of private documents, files and letters

generally inadmissible

./.

3.1

Handover, review and processing of business-related data files and electronic documents

generally admissible

no right of co-determination

3.2

Handover, review and processing of private data files and electronic documents

generally inadmissible

./.

Krakow/Petsche

Reemers Publishing Services GmbH O:/Beck/Spehl_Gruetzner/3d/01_Austria.3d from 06.03.2013 09:23:33 3B2 9.1.580; Page size: 160.00mm  240.00mm

B. The 25 key questions in connection with internal investigations Measure

23

Admissibility

Works council’s participation rights

4.1

Screening of business-related emails

– saving of call detail records is admissible – viewing of content generally admissible

– right of co-determination in case of installation of technical surveillance devices – right of information

4.2

Screening of private emails

– saving of call detail records inadmissible – viewing of content only admissible in the case that the employee is suspected of having committed a criminal offence

– right of co-determination if private usage of email account is not permitted – right of information

5.

Video surveillance of employees

open and covert video surveillance admissible if certain stringent requirements are met

– right of co-determination – right of information

6.

Tapping of telephone conversations

– tapping of phone conversations is inadmissible – listening in on phone conversations is admissible under certain circumstances

– right of co-determination in case of installation of technical surveillance devices – right of information

7.

Search of the workplace

admissible as long as search does not include any private belongings that are locked up

right of co-determination

8.

Investigations carried out in the surroundings of employees under suspicion

admissible

no right of co-determination

III. Employee interviews 1. May an employee refuse to provide information if this information incriminates himself/herself? As a general rule, employees have the right to hold back information in an 103 interview or may refuse to answer certain questions if information or their answers would incriminate them. As regards to self-incrimination, the Labor and Social Court of Vienna (Arbeits- 104 und Sozialgericht Wien) stated that, on his/her own, an employee’s denial to have committed a certain act, did not render the employee “untrustworthy” as defined by Krakow/Petsche

Reemers Publishing Services GmbH O:/Beck/Spehl_Gruetzner/3d/01_Austria.3d from 06.03.2013 09:23:34 3B2 9.1.580; Page size: 160.00mm  240.00mm

24

§ 1. Austria

law. This would imply an obligation on the part of the employee to incriminate him/her while no such obligation is provided for under Austrian law. For this reason, disapproved behavior (denial) which, when considered on an isolated basis, would not constitute a reason for dismissal (Entlassung), must not become a reason for dismissal merely because the employer can prove that the employee did commit the acts previously denied. It remains the employer’s duty to provide proof that reasons for dismissal are given. As a consequence, it is inadmissible to circumvent this duty by demanding a confession from the employee.92 105 Apparently, the OGH has not so far dealt with the aforementioned prohibition of self-incrimination in the literal sense. In two relevant decisions,93 the court stated that, on their own, lies or statements with the aim to cover up or conceal certain facts do not make the respective employee untrustworthy, however, with the restriction that this would only apply if the concealment had not caused considerable damage. This would not be the case if the employee’s lie could give the employer an inaccurate picture of the facts and circumstances of the case, thus threatening to increase the damage. 106 Based on such case law, the mere denial of having committed certain acts does not qualify as reason to dismiss an employee for lack of trustworthiness (see infra para. 155 et seq.). While the employee is entitled to refuse to provide information if the relevant answers would incriminate himself/herself, he/she is also obliged to make his/her employer aware of any imminent danger or damage.94 2. Is an employee obliged to provide information on any misconduct of or criminal offence committed by other employees? If such an obligation to provide information or to report certain incidents exists, it can only result from the individual work duties itself, especially if the employee concerned holds a (senior) position where he/she supervises and controls other employees or if the employee holds a special position of trust.95 108 One could also argue that a reporting obligation (Anzeigepflicht) results from the employee’s general duty of loyalty, in particular if the imminent damage the employer might suffer would be considerable and could still be averted if the misconduct was revealed, provided that this should not foster a culture of “spying” or a climate of mistrust within the company.96 The reporting obligation will also apply if an employee strongly suspects that colleagues committed thefts, other criminal offences, or serious breaches of trust against the employer. Should an employee fail to report any such incidents to the employer, he/she may be dismissed for lack of trustworthiness.97 109 Only one such case has been brought before the Higher State Court of Vienna (Oberlandesgericht Wien) so far, which ruled that a reporting obligation did exist in 107

92

ASG Wien 8.1.2007, 27 Cga 141/00 b. OGH 1.4.1998, 9 Ob A 384/97 d; OGH 30.7.2007, 8 Ob A 21/07 g. 94 Lo ¨ schnigg, Arbeitsrecht, 259. 95 Knyrim/Kurz/Haidinger, ARD 5681/5/2006, 5. 96 Knyrim/Kurz/Haidinger, ARD 5681/5/2006, 7. 97 Lo ¨ schnigg, Arbeitsrecht, 259. 93

Krakow/Petsche

Reemers Publishing Services GmbH O:/Beck/Spehl_Gruetzner/3d/01_Austria.3d from 06.03.2013 09:23:34 3B2 9.1.580; Page size: 160.00mm  240.00mm

B. The 25 key questions in connection with internal investigations

25

that particular case, considering the employee’s duty of loyalty, the employee’s function as a supervisor and the particular position of trust held by that employee.98 When being interviewed, senior employees are therefore obliged to provide 110 information that could incriminate other employees. Employees who do not hold a supervisory position are equally obliged to make a report to the employer when imminent damage to the employer is considerable and could still be averted if the misconduct were reported. 3. May an employee refuse to answer a question if he/she has already answered it within the scope of a previous interview? Complex and time-consuming investigations may require employees to be sub- 111 jected to more than one interview. The scope of the employer’s right to ask questions will in each case depend on the content of the questions. If the questions refer to the employee’s tasks and duties, he/she must answer the questions – even if such questions are posed repeatedly. Questions concerning only the employee’s personal sphere as e.g., his/her free-time activities should, however, never be part of an interview and the employee is under no obligation to answer such questions irrespective of whether they are posed once or repeatedly. 4. Is an employee entitled to have a member of the works council or an attorney present during the interview? a) Is an employee entitled to have of a member of the works council present during the interview? The relevant legal provisions do not stipulate that employees have the right to call 112 in a person representing their interests to attend the interview. Hence, employees are not entitled to the presence of a member of the works council during interviews. In this context, it should be considered whether an employee should be allowed 113 to bring a member of the works council if the employee would otherwise refuse to be interviewed at all. This decision, however, must remain at the employer’s discretion and will depend on whether the working relationship with the works council is good or not. b) Is an employee entitled to have an attorney present during the interview? An employee is not entitled to bring external third parties to the interview. 114 Should an employee refuse to answer questions without an external third party being present, it should be considered giving the employee the opportunity to consult a legal advisor. 5. Is an employee entitled to read the record of his/her interview? An employee does not have the right to read transcripts of his/her interview. 115 The transcripts serve to establish and secure the facts of the case. To avoid 116 subsequent disagreements and contradictions and in order to strengthen the proba98

OLG Wien 29.10.2003, 7 Ra 148/03 s, ARD 5481/6/2004.

Krakow/Petsche

Reemers Publishing Services GmbH O:/Beck/Spehl_Gruetzner/3d/01_Austria.3d from 06.03.2013 09:23:34 3B2 9.1.580; Page size: 160.00mm  240.00mm

26

§ 1. Austria

tive value of such records, however, the employee should be given the opportunity to read the transcript of his/her interview. 6. Is the employer entitled to request that the employee signs the record of the interview? In general, it will be in the employer’s interest to have the employee sign the interview transcript in order to avoid potential differences or doubts. 118 Although an employer is generally entitled to give its employees instructions, employees are only obliged to follow such instructions to the extent they are justified in connection with their work duties. An instruction will be justified if it is within the boundaries set forth by the employment contract and the ensuing rights and obligations also serve to further specify a work obligation or the behavior expected from an employee at work.99 Under these circumstances it must be assumed that the employer can instruct the employee to sign the transcript of his/her interview. 119 If the employer instructs the employee to sign a transcript, the employee must in any case be given the opportunity to carefully read the transcript. 117

7. Can the employer instruct an employee to treat the content of his/her interview as confidential? 120 121

122

123

124

The successful implementation of internal investigations will in many cases depend on whether and to what extent such measures are (or can be) kept secret. The employer will have an interest in keeping the content of interviews confidential in order to avoid other employees from preparing for the interviews as well as preventing potential delinquents from covering up their tracks in time and prior to being interviewed. Employees are generally subject to a confidentiality obligation with respect to business and trade secrets based on the employee’s duty of loyalty. Business and trade secrets are company-specific, technical or commercial information, which is only known to a small number of persons. Per definition, such information cannot or only with great difficulty, be accessed by other people and the individual authorized to possess the information does not intend to have it disclosed to anyone outside the circle of insiders.100 When disclosing information, employees generally need to proceed very carefully and always act in the interest of the employer.101 Even the disclosure or circulation of accurate information can be illegal in certain cases. In terms of keeping the interests of all parties concerned balanced, the information needs of employees, customers, etc must be compared to the need to protect the affected party (employer).102 The content of employee interviews is thus covered by the employee’s confidentiality obligation, which means that an employee is not entitled to disclose the content of his/her interview even to colleagues. In the case of internal investigations, the required balancing of interests will turn out in favor of the employer, because in 99

Lo¨schnigg, Arbeitsrecht, 60 f. Lo¨schnigg, Arbeitsrecht, 259. 101 OGH 14.6.2000, 9 Ob A 118/00 v. 102 OGH 1.12.1999, 9 Ob A 234/99 y. 100

Krakow/Petsche

Reemers Publishing Services GmbH O:/Beck/Spehl_Gruetzner/3d/01_Austria.3d from 06.03.2013 09:23:34 3B2 9.1.580; Page size: 160.00mm  240.00mm

B. The 25 key questions in connection with internal investigations

27

the absence of a confidentiality obligation, other employees could prepare for their own interviews which could possibly undermine the very purpose of the internal investigation.

IV. Sanctions imposed on employees 1. What are the sanctions under employment law that can be imposed on employees refusing to cooperate in internal investigations? a) Reasons for an employee’s duty to cooperate One of the essential features of an employment contract is the personal duty of 125 care (Fu¨rsorgepflicht) and the duty of loyalty (Treuepflicht) as well as the organizational integration in the employer’s company.103 An employment relationship is generally characterized by the fact that the employee is personally dependent from his/her employer.104 Additional indications for the personal dependence are the control of the employer and its disciplinary responsibility.105 In this context, control does not only mean controlling the performance of the work in the strict sense, but also controlling the accessibility or the other activities of an employee.106 An employee’s duty to cooperate in internal investigations results in particular from the employee’s obligation to work and his/her duty of loyalty. aa) Obligation to work An employee’s primary duty is to render the agreed work. The specific content of 126 the work is usually stipulated in the employment contract. If nothing has been agreed, such appropriate work must be rendered considering the respective circumstances.107 Within the framework provided for by the employment contract, the obligation to 127 work is specified in more detail through the employer’s right to give instructions (Weisungsrecht or Direktionsrecht). In other words, the instruction gives the employment relationship a specific shape. On the one hand, the right to give instructions allows the employer to dispose of an employee’s labor within the scope of the business organization. The employer may utilize this instruction right in order to properly serve the operation of the company’s business.108 Employees must comply with those instructions of the employer that are justified 128 according to the subject matter of their work.109 An instruction by an employer is justified if it is within the boundaries of the employment contract and the ensuing rights and obligations serve to further specify the obligation to work or the behavior expected from an employee at the workplace.110 Employees are personally depen103

OGH 14.6.2000, 9 Ob A 7/00 w mwN. OGH 20.9.1983, 4 Ob 102/83, ZAS 1985, 18 (Eypeltauer). 105 OGH 29.5.1979, 4 Ob 117/78, Arb 9796. 106 Cf. for the control of accessibility: VwGH 19.9.1997, ARD 4895/12/97; cf. generally therefore: Lo¨schnigg, Arbeitsrecht, 122. 107 § 1153 ABGB, § 6 AngG. 108 Cf. Lo ¨ schnigg, Arbeitsrecht, 244, 245. 109 OGH 10.12. 1997, 9 Ob A 269/97t, Arb 4967/21/98. 110 OGH 18.4.1978, 4 Ob 24/7, Arb 9691. 104

Krakow/Petsche

Reemers Publishing Services GmbH O:/Beck/Spehl_Gruetzner/3d/01_Austria.3d from 06.03.2013 09:23:35 3B2 9.1.580; Page size: 160.00mm  240.00mm

§ 1. Austria

28

dent on their employer and must comply with the instructions given by their employer with regard to the work.111 129 Internal investigations always refer to activities within the company. Usually, they are connected with specific employment relationships or with the organizational integration of the employees in an employer’s company. As employees must comply with instructions that are related to their work and internal investigations are without a doubt, work related, employees must cooperate in internal investigations on the basis of the employer’s direction (instruction). The duty to cooperate in internal investigations must, therefore, be regarded as part of an employee’s obligation to work. Because of the employment contract and the duty to work, an employee is obliged to cooperate in internal investigations in the area that is covered by his/her employment contract. If the employer does not request an employee’s cooperation in internal investigations, the employee is still obliged to take specific actions within the scope of the so-called duty of disclosure (Anzeigepflicht) (see infra para. 130 et seq. and para. 152 et seq.). bb) Duty of loyalty Employees are obliged to comply with and to protect the interests of their employer. Only in exceptional cases does the duty of loyalty require active conduct (for example obligation to report imminent damage to the employer, obligation to work overtime in emergencies). More often, however, duties to omit an action stem from an employee’s duty of loyalty. These duties to omit are often regulated by law (for example the confidentiality obligation regarding trade and business secrets, or the prohibition to accept bribes). 131 In other words, the duty of loyalty means that an employee is obliged to respect his/her employer’s business activities and their organizational values and chances (goodwill), which he/she gets to know and which he/she may not use, endanger or impair for his/her purposes. In practical terms this means that the duty of loyalty concerns the protection of business interests.112 The duty of loyalty also includes the employee’s obligation to warn the employer of imminent danger or to contribute to the removal of the incurred damage. In most cases internal investigations are carried out to warn the employer of an imminent danger or to remove damage that has already occurred. 132 Therefore, the duty to cooperate in internal investigations applies to all employees. The exact details and the extent of the duty to cooperate depend on whether the duty to cooperate results directly from the obligation to work or whether it exists on the basis of the duty of loyalty. If internal investigations include an area that is covered by the employment contract of an employee, the employee is obliged to cooperate in the internal investigations due to his/her obligation to work. If internal investigations include an area that is not covered by the employment contract of an employee, the employee is obliged to cooperate in the internal investigations on the basis of the duty of loyalty. 133 The duty of loyalty also results in the employee’s duty to provide assistance and his/her reporting obligation. 130

111 112

OGH 19.6.1991, 9 Ob A 77/91. Cf. Lo¨schnigg, Arbeitsrecht, 256.

Krakow/Petsche

Reemers Publishing Services GmbH O:/Beck/Spehl_Gruetzner/3d/01_Austria.3d from 06.03.2013 09:23:35 3B2 9.1.580; Page size: 160.00mm  240.00mm

B. The 25 key questions in connection with internal investigations

29

On the basis of the duty to provide assistance, the scope, type and place of work may be changed. Within the scope of internal investigations, an employer may also instruct an employee to deviate from his/her “usual” work and to assume activities or fields of activities that must be performed in the context of internal investigations. For example, the employer may require that an employee work as an “internal investigator”. This means that the employee prepares and compiles files or performs specific administrative tasks. To determine the limit for another deployment within the scope of the duty to cooperate in internal investigations, the issue of a transfer of an employee must be taken into account. Within the scope of the duty to cooperate, an employee’s obligations under his/her employment contract may not be changed in such way that this change equals a transfer. The transfer of an employee is a change of the place of work or the field of activity or of both conditions. It must be differentiated between a directional transfer resulting form the employment contract and a transfer that changes the employment contract. Only a directional transfer may be considered to be within the scope of internal investigations. A transfer is a change of the workplace and/or of the working conditions that lasts longer than 13 weeks. In accordance with § 101 ArbVG, employers must immediately notify the works council of any permanent change. As it is unlikely that the use of an employee for other tasks within the scope of his/her cooperation in internal investigations will result in a reduction of the employee’s remuneration or a deterioration of other working conditions, the use for other tasks does not require the works council’s consent. This is the case even if it should last longer than 13 weeks. The legal basis for the reporting obligation is not found in any specific legal provision. The reporting obligation may be derived rather from an employee’s obligation to work and his/her duty of loyalty. In individual cases, the reporting obligation may also be derived from a collective rule (collective agreement, works agreement) or from an individual agreement. One example, where the reporting obligation is based on an individual agreement would be that an employee performs the task of a controller or auditor (Revisor) on the basis of his/her employment contract (see infra para. 152 et seq.).113 Should an employer conduct internal investigations due to an emergency or in the case of duress, employees must accept a (short-term) change of the field of activities and overtime within the scope of what is permitted by law.114 This situation must be a company emergency or similar situation that is outside the ordinary course of business and results in a disproportionate economic damage for the employer.115 Whether or not an emergency or a case of duress has occurred, must be assessed by specific criteria that have been determined by case law. This will usually not be the case for activities triggering internal investigations, such as bribery.

113

Cf. Grillberger, ZAS 1986, 50; Lo¨schnigg, Arbeitsrecht, 259. Cf. generally to the duty of loyality: Lo¨schnigg, Arbeitsrecht, 243 ff.; also § 20 Arbeitszeitgesetz (“AZG”). 115 OGH 22.11.1995, 9 Ob A 191/95, SZ 68/224 = ZAS 1997, 20 (Brodil); VwGH 8.9.1994, 92/18/ 0521, 0522, ZfVB 1995/2037. 114

Krakow/Petsche

134

135

136

137

Reemers Publishing Services GmbH O:/Beck/Spehl_Gruetzner/3d/01_Austria.3d from 06.03.2013 09:23:35 3B2 9.1.580; Page size: 160.00mm  240.00mm

30

§ 1. Austria

b) Cutback in remuneration 138

If the remuneration has been contractually agreed to between the employer and the employee, a cutback in remuneration as a consequence of the employee’s refusal to cooperate in internal investigations is out of the question. Such a measure is not provided for under Austrian employment law. However, a cutback in remuneration can still take place if this is done on the basis of a disciplinary measure. aa) Disciplinary measure

Austrian employment law generally differentiates between a (simple) warning (Verwarnung) and a disciplinary measure (Disziplinarmaßnahme) in accordance with § 102 Labor Constitution Act (Arbeitsverfassungsgesetz – “ArbVG”) in the case where an employee violates his/her duties. The terms “discipline” (Disziplin) and “disciplinary power” (Disziplinargewalt) are no longer appropriate under modern employment law. According to the modern understanding of employment law, disciplinary measures are understood as sanctions for an employee’s violation of duties.116 The sanction imposed as a result of such a violation must be understood as a legally permissible disadvantage, which is inflicted on another person with the explicitly declared purpose to punish him/her for his/her misconduct and, at the same time, to prevent him/her and other persons to commit further misconducts.117 This corresponds to the concept of special and general prevention (Spezial- und Generalpra¨vention), which is set forth in Austrian criminal law. The (simple) warning as a measure has a warning function relating to the future, which serves to enforce compliance with the obligations under the employment contract. 140 An employer’s right to impose a disciplinary measure does not result from the employment relationship or the organizational structure of the company alone. Instead, a special basis is required e.g., a law, a collective agreement or a works agreement.118 141 If a company falls within the scope of the company statute (Betriebsverfassung), disciplinary measures are only permissible to the extent that they are provided for in forms of collective legislation, e.g. a collective agreement (industry-wide disciplinary law) or a works agreement (intra-company disciplinary law).119 The employees cannot subject themselves to this disciplinary system by way of their (individual) employment contracts.120 However, on the basis of freedom to contract, companies outside the scope of the company statute may very well determine disciplinary measures vis-a`-vis their employees in the individual employment contracts to the extent that they are not unethical within the meaning of § 879 ABGB. 139

116

Jabornegg/Resch/Strasser, marginal no. 1349. OGH 29.1.1974, 4 Ob 104/73, ZAS 1974, 181 (Tomandl); OGH 6.9.1977, 4 Ob 97/77, Arb 9623; OGH 11.10.1977, 4 Ob 127/77, Arb 9649; OGH 4.3.1980, 4 Ob 36/79, Arb 9860. 118 Lo ¨ schnigg, Arbeitsrecht, 715; here, the individual contract is also performed [sic] as a basis for the application of a disciplinary measure; however, for a measure on the basis of an individual contract see Posch, in: Mazal/Risak, Arbeitsrecht IV, 9. margin no. 54. 119 Kneihs, RdA 2005, 136 f, summarizes this under “Betriebliches Disziplinarrecht”. 120 OGH 6.9.1977, 4 Ob 97/77, DRdA 1978, 139 (Hagen); OGH 28.10.1994, 9 Ob A 192/94, DRdA 1995, 309 (Strasser) = ZAS 1996, 21 (Ku¨rner). 117

Krakow/Petsche

Reemers Publishing Services GmbH O:/Beck/Spehl_Gruetzner/3d/01_Austria.3d from 06.03.2013 09:23:36 3B2 9.1.580; Page size: 160.00mm  240.00mm

B. The 25 key questions in connection with internal investigations

31

The following are examples of disciplinary measures: reprimands, reprisals, 142 ordering legally permissible disadvantages, exclusion from specific voluntary and professional privileges. bb) Withdrawal of remuneration as a disciplinary measure If a law, a collective agreement, or a works agreement provides for a cutback in 143 remuneration as a legally permissible disciplinary measure, the remuneration can be reduced according to this disciplinary measure. However, this only applies to voluntary benefits.121 The cutback must not result in a reduction of the remuneration below the minimum wages agreed to in the collective agreement. The cutback in remuneration is also an option if an employee refuses to cooperate in internal investigations, provided that the cutback in remuneration is expressly provided for as a disciplinary measure under disciplinary law and the affected remuneration is a voluntary benefit of the employer. An intra-company disciplinary law may only be introduced by means of a 144 necessary works agreement.122 The introduction of a disciplinary system is impossible without the consent of the works council. An industry-wide disciplinary law can be determined by the parties to the collective agreement. If such a provision is set forth in the collective agreement, a works agreement, if any, may only specify further details of this provision. If the works agreement is more favorable to the employees than the collective agreement, this must be regarded as permissible unless the collective agreement excludes this favorability principle (Gu¨nstigkeitsprinzip).123 Each specific disciplinary measure, in particular any cutback in remuneration, 145 always requires the works council’s consent (§ 102 ArbVG). It is not necessary to obtain the works council’s consent if only a special panel (disciplinary committee – Disziplinarkommission) has been installed and the works council has expressly consented to the installation of this committee.124 It has not yet been decided what happens to the imposed disciplinary measure if the works council does not consent to the disciplinary measure and no disciplinary committee has been installed. In such case, the imposed disciplinary measure is absolutely invalid because otherwise the purpose of the works council’s cooperation in the disciplinary measure would be made redundant.125 c) Warning With a (simple) warning the employer notifies an employee that he/she has 146 violated his/her obligation to work as specified by law, collective agreement, works agreement, or under the individual employment contract. The purpose of the 121 OGH 29.8.1996, 8 Ob A 2113/96 k, RdW 1997, 167 = ZAS 1997, 81 (Risak) – in its decision dated 29.8.1996, the OGH quotes Spielbu¨chler, in: Floretta/Spielbu¨chler/Strasser, Arbeitsrecht4 I (1998), 169, and also mentions a cutback in remuneration as a disciplinary measure that is possible on the basis of an individual employment contract to the extent that the second part of the ArbVG does not apply; for example, this applies to company officers, which are entitled to a significant influence on the management of the company – § 36 (2) Z 3 ArbVG. 122 OGH 18.12.1979, 4 Ob 123/79, DRdA 1980, 395 (Firlei). 123 Lo ¨ schnigg, Arbeitsrecht, 716. 124 Lo ¨ schnigg, Arbeitsrecht, 716. 125 Lo ¨ schnigg, Arbeitsrecht, 718 supra note 44.

Krakow/Petsche

Reemers Publishing Services GmbH O:/Beck/Spehl_Gruetzner/3d/01_Austria.3d from 06.03.2013 09:23:36 3B2 9.1.580; Page size: 160.00mm  240.00mm

32

§ 1. Austria

(simple) warning is not to punish an employee, but rather to induce the employee to act according to his/her contract. A (simple) warning is not a disciplinary measure within the meaning of § 102 ArbVG. Instead, the (simple) warning without the character of a sanction is a measure to ensure compliance with the agreed to duties and serves as a warning function. An employee is obliged to cooperate in internal investigations; the refusal to cooperate in internal investigations can be sanctioned with a warning. 147 In order to have proof, it is advisable to issue the warning vis-a`-vis an employee for violating his/her duties in written form and not merely orally. If an employee persistently refuses to perform or to comply with the employer’s directions that are justified on the basis of the employment contract, including the cooperation in internal investigations, this constitutes a reason for dismissal (Entlassungsgrund) in accordance with § 27 no. 4 Austrian Employees‘ Act (“AngG”). Persistence is given if the violation of duties was committed several times or if it may be concluded on the basis of an employee’s conduct that the employee will persist in his/her refusal.126 The practice of the Austrian labor and social courts is that three issued warnings for one violation of duties will generally be regarded as a so-called “persistent violation of duties” (beharrliche Pflichtverletzung) by an employee and this suffices to dismiss the employee (see infra para. 148 et seq.). d) Termination of the employment relationship aa) Introduction An employment relationship can be ended in a number of ways. In Austrian working life as well as pursuant to the legal definition, the following use of language prevails: 149 If an employer prematurely ends the employment relationship, this is referred to as early dismissal (vorzeitge Entlassung) or dismissal without notice (fristlose Entlassung). If an employee prematurely ends the employment relationship, this is referred to as early resignation (vorzeitiger Austritt) or resignation without notice (fristloser Austritt). Irrespective of the above, employment relationships may be ended by termination (Ku¨ndigung) as per a specific termination date by observing the respective notice period. Employment relationships with a fixed term (befristetes Arbeitsverha¨ltnis) or subject to a condition (bedingtes Arbeitsverha¨ltnis) end upon expiry of the term or upon satisfaction of the condition, as applicable. The scope of this publication does not allow a discussion of the issue of the adversity to conditions (Bedingungsfeindlichkeit) of employment law and the conditional discharge connected thereto in more detail.127 150 As regards the term “employees:” Austrian employment law still differentiates between white collar workers (Angestellte) and workers performing manual labor (Arbeiter). A white collar worker is an employee who performs predominantly commercial services or office work for the business operations of a company. A worker performing manual labor, on the other hand, is an employee who is 148

126

Cf. OGH 28.4.1981, 4 Ob 38/81; OGH 20.11.1991, DRdA 1992, 289 (Beck–Mannagetta). On the permissibility of a conditional discharge under a so-called “potestative” condition (Potestativbedingung), i. e. a condition whose satisfaction exclusively depends on the will of the recipient of the declaration, see: OGH 25.9.1997, 4 Ob 78/79, Arb 9810; see also hereunder paras. 168 et seq. and supra note 159. 127

Krakow/Petsche

Reemers Publishing Services GmbH O:/Beck/Spehl_Gruetzner/3d/01_Austria.3d from 06.03.2013 09:23:36 3B2 9.1.580; Page size: 160.00mm  240.00mm

B. The 25 key questions in connection with internal investigations

33

regularly employed with (commercial) enterprises and is used for various services, which are different from those of a white collar worker.128 However, the boundaries blur rapidly and the respective legal provisions are continuously adapted. In addition to the exemplary reasons for the dismissal of white collar workers specified in the AngG129 and the exhaustive list for manual workers in the Austrian Industrial Code (Gewerbeordnung, “GewO”)130 other important reasons are recognized that justify the dismissal of an employee. For the purpose of the internal investigations discussed here, in particular 151 § 27 (1) AngG is relevant. According to this provision, a dismissal is possible for disloyalty at work and for lack of trustworthiness of the employee. bb) Disloyalty Disloyalty at work is an intentional violation of the employer’s business interests 152 which is committed in breach of the employee’s duties. The intent must not only be directed at the activities that cause the violation, but must also include endangering the business interests of the employer.131 It is sufficient if the employee considers it a possibility that the result will occur and accepts this (dolus eventualis). The action causing the disloyalty does not have to take place while working but they must be connected to the work performed under the employment relationship.132 Should an employee refuse to cooperate in internal investigations and should this 153 endanger the business interests of the employer (this will regularly be the case), and should the employee in addition be aware of this breach of duties, then the employee would fulfil the prerequisites necessary for disloyalty which constitutes a reason for dismissal. In this regard, it is not necessary that the employee had the intention to cause damage, that damage occurred, or that the employee’s actions are liable for prosecution.133 Employees do not have to incriminate themselves within the scope of internal 154 investigations. There is no obligation to incriminate oneself under Austrian law.134 If an employee knows that a colleague committed a criminal offence or a serious breach of duty, this falls within the scope of the reporting obligation described in paras. 130 et seq. If an employee does not report such a breach of duty or other criminal offences to the employer, irrespective of whether the breach lies within the scope of the internal investigations or not, the employer may dismiss the employee for lack of trustworthiness (see supra paras. 74 et seq. and paras. 97 et seq.).135 128 It is not possible to describe in detail the difference between white collar workers and manual workers within this scope. 129 For example: the employee’s disloyalty at work; inability of the employee to perform the agreed to work; independent enterprise of the employee without the employer’s consent; persistent refusal by the employee to perform his duties; incapacity to work; physical assault against the employer or colleagues. 130 These are: persistent refusal to perform ones duties; permanent inability to work; gross libel; imprisonment, side businesses, unauthorized abandonment of the place of work; inability to perform one’s duties, lack of trustworthiness. 131 OGH 29.1.1997, 9 Ob A 10/97 d, RdW 1998, 30. 132 LG Salzburg 10.2.1987, 40 Cga 7/87, Arb 10.590. 133 Kuderna, 82. 134 ASG Wien 8.1.2002, 27 Cga 141/00 b, ARD 5388/5/2003. 135 Cf. OGH 25.9.1984, 4 Ob 83/83, ZAS 1986, 49 (Grillberger).

Krakow/Petsche

Reemers Publishing Services GmbH O:/Beck/Spehl_Gruetzner/3d/01_Austria.3d from 06.03.2013 09:23:36 3B2 9.1.580; Page size: 160.00mm  240.00mm

34

§ 1. Austria

Depending how significant the lack of trustworthiness was which caused this failure to report, the employer may leave it to issuing a warning. cc) Lack of trustworthiness An employee lacks trustworthiness if he/she commits an act or fails to commit an act, which makes the employee seem unworthy of the employer’s trust with regard to company matters. In contrast to disloyalty, the lack of trustworthiness may also result from negligently committed actions. The employer must fear that an employee will no longer comply with his/her duties in a confidential manner and therefore would endanger the business interests of the employer.136 The actions causing the lack of trustworthiness must generally take place during working hours. The refusal to cooperate with internal investigations is generally suitable to cause the employer to view an employee untrustworthy. It must be closely examined on a case-by-case basis whether an employer may in fact regard an employee as untrustworthy. More stringent requirements are applied to employees in executive positions (company officers) than to non-executive employees.137 156 In cases with significant consequences, the employer may already view the employee as untrustworthy, if the employee only refuses to cooperate once. However, when added up, repeated refusals that do not have a significant effect on the trust between employee and employer may also result in a lack of trustworthiness and may ultimately lead to the dismissal of the employee.138 If an employee persistently refuses to cooperate in internal investigations, this can destroy the trust between employer and employee and may result in the dismissal of the employee, if the employer cannot reasonably be expected to continue the employment relationship. 157 If the refusal of the employee to cooperate in internal investigations merely shakes the employer’s trust, no lack of trustworthiness exists and hence there is no cause for dismissal. 158 The early termination of an employment relationship by way of dismissal must always be the last resort (ultima ratio). Prior to dismissing an employee due to his/ her refusal to cooperate in internal investigations, it is recommended (if possible) to resort to milder measures. Examples for such milder means are: issuing a warning or cutting back the remuneration if such a cutback of remuneration on the basis of a disciplinary measure is provided for within the company. 155

2. Is the suspicion of a criminal offence or a severe violation of duty sufficient for an extraordinary dismissal? 159

Employers are able to dismiss employees for a criminal offence against property since it is usually assumed that the employee concerned is not trustworthy and that, as a result, his/her employer cannot be reasonably expected to continue the employment relationship. Attempted theft or embezzlement only constitutes a reason for dismissal if the employee no longer has the employer’s trust. If, for instance, an employee attempts to steal from one of the customers directly attended to by his/ her employer, the employer has reason to terminate the employment relation136

Cf. Lo¨schnigg, Arbeitsrecht, 519, 520 supra note 98. OGH 21.2.1978, 4 Ob 11/78, DRdA 1978, 259. 138 OGH 4.7.1978, 4 Ob 63/78, DRdA 1978, 361. 137

Krakow/Petsche

Reemers Publishing Services GmbH O:/Beck/Spehl_Gruetzner/3d/01_Austria.3d from 06.03.2013 09:23:37 3B2 9.1.580; Page size: 160.00mm  240.00mm

B. The 25 key questions in connection with internal investigations

35

ship.139 A conviction for the criminal offence is not required. For an employee’s dismissal it is sufficient if he/she has committed an offence that qualifies as punishable (by courts or administrative authorities) under the applicable rules of law.140 However, it is important whether or not the employee’s behavior has objectively given the employer reason to fear that its interests are jeopardized.141 Criminal offences without any direct relation to the employment relationship 160 only result in a lack of trustworthiness if the employer can no longer be reasonably expected to continue the employment relationship. This needs to be investigated with particular attention on a case-by-case basis.142 The mere suspicion of a criminal offence generally does not constitute reason for 161 dismissal.143 The suspicion of theft, however, justifies an employee’s dismissal if the suspicion is based on circumstances that are so severe that the employee’s loyalty and reliability must be doubted by the employer. If this is the case the employer cannot be expected to continue the employment relationship.144 In the event that an employee strongly suspects that one of his/her colleagues is engaged in grand theft from his/her employer and fails to report his/her suspicion to the employer, then this behavior constitutes a reason for the employee’s dismissal for lack of trustworthiness (see supra paras. 155 et seq.).145 In the event of a breach of duty, employers may generally dismiss employees. 162 Whether or not a breach of duty qualifies as a so-called serious breach of duty has to be established on the basis of an analysis of the overall circumstances.146 (see supra paras. 155 et seq.). A breach of the duty of loyalty or the obligation to work, for instance, is qualified as a breach of duty.147 3. During which period of time must an extraordinary notice of dismissal be given to employees whose misconduct has been revealed by the internal investigations? Notice of dismissal must be given without delay (unverzu¨glich), i. e. without undue 163 delay (schuldhaftes Zo¨gern). Employers must not hold off on giving notice of dismissal for such a long time that the employee is led to believe that his/her employer will not exercise its right of dismissal.148 Employers lose their right of dismissal if they fail to exercise such right without undue delay because the right of dismissal extinguishes as a consequence of waiver or forfeiture, or if the employer can reasonably be expected to continue the employment relationship with the employee despite the right of dismissal. Whether or not the notice of dismissal is given without delay must be evaluated subject to the respective operational conditions and the respective economic life.149 The time it takes for the employer to reach a decision 139

OGH 1.9.1999, 9 Ob A 219/99 t, RdW 2000, 150. OGH 11.3.1998, 9 Ob A 14/98 v, RdW 1998, 696. 141 Ris-Justiz RS 0060407. 142 Dusak, RdW 1988, 355 et seqq. 143 Kuderna, 63 et seqq; Willhelm, WBl 1988, 66; OGH 14.10.1980, 9 Os 50/80, Arb 9906. 144 Dittrich/Tades, E 45 zu § 27 AnbG – ArbG Wien 7.4.1965, SozM I A d 665. 145 Cf. OGH 25.9.1984, 4 Ob 83/83, ZAS 1986, 49 (Grillberger). 146 OGH 29.9.1999, 8 Ob A 164/99 d; ecolex 2000/103, 224. 147 Supra note 130 and supra note 131 and the duties of an employee that are listed therein. 148 OGH 30.3.1982, 4 Ob 98/81, DRdA 1984, 10 (Apathy). 149 OGH 12.7.1995, 9 Ob A 109/95, RdW 1996, 178. 140

Krakow/Petsche

Reemers Publishing Services GmbH O:/Beck/Spehl_Gruetzner/3d/01_Austria.3d from 06.03.2013 09:23:37 3B2 9.1.580; Page size: 160.00mm  240.00mm

36

164

165

166

167

§ 1. Austria

within the company is always taken into account. Employers become aware of a reason for dismissal when they have obtained knowledge of the details essential for an evaluation of the corresponding facts and circumstances.150 If an executive employee in charge of human resource matters becomes aware of a reason for dismissal, then the employer will also be considered to be aware of such circumstances.151 If the facts and circumstances justify a delay in giving notice of dismissal, the right of dismissal is not forfeited. However, if the reasons for dismissal are obvious, a notice of dismissal to the employee concerned must be given without delay.152 Employers are granted a reasonable period of time to consider a dismissal carefully and obtain both legal advice and a statement from the employee concerned. Decisions made in individual cases demonstrate that notice of dismissal can be belated if fourteen or only six days have passed after the reason for the dismissal is known.153 The final decision on whether notice of dismissal is given within a reasonable period of time is made in consideration of the organizational structure of the company and the time it usually takes for the company to reach a decision. If the facts are dubious and non-transparent and the employer is unable to clarify them on its own, the employer may hold off on giving notice of dismissal until the facts have been clarified (with the help of the competent authority when necessary).154 It is, however, advisable to suspend the employee in the meantime.155 In the event that an employee is on vacation, notice of dismissal has been given in time if it is given immediately after the employee has returned to work.156 If by refusing once to cooperate in an internal investigation the employer’s trust in its employee has not suffered to the extent that it would qualify as a reason for dismissal, and if such state is not reached until the employee has repeatedly refused to cooperate in internal investigations, notice of dismissal must be given without delay after the refusal of cooperation which led to the ultimate loss of trust. 4. Must an employee cooperate in an internal investigation even after he/she has been given notice of dismissal?

After notice of dismissal has been given to an employee and the period of notice applicable in the respective case has been complied with, the employment relationship terminates on the last day of the employment relationship; the so-called termination date (Ku¨ndigungstermin). Until such date, the employment relationship continues to exist and the employee must fulfil all of his/her duties within the employment relationship. Employees are obliged to perform their services as well as to cooperate in internal investigations. 169 However, during the period of notice an employee’s presence can be referred to as “diluted” (verdu¨nnt). Employees who have been given notice of dismissal by their 168

150

OGH 17.4.1997, 8 Ob A 3/97 t, RdW 1998, 26. OGH 12.3.1998, 8 Ob A 27/98 y, RdW 1998, 476. 152 OGH 30.3.1982, 4 Ob 98/81, DRdA 1984, 10 (Apathy). 153 OGH 20.9.2000, 9 Ob A 185/00 x, ARD 5193/31/2001; OGH 16.12.2005, 9 Ob A 151/05 d, ARD 5697/12/2006. 154 OGH 30.3.1982, 4 Ob 98/81, DRdA 1984, 10 (Apathy). 155 For more information on the suspension of physicians and the corresponding cutbacks in ¨ rzten, RdM 2006, 174. remuneration see: Risak, Die Suspendierung von A 156 Kuderna, 17. 151

Krakow/Petsche

Reemers Publishing Services GmbH O:/Beck/Spehl_Gruetzner/3d/01_Austria.3d from 06.03.2013 09:23:37 3B2 9.1.580; Page size: 160.00mm  240.00mm

B. The 25 key questions in connection with internal investigations

37

employer must be released from their duties for one fifth of their normal weekly hours of work so that they can look for a new job (“job-hunting days”) (Postensuchtage), but, are nevertheless, still obliged to cooperate in internal investigations. Employees do not have to furnish proof to the fact that they actually applied for a new position in the time granted for job hunting. Employers are not allowed to reduce remuneration on grounds of the reduced amount of work performed by the employee as a consequence of job hunting.157 If notice of termination is given by the employee he/she does not have the right to be released from his/her duties. In the event that an employer releases an employee from his/her duties during the period of notice, the employee is no longer obliged to offer his/her services to the employer but must still cooperate in internal investigations until the termination date. This is owing to the fact that the employment relationship still exists. In the event of a dismissal with undue notice (terminwidrige Ku¨ndigung) the employment relationship and hence the obligation to cooperate in internal investigations continues to exist until the next-possible (proper) termination date due to the fact the employment relationship does not end until such a date. If the employee does not cooperate in internal investigations during these periods this might give the employer a reason for dismissal (see supra paras. 148 et seq.). If there has been a reason for an employee’s dismissal, the employment relationship will end as soon as the employer gives notice of dismissal and the employee receives such notice. As a consequence of the termination of the employment relationship, the obligation to cooperate in internal investigations ends on the same day. In the event of a conditional dismissal (bedingte Entlassung) the dismissal is subject to certain conditions. As a general rule, according to Austrian Law, the satisfaction of certain conditions results in the nullity of a declaration of intent and hence of a dismissal. However, this is not the case if the satisfaction of the condition depends on the will of the recipient of the declaration (e.g. the employee).158 In the event that an employee is given notice of dismissal subject to a condition that can be fulfilled by the employee himself/herself, and if the dismissal is revoked upon fulfilment of such condition, the employee is obliged to cooperate in internal investigations during this period of time because the employment relationship has not been terminated. If an employer gives notice of dismissal vis-a`-vis an employee on condition that the dismissal is subject to the employee’s cooperation in internal investigations (e.g. that the employee must cooperate in an internal investigation within seven days because he/she is obliged to cooperate in internal investigations and his/her refusal to cooperate constitutes a reason for dismissal), the employee himself/herself can influence such a condition by making his/her own decision on how to act. If this is the case, employees are obliged to cooperate in internal investigations until the condition occurs/is fulfilled. Linking a dismissal to a time limit is subject to many restrictions because, as a general rule, notice of dismissal must be given without delay. After the dismissal 157

Lo¨schnigg, Arbeitsrecht, 598. The OGH, for instance, accepted a dismissal that was not supposed to become legally effective unless the employee failed to disclose the reasons why he did not show up in writing by a certain date, OGH 25.9.1979, 4 Ob 78/79, DRdA 1981, 299 (Fenyves) = ZAS 1981, 100 (Schrank). 158

Krakow/Petsche

170

171

172

173 174

175

176

177

Reemers Publishing Services GmbH O:/Beck/Spehl_Gruetzner/3d/01_Austria.3d from 06.03.2013 09:23:38 3B2 9.1.580; Page size: 160.00mm  240.00mm

38

§ 1. Austria

date the employment relationship continues for a certain period of time which is, however, shorter than the “normal” period of notice. Such a dismissal is only possible if the recipient of the declaration (employee) has an overriding interest in the setting of the period of notice.159 In principle, the granting of a certain period of time after the notice of dismissal has been given indicates that “good cause (for dismissal)” is irrelevant. If notice of dismissal is given with effect as per a later point in time, it requires a close examination of the circumstances that substantiate a continuation of the employment relationship with the employee for a certain period of time but rule out a continuation of the employment relationship until the period of notice has expired.160 To the extent that notice of dismissal can be given is subject to a time limit, employees are also obliged to cooperate in internal investigations during the period from the date the notice of dismissal is given/received, and the date the employment relationship actually ends.

V. Use of the obtained information 1. Is it permissible to disclose the findings and information obtained within the scope of any internal investigation to other group companies? a) Definitions161 178

The following section is structured in such way so that it is also possible to continue reading infra paras. 196 et seq. and to read the “interim part” only if necessary. aa) Controller

179

Controllers (Auftraggeber) within the meaning of the Austrian Data Protection Act (Datenschutzgesetz – “DSG”) are natural or legal persons, groups of persons (general commercial partnership (Offene Gesellschaft, OG), limited commercial partnership (Kommanditgesellschaft, KG), civil law partnership (Gesellschaft bu¨rgerlichen Rechts, GesbR) or organs of a territorial corporate body (Gebietsko¨rperschaft) if they decided to process data for a specific purpose alone or jointly with others. The processing can be done by the controller itself or by third parties. The controller is the so-called “master of the data”.162 bb) Data subject

180

Data subject (Betroffener) within the meaning of the DSG is any natural or legal person or any group of persons not identical with the controller, whose data is processed.

159

LG Feldkirch 26.6.1984, Arb 10.342. OGH 14.9.1982, 4 Ob 84/82, DRdA 1985, 200. 161 Providing a clear overview on the Austrian Data Protection Act (DSG): Graf, Datenschutz¨ berblick (2004). recht im U 162 Graf, 37. 160

Krakow/Petsche

Reemers Publishing Services GmbH O:/Beck/Spehl_Gruetzner/3d/01_Austria.3d from 06.03.2013 09:23:38 3B2 9.1.580; Page size: 160.00mm  240.00mm

B. The 25 key questions in connection with internal investigations

39

cc) Personal data The DSG exclusively applies to the processing of personal data (personenbezogene 181 Daten) (§ 4 no. 1 DSG). Personal data is any information on data subjects, whose identity is identified or identifiable (also by third persons).163 This term also covers “indirect” personal data, which the user can only trace back 182 to a person by illegal means. Unlike personal data, indirect personal data is subject to the following facilitations: (i) When transmitting data, secrecy interests deserving protection are not infringed. (ii) The processing of the data is not subject to the duty to notify. (iii) The transmission and transfer to a foreign country is not subject to the requirement of approval. The DSG does not apply to so-called anonymous data, which does not allow the identification of a person. dd) Sensitive data Sensitive data (sensible Daten) are data relating to natural persons concerning 183 their racial or ethnic origin, political opinion, trade-union membership, religious or philosophical beliefs, and data concerning health or sex life (according to § 4 (2) DSG). The use of such data is generally prohibited unless otherwise provided in non-constitutional laws (einfache Gesetze) and unless at the same time appropriate guaranties are established to protect the data subjects‘ interests in secrecy. ee) Non-sensitive data with increased protection Data on criminal offences punishable by the courts or administrative authorities 184 does not constitute sensitive data, but does however enjoy a higher level of protection. The use of this data does not infringe interests in secrecy deserving protection if (i) there is an explicit legal authorization or obligation to use this data (e.g. the weapons act (Waffengesetz), the criminal records act (Strafregistergesetz)); or (ii) the use is a material requirement for the performance of statutory duties; or (iii) the permissibility results from statutory duties of care or the overriding legitimate interests of the controller and the safeguarding of the data subject’s interests is, therefore, ensured. ff) Use of data The DSG specifies “use of data” (Verwendung von Daten) as any kind of 185 operation with data of a data application, i. e. the processing and transmission of this data. “Processing” (Verarbeiten) means any kind of operation with data, i. e. the collection, recording, storing, keeping, sorting, comparing, modification, interlinking, reproduction, consultation, output, utilization, committing, blocking, erasure ¨ bermitteln) does not only mean the transfer of and destruction. “Transmission” (U data to other recipients than the data subject but also the use of data for another application purpose of the controller.

163

Personal data may, inter alia, be: date of birth, residence (address), fingerprints, photographs or audiotape recordings – Knyrim, 14, refers to this data as “normal” data.

Krakow/Petsche

Reemers Publishing Services GmbH O:/Beck/Spehl_Gruetzner/3d/01_Austria.3d from 06.03.2013 09:23:38 3B2 9.1.580; Page size: 160.00mm  240.00mm

40

§ 1. Austria

b) Transmission of data to group companies in Austria aa) Controller’s registered office located in Austria 186

If the controller of the data application has its registered office in Austria and if the data obtained by means of internal investigations is transferred to or stored with a subsidiary or the parent company in Austria, the provisions of the DSG apply. bb) Controller’s registered office located in a member state of the EC

If the controller has its registered office in a member state of the EC and if the personal data is used in Austria, it must be differentiated whether the data application serves the purposes of an establishment of the controller in Austria (application of the DSG – use of data in Austria), or whether the data application does not serve the purposes of an establishment of the controller located in Austria. In this case, the law of the country in which the controller has its registered office is applicable. (In this regard we refer to the respective country-specific statements contained in this publication; on the transmission of data within Europe, see infra paras. 199 et seq.). 188 Pursuant to § 4 no. 15 DSG, an establishment is any organizational unit set apart in terms of location und function by fixed facilities at a specific place (with or without the status of a legal person) which carries out activities at the place where it is set up. 187

cc) Permissibility of the transmission of data The transmission of data is covered by the term use of data. According to the DSG, each use of data must undergo a permissibility assessment comprising of two steps. First, the purpose of the use of data must be assessed; then, it must be determined whether secrecy interests deserving protection are infringed. In doing so, it must be differentiated whether the data in question is sensitive or not. The infringement of the fundamental right to data protection is only allowed within the required scope and with the mildest means possible (proportionality). 190 Purpose and content of the data collected by the internal investigations are covered by the legal authority of the controller (employer) (regarding the reasons, please see supra paras. 125 et seqq.). The collected data must be adequate for the purpose and may not be excessive in relation to the purpose. The data must also be factually accurate. If the use of the data is inadmissible, a transmission must be ruled out in any case. 191 If the use of data is permissible, it must be further be examined whether the data subject’s secrecy interests deserving protection are infringed. 192 According to § 8 (1) DSG, in the case of non-sensitive data, secrecy interests deserving protection are not infringed if (i) there is an explicit legal authorization or obligation to use this data; or (ii) the data subject has given his/her consent, which can be revoked at any time; or (iii) vital interests of the data subject require the use; or (iv) overriding legitimate interests pursued by the controller or a third party require the use of the data. 189

Krakow/Petsche

Reemers Publishing Services GmbH O:/Beck/Spehl_Gruetzner/3d/01_Austria.3d from 06.03.2013 09:23:39 3B2 9.1.580; Page size: 160.00mm  240.00mm

B. The 25 key questions in connection with internal investigations

41

According to § 8 (3) DSG, in the case of non-sensitive data, secrecy interests 193 deserving protection are not infringed due to overriding legitimate interests of the controller or a third party (§ 8 (1) no. 4 DSG) if the use of the data (i) is an essential requirement for a controller of the public sector to exercise a legally assigned function; (ii) is performed by a controller of the public sector in fulfilment of its obligation to provide inter-authority assistance (Amtshilfe); (iii) is required to protect the vital interests of a third party; (iv) is necessary for the fulfilment of a contract between the controller and the data subject; (v) is necessary for establishing, exercising or defending legal claims of the controller before a public authority and if the data was collected legitimately; (vi) exclusively concerns the exercise of a public office by the data subject. In accordance with § 9 DSG, sensitive data is generally subject to a prohibition to 194 process. The quoted provision stipulates thirteen exceptions. The exceptions that are the most important ones for this topic are listed below: The use of sensitive data does, inter alia, not infringe secrecy interests deserving protection if (i) the data is used only in indirect personal form; (ii) the authorization or obligation to use the data is stipulated by legal provisions; (iii) the data subject has given his/her express consent, which can be revoked at any time, the revocation making any further use of the data illegal; (iv) the use is necessary for establishing, exercising or defending legal claims of the controller before a public authority and if the data was legitimately transmitted; (v) the use is required to account for the rights and duties of the controller in the field of employment law and civil service regulations, and is legitimate according to specific legal provisions; the rights of the works councils according to the ArbVG with regard to the use of data remain unaffected. If a use of data is ruled out due to the data subject’s secrecy interest deserving 195 protection, the transmission of data is inadmissible as well. An additional restriction for the use of data is set forth in § 6 (1) DSG. According to this provision, data may only be used “fairly” and “lawfully” and may only be “collected for specific, explicit, and legitimate purposes” and may not be used “in a way incompatible with those purposes”. dd) Summary In summary, one can say that a use (processing and/or transmission) of personal 196 data is only permissible if one of the exceptions provided for in the DSG is fulfilled. This applies if (i) a legal provision exists, that expressly authorizes or obligates the controller to use the data. (ii) the data subject gave his/her consent (it is required that a detailed description of the types of data, the recipients of the transmission and the purpose of the processing and transmission of data is provided).164 The consent must have

164

Cf. Pfarl, ecolex 2005, 569.

Krakow/Petsche

Reemers Publishing Services GmbH O:/Beck/Spehl_Gruetzner/3d/01_Austria.3d from 06.03.2013 09:23:39 3B2 9.1.580; Page size: 160.00mm  240.00mm

42

§ 1. Austria

been given without any constraint. There is no requirement of writing; written form is only required in case of doubts and when transmitting sensitive data.165 (iii) the use of data is in the overriding legitimate interest of the controller. Such an interest exists, for example, if the use of the data is necessary for the fulfilment of a contract between the controller and the data subject. (§ 8 (3) no. 4 DSG). This means that in case of an employee database, for example, the use of data is permissible without the employees‘ consent insofar as this is required for the administration of the employees‘ vacation days or for payroll accounting purposes or if the use of the data generally serves to fulfil contractual entitlements. 197 Where the data subject has an interest in secrecy, which deserves protection, the use of data will be punished, with a prison sentence of up to one year (in accordance with § 51 DSG). The prosecution of the offence requires the authorization of the data subject. 198 According to the legal provisions on administrative offences, a penalty in the amount of up to EUR 18,890 can be imposed if certain legal requirements of offences specified in § 52 DSG are fulfilled. c) Transmission of data to group companies in Europe and to countries with “adequate” data protection In accordance with § 12 (1) DSG, the movement of data within the EC is not subject to any authorization requirements. However, data may only be transmitted if it originates from a permitted use of data and the recipient has satisfactorily demonstrated its statutory competence or legitimate authorization with regard to the purpose of the transmission to the transmitting party (§ 7 (2) DSG). Furthermore, purpose and content of the transmission may not infringe the data subject’s interest in secrecy deserving protection. 200 The transmission of data to recipients (group companies) in member states of the EC and the transmission to recipients (group companies) to countries outside the EC (third countries) do not require authorization if these countries ensure an adequate protection of data (§ 12 DSG). Those countries which have an adequate level of data protection are specified in an ordinance (Verordnung) of the Federal Chancellor (Bundeskanzler).166 The USA does not qualify as a country in which an adequate level of data protection is ensured (however, please see the next section, according to which companies may subject themselves to the Safe Harbor requirements). 201 However, the basic requirement for any data transmission to foreign countries is always the legal use of data in Austria in accordance with § 7 DSG. 199

d) Transmission of data to group companies outside Europe 202

The transmission of data to foreign countries does not require authorization (without consent of the data protection commission (Datenschutzkommission “DSK”)) if (i) the data has been lawfully published in Austria; 165

Cf. Mayer-Scho¨nberger/Brandl, 64. See therefore the so called “Datenschutzangemessenheits-Verordnung” (“DSAV”), BGBl. II Nr. 521/99 (the DSAV lists Switzerland and Hungary as countries with an adequate level of data protection); in the meantime, Hungary has become a member state of the European Union, therefore, its mention in the DSAV is set aside in substance. 166

Krakow/Petsche

Reemers Publishing Services GmbH O:/Beck/Spehl_Gruetzner/3d/01_Austria.3d from 06.03.2013 09:23:39 3B2 9.1.580; Page size: 160.00mm  240.00mm

B. The 25 key questions in connection with internal investigations

43

(ii) data is transferred or committed that is only indirectly personal to the recipient; (iii) the data subject has without any doubt given his/her consent to the transmission or committing to foreign countries; (iv) a contract between the controller and the data subject or a third party that has been concluded clearly in the interest of the data subject cannot be fulfilled except by the transmission of data to foreign countries; (v) the transmission is necessary for establishing, exercising or defending legal claims before a foreign authority and the data was legitimately collected; (vi) the transmission or committing is expressly listed in a standard ordinance (Standardverordnung) or model contract (Mustervertrag); (vii) the transmissions or committing are made from data applications that are exempted from notification. As already mentioned, the basic requirement for any data transmission to foreign countries is the legal use of data in Austria in accordance with § 7 DSG. If the requirements for an exemption from authorization are not fulfilled, the controller would have to obtain the DSK’s authorization prior to transmitting or committing data to foreign countries in order to meet the requirements of the DSG. However, the Austrian legislature has not yet responded to very important developments in Community law. The European Commission has acknowledged that Argentina, Canada, Switzerland, Guernsey and the Isle of Man have an adequate level of data protection.167 In addition, data recipients who are subject to the Canadian data protection act168 as well as companies who subjected themselves to the Safe Harbor requirements have an adequate level of data protection.169 The Safe Harbor framework consists of an agreement in principle, entered into by the US Department of Commerce and the European Commission from July 2000, which contains certain data protection principles and to which US companies may accede to on a voluntary basis.170 Furthermore, the EC issued standard contractual clauses (“SCC”).171 These substantiate the permissibility under data protection laws of a data transfer from a member state of the EC to a data recipient having its registered office in a third country, and who would otherwise not be considered to have an adequate level of data protection.172 Until today, the Austrian legislature has not transformed the above-described developments into Austrian law. However, this does not necessarily mean that they may be disregarded in the Austrian data protection laws. Irrespective of the question regarding the priority of application of Community law, it must be stated that § 13 (2) no. 1 and § 2 DSG already stipulate that the authorization of a cross167 KOM 30.6.2003, K(2003) 1731; KOM 2002/2/EG, ABl 2002 L2/13; KOM 2000/518/EG, ABl 2000 L 251/1; KOM 2003/821/EG, ABl 2003 L 308/27; KOM 2004/411/EG, ABl 2004 L 151/51. 168 Personal Information Protection and Electronic Documents Act (“PIPEDA”), available on the website: http://laws.justice.gc.ca/en/showtdm/cs/P-8.6. 169 KOM 2002/2/EG, ABl 2002 L 2/13 (PIPEDA, by the Commission referred to as “Canadian Law”) und KOM 2000/520/EG ABl 2000 L 215/7 (referred to as “Safe Harbor”). 170 The index containing the so called „Safe Harbor companies is available on the website of the US Department of Trade Ministry: www.export.gov/safehrbr/list.aspx. 171 KOM 2001/497/EG, ABl 2001 L 181/19; KOM 2002/16/EG, ABl 2002 L 6/52; KOM 2004/915/ EG, ABl 2004 L 385/74. The SVK’s are available on the website of the Austrian data protection commission: www.dsk.gv.at/site/6208/default.aspx. 172 Leissler, Und die Daten fließen u ¨ ber den Atlantik …, ecolex 2007, 747–748.

Krakow/Petsche

203

204

205

206

207

Reemers Publishing Services GmbH O:/Beck/Spehl_Gruetzner/3d/01_Austria.3d from 06.03.2013 09:23:39 3B2 9.1.580; Page size: 160.00mm  240.00mm

44

§ 1. Austria

border data transfer may only be granted if an adequate level of protection exists in the individual case or if the controller can satisfactorily demonstrate that the interests in secrecy deserving protection of the data subject of the planned data exchange will also be respected outside of Austria.173 208 Therefore, at the moment no authorization must be obtained from the DSK if the parent of the group is a Safe Harbor company included in the US Department of Commerce’s list174 or if the data recipient is subject to the PIPEDA.175 Should an application be filed with the DSK for an authorization of the transmission of data to a Safe Harbor company, this application will be rejected because such a transmission is not subject to the authorization requirement.176 209 However, if data is transmitted to a parent company that is neither subject to the PIPEDA nor a Safe Harbor company, the transmission by using the SCC must be formally authorized by the DSK.177 In practice, however, “simplified” proceedings for issuing the authorization usually take place because the adequacy of the level of protection on the part of the data recipient is regularly assumed by the DSK when using the SCC.178 The Safe Harbor listing of a (US) company does not exempt its Austrian subsidiary from complying with the requirements for admissibility of the use of data specified under Austrian data protection laws (cf. supra paras. 178 et seq. and paras. 186 et seq.). 2. Is it obligatory, permissible and advisable to forward the findings and information obtained within the scope of any internal investigations to public authorities? a) Obligation to transmit personal data to public authorities If the public authority is legally authorized to request the disclosure of data because the public authority can only perform the functions assigned to it with this data, the concerned company is obliged to disclose the data. The data transmitted on this basis may only be processed insofar as the controller is authorized to do so on the basis of statutory competence or legitimate authority, and the interests in secrecy deserving protection of the data subject are not infringed (§ 7 (1) DSG). For this to be the case, the data must originate from an admissible data application, the recipient must have satisfactorily demonstrated that it has sufficient statutory competence or legitimate authority, and the data subjects‘ interests deserving protection are not infringed by the transmission of data (§ 7 (2) DSG). On the question of when interests in secrecy deserving protection in case of non-sensitive or sensitive data are not infringed, see supra paras. 189 et seq. 211 The public authority is obliged to satisfactorily demonstrate the purpose of the transmission if it is authorized by law to request the transmission. Therefore, it must 210

173

Leissler, Id. at 748. Cf. DSK 5.4.2006, K178.205/0007-DSK/2006; 9.6.2006, K178.206/0007-DSK/2006. 175 Cf. therefore supra note 170. 176 Cf. DSK 9.6.2006, K178.206/0007-DSK/2006. 177 Cf. Knyrim, 136. 178 Leissler, ecolex 2007, 749. 174

Krakow/Petsche

Reemers Publishing Services GmbH O:/Beck/Spehl_Gruetzner/3d/01_Austria.3d from 06.03.2013 09:23:40 3B2 9.1.580; Page size: 160.00mm  240.00mm

B. The 25 key questions in connection with internal investigations

45

be concluded a maiore ad minus that the public authority is also obliged to provide satisfactory evidence if it wants the data to be transmitted on a voluntary basis. As regards to the restrictions applicable to the transmission of information on 212 criminal offences or omissions punishable by courts or administrative authorities see supra para. 183. In this context, mention should be made of the notification requirement as 213 specified in § 78 of the Austrian Criminal Procedure Law (Strafprozessordnung, “StPO”).179 If internal investigations are to be carried out by/in a public office or authority within the scope of sovereign public administration (Hoheitsverwaltung) and if a criminal offence is suspected, the public authority or office is obliged to report this to the criminal investigation department (Kriminalpolizei) or the public prosecutor’s office (Staatsanwaltschaft). If public offices or authorities are active in the area of private commercial administration (Privatwirtschaftsverwaltung), the obligation does not apply.180 For legal persons under private law, the notification requirement does not generally apply. The notification required pursuant to § 78 StPO only applies to offences prosecuted ex officio (Offizialdelikte). For special types of criminal offences such as, for example, the suspicion of 214 money laundering or terrorist financing, there is also a notification requirement for (legal/natural) persons under civil law. For example, casinos, finance and credit institutions as well as lawyers, notaries, independent accountants (Wirtschaftstreuha¨nder) etc. are obliged to report such activities. In the context of this publication, we cannot address in more detail further notification requirements that are specific to a certain profession. b) Is it advisable to voluntarily disclose data to public authorities? If internal investigations reveal that certain legal provisions have been violated, it 215 must be balanced whether the voluntary transmission of data (i) is necessary or advantageous for the relationship to the public authority; (ii) is necessary and/or expedient for the positioning of the company with regard to public relations; (iii) is necessary and/or expedient for the trust between potential contracting partners. This evaluation must be performed by the management or the authorized 216 department. It seems that it is not always advisable to voluntarily transmit such data to a public authority. It is however advisable to closely evaluate each transmission on a case-by-case basis. In the end, it is rather a strategic and tactical decision of the management. Nevertheless, the above-described restrictions of the DSG may not be disregarded when transmitting data.

179 The notification requirement in accordance with § 78 StPO should not be confused with the reporting obligation of the employee that derives from the duty of loyalty (see supra paras. 130 et seq.). 180 Cf. Schwaighofer, in: Fuchs/Ratz, § 78 marginal no. 8; as a rule, a public authority is active in civil commercial administration if it uses the legal forms of private law, in particular the form of a contract (See therefore also: Walter/Mayer/Kucsko-Stadlmayer, marginal no. 560, 588).

Krakow/Petsche

Reemers Publishing Services GmbH O:/Beck/Spehl_Gruetzner/3d/01_Austria.3d from 06.03.2013 09:23:40 3B2 9.1.580; Page size: 160.00mm  240.00mm

46

§ 1. Austria

3. Are the findings made in the scope of internal investigations subject to the attorney-client privilege? a) No right to refuse to give evidence of in-house counsels who are involved in internal investigations In-house counsels are not attorneys (Rechtsanwalt) within the meaning of the Austrian rules of the profession. In contrast, attorneys are such persons that fulfil the requirements of practicing as an attorney and are registered with the register of Austrian attorneys in accordance with §§ 1, 5, 5 a of the Austrian Attorneys’ Code (Rechtsanwaltsordnung, “RAO”). 218 Unlike “external” attorneys, in-house counsels do not have the right to refuse to give evidence in civil or criminal proceedings.181 However, they may still invoke a business secret or professional secrecy or a confidentiality obligation if they are subject to such an obligation (banking secrecy, official secrecy – the so-called “Amtsverschwiegenheit”).182 217

b) The right to refuse to give evidence of external advisers If external advisers (for example attorneys, auditors) carry out internal investigations, the confidentiality obligations under the respective rules of the profession apply to the obtained information.183 The persons who are obliged to maintain secrecy may refuse to give evidence if they are entrusted with matters due to their professional capacity or if they otherwise gain knowledge of facts in regard to which their client has an interest in confidentiality. 220 The client can exempt the attorney from the confidentiality obligation with regard to facts the attorney has been entrusted with and facts that have otherwise become known and in regard to which the client has an interest in confidentiality. 221 An exemption within the first case group (“entrust”) is undisputed and may also be made implicitly. Within the second case group (“facts which have become otherwise known and in regard to which the client has an interest in confidentiality”), despite an (implied) exemption by the client, the attorney must review whether the client should fear detrimental effects due to disclosure of the secrets which the client is not necessarily aware of.184 If this is the case, the attorney must refuse to give evidence in respect to these facts. 222 The right to refuse to give evidence may not be circumvented by judicial or other measures, and in particular not by questioning the attorney’s assistants. The right to 219

181 Arg e contrario from § 321 (1) no. 4 ZPO; § 157 (1) no. 2 StPO; see therefore also EUGH 17.9.2007, T-125/03, T-253/03. 182 For instance: § 54 A ¨ rztegesetz 1998 (“A ¨ rzteG”), § 38 Bankwesengesetz (“BWG”), § 15 DSG 2000, § 3 Postgesetz 1997 (“PostG”), § 88 Telekommunikationsgesetz (“TKG”), § 9 Bundesgesetz u¨ber Krankenanstalten und Kuranstalten (“KAKuG”), § 37 Notariatsordnung (“NO”), § 17 Patentanwalt Gesetz (“PatAnwG”), § 9 RAO, § 31 Mediengesetz (“MedienG”), § 108 a Versicherungsaufsichtsgesetz (“VAG”), § 91 Wirtschaftstreuhandberufsgesetz (“WTBG”), § 15 Ziviltechnikergesetz (“ZTG”). 183 § 321 (1) no 4 ZPO in combination with § 9 (2) RAO respectively § 91 WTBG; cf. also Frauenberger, in: Fasching/Konecny, § 321 ZPO marginal no. 16 et seqq. 184 OBDK 14.10.1991, Bkd 92/89, AnwBl. 1993/4477 (Strigl); Feil/Wennig, § 9 RAO marginal no. 25; OLG Wien 13.8.2001, 15 R 135/01 k, AnwBl. 2002/7822, 421 (Lachmann); other opinion: Frauenberger, in: Fasching/Konecny, § 321 ZPO marginal no. 22. The exemption is comprehensively made and the client is held accountable for any detriments itself.

Krakow/Petsche

Reemers Publishing Services GmbH O:/Beck/Spehl_Gruetzner/3d/01_Austria.3d from 06.03.2013 09:23:40 3B2 9.1.580; Page size: 160.00mm  240.00mm

B. The 25 key questions in connection with internal investigations

47

refuse to give evidence may also not be circumvented by ordering the disclosure of documents, video or audio files or data carriers or by confiscating them.185 The confidentiality obligation has always extended to the employees and assistants of the attorney as well.186 Therefore, the external adviser’s employees also have the right to refuse to give evidence, if the advisers themselves are obliged to maintain confidentiality on the basis of the rules of their profession or if they are entitled to refuse to give evidence. 4. Does the attorney client privilege also apply to foreign attorneys? The issue of in how far does a foreign attorney have a right of refusal to give evidence is disputed. According to one opinion, a foreign attorney may not invoke a more extensive confidentiality obligation he/she is subject to according to the laws of his/her home country but he/she may invoke § 9 (2) RAO in accordance with the principle of lex fori.187 This applies to non-EC or GATS attorneys as well. Whether the respective attorney must be considered an attorney within the meaning of the procedural rules and whether he/she may invoke the right to refuse to give evidence must be decided by the respective court.188 According to another opinion, the trust between attorney and client which is necessary for practicing law is to be protected and must, therefore, be evaluated in accordance with the law that is applicable to the legal relationship itself in accordance with the provisions of private international law.189 The law of the place where the attorney has his/her office is applicable to a contract between the attorney and his/her client.190 Accordingly, this view favors the respective law of the home country of the attorney. Since the Federal Law on the Free Movement of Services and Establishment of European Attorneys in Austria (Bundesgesetz u¨ber den freien Dienstleistungsverkehr ¨ sterreich, “EuRAG”, now und die Niederlassung von europa¨ischen Rechtsanwa¨lten in O “EIRAG”) entered into effect in May 2000, attorneys from other member states of the European Union and other contracting states of the European Economic Area Agreement may establish an office in Austria under certain circumstances. European attorneys having an office in Austria have restricted rights as compared to Austrian attorneys (§ 13 EIRAG) and, in the case of legal proceedings where the presence of an Austrian attorney is required, are obliged to involve an Austrian attorney (Einvernehmensanwalt) when representing or defending a client in legal proceedings (§ 14 in conjunction with § 5 EIRAG). However, the services of European attorneys having an office in Austria and attorneys providing legal advice in Austria on a temporary basis (§ 2 in conjunction with § 4 EIRAG) are in this context treated as equal to the

According to § 9 (3) RAO. OBDK 24.1.1994, Bkd 65/90, AnwBl. 1994/4831 (Strigl). 187 Fasching, ZPO, 427. 188 Schur, Die anwaltliche Verschwiegenheitspflicht in der o ¨ sterreichischen Rechtsordnung, AnwBl. 2009 (257), 260. 189 Herz, Zur Verschwiegenheitspflicht des ausla ¨ndischen Rechtsanwaltes, AnwBl. 1962, 68; Frauenberger, in: Fasching/Konecny, § 321 ZPO marginal no. 23; Schur, supra note 188 at., 260. 190 Verschraegen, in: Rummel, ABGB, Art. 4 EVU ¨ marginal no. 57. 185 186

Krakow/Petsche

223 224

225

226

Reemers Publishing Services GmbH O:/Beck/Spehl_Gruetzner/3d/01_Austria.3d from 06.03.2013 09:23:41 3B2 9.1.580; Page size: 160.00mm  240.00mm

48

§ 1. Austria

services rendered by the Austrian attorneys and such attorneys may invoke the confidentiality obligation in accordance with § 9 (2) RAO.191

VI. Following-up on internal investigations 1. What is to be observed during the follow-up of internal investigations? If violations of law or large security gaps, in particular a deficient control system, were detected within the scope of a company’s internal investigation, then the management must take appropriate measures to prevent such violations in the future or at least try to close the security gap, as applicable, in order to avert any danger imminent due to the gap. Should the management not take such measures, this could result in a claim for damages by the company against the managing directors. 228 Moreover, if it can be proven that the management committed an organizational fault (Organisationsverschulden) it may be possible that the company itself will be punished in accordance with the Act on the Responsibility of Associations (Verbandsverantwortlichkeitsgesetz, “VbVG”). If one (or several) employee(s) commit(s) an objectively substantive and illegal crime within the scope of his/their activity for the association (Verband), it will be attributed to the association under criminal law if committing the crime was possible because a decision-maker neglected the care which had been required under the circumstances. In particular it is to be taken into account whether he/she failed to take material, technical, organizational, or HR measures to prevent such offences from being committed. The requirement for the liability as regards to the conduct of employees is an organizational fault. In this regard, it is not decisive whether the employee acted negligently or wilfully. If an organizational fault is given, a fine (Verbandsgeldbuße) may be imposed on the association. In accordance with § 4 (2) VbVG, this fine must be expressed in daily rates. The amount of the daily rate is based on the association’s economic ability and the amount of the daily rate may be up to EUR 1,800,000.00. 229 Should internal investigations reveal that employees intentionally violated their duties or committed acts that constitute an offence under criminal law, measures should be taken vis-a`-vis these employees, unless the employees participated in an amnesty program, if any. 230 In analogy to the case law on the costs for a private investigator in case of extramarital relationships (ehewidrige Beziehungen), it is possible that the employer is entitled to compensation for the costs of the investigation within the scope of an adequate, typical and causal connection, if the employee first gave sufficient indications for conduct in breach of a contract violating the interests of the employer, which caused the employer to further clarify the situation by initiating investigations.192 227

191 Frauenberger, in: Fasching/Konecny, § 321 ZPO marginal no. 23. The right to refuse to give evidence also applies in other types of proceedings, such as in administrative proceedings (§ 49 (1) line 2 and (2) AVG; § 24 VStG), and in legal proceedings for fiscal offences (§ 104 (1) lit d and (2) FinStrG; § 171 (1) lit c und (2) BAO). 192 OGH 17.7.2006, 9 Ob A 129/05 v.

Krakow/Petsche

Reemers Publishing Services GmbH O:/Beck/Spehl_Gruetzner/3d/01_Austria.3d from 06.03.2013 09:23:41 3B2 9.1.580; Page size: 160.00mm  240.00mm

B. The 25 key questions in connection with internal investigations

49

2. May an employer pay its employee’s legal fee if he/she is being prosecuted under criminal law? Should the employer decide to bear the legal fees for its company’s employees, it 231 should be tied to additional conditions. For example, it could be stipulated that, if the employee committed the crime intentionally, legal fees will not be compensated. In some cases, it could even be helpful if the employer provides the attorney 232 because by doing so, the defense strategy may be determined at its discretion.

VII. Miscellaneous 1. Costs of the control measure The conduct of internal investigations or the installation of surveillance systems 233 often triggers enormous costs. In this regard, the question arises whether the employee is obliged to compensate these costs. In employment law matters, the Austrian Supreme Court (OGH) has repeatedly193 dealt with the costs for a private investigator in connection with activities of employees in breach of contract or their duty of loyalty. In analogy to the case law on the costs for a private investigator in case of extramarital relationships, the Supreme Court stated that the employer is entitled to be compensated for the costs of the investigation within the scope of an adequate, typical and causal connection, if the employee first gave sufficient indications for conduct in breach of contract violating the interests of the employer which caused the employer to further clarify the situation by initiating investigations. This means that the employee does not have to bear the costs if activities 234 breaching the contract or breaching duties of loyalty are only revealed by means of internal investigations or by means of installed surveillance systems. However, if these measures are taken because there is a specific suspicion vis-a`-vis one or several employees, and if these suspicions can be confirmed by these measures, it may be assumed on the basis of the aforementioned case law that the employee must compensate the employer for the costs incurred by these measures. 2. Use of illegally obtained evidence in legal proceedings In consideration of the above, the question arises as to how far illegally obtained 235 data may be used as evidence in potential legal proceedings. Experts in current literature generally deny that exclusion of evidence improperly obtained (Beweisverwertungsverbote) apply in civil proceedings. The same applies to proceedings before labor courts. Until now, the OGH has not ruled on this issue so that, according to the current opinion, even illegally obtained data may be used as evidence.194

193

OGH 25.9.1979, 4 Ob 20/79; OGH 17.2.19981, 4 Ob 67/80. Graf/Scho¨berl, Beweisverwertungsverbote im Arbeitsrecht?, ZAS 2004, 30; Rauch, Zur privaten Nutzung des PC und des Telefons im Arbeitsverha¨ltnis, ASoK 2007, 171. 194

Krakow/Petsche

Reemers Publishing Services GmbH O:/Beck/Spehl_Gruetzner/3d/01_Austria.3d from 06.03.2013 09:23:41 3B2 9.1.580; Page size: 160.00mm  240.00mm

50

§ 1. Austria

C. Summary of key results I.

Should there be sufficient suspicion in the company that violations of duties or laws are committed or were committed, the management is required to conduct internal investigations or have them conducted without delay to prevent any (further) damage. In such cases, the management is, furthermore, obliged vis-a`-vis the company to take suitable measures to prevent any (imminent) damage. II. When conducting internal investigations or when installing control systems the personal rights of the employees, the Austrian Data Protection Act and the right to co-approval of the works council, if applicable, must primarily be observed. III. The duty to cooperate in internal investigations derives from the employee’s obligation to work and his/her duty of loyalty under the employment contract. If employees refuse to cooperate in internal investigations, this may result in a premature termination of the employment relationship (dismissal). IV. A cutback in remuneration because of the employee’s refusal to cooperate in internal investigations is generally impossible, because such a measure is not provided for in Austrian employment law. V. The mere suspicion that an employee committed a criminal offence does not generally constitute a reason for early dismissal. VI. When transmitting personal data, the respective provisions of the DSG must be complied with. A violation can be punished with an administrative fine of up to EUR 18,890.00. The movement of data within the EU and countries with an adequate level of data protection is not subject to any authorization requirement. For data recipients in a third country in regard to which no adequate data protection is conceded, the data must be transmitted by using the SCC and the transmission of data requires the formal authorization by the DSK. The transmission of data to companies that are on the list of Safe Harbor companies or that are subject to the PIPEDA does not in general require the DSK’s authorization. VII. While in-house counsels involved in internal investigations do not have the right to refuse to give evidence, Austrian and foreign attorneys may very well invoke this right.

Krakow/Petsche

Reemers Publishing Services GmbH O:/Beck/Spehl_Gruetzner/3d/02_Brazil.3d from 06.03.2013 09:24:14 3B2 9.1.580; Page size: 160.00mm  240.00mm

§ 2. Brazil Para. Initiation of internal investigations . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 1 When and to what extent should internal investigations be initiated? 1 Should the internal investigations be of an open or covert nature? . . . 10 Is it advisable to involve external investigators? . . . . . . . . . . . . . . . . . . . . . . . 14 Is it permitted that foreign attorneys conduct internal investigations in Brazil? . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 23 V. When should national authorities be called in? . . . . . . . . . . . . . . . . . . . . . . . 25 B. Admissibility and implementation of individual measures within the scope of internal investigations . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 31 I. What measures are admissible within the scope of internal investigations? . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 31 1. Employee Interviews . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 31 2. Email Screening . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 35 3. Handover, review and processing of files, letters and documents of employees . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 47 4. Handover and imaging of the computer and subsequent processing of the business-related data and electronically stored businessrelated documents of employees (other than emails) . . . . . . . . . . . . . . . 51 5. Inspection of the personnel files of employees . . . . . . . . . . . . . . . . . . . . . . 55 6. Video surveillance of employees . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 56 7. Tapping of telephone conversations . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 59 8. Search of the workplace . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 67 9. Covert listening in on conversations (other than telephone conversations) on the business premises . . . . . . . . . . . . . . . . . . . . . . . . . . . . 70 10. Investigations carried out in the surroundings of employees under suspicion . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 74 II. Must employees’ representatives such as the works council be involved in internal investigations? . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 77 C. Employee interviews . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 78 I. May an employee refuse to provide information if this information would incriminate himself/herself? . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 78 1. Duty to provide information on the tasks directly assigned to the employee or carried out by the employee. . . . . . . . . . . . . . . . . . . . . . . . . . . 93 2. Duty to provide information in indirect connection with the scope of work . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 98 3. Duty to provide information outside the scope of work . . . . . . . . . . . . 99 4. No disclosure of information to authorities if the employee is obliged to incriminate himself/herself . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 100 II. Is an employee obliged to provide information on any misconduct of or criminal offence committed by other employees? . . . . . . . . . . . . . . . . . . 105 III. May an employee refuse to answer a question if he/she has already answered it within the scope of a previous interview? . . . . . . . . . . . . . . . . . 108 IV. Is an employee entitled to the presence of a member of the works council or an attorney during the interview? . . . . . . . . . . . . . . . . . . . . . . . . . . 109 1. The employee’s right to the presence of a member of the works council . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 109 2. The employee’s right to the presence of a lawyer representing the employee’s rights . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 110 V. Is an employee entitled to read the record of his/her interview? . . . . . . 113 VI. Is the employer entitled to request that the employee signs the record of the interview? . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 114 A. I. II. III. IV.

v. Ancken/Flesch/Fonseca/Lima/Maeda

Reemers Publishing Services GmbH O:/Beck/Spehl_Gruetzner/3d/02_Brazil.3d from 06.03.2013 09:24:14 3B2 9.1.580; Page size: 160.00mm  240.00mm

52

§ 2. Brazil Para. VII. Can the employer instruct an employee to treat the content of his/her interview as confidential? . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 115 D. Sanctions imposed on employees . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 117 I. What are the sanctions under employment law that can be imposed on employees refusing to cooperate in internal investigations? . . . . . . . . 117 1. Reduction of the remuneration . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 122 2. Warning letter and termination . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 123 II. Is the suspicion of a criminal offence or of a severe violation of duty sufficient for an extraordinary termination? . . . . . . . . . . . . . . . . . . . . . . . . . . . 125 III. During which period of time must an extraordinary notice of termination be given to employees whose misconduct has been revealed by the internal investigations? . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 129 IV. Must an employee cooperate in internal investigations even after he/ she has been given notice of termination? . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 132 E. Use of the obtained information . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 133 I. Is it permissible to disclose the findings and information obtained within the scope of any internal investigations to other group companies? . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 133 II. Is it permissible and advisable to forward the findings and information obtained within the scope of any internal investigations to public authorities? . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 141 1. Admissibility of disclosure of personal data . . . . . . . . . . . . . . . . . . . . . . . . 141 2. Is it advisable to voluntarily disclose data to public authorities? . . . . 143 III. Are the findings made in the scope of internal investigations subject to the attorney-client privilege? . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 144 1. No attorney-client privilege for in-house counsel involved in the investigations . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 144 2. Privileges in the case that external investigators are involved . . . . . . . 147 IV. Does the attorney-client privilege also apply to foreign attorneys? . . . . 148 F. Following-up on internal investigations . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 150 I. What is to be observed during the follow-up of internal investigations? . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 150 II. May an employer pay its employee’s legal fees if he/she is being prosecuted under criminal law? . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 153

A. Initiation of internal investigations I. When and to what extent should internal investigations be initiated? Under Brazilian law, there is no specific legal requirement for a company to conduct internal investigations. The decision of when and to what extent internal investigations should be conducted belongs to the company. 2 Even though companies in Brazil are under no legal duty to do so, investigating possible misconducts may be important for a number of reasons. Firstly, investigating is important for the company to be able to cause the misconduct to cease, thus avoiding further damages and increased legal exposure to the company (e.g., when the misconduct could result in penalties to the legal entity, such as frauds in public tenders, or when the misconduct involves the company’s employees or any third parties acting on its behalf and, therefore, the company’s name and reputation). Secondly, internal investigations are also important to allow the company to determine the persons responsible for the improper acts and to collect and preserve any supporting evidence, which will generally be important for the company to consider how it will proceed against involved employees and parties (e.g., dismissal, 1

v. Ancken/Flesch/Fonseca/Lima/Maeda

Reemers Publishing Services GmbH O:/Beck/Spehl_Gruetzner/3d/02_Brazil.3d from 06.03.2013 09:24:14 3B2 9.1.580; Page size: 160.00mm  240.00mm

A. Initiation of internal investigations

53

lawsuit). Thirdly, internal investigations are important to help the company avoid recurrence of the problem by allowing the company to take remediation actions and enhance its internal controls and procedures. Finally, depending on the allegations and timing, implementing internal investigations may be crucial to mitigate the company’s exposure to sanctions and legal liability. Another reason for a company to investigate misconducts may arise from a Bill of Law currently being voted by the Brazilian Congress (Nr. 6, 826/2010), if approved and converted into law with its current wording. This document provides for the strict liability of legal entities (in addition to individuals’ liability) for, among others, corruption and violation to public procurement laws committed by the company’s employees or third parties acting on its behalf. The Bill of Law establishes severe penalties for such actions and lists some factors to be taken into account by the authorities when applying the penalties to the relevant legal entities. Among these factors, the authorities would consider (i) the cooperation in the investigation of the violations, including by voluntarily reporting the illegalities to the authorities before the formal initiation of a proceeding by such authorities, as well as the disclosure of information during the course of the formal investigations, and (ii) the existence of internal integrity program and controls, as well as the existence of mechanisms to report irregularities and the effective application of ethics and conduct codes within the organization. By listing these factors as possible penalty mitigators, if and when approved, this Bill of Law may result in a good reason for companies to not only take its compliance program seriously by effectively enforcing the ethics and conduct rules when necessary, but also for companies to take the investigation route every time there is a suspicion of illegalities. In general, internal investigations may also be implemented preventively (e.g., regular investigations conducted to ensure that the company is operating in compliance with all legal and ethical rules, in an attempt to avoid unexpected situations), or, as in most cases, in response to some type of complaint, accusation, allegation or manifestation of suspicion. Investigations are usually initiated upon one of the following occurrences: (i) internal denouncement by one or some of the employees of suspicious or wrongful actions by other employees, (ii) anonymous allegations, (iii) denouncement by third parties doing business with the company, (iv) regular internal or external audits, (v) police or law enforcement authorities’ accusations of wrongful actions within the company, (vi) request by law enforcement authorities due to non-compliance with laws and regulations (including situations where there is an ongoing official investigation regarding practices of affiliated companies in other countries), or, less commonly, (vii) due to a decision by the management to implement an internal investigation procedure on a preventive basis. It is common that complaints and accusations are made to the company anonymously by means of whistle blowing hotlines made available to the company’s employees or to third parties engaged by the company. The company should, of course, carefully consider whether it is necessary or otherwise advisable to implement internal investigations based on such allegations, and how broad and detailed the investigations should be, especially because the ultimate reason for the whistleblower to have raised the issue is not really known and, in many cases, his/her credibility cannot be evaluated at all.

v. Ancken/Flesch/Fonseca/Lima/Maeda

3

4

5

6

Reemers Publishing Services GmbH O:/Beck/Spehl_Gruetzner/3d/02_Brazil.3d from 06.03.2013 09:24:15 3B2 9.1.580; Page size: 160.00mm  240.00mm

54

§ 2. Brazil

When deciding whether or not to conduct an investigation, companies normally take into account the possible adverse consequences that it may suffer. Depending on the allegations, it may include deterioration of its image before the other market players and partners, allegations by public authorities (if and when involved in the case) that the management decided not to investigate an allegation of misconduct, and the penalties to which the company and the individuals (including the management) may be subject, not only in Brazil but also in other countries that may claim jurisdiction for acts committed in Brazil. In situations of corruption allegations, for instance, the seriousness of the potential consequences to the company and individuals normally makes it highly advisable to initiate some form of internal investigations in cases of internal or external denouncements or allegations of misconduct. Another reason for investigating and taking disciplinary and remedial actions, when applicable, is to demonstrate to all employees, and to the public authorities, whenever necessary, that the company does not tolerate any misconduct and will reasonably investigate all allegations that are brought to its attention. Finally, the aforementioned Bill of Law, if and when approved, may result in higher penalties to companies that choose to ignore possible suspicions of irregularities. 8 It is of utmost importance to define the scope and reach of the investigation before any steps are taken. The reason that prompted the investigation is crucial for the definition of its scope, as well as the goals the company wishes to have achieved once it is concluded. The company may want just sufficient evidence to terminate someone from the company or it may want to assess existing criminal or other types of liability, among many other reasons, which may cause an extreme variation in the scope and limits of the investigation. Depending on the nature of the allegation (e.g., corruption), it may be important for the company to be able to evidence that the investigations were as thorough and complete as reasonably necessary in view of the allegations and that they were broad enough to demonstrate to such authorities the company’s good faith, diligence, efforts and sincere intentions to identify, stop and remediate any wrongdoings. 9 According to Skalak, Alas and Sellitto, in “A Guide to Forensic Accounting Investigation”, investigations should lead to actions commensurate with the size and seriousness of the impropriety or fraud, no matter whether it is found to be a minor infraction of corporate policy or a major scheme to create fraudulent financial statements or misappropriate significant assets.1 As a first step, companies usually start the investigation by the persons/departments pointed out in the internal or external accusations or audits and, once this is done, it will analyze the possible impact the uncovered violation may have on other employees and departments, in order to decide to what extent the investigation will be expanded within the company. 7

II. Should the internal investigations be of an open or covert nature? 10

In most cases and to the extent possible, it is advisable to conduct internal investigations confidentially, so that the company does not run any risk of having 1

Golden/Skalak/Clayton, A Guide to Forensic Accounting Investigation (2006), p. 41.

v. Ancken/Flesch/Fonseca/Lima/Maeda

Reemers Publishing Services GmbH O:/Beck/Spehl_Gruetzner/3d/02_Brazil.3d from 06.03.2013 09:24:15 3B2 9.1.580; Page size: 160.00mm  240.00mm

A. Initiation of internal investigations

55

the employees potentially involved in wrongdoings hiding or destroying evidence that would have been available if they were not aware of the investigation. Conducting investigations on a completely confidential basis is usually not possible, as the company normally needs to notify or involve employees for document retention purposes, as well as to interview people. In any case, even if it is not possible to keep the existence of the investigation totally confidential, it is advisable to disclose the subject matter of the investigation to employees on a need to know basis. Preserving evidence is of utmost importance in any investigation proceeding and 11 a key factor for the success and reliability of the investigative procedures. As people tend to destroy evidence when aware of the fact that investigations are ongoing, companies usually do not opt for open communications. By jeopardizing evidence or by taking the risk of losing it, management may be seen as not diligent enough and possibly interested in the destruction of evidence. On the other hand, by demonstrating that the company took steps to avoid destruction of data, the company will be in a better position to show to the public authorities, if necessary, that its internal investigation is reliable and complete. In fact, if the company is requested, at any point in time, by any government body, to present their internal investigation plan and results, it must be able to demonstrate that it made in fact all efforts available and acted as diligently as possible with regard to the preservation of evidence. In some cases, it may be also important for the company to collect and preserve evidence that may be relevant in future actions to be taken by the company (e.g., evidence of wrongdoing to justify dismissal for cause or lawsuit to collect damages). Keeping the investigation confidential to the maximum extent possible is also 12 generally advisable under Brazilian labor laws in order to avoid or lessen the risk of possible claims (including for moral damages) from employees being investigated. For this reason, even if the existence of investigative proceedings by the company is disclosed to the employees, it is advisable not to disclose the exact and precise subject matters or areas being investigated. This applies to the situation where the company needs to issue a documents preservation notice to its employees, whereby it requires the employees to cease any destruction of documents pertaining to a specific category or relating to specific matters or activities. In this case, in order to avoid association by employees, through the document retention notice, with the areas or persons that are being investigated or under review, it may be advisable to broaden the scope of the document retention notice to include additional areas or documents, so that other employees will not be able to directly associate the investigation to one or more specific areas or persons within the company. With regard to keeping the investigation confidential before the authorities, there 13 is currently in Brazil no duty to report. However, if and when the Bill of Law mentioned under section 1 above is approved and converted into law, the cooperation with authorities in the investigation of violations, including by voluntarily reporting the illegalities to the authorities before the formal initiation of a proceeding by such authorities, may be a factor to be taken into account in the application of the penalties and may, therefore, mitigate the penalties. This will, of course, depend, among others, on whether the Bill of Law is actually approved, whether the current wording will remain and how authorities will actually apply this rule.

v. Ancken/Flesch/Fonseca/Lima/Maeda

Reemers Publishing Services GmbH O:/Beck/Spehl_Gruetzner/3d/02_Brazil.3d from 06.03.2013 09:24:15 3B2 9.1.580; Page size: 160.00mm  240.00mm

56

§ 2. Brazil

III. Is it advisable to involve external investigators? 14

15

16

17

18

Depending on the nature of the allegations, it may be advisable to involve external counsel and/or auditors in the investigation. This is particularly important in situations where the company needs to be able to show that the investigations were conducted with impartiality, specialization, and credibility. However, while the coordination by external investigators result in more impartial and credible results, the involvement of key internal employees may also be essential given their familiarity with the company’s operation, culture, structure, process and reporting systems. Other factors may also make the use of external investigators advisable, as further described below. The relationship among employees resulting from their daily routine could naturally impact the impartiality in internal investigations, if and whenever it is conducted internally, due to possible conflict of interests. It may, for instance, be awkward for in-house counsel to interview senior management or colleagues about sensitive issues and, in particular for in-house counsel to implement remedial measures and disciplinary actions. It is also possible that in-house counsel or employees in other functions (e.g., finance or human resources) may have had some type of involvement or participation in the subject matter of the investigation, either regarding its original scope or other matters that may arise in connection with an expanded scope of the investigations. Depending on the circumstances, misconduct in the company may highlight some form of lack or failure in the company’s controls, which in-house counsel, finance, audit or other employees of the company may prefer not to expose as this may suggest that their functions were not properly performed. There is undoubtedly a specialized know-how related to internal investigations that take into account not only the functioning of the company’s business, but also the cultural and legal-related aspects of the environment being investigated. Such experience is a rather relevant factor whenever the non-compliance could trigger the participation of public authorities, such as the United States Department of Justice (DOJ) and the Securities and Exchange Commission (SEC) established in January 2003, as per requirement made by the Sarbanes-Oxley Act of 2002.2 In these cases, experience the outside counsel possesses in dealing with the public authorities involved, could and will make a significant difference in the investigation’s final result and as a consequence, in the penalties to be possibly applied to the company and involved individuals. Another factor to be taken into consideration is that the results of an investigation conducted by independent external professionals show, before courts or any governmental authority, much more credibility and objectivity than an investigation conducted internally by the company. This is especially relevant if the results of the investigations are favorable to the company, which could be seen with increased suspicion by the authorities if the investigation were conducted by the company’s own resources. Along with cooperating with public authorities and having a good and solid compliance plan and structure, a reliable investigation is one of the three (3) most important factors for purposes of credit with and trust by public authorities. 2

Golden/Skalak/Clayton, A Guide to Forensic Accounting Investigation (2006), p. 41.

v. Ancken/Flesch/Fonseca/Lima/Maeda

Reemers Publishing Services GmbH O:/Beck/Spehl_Gruetzner/3d/02_Brazil.3d from 06.03.2013 09:24:15 3B2 9.1.580; Page size: 160.00mm  240.00mm

A. Initiation of internal investigations

57

According to “A Guide to Forensic Accounting Investigation”, the main reason for an audit to be independent is to help ensure that the auditor will think and act with objectivity. The main reason for appearing independent is to inspire public trust without ambiguity.3 This also applies to internal investigations. Furthermore, in-house counsel and other resources (e.g., finance employees) are usually very busy with their daily workload and do not have enough time to invest in a complete and thorough investigation. In addition to that, employees may be inclined to give in-house counsel answers they think they want to hear, rather than answers that reflect the reality of the situation. It is also worth mentioning that whenever investigations are conducted by outside counsel, there is not only the advantage of the legal confidentiality obligation provided by Brazilian laws4 and to be respected by lawyers regarding their clients, but also the right reserved to lawyers of inviolability of their offices, workplaces, labor instruments and communication.5 There is only one exception,6 which is when there are signs of a crime having been committed by the lawyer and, in this case, the authorities may break the privilege by means of a specific and detailed search and seizure order. However, the use of document means and objects belonging to the lawyer’s clients and of the other work instruments containing client information is prohibited.7 In view of the above, it is normally advisable to put a combined team together, including outside counsel and auditors, in-house counsel, and other key employees (e.g., HR director), given that the latter are more familiarized with the company’s operation, culture, structure, process and reporting systems, and the possibility of an in-house counsel or HR director to be more aware of the individual employee’s issues and whistleblower backgrounds.

19

20

21

22

IV. Is it permitted that foreign attorneys conduct internal investigations in Brazil? Foreign attorneys may conduct internal investigations in Brazil, as long as their 23 activities within the investigation are outside the scope of activities described under the Statute of the Legal Profession and the Brazilian Bar Association (Ordem dos Advogados do Brasil/OAB)8 as being exclusive to lawyers, i. e., (i) presentation of requests to any organ of the Judiciary Body and the special courts and (ii) legal consulting, assistance and direction. According to the same statute, the performance

3

Golden/Skalak/Clayton, A Guide to Forensic Accounting Investigation (2006), p. 41. Statute of the Legal Profession and the Brazilian Bar Association and Sections 25, 26 and 27 of the Code of Ethics and Discipline of the Brazilian Bar Association. 5 Statute of the Legal Profession and the Brazilian Bar Association, Section 7, II. 6 Statute of the Legal Profession and the Brazilian Bar Association, Section 7, § 6. 7 Notwithstanding these guarantees provided by law, they are not in practice always completely respected. At the moment of a dawn raid, police officers usually search for and apprehend documents that would be protected by the attorney-client privilege. Although one can always challenge this later in court, the fact is that it is not possible to rely one hundred percent in such protection. 8 Statute of the Legal Profession and the Brazilian Bar Association, Section 1. 4

v. Ancken/Flesch/Fonseca/Lima/Maeda

Reemers Publishing Services GmbH O:/Beck/Spehl_Gruetzner/3d/02_Brazil.3d from 06.03.2013 09:24:16 3B2 9.1.580; Page size: 160.00mm  240.00mm

58

§ 2. Brazil

of such activities in the Brazilian territory and the use of the title “lawyer” are exclusive to the professionals enrolled with the Brazilian Bar Association.9 24 Therefore, conducting an internal investigation itself is not qualified as an activity to be performed exclusively by lawyers, and, consequently, does not require the admission to the Brazilian Bar Association. However if the investigation includes and requires legal consulting or related services, only a lawyer duly enrolled with the Brazilian Bar Association would be allowed to be involved.

V. When should national authorities be called in? Under Brazilian law (unless one is a public official), there is no general duty to report a fortuitous criminal act.10 This means that the company is not bound to communicate to the police or the prosecutor, illegalities that may be found. This is the company’s option and the question as to if and when national authorities should be called in depends very much on each particular case. On the one hand, cooperation with public authorities could render the company advantages as it would show that the company is willing to make all the necessary efforts to stop any wrongdoing within its organization. However, depending on the case, it may be advisable to contact the authorities only after the company has found out more about the violation. 26 As previously mentioned, if and when the Bill of Law mentioned under section 1 above is approved and converted into law, the cooperation with authorities in the investigation of violations, including by voluntarily reporting the illegalities to the authorities before the formal initiation of a proceeding by such authorities, may be a factor to be taken into account in the application of the penalties and may, therefore, mitigate the penalties. This will, of course, depend, among others, on whether the Bill of Law is actually approved, whether the current wording will remain and how authorities will actually apply this rule. 27 Currently, companies in Brazil usually take a more conservative and defensive approach when dealing with the authorities. Cooperation could render the company credits and maybe minimize the penalties. However, companies in Brazil do not have a strong cooperation culture, as it has not yet become usual practice. Therefore, if they do choose to involve the authorities, most of them do so when the investigation has produced results and when they are aware of the scope of the violation, the penalties applied to it, and which authorities should be called in. 28 The determination of which authorities should be involved is of utmost importance given that, depending on the case, even foreign authorities could/should be involved (e.g., United States Authorities whenever the Foreign Corrupt Practices Act apply to the company). In this case, it is specially advisable to involve an experienced outside counsel to make sure the investigation will take into account all the important factors not only under Brazilian law but also under the applicable foreign law. 25

9

Statute of the Legal Profession and the Brazilian Bar Association, Section 3 In the environmental, tax and regulatory areas, there are some duties to report to and involve public authorities, depending on the case. Please note the recent Anti-Money Laundering Legislation, which requires communications to the competent authorities of certain activities that may be construed as indicia of criminal offences (Law 12, 683/2012). 10

v. Ancken/Flesch/Fonseca/Lima/Maeda

Reemers Publishing Services GmbH O:/Beck/Spehl_Gruetzner/3d/02_Brazil.3d from 06.03.2013 09:24:16 3B2 9.1.580; Page size: 160.00mm  240.00mm

B. Admissibility and implementation of individual measures

59

Another downside of involving criminal authorities is that once a police investi- 29 gation is initiated upon a party’s request, the police have the right and duty to investigate any facts and information regarding any conduct, individuals, and crimes (including any other irregularities within the company) that any party (including the individuals who allegedly committed the wrongdoings) may bring to the police’s attention. Consequently, once a criminal investigation is initiated, the control of the investigation will belong exclusively to the criminal authorities (and no longer to the company), and the criminal authorities will be able to investigate whatever issues they deem necessary and to the extent they deem appropriate. An additional important issue to be considered on a case-by-case basis refers to 30 the possible impacts of a police investigation on the company’s operations, business reputation, and confidential information. Specifically regarding reputation, once public authorities are involved, there is always the risk that the allegations become public in the media.

B. Admissibility and implementation of individual measures within the scope of internal investigations I. What measures are admissible within the scope of internal investigations? 1. Employee Interviews One of the measures that can be adopted by the employer to clarify facts in 31 internal investigations is the interview of the involved or suspected employees. In this regard, the employee can be invited for confidential meetings for the purpose of providing the employer with clarification. The participation in interviews is not mandatory by law even if provided under the company’s code of conduct or other policies. As further explained below, although employee interviews with the purpose of 32 aiding internal investigations are admissible, the interviewed employee may refuse to attend the interview, refuse to talk, or may refuse to provide any kind of information, not tell the truth or even lie. As a general rule and depending on all the circumstances of the specific case, employees cannot be terminated for cause for refusing to cooperate. It is, however, important to note that the employer may always dismiss its employees without cause by making the severance payments due to an employee. Another aspect is that the employer’s investigative powers are limited to the 33 employee’s fundamental right to intimacy and privacy set forth by the Brazilian Federal Constitution, as follows: Art. 5 – All persons are equal before the law, without any distinction whatsoever, and Brazilians and foreigners resident in Brazil are assured inviolability of the right to life, to liberty, to equality, to security and to property, on the following terms: (…) X: The intimacy, private life, honor and image of persons are inviolable, and the right to compensation for material or moral damages resulting from their violation is ensured.

With the foregoing considerations in mind, it is possible to conduct employee 34 interviews aimed at clarifying some facts during an internal investigation. Nonetheless, in order to reduce the risks of claims from the employees (e.g., based on v. Ancken/Flesch/Fonseca/Lima/Maeda

Reemers Publishing Services GmbH O:/Beck/Spehl_Gruetzner/3d/02_Brazil.3d from 06.03.2013 09:24:16 3B2 9.1.580; Page size: 160.00mm  240.00mm

60

§ 2. Brazil

allegations of offence to the rights of privacy and intimacy), below are some observations concerning internal investigation interviews under Brazilian law. a) The interviews with employees should, to the extent possible, be performed confidentially in order to avoid allegations that the company exposed the employee to judgment and false interpretation of his/her colleagues. If appropriate, interviews should be conducted outside of the company’s facilities. In this sense, a decision ruled by the Regional Labor Court of Sa˜o Paulo11 stated that as long as the interviews were conducted confidentially and there were no indications of vexation and offence to the honor and dignity of the employee, no indemnification was due. b) The employee should, to the extent possible, be expressly informed that (i) all discussions in the interview should be kept under strict confidence and the employee cannot discuss anything with others, including with his/her superiors; (ii) any attorneys conducting the interview for the company represent the company, not the interviewee, meaning that any privilege protection belongs to the company, not to the interviewee, and, because of that, only the company can decide to keep or waive such privilege; and (iii) the company does not admit any form of retaliation against other employees for reporting facts or suspicions to the company. c) Whenever appropriate, it should be stressed to the employees that they are being invited to cooperate in the context of a confidential internal investigation proceeding conducted by the company. In view of that, the employee is being requested by the company to provide complete and truthful information. As mentioned above, employees may refuse to cooperate and to participate in the interview, and the company’s ability to take measures against the employee will depend on a case-by-case analysis. Depending on the specific situation, it may be advisable for the company to expressly inform the employee that he/she is free not to participate in the interview and can refuse to answer specific questions in the interview. d) The employees should be informed that they can interrupt the interview at any time and take short breaks. e) Only a few people should be present during the interview in order to make the employees feel more comfortable. f) Whenever possible, the interview should be conducted in the native language of the employees, because: (i) the interviewee will feel more comfortable to answer the questions; (ii) by speaking in their native language, employee’s answers tend to be more specific, complete and clear, also allowing interviewers to better evaluate body language and other signs (e.g., nervousness, uncertainty, etc.); (iii) it will reduce the risks of claims from the employee in the sense that he/she did not understand the question well or that the responses provided were not exactly what he/she wanted to say; and (iv) it will reduce the risks of claims from the employee for moral damages alleging that the interview was intended to shame or embarrass them. Indeed, questions that would be generally accepted as reasonable in one country may be offensive when made to a Brazilian employee, simply because of language or toning matters. 11

Regional Labor Court of the 2nd Region – Decision No. 20060804437 – Proceedings No. 02387.2005.064.02.00-0.

v. Ancken/Flesch/Fonseca/Lima/Maeda

Reemers Publishing Services GmbH O:/Beck/Spehl_Gruetzner/3d/02_Brazil.3d from 06.03.2013 09:24:16 3B2 9.1.580; Page size: 160.00mm  240.00mm

B. Admissibility and implementation of individual measures

61

g) From a Brazilian law perspective, it is possible to record and to videotape the interviews, but the employees must first be aware of the recording/videotaping and must previously consent to it. However, in addition to the fact that recording naturally makes interviewees feel less comfortable, other aspects must be taken into account, including and especially, whether the investigation may have any type of implication or be relevant for other jurisdictions with different rules on discovery and privilege matters. For instance, if the company is subject to U.S. law and the subject matter of the investigation is covered by any U.S. law with an extraterritorial reach (e.g., Foreign Corruption Practices Act – FCPA), companies may prefer not to record or videotape the interviews. h) It is also possible to prepare a summary of employees’ answers during the interview or minutes of the meeting. From a Brazilian law perspective, there is no impediment to prepare a transcript of the interview and request the employee to read and attest the accuracy of the statements made in the interview, signing the transcript at the end of the interview (although, as mentioned above, the employee may refuse to sign it). On the other hand, and similarly to our comments above on the recording of the interview, preparing an exact transcript of the interview and requiring the interviewee to sign it will not be advisable in all circumstances – especially because it may not be protected under the attorney-client privilege doctrine – being subject to discovery duties in other jurisdictions outside Brazil. i) It is advisable to avoid direct accusations against the employees of any wrongdoing, in order to reduce the risks of moral damages claims from the employee. To the extent possible, questions should be made in an objective manner, without showing a pre-judgment by the company in the sense that the employee has actually committed wrongdoings. If the company wants to confront the employee with documents or other type of evidence collected and reviewed before the interview, this confrontation should be made in a respectful manner (for instance, by showing the document to the employee as additional help in order for the employee to recollect the facts, avoiding direct accusations against the employee of lying or hiding the truth). j) The employees being interviewed must be treated with respect, without pressure or any type of aggression. The right of the company to perform internal investigations with respect to any violation of the laws or ethical rules and policies must be properly exercised, without any threats or accusations to employees. The company must avoid any embarrassment to the interviewee and always take cultural and language differences into account. 2. Email Screening Besides the aforementioned fundamental right to intimacy and privacy, the 35 Brazilian Federal Constitution further provides in Art. 5, XII and LVI, that: Art. 5, XII: The secrecy of correspondence and of telegraphic, data and telephone communications is inviolable, except, in the latter case, by court order, in the cases and in the manner prescribed by law for the purposes of criminal investigation or criminal procedural finding of facts; and Art. 5, LVI: Evidence obtained by illicit means is unacceptable in a lawsuit.

The telephone interception set forth by Art. 5, XII of the Brazilian Federal 36 Constitution is further regulated by Law 9, 296/1996. Such law also applies to any v. Ancken/Flesch/Fonseca/Lima/Maeda

Reemers Publishing Services GmbH O:/Beck/Spehl_Gruetzner/3d/02_Brazil.3d from 06.03.2013 09:24:17 3B2 9.1.580; Page size: 160.00mm  240.00mm

62

37

38

39

40

41

42

43

§ 2. Brazil

communication made by means of IT systems12 and provides that such communication means can only be intercepted for the purposes of evidence in criminal investigations and in criminal procedural finding of facts, in accordance with the provisions of such law and upon an order by the judge responsible for the criminal procedure or lawsuit. The information resulting from interceptions must be kept under judicial secrecy.13 To further guarantee the confidentiality of correspondence, Art. 151 of the Brazilian Criminal Code characterizes irregularly having access to closed correspondence addressed to others as a crime. Therefore, as a matter of general principle, it is illegal to intercept or monitor electronic communications of third parties, and also to use them as evidence in a court proceeding, except if such interception is made in accordance with the provisions of Law 9, 296/96. However, in an employment relationship the power of direction of the employer must also be taken into account.14 In this context, doctrine and court decisions have accepted monitoring practices of employees due to the employer’s power of direction. According to a court decision by the Regional Labor Court,15 considering that a company is liable for the actions that its employees undertake on its behalf,16 it is reasonable that the employer has the right to monitor the activities of his/her employees, to ensure compliance by the employee with applicable laws and the employer’s policies. In fact, as computers and email are provided by the employers to be used for business purposes, it is generally acceptable that employers can monitor the use of computers and corporate emails by the employees. In this sense, claims arguing that corporate emails are protected as private communications have not been accepted by Brazilians courts. Therefore, there are arguments to defend that the employer has the right to review the files stored in the computers and systems provided to its employees – even more so if the employment guidelines and other policies expressly define so and the employee is duly informed of the employer’s right. Indeed, given that there is no clear concept defining the extent of the employee’s privacy rights when using corporate facilities and communication means, it is advisable that the employer clearly informs his/her employees about the purposes for which they are allowed to use their business email (i. e., for the purposes of the business), as well as of the lack of privacy expectation when using corporate email and the company’s computer systems. This understanding has been confirmed by a series of judicial decisions. In a case from 2009, the Brazilian Supreme Court on Labor Matters ruled that an employer has the right to monitor and intercept electronic communications of an 12

Law 9, 296/96, Art. 1, sole paragraph. Law 9, 296/96, Art. 1. 14 Delgado, Curso de Direito do Trabalho. LTr. Sa ˜o Paulo, 5a ed. (2006), p. 635. 15 Regional Labor Court of the 2nd Region – 3a Turma – RO 0504/2002. 16 Art. 932 of the Brazilian Civil Code provides that “The following shall also be liable for civil reparation: III – the employer (…) for its employees (…) when performing assigned functions”. Art. 2 of the Brazilian Consolidation of Labor Laws also provides that “Employer” shall mean the individual or corporate body who undertake the activity’s financial risks and engages, pays and directs the work personally performed by persons in his employment. 13

v. Ancken/Flesch/Fonseca/Lima/Maeda

Reemers Publishing Services GmbH O:/Beck/Spehl_Gruetzner/3d/02_Brazil.3d from 06.03.2013 09:24:17 3B2 9.1.580; Page size: 160.00mm  240.00mm

B. Admissibility and implementation of individual measures

63

employee if such communications originate from the company’s email system. Furthermore, the Supreme Court ruled that, by using the corporate email network, the employee has no reasonable expectation of privacy in his/her communications. The court also clarified that if an employee wants to exchange private communications, he or she must sign up for a private email account.17 In another decision rendered in 2007 by the Brazilian Supreme Court on Labor 44 Matters, it was ruled that an employer has the right to monitor the employee’s corporate emails especially when the employee is fully informed of the monitoring by means of a clear policy regarding the use of the company’s computers and email network.18 As mentioned above, the company should clearly inform its employees in advance that the company’s email are “working tools” that shall be used exclusively for business purposes and that, while using such tools, the employees should not expect privacy. The employees should be aware that their email messages can be monitored or later reviewed. While the possibility to review and monitor corporate email communications has 45 been generally accepted by Brazilian courts,19 the possibility to review data from personal email communications is more controversial. The prevailing understanding is that companies cannot intercept private email accounts. On the other hand, the possibility to monitor and review fragments of data left in the computer by private emails usage (not involving interception or monitoring) depends on the circumstances of each specific case. Finally, it is important to mention that data that is subject to specific data 46 protection legislation (e.g. banking and tax data) cannot be searched or monitored. Brazilian courts tend to deem such data inviolable and therefore should only be accessed upon court order, as ruled by the Brazilian Supreme Court on Labor Matters in a decision of 2008.20 3. Handover, review and processing of files, letters and documents of employees If the letters, documents and files are work-related and use company’s computers 47 or systems, employers have the right to require their handover and inspect them. This is based on the same arguments detailed in supra paras. 35 et seq. (the employer’s power of direction and liability for actions undertaken by an employee on the employer’s behalf).

17

Superior Labor Court (TST), RR – 9961/2004-015-09-00. Superior Labor Court (TST), No 1130/2004-047-02-40. 19 In a decision by the Superior Labor Court (TST), it was ruled that “The employer may exercise in a moderate, generalized and impersonal way, the control over the emails received and sent by the email account made available by the employer, with the strict purpose of avoiding abuses as these may come to cause damages to the company. This electronic means supplied by the company has the legal nature equivalent to a working tool. Thus, unless the employer agrees to a different use, it is destined to a strictly professional use”. (Interlocutory Appeal on Review Appeal No. 613/2000, Reporting judge Minister Joa˜o Oreste Dalazen, May 16, 2005). In another decision, the State of Parana Appellate Court ruled that “The email account (mail box), although in the name of Plaintiff, in fact did not belong to her, but to the employer and, for this reason, the employer may monitor the emails exchanged by the employee”. (Civil Appeal No. 275.795-9, 5th Civil Court, Proceedings No. 0275795–9, Nov. 16, 2004). 20 Superior Labor Court (TST), No 1187/2002-029-12-00. 18

v. Ancken/Flesch/Fonseca/Lima/Maeda

Reemers Publishing Services GmbH O:/Beck/Spehl_Gruetzner/3d/02_Brazil.3d from 06.03.2013 09:24:17 3B2 9.1.580; Page size: 160.00mm  240.00mm

64

§ 2. Brazil

On the other hand, the employer’s power of direction is limited by the fundamental individual rights set forth in the Brazilian Constitution, including the right of privacy and intimacy.21 Therefore, if the files, letters, or documents bear private content, the Brazilian Federal Constitution protects them against disclosure by means of Art. 5, X and XII transcribed above (supra paras. 31 et seq. and 35 et seq.). As a consequence, while the employer is entitled to review documents related to the company’s activities and the performance of the employee’s work (given that the information in these documents are related to the professional activities performed by the employee, and, therefore, are not covered by the privacy protection) personal documents should not be included in the investigation, given that such inclusion could expose the company to certain privacy-related risks.22 49 In view of the legal provisions referred to above, the proceedings for the collection of physical documents and files kept by the employee should be conducted in a careful manner. It is generally advisable that such collection of documents be made by the employee him/herself, in the presence of someone from the investigation team to avoid destruction of documents. In this case, the employee would be the one handling the documents related to the work activity to the investigation team member, and the investigation team member would not perform the initial review and selection of documents to determine which of them are personal and which are professional. Indeed, individuals normally maintain personal documents such as banking account information, income tax data, or personal telephone numbers among his/her files and documents. In case any of these documents are mishandled by the employer, the employee may feel offended and, consequently, file a claim seeking the payment of moral damages or claim a constructive dismissal.23 50 To summarize the foregoing, in case of collection of physical documents, if an employer decides to investigate the documents and files in the employee’s working station, the investigated employee should, if possible, be requested to select the documents the company will have access to. This would, on one hand, reduce the chances of finding evidence against the investigated employee. On the other hand, if the documents are selected and handed in by the employee, the chances of success for the company in the event of a lawsuit filed by the investigated employee seeking payment for moral damages would significantly increase. The company will need to evaluate the advantages and risks associated to each such option, in view of the specific circumstances of the case. 48

21 Viana, Direito e FlexibilizaÅao, in: Simo ´ n, A ProteÅa˜o Constitutional da Intimidade e da Vida Privada do Empregado, LTr. Sa˜o Paulo (2000), p. 119. 22 Although there are risks related to the review of personal documents in the employer’s computers and systems, there are arguments to defend that such personal files may be reviewed, specially if the employee was warned not to have any privacy expectations related to such documents saved in the employer’s systems, and/or if the investigation context justifies such review. 23 As mentioned above, some documents have their confidentiality protected under the applicable banking and tax secrecy rules. Mishandling of this type of files may be considered a crime, as set forth in Art. 10 of Complementary Law 105 of January 10, 2001.

v. Ancken/Flesch/Fonseca/Lima/Maeda

Reemers Publishing Services GmbH O:/Beck/Spehl_Gruetzner/3d/02_Brazil.3d from 06.03.2013 09:24:17 3B2 9.1.580; Page size: 160.00mm  240.00mm

B. Admissibility and implementation of individual measures

65

4. Handover and imaging of the computer and subsequent processing of the business-related data and electronically stored business-related documents of employees (other than emails) The employer may request the handover and imaging of the company’s computer used by its employees for processing and review, especially if only businessrelated data and electronically stored business-related documents of employees will be subject to search and processing. A computer is deemed to be the company’s property and the information contained therein has a professional nature, as ruled by the Brazilian Supreme Court on Labor Matters.24 In fact, it has been generally accepted that the employer has the right to review all business-related files stored in the computers provided to its employees, especially if (i) the employment policies expressly provide so and the employee is aware of them; (ii) the company avoids reviewing personal files that may be stored in the company’s computer (although normally the company can only determine that a file is of a personal nature after processing it and after a preliminary analysis); and (iii) the employer can justify the need for the processing and review of electronic files as a reasonable measure in the context of the investigation. According to a decision by the Regional Labor Court of Sa˜o Paulo mentioned below, an employer may investigate the documents and files that the employee maintains in the computer he/she was provided with to perform his/her activities, especially if said documents and files are not protected by password or similar protection mechanism and the information obtained by the employer is not disclosed to third parties.25

51

52

53

54

5. Inspection of the personnel files of employees As the personnel files of employees contain personal information, such as health- 55 related data, their professional path, basic contact information, place and date of birth, among others, the employee’s rights against their disclosure is protected by the Brazilian Federal Constitution by means of its Art. 5, X transcribed in supra paras. 31 et seq. As a consequence, the employer’s use of the information contained in the employees’ personnel files should be conducted in a careful way and strictly as necessary for the conduction of the investigation. 6. Video surveillance of employees Employers may use surveillance cameras to protect the business, to prevent 56 incidents or misconducts of any kind, or for reasons of productivity and efficiency. 24

Superior Labor Court (TST), AIRR-2771/2003-262-02-40.9 In this decision, it was ruled that due to its duty of surveillance and the right of property, the employer has the right to perform an internal investigation and review the data available in the hardware of the computer used by its employees. The Court also stressed that this right was much clearer since the employer did not have to break any password or disclose the data obtained during the investigation to third parties. The understanding of the Judges was in the sense that in case the employee uses the computer provided by the employer to save personal files, no privacy could be expected. (Regional Labor Court of the 2nd Region – Decision No. 20070506382 – Procedure No. 00316200304402006). 25

v. Ancken/Flesch/Fonseca/Lima/Maeda

Reemers Publishing Services GmbH O:/Beck/Spehl_Gruetzner/3d/02_Brazil.3d from 06.03.2013 09:24:18 3B2 9.1.580; Page size: 160.00mm  240.00mm

66

§ 2. Brazil

There is no express provision provided by the law regarding this issue. However, in view of the fundamental protection of privacy, an employer should find a proper balance between the need to use surveillance cameras taking into account how it may affect employees’ privacy and intimacy.26 57 There are, for instance, improper locations to install cameras that can constitute privacy violation as the employer’s surveillance right is not unlimited.27 In several occasions, Brazilian Courts have decided that an employer has the right to monitor employees by means of surveillance cameras if aiming at lawful purposes only.28 58 As the use of surveillance cameras is not an issue completely settled by law, some commentators state that employees should, due to the principle of good-faith of the labor agreement,29 be notified in writing that surveillance will be conducted and they should sign a declaration attesting that they are aware that they may be monitored. Another option would be to put visible signs in the areas that are under surveillance. In addition, in order to avoid allegations of moral harassment, bullying or discrimination when using video surveillance, the cameras must be focused on several employees or placed in areas used by various employees. 7. Tapping of telephone conversations As described above, Art. 5, X, XII and LVI of the chapter of fundamental guarantees of the Brazilian Federal Constitution protect the privacy of individuals, by guaranteeing the right to compensation for material or moral damages resulting from any privacy violation. These provisions also set forth that telephone communications are inviolable, except as prescribed by Law 9, 296/96, for purposes of criminal investigation or criminal procedural finding of facts. 60 Such law provides that telephone communication means can only be intercepted for evidencing purposes in criminal investigations and in criminal procedural finding of facts, in accordance with its provisions and upon an order by the judge responsible for the criminal procedure or lawsuit. All information resulting from the interception shall run under judicial secrecy.30 61 According to Law 9, 296/96, the interception shall not be permitted whenever (i) there are no reasonable signs of authorship or participation of the target individual in a criminal violation, (ii) the evidence may be obtained by other means, and (iii) the investigated fact is a minor criminal violation or a misdemeanor. 59

26

Barros, ProteÅa˜o a` intimidade do empregado. LTr. Sa˜o Paulo (1997), p. 80. This includes locations for the employee’s personal comfort and health, such as changing rooms and toilet rooms, which should not be object of surveillance. (Barros, ProteÅa˜o a` intimidade do empregado. LTr. Sa˜o Paulo (1997), p. 80). In fact, a decision rendered by the Brazilian Supreme Court on Labor Matters ruled that the company’s attitude of installing surveillance cameras in toilet rooms exceeds the employer’s power of direction, and constitutes violation in view of the Constitutional protection of privacy rights (Superior Labor Court (TST), No RR – 1263/2003-044-03-00). 28 In a decision rendered by a lower labor court it was ruled that the use of surveillance cameras does not constitute an unlawful act since the cameras installed in the workplace aim at protecting both personal and patrimonial security. The decision also emphasized that the employer did not violate privacy’s right, because there were not surveillance cameras in private areas such as toilet rooms (Regional Labor Court of the 4th Region Decision No. RO 01177-2006-372-04-00-3). 29 Nascimento, Curso de Direito do Trabalho. 24a ed. Sa ˜o Paulo (2009), p. 386. 30 Law 9296/96, Art. 1. 27

v. Ancken/Flesch/Fonseca/Lima/Maeda

Reemers Publishing Services GmbH O:/Beck/Spehl_Gruetzner/3d/02_Brazil.3d from 06.03.2013 09:24:18 3B2 9.1.580; Page size: 160.00mm  240.00mm

B. Admissibility and implementation of individual measures

67

Therefore, it is illegal to intercept or monitor telephone communications of third parties, as well as to use them as evidence in a court proceeding; except if such interception is made in accordance with the provisions of Law 9, 296/96. However, in an employment relationship, the power of direction of the employer must be taken into account, as in the case of email monitoring. Tapping of telephone conversation by employers has been accepted when telephone is crucial to operate and manage the company’s business activity, such as for telemarketing companies,31 and when the employee is made aware of the monitoring practices by the employer.32 On the other hand, once it is accepted at a company that employees use telephone for private matters, employees naturally have some privacy expectation when using this communication means. For this reason, a decision rendered by the Brazilian Supreme Court on Labor Matters ruled that evidence from telephone tapping is not accepted considering that the employer’s powers of direction and surveillance are not unlimited and cannot overcome the rights granted by the Brazilian Constitution.33 As outlined before, it is advisable to clearly inform the employees that the company’s email, computer systems and telephone lines (in the latter case, assuming that telephone is crucial to operate and manage the company’s business activity) are “work tools” that shall be used exclusively for business purposes and that, while using such tools, the employees should not expect to have privacy.

62

63

64

65

66

8. Search of the workplace In view of the principles in the Brazilian Federal Constitution, the investigation 67 of an individual’s private life (depending on how and to what extent the investigation is conducted) may cause a violation to the right to intimacy and privacy, giving grounds for material or moral damage claims. As a general rule, the employee’s work area is inviolable and, therefore, shall not 68 be searched by the employer without the employee’s consent.34 In this sense, search of the workplace may, depending on the case, be only admitted exceptionally for security reasons and to protect the employer’s assets.35 31 Simo ´ n, A proteÅa˜o constitucional da intimidade e da vida privada do empregado. LTr. Sa˜o Paulo (2000), p. 154. 32 Regional Labor Court of the 10th Region RO 00439-2003-011-10-00-2. 33 Superior Labor Court (TST), AIRR-23/2000-043-01-40.0. 34 Simo ´ n, A proteÅa˜o constitucional da intimidade e da vida privada do empregado. LTr. Sa˜o Paulo (2000), p. 150. The Brazilian Regional Labor Court of the 2nd Region ruled that “it is correct to assume that the employer has the power to direct the employee, which allows it to set forth the guidelines and internal procedures to be adopted for the solution of matters under controversy. However, this advantage never surpasses the principle of the dignity of the human being. The investigation of private assets, as in this case in the plaintiff’s locker, could not be seen as allowed by an contractual clause or condition. As duly stressed by the judge of the first level of jurisdiction, if the defendant offered a locker with a key to its employees to keep their assets, unlocking said lockers without the corresponding employee’s authorization is an evident violation of his/her privacy”. (Regional Labor Court of the 2nd Region – Decision No. 20090296014 – Procedure No. 00729.2004.074.02.00-3). 35 Simo ´ n, A proteÅa˜o constitucional da intimidade e da vida privada do empregado. LTr. Sa˜o Paulo (2000), p. 149.

v. Ancken/Flesch/Fonseca/Lima/Maeda

Reemers Publishing Services GmbH O:/Beck/Spehl_Gruetzner/3d/02_Brazil.3d from 06.03.2013 09:24:18 3B2 9.1.580; Page size: 160.00mm  240.00mm

68 69

§ 2. Brazil

Any kind of search of the workplace must be conducted carefully; especially because employees usually have some personal documents or assets at their workplaces. In this regard, in case the employer intends to investigate employees’ offices, the investigation shall be duly grounded, in order to show that it was not performed in a way to discriminate or embarrass the employee. To reduce the risks of claims, it is advisable to provide the employee with prior warning, informing the reasons for the investigation, and to request the employee to pick up his/her personal assets or documents before the investigation. 9. Covert listening in on conversations (other than telephone conversations) on the business premises

There is no general prohibition against covert listening of conversations at the workplace in Brazil. However, it is clearly an aggressive monitoring practice that should be carefully considered before its implementation. 71 From a doctrinal perspective, technological improvements cannot be ignoredconsidering that their availability increases company’s efficiency and productivity.36 However, monitoring techniques should only be implemented for work-related reasons and lawful purposes. 72 In case covert listening of conversations is used for supervising and controlling employee activities-in order to ensure quality of the work, for instance, it should only be carried out in places where employees perform their professional activities and only within business limitations. Yet, like other monitoring practices, employees should be previously informed of the possibility of covert listening (and consent to it), and the employer should clearly establish this practice in the company’s policies in order not to raise false privacy expectations. 73 As there is no express provision in Brazilian laws about this practice, one cannot exclude the possibility of the courts understanding it as unreasonable, taking into account the intimacy and privacy right of the individual ensured by the Brazilian Federal Constitution. 70

10. Investigations carried out in the surroundings of employees under suspicion Employers may, in principle, carry out interviews with third parties related to an employee under suspicion. 75 The interview should only be conducted if voluntarily accepted by the third party. A third party’s interview refusal should not be used as a decisive element when determining whether to keep the employee in the company. Otherwise, a third party may allege that he/she was obliged to practice an act against his/her will, which may constitute a criminal offence of illegal constraint.37 76 With respect to investigations carried out in an employee’s surroundings, please refer to the cautions above regarding the employee’s right of privacy and measures to avoid allegations of discriminatory practices, bullying and moral harassment. 74

36 Simo ´ n, A proteÅa˜o constitucional da intimidade e da vida privada do empregado. LTr. Sa˜o Paulo (2000), p. 152. 37 Brazilian Criminal Code, Art. 146.

v. Ancken/Flesch/Fonseca/Lima/Maeda

Reemers Publishing Services GmbH O:/Beck/Spehl_Gruetzner/3d/02_Brazil.3d from 06.03.2013 09:24:19 3B2 9.1.580; Page size: 160.00mm  240.00mm

C. Employee interviews

69

II. Must employees’ representatives such as the works council be involved in internal investigations? In Brazil, there are no legal provisions regarding works council. This type of 77 council is not adopted by employees or employers in the country.

C. Employee interviews I. May an employee refuse to provide information if this information would incriminate himself/herself? Employees may refuse to speak during an interview conducted by his/her 78 employer, even if the information would not incriminate him/her. According to the principle against self-incrimination provided by the Brazilian 79 Federal Constitution, an employee may refuse to provide any kind of information against him/her and such refusal shall not disfavor him/her. This right that the accused or suspect individual has, of not being obliged to produce evidence against him/herself, could be extracted from the provision of full defense and other Brazilian constitutional provisions, such as the presumption of innocence. As there is no express legal provision in this sense, the principle against self- 80 incrimination is a result of the doctrine and generally accepted by Brazilian courts – especially because of the interpretation of three (3) provisions provided by the Brazilian Federal Constitution, Art. 5, LXIII, LV and LVII, as described below: “LXIII – the arrested person shall be informed of his/her rights, among which the right to remain silent, and he shall be ensured of assistance by his/her family and a lawyer; “LV – litigants, in judicial or administrative proceedings, as well as defendants in general, are ensured of the adversary system and of full defense, with the means and resources inherent to it” “LVII – no one shall be considered guilty before the issuing of a final and unappealable criminal decision;”

This constitutional right is also protected by Art. 186 of the Code of Criminal 81 Procedure, according to which the accused individual shall be informed, prior to the questioning, of his/her right to remain silent and not to answer the questions posed to him/her. In addition, according to this same Article, an individual’s silence shall not be deemed a confession and must not be interpreted to the prejudice of the defense.38 According to Art. 198 of the Code of Criminal Procedure, although such silence shall not be deemed a confession, it may constitute an element for the judge’s opinion.39 However, the Brazilian Federal Supreme Court has ruled that the silence of the accused may only constitute an element for the formation of the judge’s convincement, if it is in favour of the accused (but never to his or her detriment).40 38 Code of Criminal Procedure, Art. 186: Once duly qualified and informed of the entire content of the accusation, the accused individual shall be informed by the judge, before starting the interrogatory, of his/her right to remain in silence and not to respond to questions. Sole Paragraph: The silence, which shall not be deemed a confession, shall not be interpreted in prejudice of the defense. 39 Code of Criminal Procedure, Art. 198. The silence of the accused individual shall not be deemed a confession, however, it may constitute an element for the judge to build its opinion. 40 Brazilian Supreme Court Habeas Corpus No 84.517/SP.

v. Ancken/Flesch/Fonseca/Lima/Maeda

Reemers Publishing Services GmbH O:/Beck/Spehl_Gruetzner/3d/02_Brazil.3d from 06.03.2013 09:24:19 3B2 9.1.580; Page size: 160.00mm  240.00mm

70 82

83

84

85

86

87

88

§ 2. Brazil

By means of the Costa Rica Convention homologated by Brazil, this principle was incorporated into the national legal system.41 Item g, Art. 8 of said Convention provides that “every person has the right of not being compelled to be a witness against himself or to plead guilty”.42 It should also be noted that although the Brazilian Constitution expressly mentions “the arrested person”, Brazilian case law and commentators generally accept that, as a fundamental guarantee, the right to remain silent extends to any and all individuals in Brazil (including foreigners) and not only in a formal criminal proceeding but in any situation where that individual understands that the provision of a statement may be detrimental to him/her. There is also an understanding by some authors that the accused individual may lie during an interview due to his/her constitutional right to remain silent guaranteed under Art. 5 LXIII and § 2 and the right against self-incrimination. Indeed, unlike other jurisdictions where perjury is committed when a defendant under oath lies (e.g. the United States), Brazilian courts and leading commentators have accepted that lying is actually a way of exercising the right to remain silent and not disclose facts which the defendant considers detrimental to his/her defense, in order to guarantee the right of full defense. As there is no crime of perjury in Brazil and the defendant or accused has the right to remain silent- with no legal obligation to tell the truth or produce evidence against him- the consequence is that the defendant or accused can also lie in court. Although in the civil sphere there is a general obligation for the parties to expose the facts according to the truth and act in good faith (Art. 14 of the Brazilian Code of Civil Procedure), the same legislation also contains a similar provision allowing the parties to remain silent regarding facts that can involve an accusation of criminal or tort conduct against that party. According to Art. 347, “the party is not obliged to testify about facts: I – that constitute crime or tort imposed on it; […]”. In addition, as there is no general disclosure obligation under Brazilian law, the judge in a civil claim can only order one party to present specific documents that the opposing party knows to exist and specifically requested. In any case, the party receiving an order to present a specific document can refuse to do so in certain situations set forth by Art. 363 of the Civil Procedure Code, including when “its presentation can violate duty of honor” (item II); “the publicity of the document causes dishonor to the party or to third party, as well as to their direct relatives or relatives up to the third degree, or represents risks of criminal claim against them” (item III); “there is serious reasons that can justify the refusal to present the document, at the reasonable discretion of the judge” (item III). With respect to witnesses (i. e., not accused persons), once under oath they have the obligation to tell the truth to the judge, otherwise they may be subject to criminal sanctions.43

41

Decree-law 678 of 11.6.1992. Fernandes, Processo Penal Constitucional, 5a ed., Sa˜o Paulo: Revista dos Tribunais (2007), pp. 303/304. 43 According to Art. 203 of the Brazilian Code of Criminal Procedure, “the witness will promise, under oath, to say the truth about what he knows and is demanded, […] and report what he knows, explaining always the reasons of his knowledge or the circumstances that can make it possible to evaluate his credibility”. 42

v. Ancken/Flesch/Fonseca/Lima/Maeda

Reemers Publishing Services GmbH O:/Beck/Spehl_Gruetzner/3d/02_Brazil.3d from 06.03.2013 09:24:19 3B2 9.1.580; Page size: 160.00mm  240.00mm

C. Employee interviews

71

However, it is important to note that such an obligation is also subject to certain exceptions, notably when the witness understands that his/her statements may expose himself/herself to criminal prosecution, in which case the comments above (applicable to accused parties) would also apply to the witnesses. As already decided by the Brazilian superior courts, even if someone is invited to speak as a witness (and not formally as an accused or investigated individual), he/she has the right not to produce evidence against him/herself.44 Accordingly, the witness can remain silent or lie to protect himself from criminal liability.45 In situations of internal corporate investigations, because the employee is not under oath before a judge, no crime of false testimony can be committed during an internal audit. In view of the foregoing, an employee who is under investigation has no obligation to tell the truth in meetings or formal interviews. As the employees may understand that their statements may be used against them in possible criminal or other proceedings, they have the right, under Brazilian law, to remain silent or even lie. The same applies to employees who are not formally investigated but only invited to cooperate and provide information as a witness, in case they understand that the facts questioned by the company may result in criminal implications to them. Moreover, in general terms and except for some specific situations, the employers will not be entitled to dismiss an employee for cause solely because the employee refused to participate in interviews or because the employer understands that the employee is not telling the truth or omitting facts. As there is no specific legal obligation for employees to cooperate in internal investigations as witnesses – and also because as an accused or investigated party, the employee would be entitled to the Constitutional right mentioned above – the employer cannot generally force employees to cooperate.

89

90

91

92

1. Duty to provide information on the tasks directly assigned to the employee or carried out by the employee. As described in the previous item, employees may on the one hand refuse to talk 93 during an interview conducted by his/her employer, even if the information would not incriminate him/herself. If the information is incriminating, the employee would especially be able to refuse to provide the information on account of the principle against self-incrimination. On the other hand, based on inherent characteristics of the employment relation- 94 ship in Brazil, such as the power of direction and subordination, an employer may request that an employee presents any kind of work-related information. More precisely, due to the legal aspect of the employer’s power of direction, the employee has a duty to obey all reasonable directions of the employer.46 In its turn, subordination represents a legal situation that derives from an individual contract 44 RTJ 163/626, Min. Carlos Velloso; RTJ 163/626; RTJ 176/805-806; RTJ 141/512, Min. Celso de Mello. 45 Likewise, Art. 406 of the Code of Civil Procedure provides that “the witness is not obliged to testify about facts: I – that constitute crime or tort imposed on it; […]”. 46 Simo ´ n, A proteÅa˜o constitucional da intimidade e da vida privada do empregado. LTr. Sa˜o Paulo (2000), p. 106.

v. Ancken/Flesch/Fonseca/Lima/Maeda

Reemers Publishing Services GmbH O:/Beck/Spehl_Gruetzner/3d/02_Brazil.3d from 06.03.2013 09:24:20 3B2 9.1.580; Page size: 160.00mm  240.00mm

72

§ 2. Brazil

of employment, which implies acceptance by the employee, of the employer’s power of direction and control in performing the duties provided in the employment contract.47 Therefore, an employee must also obey any order from his/her superior in this sense, within the limitations in the paragraph above and within his/her constitutional right to privacy. 95 The refusal by the employee to provide work-related information may constitute a serious fault which may give rise, depending on the case to the employee’s dismissal. 96 The termination with cause48 for this case is set forth in items (b) and (c) of Art. 482 of the Brazilian Consolidation of Labor Laws (CLT), as follows: “Art. 482. The following shall be deemed to be lawful causes for the cancellation of a contract of employment by the employer: (…) (b) Misconduct or bad behavior; (h) Breach of discipline or insubordination”;

97

In case the employee refuses to provide work-related information, the employer has the right to take the necessary measures to obtain such information within the limitations imposed by the employee’s constitutional right to privacy. 2. Duty to provide information in indirect connection with the scope of work

98

When the requested information has only an indirect connection with the scope of work, the right of the employee not to provide the employer with any information during an interview is likely to supersede arguments in the sense that the employee must provide information to the employer in view of subordination obligation. This is particularly the case because the level of private information contained therein tends to be higher. In any case, this must be analyzed on a caseby-case basis. 3. Duty to provide information outside the scope of work

99

The employee has no duty to provide information outside the scope of work. On the contrary, by requesting and using such information, the employer may be subject to claims for violation of privacy rights. 4. No disclosure of information to authorities if the employee is obliged to incriminate himself/herself

Under Brazilian law, no one is obliged to incriminate him/herself. On the contrary, an employee may refuse to provide any information that incriminates him/her considering the right against self-incrimination previously mentioned. 101 Moreover, the Brazilian Constitution and criminal system warrant the due process of law, trial and possibility of a broad defense. Besides, according to the 100

47 Delgado, O poder empregatı´cio, in: Simo ´ n, A proteÅa˜o constitucional, LTr. Sa˜o Paulo (1996), p. 108. 48 One of the consequences of termination for cause is that the employee loses part of his/her right to severance payments that are assured by law in case of dismissal without cause.

v. Ancken/Flesch/Fonseca/Lima/Maeda

Reemers Publishing Services GmbH O:/Beck/Spehl_Gruetzner/3d/02_Brazil.3d from 06.03.2013 09:24:20 3B2 9.1.580; Page size: 160.00mm  240.00mm

C. Employee interviews

73

criminal law principle “in dubio pro reo” or presumption of innocence, an individual is deemed innocent until proven guilty. In case an employee incriminates himself, this information may be used against 102 him in the course of legal proceedings. However, for evidencing purposes, the confession must be a voluntary admission of the wrongdoing. Otherwise, this evidence may be deemed unfairly obtained, and therefore, illegal (e.g. confessions obtained by the use of threat or violence). In this sense, the confession made by an employee in an internal investigation 103 (extrajudicial confession) needs elements that evidence its legitimacy, in order for it to be considered legal evidence (e.g., written confession by the employee accompanied by a lawyer). This is because, in many cases in an employment context, the employee may feel indirectly obliged and compelled to provide the employer with information in order to keep his/her job. Consequently, this evidence has a relative value, as it may not be considered by the judge depending on the circumstances it was obtained. If, however, an employee’s lawyer is present when the confession is made, the value of this evidence would considerably increase. The admissibility of the extra judicial confession depends on the confirmation 104 thereof by the accused individual or witness in court.49 Although the trial judge may use the extrajudicial confession to form his/her opinion, additional evidence brought into the lawsuit should also be taken into account, as provided by Art. 197 of the Brazilian Criminal Procedure Code.50 In this sense, the Brazilian Supreme Court ruled that a confession obtained during the police investigation may be retracted in the legal proceedings.51

II. Is an employee obliged to provide information on any misconduct of or criminal offence committed by other employees? There is no provision in the Brazilian legal system that obliges an employee to 105 provide information on any misconduct or criminal offence committed by other employees. Although there is no requirement under Brazilian law, the company may en- 106 courage employees to report misconducts committed by others, including superiors in the organization, without having his/her position threatened or harmed. This could be implemented by means of whistle blowing hotlines made available to employees. However, in case an employee is directly responsible to monitor and supervise 107 the activities of others (e.g., his/her subordinates) due to his/her position within the company, any known misconduct not reported may constitute a serious fault. The Brazilian Supreme Court on Labor Matters ruled that, due to the position within the company, the employee’s hierarchic level and specific functions assigned to him/ her, an employee may be obliged to inform any misconduct of any other employee 49 Moreira, Da confissa ˜o no processo Penal. Article available at: www.juspodivm.com.br/i/a/ %7B1813C1FD-8558-4EAD-8B61-5F49A4D89156%7D_026.pdf on 10.26.09. 50 Criminal Procedure Code, Art. 197: The value of the confession shall be determined by the criterion adopted for other evidence elements, and for its appreciation, the judge shall confront it with the other evidences in the lawsuit, by verifying if they are compatible. 51 Brazilian Supreme Court Habeas Corpus No 84.157.

v. Ancken/Flesch/Fonseca/Lima/Maeda

Reemers Publishing Services GmbH O:/Beck/Spehl_Gruetzner/3d/02_Brazil.3d from 06.03.2013 09:24:20 3B2 9.1.580; Page size: 160.00mm  240.00mm

§ 2. Brazil

74

he/she is responsible for.52 Therefore the breach of this duty can lead to dismissal with cause; considering that the employee did not fulfill and accomplish the functions he/she was assigned with and continuity of the employment relationship cannot be maintained due to the employer’s lack of confidence in the employee.53

III. May an employee refuse to answer a question if he/she has already answered it within the scope of a previous interview? 108

The question on whether an employee may refuse to answer a question if he/she has already answered it within the scope of the previous interview depends on the same elements explored under question in supra paras. 78 et seq.

IV. Is an employee entitled to the presence of a member of the works council or an attorney during the interview? 1. The employee’s right to the presence of a member of the works council 109

As referred to before, this question is not applicable to Brazil. 2. The employee’s right to the presence of a lawyer representing the employee’s rights

The employee is not obliged to agree with the interview and may condition his/ her participation to the presence of a lawyer. Brazilian labor law does not have any specific rule in this regard. 111 However, in case there is a lawyer of the company participating in the interview, it is reasonable to argue that the employee would be also entitled to the right of having his/her own lawyer present. This is especially the case if the interviewee is under suspicion. In any case, this will depend on a case-by-case analysis. 112 In addition, depending on the matter under investigation and the scope of the interview, the absence of a lawyer representing the employee’s rights during the interview could be an argument against the company in a moral damages claim from the employee.54 110

52

Superior Labor Court (TST), Decision No 67503/2002-900-04-00. Nascimento, Curso de Direito do Trabalho, 24a ed. Sa˜o Paulo (2009), p. 776. 54 In this regard, in a decision issued by the Labor Court of Sa ˜o Paulo, in a case that involved the theft of company’s assets, the Judges understood, in summary, the following: “The investigation of a crime can be solely carried out by the State, by the police department and an internal investigation performed by the employer – submitting the employees to interrogatories – exceeded the limits of the powers of the employer to direct the business, specially if the interrogatories occurred individually, in a separate room, where the employees did not have any witnesses to verify how they were treated, nor a lawyer to assist by granting them the respect to the minimal conditions of human dignity. Based on these arguments, the Labor Court granted an indemnification for moral damage.” (Regional Labor Court of the 2nd Region – Decision No. 20060982084 – Proceedings No. 00174-2004-446-02-00-3). 53

v. Ancken/Flesch/Fonseca/Lima/Maeda

Reemers Publishing Services GmbH O:/Beck/Spehl_Gruetzner/3d/02_Brazil.3d from 06.03.2013 09:24:20 3B2 9.1.580; Page size: 160.00mm  240.00mm

D. Sanctions imposed on employees

75

V. Is an employee entitled to read the record of his/her interview? As a general rule, an employer is not obliged to allow an employee to read the 113 record of the interview, except if otherwise agreed upon between the employer and the employee.

VI. Is the employer entitled to request that the employee signs the record of the interview? The employer may request that the employee signs the record of the interview, 114 and the employee can refuse to sign it. The employee is obviously entitled to the right to read it and request any modifications to it, in case the employee decides to actually sign the records. With respect to the record/transcript of interviews, please refer to our comments in supra paras. 59 et seq. regarding possible adverse implications under U.S. laws in connection with privilege and discovery matters.

VII. Can the employer instruct an employee to treat the content of his/her interview as confidential? Considering that, in most cases, the issues raised in the investigations are very 115 sensitive, the employer not only can, but should instruct the employee to treat the content of the interview as confidential. In addition, note that the employer may also ask the employee to sign a confidentiality agreement to reinforce the obligation of non disclosure of the information. On the other hand, it is important to make clear to the employee that the 116 company may disclose the statements provided by the employee to third parties – including public authorities – at the sole discretion of the company and without the need to obtain the employee’s consent.

D. Sanctions imposed on employees I. What are the sanctions under employment law that can be imposed on employees refusing to cooperate in internal investigations? The employee may refuse to cooperate in an internal investigation. In general, 117 this conduct, with exceptions depending on the specific circumstances (e.g., an employee who refuses to talk about his/her job functions may, depending on the situation, be subject to sanction) may not be considered a cause for any sanction. Nonetheless, in practical terms, the employee will likely cooperate with the 118 internal investigation because, except for the tenured employees, the majority of employees are afraid of termination even if without a cause. In Brazil, an employer can terminate the employment contract without a cause at any time. Although termination without a cause is not considered a sanction, in practical terms, employees try to cooperate with employers in order to avoid it. v. Ancken/Flesch/Fonseca/Lima/Maeda

Reemers Publishing Services GmbH O:/Beck/Spehl_Gruetzner/3d/02_Brazil.3d from 06.03.2013 09:24:21 3B2 9.1.580; Page size: 160.00mm  240.00mm

§ 2. Brazil

76

Regarding termination without cause, the Brazilian Federal Constitution protects employees against “arbitrary dismissal or without cause” by means of specific regulation. It also provides that if an employment agreement is terminated arbitrarily or without cause, the employer must pay a fine in an amount equal to 50 % of the funds existing in the employee’s Severance Fund account.55 120 There are certain tenure circumstances in which an employer is prevented from terminating an employment relationship arbitrarily or without a cause. For example, when an employee is an elected member of the board of the employees’ union or a member of the employer’s Internal Committee for Prevention of Accidents (“CIPA”). Furthermore, employees may not be terminated while on vacation, maternity leave, or sick leave. 121 Collective bargaining agreements between the employees’ union and employers’ association can also provide for certain special cases of tenure protecting employment. For example, the agreement may restrict the employer from terminating an employment relationship when the employee is less than two (2) years from retirement. The laws require that the employees’ union and the employers’ association enter into annual collective bargaining agreements dealing with general employment conditions, the most important of which is a salary raise. If no such agreement is executed, either party may file a collective bargaining claim to provoke collective negotiations. 119

1. Reduction of the remuneration 122

Salary reduction is only allowed in Brazil through collective negotiation with the labor union that represents the employees. As it is a result of negotiation, salary reduction is usually established in exchange for another benefit (e.g., reduction of working hours). For this reason, the reduction of remuneration is not seen as a sanction to the employees and it could not be used with the purpose of punishing the employee. 2. Warning letter and termination

Except for very specific cases,56 Brazilian employees may face only three (3) kinds of sanctions: (i) warnings (oral or written); (ii) suspension of the employment contract, without the payment of compensation during the suspension period, which is limited to thirty (30) days; and (iii) termination with cause. 124 As outlined above, the refusal by an employee to cooperate in an internal investigation may not per se give grounds for any kind of sanction. 123

55

Severance Funds must be created by the employer for each employee by depositing an amount equal to 8.0 % of the employee’s monthly compensation in a special blocked bank account, opened in the name of the employee for that particular purpose. The amounts deposited in these funds, accrued by interest and adjusted according to the inflation, may be withdrawn by the employee upon retirement, as well as in certain other cases such as termination by the employer without a cause. 56 Such as football players.

v. Ancken/Flesch/Fonseca/Lima/Maeda

Reemers Publishing Services GmbH O:/Beck/Spehl_Gruetzner/3d/02_Brazil.3d from 06.03.2013 09:24:21 3B2 9.1.580; Page size: 160.00mm  240.00mm

D. Sanctions imposed on employees

77

II. Is the suspicion of a criminal offence or of a severe violation of duty sufficient for an extraordinary termination? In Brazil, an employer can terminate an employment contract without cause at any time, including for mere suspicion of an offence or violation. If the company wants to terminate the employment of the suspected individual for cause, it is important that the company has strong evidence of the faults committed by the employee in order to be able to later support the termination for cause in court in case the employee files a claim to annul his/her termination for cause. If the company dismisses an employee for cause based only on a suspicion without evidence, the employee may be able to revert the termination for cause in court. In this case, in addition to receiving additional severance payments, the employee may add moral damages claims in the labor lawsuit. The causes for termination are set forth by Brazilian laws, as described below: (i) Practice of any dishonest act; (ii) Lack of self-restraint and improper conduct; (iii) Regularly doing business without permission of the employer, when the same is in competition with the enterprise of the employer and is harmful for the employee’s activities; (iv) Criminal sentence of the employee, in final judgment, provided that the execution of the penalty has not been suspended; (v) Sloth by the employee in the execution of his/her duties; (vi) Usual drunkenness or drunkenness during working hours; (vii) Violation of the employer’s secrets; (viii) Act of insubordination; (ix) Abandonment of employment; (x) Practice of acts that are injurious to the honor or reputation of any person, practiced during the working hours, as well as any physical violence practiced under the same conditions, except in case of legitimate defense; (xi) Practice of acts that are injurious to the honor or reputation of the employer or the employee’s superiors, as well as any physical violence to them, except in case of legitimate defense; (xii) Constant gambling; (xiii) Practice of acts against the national security duly evidenced by administrative investigation. According to the precedents of our Labor Courts, as a condition for the termination with cause, the fault committed by the employee must be serious and strong enough to break the trustful relationship between the parties.

125 126

127

128

III. During which period of time must an extraordinary notice of termination be given to employees whose misconduct has been revealed by the internal investigations? If the company decides to terminate an employee without cause, it must be 129 preceded by a written notice of at least 30 days. Since the presence of the employee under notice on the company’s premises is generally not convenient, most compav. Ancken/Flesch/Fonseca/Lima/Maeda

Reemers Publishing Services GmbH O:/Beck/Spehl_Gruetzner/3d/02_Brazil.3d from 06.03.2013 09:24:21 3B2 9.1.580; Page size: 160.00mm  240.00mm

78

§ 2. Brazil

nies prefer to pay one extra month of compensation and terminate employment immediately. 130 On the other hand, if the company decides to terminate the employee for cause, no severance notice is required and the termination produces effects immediately. 131 If the employer wants to terminate the employment contract for cause, this should be done as soon as the employer is aware of the misconduct and evidence supporting it. Taking too long to act can be viewed as a tacit waiver.

IV. Must an employee cooperate in internal investigations even after he/she has been given notice of termination? 132

As mentioned before, the employee is not required to cooperate in an internal investigation, regardless of the fact that he/she has been given notice of termination or not.

E. Use of the obtained information I. Is it permissible to disclose the findings and information obtained within the scope of any internal investigations to other group companies? 133

134

135

136

137

In case the findings and information obtained within the scope of an internal investigation include personal information, the disclosure and maintenance of such information is possible, however, it must be in accordance with the applicable Brazilian data protection-related legislation and requirements. The concept of personal information is not provided under Brazilian laws. However, some authors refer to personal data as the set of information about an individual which he/she may decide to keep under his/her exclusive control, or communicate, deciding to whom, when, where and under which conditions. Another factor that must be taken into account is whether such personal information is enough to enable other people to duly identify the person. With regard to sensitive data, unlike other jurisdictions with specific privacy legislation, Brazilian law does not provide for any specific definition of such type of data. There is no specific legislation on personal data protection in Brazil. There is a sectorial privacy legislation that has its base and structure in the Brazilian Federal Constitution which, in turn, brings together general principles to protect the privacy and confidentiality of personal information and communication, as described above. With regard to the requirements for the disclosure, transfer or any treatment of personal data, based on the Brazilian Federal Constitution, one can conclude that (i) privacy is a fundamental right and the person whose privacy has been infringed has the right to indemnification for any moral or material damages arising out of such infringement; and (ii) the owner of the personal information should have knowledge of and access to his/her personal information present in databases that may be transmitted to third parties and should be given the possibility to correct such personal information. From a labor law perspective, there are no specific legal provisions regarding personal data of employees or applicants. Labor laws do not expressly impose any v. Ancken/Flesch/Fonseca/Lima/Maeda

Reemers Publishing Services GmbH O:/Beck/Spehl_Gruetzner/3d/02_Brazil.3d from 06.03.2013 09:24:22 3B2 9.1.580; Page size: 160.00mm  240.00mm

E. Use of the obtained information

79

limitations on the employer’s ability to obtain, keep or transfer such data inside or outside of our jurisdiction. Since there is no law or consistent court precedents in our jurisdiction dealing with 138 obligations of employers with respect to employee’s or any applicant’s personal data, in order to avoid labor liabilities it is important that the employer uses common sense when dealing with such personal data. Generally, the obtaining, use or disclosure of the employee’s information should not cause him/her any embarrassment, personal exposure or offence. If the employee feels humiliated or dishonored by such actions, he/she may file a claim against the company for moral damages and privacy violation. Furthermore, in order to be protected from future claims, the employer should 139 inform the applicants about the obtaining of their personal data and how this information will be used, treated, stored and transfered. Upon their hiring, the employers should, for instance, ask the employees to execute a letter in Portuguese that authorizes the employer to transfer and disclose the employee’s personal data within its economic group. This letter should specify in reasonable detail which information may be transferred. This procedure should minimize an employer’s liability in case any labor claims are filed in the future against the company with the allegation of anti-ethical conduct. Finally, although there is no specific regulation on personal data protection in 140 Brazil, and the concepts of privacy, personal data or personal information are not provided for under Brazilian law, there are however, some bills of law for specific regulation on personal data protection pending at the Brazilian Congress.

II. Is it permissible and advisable to forward the findings and information obtained within the scope of any internal investigations to public authorities? 1. Admissibility of disclosure of personal data As described above, disclosure of personal data is generally admissible in Brazil as 141 long as the legal requirements under supra paras. 133 et seq. are complied with. In general, the obtaining or disclosure of the employee’s information shall not 142 cause him/her any embarrassment, personal exposure or offence, because if the employee feels humiliated or dishonored by such actions, he/she may file a claim against the company for moral damages and privacy violation. However, in case of disclosure of internal investigation results to public authorities, there will necessarily be some personal data. In these cases, it is advisable to limit such disclosure to the data strictly necessary for the purposes of the disclosure to the public authorities. Such disclosure should be proportionate and reasonable given its purposes and must be analyzed on a case by case basis. 2. Is it advisable to voluntarily disclose data to public authorities? Please refer to our comments in supra paras. 25 et seq.

v. Ancken/Flesch/Fonseca/Lima/Maeda

143

Reemers Publishing Services GmbH O:/Beck/Spehl_Gruetzner/3d/02_Brazil.3d from 06.03.2013 09:24:22 3B2 9.1.580; Page size: 160.00mm  240.00mm

80

§ 2. Brazil

III. Are the findings made in the scope of internal investigations subject to the attorney-client privilege? 1. No attorney-client privilege for in-house counsel involved in the investigations The attorney-client privilege is established in the Statute of the Legal Profession and the Brazilian Bar Association (Estatuto da OAB) and assures the inviolability of the attorney’s office, as well as all documents strictly related to his/her professional activity (including letters, phone calls and emails). The Statute, however, is not clear about the elements required to assert it. 145 Such Statute does not differentiate, for privilege purposes, between an in-house counsel and an outside counsel. However, Brazilian Courts have understood that companies’ legal departments can be subject to raids. 146 If outside counsel is considered to be part of the scheme or a suspect of a crime, the authorities might have access to the privileged documents. 144

2. Privileges in the case that external investigators are involved 147

As previously mentioned under supra paras. 14 et seq., if the investigations are conducted by outside counsel, confidentiality obligations are legally guaranteed.57

IV. Does the attorney-client privilege also apply to foreign attorneys? Foreign attorneys may conduct internal investigations in Brazil, as long as their activities within the investigation are outside of the scope of the activities described by the Statute of the Legal Profession and of the Brazilian Bar Association (Ordem dos Advogados do Brasil/OAB)58 as being exclusive to lawyers, i. e., (i) presentation of requests to any organ of the Judiciary Body and the special courts and (ii) legal consulting, assistance and direction. According to the same statute, the performance of such activities in the Brazilian territory and the use of the title “lawyer” are exclusive to the professionals enrolled with the Brazilian Bar Association.59 149 Therefore, as the attorney-client privilege in Brazil applies to “lawyers,” it does not apply to foreign attorneys; unless they are duly admitted by the Brazilian Bar Association. 148

F. Following-up on internal investigations I. What is to be observed during the follow-up of internal investigations? 150

During the follow-up of internal investigations, it is important to implement internal proceedings in order to make sure that the weaknesses demonstrated as a 57 Statute of the Legal Profession and the Brazilian Bar Association, and Sections 25, 26 and 27 of the Code of Ethics and Discipline of the Brazilian Bar Association. 58 Statute of the Legal Profession and the Brazilian Bar Association Section 1. 59 Statute of the Legal Profession and the Brazilian Bar Association Section 3.

v. Ancken/Flesch/Fonseca/Lima/Maeda

Reemers Publishing Services GmbH O:/Beck/Spehl_Gruetzner/3d/02_Brazil.3d from 06.03.2013 09:24:22 3B2 9.1.580; Page size: 160.00mm  240.00mm

F. Following-up on internal investigations

81

result of the internal investigation are resolved and will no longer expose the company to any liability. In order to achieve this goal, the company must monitor the key areas identified 151 during the internal investigation by means of the most appropriate tools for the particular case, such as review of its internal control systems, constant review of its business partners, disciplinary actions, implementation of internal and external trainings, followed by tests, reviews and updates, improvement of its code of conduct and policies, implementation of hotlines, rotation policy by means of which certain key positions are rotated on a frequent basis, increase of its internal audits and of the interaction between management and the audit committee. If the investigation reveals criminal offences by employees, the company still has 152 an option to communicate to the Brazilian authorities the facts, since there is no legal duty to act accordingly. Once it decides that it should disclose the matter, it is possible to file a motion reporting the facts to the police authorities or District Attorney and request that they take the appropriate measures to investigate the issues brought, initiating a police inquiry.

II. May an employer pay its employee’s legal fees if he/she is being prosecuted under criminal law? In principle, the employer may pay the employee’s legal fees in case he/she is 153 prosecuted under civil and/or criminal law. However, whether or not an employer should pay for an employee’s legal fees must 154 be analyzed on a case by case basis. For instance, assuming that (i) the employee is being prosecuted for practicing acts related to his/her job duties (i. e. officer accused of environmental crimes); (ii) the claim is deemed groundless; and (iii) the company did not pay the employees’ legal fees, the employee would, in this case, be able to file a claim against the employer seeking the reimbursement of the legal fees he/she incurred, alleging that the employer is responsible for the expenses he/she had in connection with the function he/she developed in the company.

v. Ancken/Flesch/Fonseca/Lima/Maeda

Reemers Publishing Services GmbH O:/Beck/Spehl_Gruetzner/3d/02_Brazil.3d from 06.03.2013 09:24:22 3B2 9.1.580; Page size: 160.00mm  240.00mm

Reemers Publishing Services GmbH O:/Beck/Spehl_Gruetzner/3d/03_China.3d from 06.03.2013 09:25:01 3B2 9.1.580; Page size: 160.00mm  240.00mm

§ 3. China Para. A. Initiation of internal investigations . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 1 I. When and to what extent should internal investigations be conducted? . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 1 II. Should the internal investigations be of an open or covert nature? . . . 4 III. Is it advisable to involve external investigators? . . . . . . . . . . . . . . . . . . . . . . . 7 1. Effectiveness . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 8 2. Trustworthiness . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 9 3. Attorney-client privilege . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 10 4. Cost-effectiveness . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 11 IV. Are foreign attorneys permitted to conduct internal investigations in China? . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 12 1. Overseas prosecution or litigation . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 13 2. Chinese legal affairs . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 14 V. When should national authorities be called in? . . . . . . . . . . . . . . . . . . . . . . . 17 1. Possible criminal offence . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 17 2. Possible administrative offence . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 19 B. Admissibility and implementation of individual measures in internal investigations . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 20 I. What measures are admissible in internal investigations? . . . . . . . . . . . . . 20 1. Overview . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 20 2. Employee interviews . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 24 3. Email screening . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 25 4. Inspection of the personnel files of employees . . . . . . . . . . . . . . . . . . . . . . 29 a) Personnel files (dang’an) . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 29 b) Personal information contained in FIE archives . . . . . . . . . . . . . . . . . 30 c) Personal data (geren ziliao) . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 32 5. Video and audio surveillance of employees . . . . . . . . . . . . . . . . . . . . . . . . . . 35 6. Tapping of telephone conversations . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 37 7. Search of the workplace . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 39 II. Are employee representatives, such as the works council, required to be involved in internal investigations? . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 41 C. Employee interviews . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 42 I. May an employee refuse to provide information if the information would be self-incriminating? . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 42 II. Is an employee obliged to provide information on misconduct or criminal offences committed by other employees? . . . . . . . . . . . . . . . . . . . . 43 III. May an employee refuse to answer a question he has already answered in a previous interview? . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 44 IV. Is an employee entitled to the presence of a member of the works council or an attorney during the interview? . . . . . . . . . . . . . . . . . . . . . . . . . . 45 V. Is an employee entitled to read the record of his interview? . . . . . . . . . . 46 VI. Is the employer entitled to request that the employee signs the record of the interview? . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 47 VII. Can the employer instruct an employee to treat the content of his interview as confidential? . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 48 D. Sanctions imposed on employees . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 49 I. What are the sanctions under employment law that employers can impose on employees who refuse to cooperate in internal investigations? . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 49 1. Deduction of remuneration . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 50 2. Warning letter . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 53

Gon/Zheng

Reemers Publishing Services GmbH O:/Beck/Spehl_Gruetzner/3d/03_China.3d from 06.03.2013 09:25:01 3B2 9.1.580; Page size: 160.00mm  240.00mm

84

§ 3. China Para. 3. Termination of employment . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 54 II. Is suspicion of a criminal offence or a severe violation of duty sufficient for an extraordinary termination? . . . . . . . . . . . . . . . . . . . . . . . . . . . 55 1. Suspicion of a criminal offence . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 55 2. Severe violation of duty . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 58 III. How soon after an internal investigation has revealed an employee’s misconduct must an employer give an extraordinary notice of termination? . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 59 E. Use of the information obtained through an internal investigation . 62 I. Is it permissible to disclose the findings and information obtained through an internal investigation to other group companies? . . . . . . . . . 62 1. State secrets . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 63 2. Individual privacy . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 64 II. Is it permissible and advisable to forward findings and information obtained through an internal investigation to public authorities? . . . . . 66 III. Are the findings of internal investigations subject to the attorneyclient privilege? . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 68 IV. Does the attorney-client privilege also apply to foreign attorneys? . . . . 69 F. Following-up on internal investigations . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 70 I. What does the follow-up to internal investigations entail? . . . . . . . . . . . . 70 II. May an employer pay its employee’s legal fees if he is being prosecuted under criminal law? . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 73 G. Miscellaneous . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 74 I. Employee fidelity insurance . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 74 II. Introduction of PRC evidentiary rules . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 77 1. Overview . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 78 2. Forms of admissible evidence . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 80 3. Admissibility . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 82 4. Exclusionary rules . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 83 a) General exclusion . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 83 b) Specific exclusions . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 84 aa) Illegally obtained evidence . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 84 bb) Hearsay evidence . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 88 cc) Character and propensity evidence . . . . . . . . . . . . . . . . . . . . . . . . . . 92 dd) Liability evidence . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 95 5. Other concerns . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 99 a) Original evidence . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 99 b) Evidence created outside China . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 101 c) Electronic evidence . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 102

A. Initiation of internal investigations I. When and to what extent should internal investigations be conducted? Administrative regulations issued by the government of the People’s Republic of China (PRC) often encourage companies established in the PRC to carry out selfinitiated investigations and rectifications when they detect possible violations, such as insider trading and unlawful promotional activities by retailers. Companies generally face no penalty, however, for failing to initiate an internal investigation. 2 Nonetheless, companies with sound corporate governance and compliance regimes are expected to initiate internal investigations in response to meritorious allegations, complaints, or statements that suggest an employee may have violated company rules. 1

Gon/Zheng

Reemers Publishing Services GmbH O:/Beck/Spehl_Gruetzner/3d/03_China.3d from 06.03.2013 09:25:02 3B2 9.1.580; Page size: 160.00mm  240.00mm

A. Initiation of internal investigations

85

A company’s management may use its own discretion in deciding how exten- 3 sively to pursue such an internal investigation. The PRC Company Law, which was amended in 2006, requires all companies in China to appoint a supervisor or a supervisory board consisting of three supervisors to oversee the company’s operations and management. The Company Law also provides that when supervisors detect abnormal operations within the company, they may use company funds to conduct an investigation and, if necessary, engage an accounting firm.1

II. Should the internal investigations be of an open or covert nature? Whether an internal investigation should be conducted openly or covertly 4 depends on the specific circumstances and detailed facts available at the beginning of the investigation. This is more of a practical matter than a legal issue. Generally, a covert investigation is likely to have a smaller impact on employee 5 morale and be conducive to collecting valuable information to help with the investigation. One disadvantage of a covert investigation is that any leakage of the investigation is likely to generate rumours and even panic among employees, which could result in employees losing trust in the company. An open investigation is advisable when a company is under investigation by a 6 government authority. It will send a positive message to the outside world that the company is willing and prepared to tackle the problem by carrying out a thorough and transparent internal investigation. It will help the company restore its employees and customers’ confidence in the company.

III. Is it advisable to involve external investigators? The involvement of external investigators such as attorneys and accountants is 7 generally advisable. 1. Effectiveness Compared to internal investigators, such as in-house counsel and internal 8 auditors, external investigators usually have more experience and expertise in conducting investigations. Furthermore, as the subject matter of an investigation is likely to be a sensitive issue within the company, external investigators who come from outside the company’s system and hierarchy can often be more effective in avoiding awkwardness and thereby obtaining more useful and valuable information from the employees. 2. Trustworthiness In addition, public authorities, shareholders and other interested parties usually 9 consider the work of external investigators, especially those independent interna-

1

Company Law of the People’s Republic of China (ѝഭӪ≁‫઼ޡ‬ഭ‫ޜ‬ਨ⌅) (“Company Law”), amended by the National People’s Congress, effective 1 January 2006, Art. 55.

Gon/Zheng

Reemers Publishing Services GmbH O:/Beck/Spehl_Gruetzner/3d/03_China.3d from 06.03.2013 09:25:02 3B2 9.1.580; Page size: 160.00mm  240.00mm

§ 3. China

86

tional law firms and accounting firms renowned for their investigative work, more impartial and credible. 3. Attorney-client privilege 10

Another advantage of involving external attorneys is that their investigations may invoke the attorney-client privilege under certain circumstances. Although PRC law does not recognize the concept of attorney-client privilege (see discussion in infra para 68), investigations conducted in China for use in an overseas jurisdiction that recognizes the attorney-client privilege may benefit from such rule if qualified lawyers are engaged in carrying out investigations in China pursuant to the laws of the overseas jurisdiction. 4. Cost-effectiveness

11

Cost is always an important factor to consider when determining whether to engage external investigators. Under circumstances where the nature of the suspected violation is less serious or where such a violation, if proved true, would only have a limited impact on the company, the involvement of external investigators may not be justified or necessary as long as the company retains adequate internal investigation capability.

IV. Are foreign attorneys permitted to conduct internal investigations in China? 12

PRC law generally does not prohibit foreign attorneys from conducting internal investigations in China. Foreign attorneys must make sure however, that (1) they do not collect evidence for the purpose of overseas prosecution or litigation, and (2) they do not engage in Chinese legal affairs,2 which are reserved for PRC domestic law firms. 1. Overseas prosecution or litigation

13

The collection of evidence for overseas prosecution or litigation of matters within China’s judicial sovereignty should be handled through diplomatic channels or in accordance with the relevant international treaties. For civil or commercial judicial proceedings, whether commenced or contemplated, China is a signatory to the Convention on the Taking of Evidence Abroad in Civil or Commercial Matters, according to which the judicial authority of a contracting state may request the competent authority of another contracting state, by means of a letter of request, to

2 Relevant regulations state that “Chinese legal affairs” include, but are not limited to, representing a client in litigation activities in China and providing opinions on or certifying specific issues, acts or events governed by Chinese law. See Regulations Regarding the Enforcement of the Regulations on the Administration of Representative Offices of Foreign Law Firms in China, issued by the Ministry of Justice (ਨ⌅䜘‫ޣ‬Ҿᢗ㹼ljཆഭᖻᐸһ࣑ᡰ傫ॾԓ㺘ᵪᶴ㇑⨶ᶑֻNJⲴ㿴ᇊ), effective 1 September 2002, Art 32.

Gon/Zheng

Reemers Publishing Services GmbH O:/Beck/Spehl_Gruetzner/3d/03_China.3d from 06.03.2013 09:25:03 3B2 9.1.580; Page size: 160.00mm  240.00mm

A. Initiation of internal investigations

87

obtain evidence or perform other judicial acts.3 Such a letter should be addressed to the PRC Ministry of Justice.4 2. Chinese legal affairs PRC law differentiates between foreign and domestic law firms. Attorneys who 14 work for foreign law firms should be aware that the legal services they provide in China must not involve Chinese legal affairs. In China, the Ministry of Justice supervises the activities of foreign law firms’ 15 representative offices. Chinese lawyers working for foreign law firms may incur a temporary suspension of their license. Foreign attorneys and law firms may only engage in activities that do not touch on Chinese legal affairs. They may, for example, provide consultation or handle legal affairs which involve the laws of those countries where the foreign law firms are permitted to provide legal services.5 Currently, there are no specific regulations which govern the activities within the 16 PRC of foreign attorneys hired by foreign law firms without a presence in China. It is advisable, however, that such firms ensure their activities do not encroach on Chinese legal affairs.

V. When should national authorities be called in? 1. Possible criminal offence An individual or entity has an obligation under PRC law to report a criminal case 17 or provide information to a police bureau, procuratorate or court if it is aware of any criminal activities or criminal suspects.6 However, there is no specific penalty associated with a failure to report a crime or a criminal suspect, and such an obligation is rarely, if ever, enforced. PRC law also encourages voluntary surrender (zishou). Voluntary surrender is 18 when a person or entity has committed a criminal offence and voluntarily turns him or itself in and confesses a crime. Under PRC Criminal Law, a perpetrator who surrenders voluntarily may face a mitigated or reduced punishment, and, if the criminal offence is relatively minor, may even be exempted from punishment.7

3 Convention on the Taking of Evidence Abroad in Civil or Commercial Matters ( ‫ޣ‬ҾӾഭ ཆ䈳ਆ≁һᡆ୶һ䇱ᦞⲴ‫ޜ‬㓖), concluded on 18 March 1970, Art. 1. 4 Decision of the Standing Committee of the National People’s Congress on China’s Accession to the Convention on the Taking of Evidence Abroad in Civil or Commercial Matters, (‫ޘ‬ഭӪ ≁ԓ㺘བྷՊᑨ࣑ငઈՊ‫ޣ‬Ҿᡁഭ࣐‫ޕ‬lj‫ޣ‬ҾӾഭཆ䈳ਆ≁һᡆ୶һ䇱ᦞⲴ‫ޜ‬㓖NJⲴߣᇊ), issued on 3 July 1997, Art. 1. China became a signatory to the convention on December 8, 1997. 5 Regulations on the Administration of Representative Offices of Foreign Law Firms in China (ཆഭᖻᐸһ࣑ᡰ傫ॾԓ㺘ᵪᶴ㇑⨶ᶑֻ), issued by the State Council, effective 1 January 2002, Art. 15. 6 Criminal Procedural Law of the People’s Republic of China ( ѝॾӪ≁‫઼ޡ‬ഭࡁһ䇹䇬⌅) (“Criminal Procedural Law”), amended by the National People’s Congress, effective 1 January 1997, Art. 84. 7 Criminal Law of the People’s Republic of China ( ѝॾӪ≁‫઼ޡ‬ഭࡁ⌅), amended by the National People’s Congress, effective 1 October 1997, Art. 67.

Gon/Zheng

Reemers Publishing Services GmbH O:/Beck/Spehl_Gruetzner/3d/03_China.3d from 06.03.2013 09:25:04 3B2 9.1.580; Page size: 160.00mm  240.00mm

§ 3. China

88

2. Possible administrative offence 19

In general, PRC administrative regulations do not impose an obligation on an entity to report that it has discovered an administrative offence, except for those violations which might endanger public safety or the public interest, e.g., a leakage of poisonous chemicals or product defects. Nonetheless, voluntary disclosure to relevant administrative authorities can help show a company’s willingness to cooperate with and assist authorities in the discharge of their duties and may even help the company gain more lenient penalties. Of course, companies should weigh the benefits of voluntary disclosure against its drawbacks, such as the possible disclosure of company information, media exposure and reputational damage.

B. Admissibility and implementation of individual measures in internal investigations I. What measures are admissible in internal investigations? 1. Overview Measures that infringe on employees’ personal privacy may raise red flags in China, though the concept of personal privacy protection is not yet well developed. The government is reportedly drafting a new law to protect individual data privacy rights, but there are currently no laws or regulations that clearly define the scope of privacy rights in China. 21 In principle, the PRC Constitution protects certain “lawful interests” of PRC citizens, among which “personal dignity” is recognised as a lawful interest.8 The Constitution does not, however, define personal dignity. 22 The Civil Code provides that citizens have a right to their name, reputation, personal dignity and honor.9 Yet these terms are not defined in the PRC Civil Code. The Supreme Court’s interpretation of the PRC Civil Code defines violation of the right of reputation (mingyuquan) as cases where the private affairs of an individual have been published, an attempt has been made to vilify or defame another individual, or someone has used another person’s name.10 The prohibition against disclosure of the private affairs of an individual, vague as it is, is the only clear legal basis for bringing civil claims for violation of the privacy rights of individuals. While there are also provisions that specifically protect employees’ data privacy rights (see infra paras 25 et seq.), no penalties or consequences are specified. 23 From a practical perspective, if employers wish to avoid complaints of privacy invasion, they should advise employees of the specific monitoring methods that will 20

8 Constitution of the People’s Republic of China ( ѝॾӪ≁‫઼ޡ‬ഭᇚ⌅) (“Constitution”), enacted by the National People’s Congress, effective 4 December 1982, Art. 38. 9 General Provisions of the Civil Code of the People’s Republic of China ( ѝॾӪ≁‫઼ޡ‬ഭ≁ ⌅䙊ࡉ), enacted by the National People’s Congress, effective 1 January 1987, Arts. 99–102. 10 Opinion of the Supreme People’s Court on Several Problems in the Implementation of the “General Provisions of the Civil Code of the People’s Republic of China” (ᴰ儈Ӫ≁⌅䲒ঠਁlj‫ޣ‬Ҿ 䍟ᖫᢗ㹼ljѝॾӪ≁‫઼ޡ‬ഭ≁⌅䙊ࡉNJ㤕ᒢ䰞仈Ⲵ᜿㿱˄䈅㹼 NJⲴ䙊⸕), effective 2 April 1988, Art. 140.

Gon/Zheng

Reemers Publishing Services GmbH O:/Beck/Spehl_Gruetzner/3d/03_China.3d from 06.03.2013 09:25:05 3B2 9.1.580; Page size: 160.00mm  240.00mm

B. Admissibility and implementation of individual measures

89

be used. Although written confirmation from employees indicating that they are aware of such monitoring is not required, it is highly recommended. 2. Employee interviews An employer may request its employees to sit through interviews on matters 24 directly or indirectly related to their job responsibilities. However, employees do not have a statutory obligation to attend employee interviews. If there are provisions in company rules or employment contracts that require employees to cooperate in internal investigations, an employer may take disciplinary action against an employee for breach of such provisions. 3. Email screening Legislation appears to permit the monitoring of personal correspondence, supervision of Internet usage and related censorship activities for reasons of “state security and public morality”.11 On the other hand, individuals (not employees specifically) are entitled to a vaguely worded right to privacy of correspondence, though the scope of this right is not clearly defined.12 It is fairly common for companies in China to implement email or Internet use policies. Such policies must be adopted in accordance with the statutory employee consultation procedure and must be made available to all employees. PRC law prohibits organizations and individuals from using the Internet to “jeopardize state security or disclose state secrets; to encroach upon the national, social or collective interest or the lawful rights and interests of citizens; or to engage in illegal or criminal activities.”13 Thus, within the ambit of safeguarding the above interests, employers have an obligation to monitor and ensure that their systems are used properly. It is not illegal for employers to require employees to sign agreements indicating they will use the employer’s Internet system only for business purposes and that they will not receive or transmit materials with harmful content through the employer’s Internet system. Such agreements should refer to the government’s definition of prohibited content and any other restrictions imposed by the employer to promote “acceptable” behaviour in the workplace.

11 Measures for the Administration of the Protection of the Security of International Networking of Computer Information Networks (䇑㇇ᵪؑ᚟㖁㔌ഭ䱵㚄㖁ᆹ‫؍ޘ‬ᣔ㇑⨶࣎⌅), promulgated by the Ministry of Security of the People’s Republic of China on 16 December 1997 (by Order No 33 of the Department of Security) and effective 30 December 1997 (“Security Measures”), Art. 8. Art. 3 of the Measures for the Administration of Internet Email Services (ӂ㚄㖁⭥ᆀ䛞Ԧᴽ࣑㇑⨶ ࣎⌅) (“Email Measures”), promulgated by the Ministry of Information Industry on 20 February 2006 and effective 30 March 2006, contains a similar provision. 12 Security Measures, Art. 7. Art. 3 of the Email Measures contains a similar rule. 13 Security Measures, Art. 4.

Gon/Zheng

25

26

27

28

Reemers Publishing Services GmbH O:/Beck/Spehl_Gruetzner/3d/03_China.3d from 06.03.2013 09:25:05 3B2 9.1.580; Page size: 160.00mm  240.00mm

90

§ 3. China

4. Inspection of the personnel files of employees a) Personnel files (dang’an) 29

In terms of personal information and the workplace, China continues to maintain individual personnel files (renshi dang’an) on all Chinese citizens. These files form part of the central government’s comprehensive system for monitoring and supervising its citizens. Personnel files contain data such as date and place of birth, schools attended, degrees received, work positions held, memberships, political activities, family background and criminal record, if any. The files are used as the basis for many bureaucratic procedures. Although the influence of the personnel file system is beginning to fade, it is still significant in certain aspects of life, and whoever controls a person’s personnel file can exercise a certain degree of control over that individual. b) Personal information contained in FIE archives

Foreign-invested enterprises (“FIEs”) are required to retain archives that include documents and materials related to the FIE’s establishment; financial and accounting management; and human resources and daily operation, including issues related to “management of labor and salaries and personal and legal affairs” and “education and training”.14 These are unofficial employee files created and kept by employers for their own use and should be distinguished from the official personnel files, which are considered state property. 31 Taking FIE archives out of China without authorization may result in administrative punishment or even criminal liability for the offender.15 However, neither the nature of the punishment nor the procedures for obtaining the necessary authorization (nor from whom such authorization should be obtained) is specified in the relevant regulations. In practice, there are no reported cases of action being taken against an FIE for transferring its information on an overseas employee for its own use. 30

c) Personal data (geren ziliao) The only specific protection for employees’ private information is found in regulations which stipulate that employees’ “personal data” (geren ziliao) should be kept confidential and that an employer may not “publicize” (gongkai) an employee’s personal data without the employee’s consent.16 33 The terms “publicize” and “personal data” are not defined in detail in the relevant regulations, so it is unclear whether the transfer of employee information to affiliated companies would be covered by the consent requirement or whether it would be considered “publicizing” if kept within the same company group. Because the scope of the protection is unclear, to satisfy the consent requirement in the personal data privacy regulations, employers are advised to include a clause in their employment 32

14 Provisional Regulations for the Administration of the Archives of Foreign-Invested Enterprises (ཆ୶ᣅ䍴ԱъẓṸ㇑⨶Ჲ㹼㿴ᇊ) (“FIE File Regulations”), promulgated by the Ministry of Foreign Trade and Economic Cooperation, the State Economic and Trade Commission and the State Bureau of Archives, effective 29 December 1994, Art. 6.4. 15 FIE File Regulations, Art. 14.4. 16 Regulations on Employment Services and Employment Management ( ቡъᴽ࣑оቡъ㇑⨶ 㿴ᇊ), issued by the Ministry of Labor and Social Security, effective 1 January 2008, Art. 13.

Gon/Zheng

Reemers Publishing Services GmbH O:/Beck/Spehl_Gruetzner/3d/03_China.3d from 06.03.2013 09:25:06 3B2 9.1.580; Page size: 160.00mm  240.00mm

B. Admissibility and implementation of individual measures

91

contracts or other agreements with employees that provides employers with a general right to collect employee information and the transfer to its affiliates. The relevant regulations do not specify penalties or liability for violation. An 34 employee may be able to bring a civil claim under the PRC Civil Code based on the general protection of reputation. The government is drafting a Data Protection Law, but it is unclear if and when it will be passed. 5. Video and audio surveillance of employees Video surveillance of employees is permitted under PRC law as long as such 35 surveillance is installed in a non-private area. Though workplaces are generally not considered private areas, employers should notify employees about the installation and exact location of the surveillance cameras to avoid infringing upon individuals’ privacy. According to local rules in some jurisdictions, for example, in Beijing, enterprises 36 engaged in manufacturing, selling and storing hazardous materials are required to install surveillance cameras.17 6. Tapping of telephone conversations No organisation or individual may for any reason inspect the content of telecom- 37 munications, with the exception that public security authorities, the state security authority and the People’s Procuratorate may do so in accordance with procedures stipulated by law in response to the requirements of state security or the investigation of criminal offences.18 In other words, Chinese law prohibits private third-party individuals and entities from listening to or recording other people’s conversations. No exemptions are granted to enable private employers to monitor employee telephone calls without their express permission. Moreover, in a relevant decision issued by the Standing Committee of the 38 National People’s Congress, it may be a criminal offence to invade the right of citizens to communicate freely and secretly by illegally intercepting, amending or deleting emails or other data.19 Although the clarification only specifically mentions email, under China’s telecommunications legislation, “other data” can be construed to cover voice data carried through public networks. 7. Search of the workplace Search of the workplace by an employer is not specifically prohibited by PRC law. 39 However, as discussed above, to avoid infringing upon individuals’ privacy rights, 17 Measures on the Administration of Image Data System for Public Safety, ( ेӜᐲ‫ޡޜ‬ᆹ ‫ޘ‬മ‫ؑۿ‬᚟㌫㔏㇑⨶࣎⌅), issued by the People’s Government of Beijing, effective 1 April 2007, Art. 11 & 15. 18 Telecommunications Regulations of the People’s Republic of China ( ѝॾӪ≁‫઼ޡ‬ഭ⭥ؑᶑֻ) (“Telecommunications Regulations”), issued by the State Council, effective 25 September 2000, Art. 66. 19 Decision of the Standing Committee of the National People’s Congress on Maintaining Internet Security (‫ޘ‬ഭӪ≁ԓ㺘བྷՊᑨ࣑ငઈՊ‫ޣ‬Ҿ㔤ᣔӂ㚄㖁ᆹ‫ߣⲴޘ‬ᇊ), effective 28 December 2000, Art. 4.2.

Gon/Zheng

Reemers Publishing Services GmbH O:/Beck/Spehl_Gruetzner/3d/03_China.3d from 06.03.2013 09:25:07 3B2 9.1.580; Page size: 160.00mm  240.00mm

92

§ 3. China

an employer should expressly notify employees and obtain their written consent in advance. 40 It should be noted that the PRC Constitution prohibits the illegal search of an employee’s body.20 Unwarranted search of an employee’s body may subject the employer to administrative and criminal liability.21

II. Are employee representatives, such as the works council, required to be involved in internal investigations? 41

Labor unions are generally not required to be involved in internal investigations. However, PRC law requires employers to consult the labor union or all employees for decisions on major issues that affect the immediate interest of the employees.22 While it is arguable whether a decision to conduct a large-scale internal investigation may be viewed as a major issue affecting the immediate interest of the employees, an employer should be aware of the power of the labor union and consider whether to involve the labor union before carrying out a large-scale investigation. To engage the labor union at an early stage would ensure that it is likely to have the support or understanding of the labor union if the company wants to take disciplinary action against a substantial number of employees as a result of the investigation.

C. Employee interviews I. May an employee refuse to provide information if the information would be self-incriminating? 42

PRC law does not recognise the right to remain silent in case of possible selfincrimination. In addition, it traditionally embraces the concept of granting leniency for candor (tanbaicongkuan). Nonetheless, as an employee has no statutory obligation to attend or take part in an interview as part of an internal investigation, an employee may for any reason refuse to provide information during an interview.

II. Is an employee obliged to provide information on misconduct or criminal offences committed by other employees? 43

As discussed in supra paras. 17 et seq., all entities and individuals have an obligation under PRC Criminal Procedural Law to report any crimes or criminal suspects to public authorities. This reporting obligation is owed by an individual or entity to the general public, not to the employer. Therefore, employees are not obliged to provide information to their employer on misconduct or criminal offences committed by other employees. 20

Constitution, Art. 37. Labor Law of the People’s Republic of China (ѝॾӪ≁‫઼ޡ‬ഭࣣࣘ⌅), enacted by the National People’s Congress, effective 1 January 1995, Art. 96. 22 Law of the People’s Republic of China on Employment Contracts ( ѝॾӪ≁‫઼ޡ‬ഭࣣࣘਸ ਼⌅) (“Employment Contract Law”), effective 1 January 2008, Art. 4. 21

Gon/Zheng

Reemers Publishing Services GmbH O:/Beck/Spehl_Gruetzner/3d/03_China.3d from 06.03.2013 09:25:08 3B2 9.1.580; Page size: 160.00mm  240.00mm

D. Sanctions imposed on employees

93

III. May an employee refuse to answer a question he has already answered in a previous interview? An employee has no statutory obligation to attend or take part in an interview as 44 part of an internal investigation, so an employee may refuse to provide information during an interview.

IV. Is an employee entitled to the presence of a member of the works council or an attorney during the interview? There are no specific rules in PRC law on this issue.

45

V. Is an employee entitled to read the record of his interview? There are no specific rules on this in PRC law. However, an interview record that 46 has not been read and acknowledged by the employee will carry less weight than one that has been read and signed by the employee.

VI. Is the employer entitled to request that the employee signs the record of the interview? An employer has no right to request that an employee signs an interview record. 47

VII. Can the employer instruct an employee to treat the content of his interview as confidential? In general, an employer does not have a statutory right to instruct an employee to 48 keep the content of his interview confidential. However, an employer may include in the employment contract a provision that requires the employee to keep the content of his interview confidential, or enter into a separate agreement to that effect. The employer may also include such a requirement in its employee handbook, as long as the employee handbook is adopted in accordance with the statutory employee consultation procedure.

D. Sanctions imposed on employees I. What are the sanctions under employment law that employers can impose on employees who refuse to cooperate in internal investigations? An employer has no statutory right to impose sanctions on an employee who 49 refuses to cooperate in the employer’s internal investigation. The employer may, however, stipulate certain specific penalties in the employment contract with the employee or in the company’s internal rules and take disciplinary action accordingly. Gon/Zheng

Reemers Publishing Services GmbH O:/Beck/Spehl_Gruetzner/3d/03_China.3d from 06.03.2013 09:25:08 3B2 9.1.580; Page size: 160.00mm  240.00mm

94

§ 3. China

1. Deduction of remuneration Employers are prohibited from unreasonably deducting or withholding an employee’s wages. National legislation provides that deductions are permissible if they have been clearly specified in the employment contract or in the employer’s internal rules or regulations adopted according to law.23 51 If an employment contract or company rules clearly provide that non-cooperation in an internal investigation will entitle the employer to deduct the employee’s wages, the employer may deduct the wages in accordance with the rules, with the caveats that the monthly deduction shall not exceed 20 % of the employee’s monthly wages and the employee’s wages after the deduction must be higher than the local government-set minimum wage. 52 As remuneration deductions clearly affect employees’ immediate interests, any employer provisions on such deductions must comply with relevant legal requirements to be valid (see supra para. 41). Further, there is a split of judicial authority on whether it is legal to use wage deduction as a means of punishing certain wrongdoing by employees. 50

2. Warning letter 53

An employer may issue a warning letter to an employee if he does not cooperate in an internal investigation so long as company rules or employment contracts contain provisions to this effect. 3. Termination of employment

54

PRC Law allows for termination on grounds of serious violation of company rules.24 Therefore, an employer may terminate an employee for his non-cooperation in an internal investigation if such refusal would constitute a serious breach of the company rules. The employer should be cognizant of what constitutes “refusal to cooperate”, as the employer bears the burden of proof in case of employee’s serious violation of company rules.

II. Is suspicion of a criminal offence or a severe violation of duty sufficient for an extraordinary termination? 1. Suspicion of a criminal offence 55

Mere suspicion is insufficient for terminating an employee in China. Under PRC law, an employer is permitted to unilaterally terminate an employment contract only if PRC judicial organs have found the employee criminally liable.25

23 Supplementary Provisions on Issues Related to the Interim Provisions on Payment of Wages (ሩljᐕ䍴᭟ԈᲲ㹼㿴ᇊNJᴹ‫ޣ‬䰞仈Ⲵ㺕‫ݵ‬㿴ᇊ) (“Supplementary Wage Provisions”), issued by the Ministry of Labor and Social Security, effective 12 May 1995, Art. 3. 24 Employment Contract Law, Art. 39. 25 Employment Contract Law, Art. 39.6.

Gon/Zheng

Reemers Publishing Services GmbH O:/Beck/Spehl_Gruetzner/3d/03_China.3d from 06.03.2013 09:25:08 3B2 9.1.580; Page size: 160.00mm  240.00mm

D. Sanctions imposed on employees

95

A relevant explanatory notice makes it clear that this refers to the following 56 situations: – where the People’s Procuratorate finds that a criminal violation has occurred but has exempted the employee from prosecution; – where a People’s Court has imposed a criminal sentence; or – where a People’s Court has waived criminal punishment.26 Accordingly, if an employee has been arrested and detained for suspected involve- 57 ment in criminal activity, the employer may not be able to rely on this ground to immediately dismiss the employee. If the employee’s personal freedom is restricted, however, the employer may temporarily suspend performance of the employment contract.27 If the employee is ultimately found not guilty and released from custody, the employer should resume the employment contract. 2. Severe violation of duty PRC law also permits termination of employment if the employee commits 58 serious dereliction of duty or practices graft and has caused substantial damage to the employer.28 Whether the employer has experienced substantial damage is a key element in determining whether an employer may exercise its right to terminate the employee, yet PRC law does not provide a clear monetary amount threshold for what constitutes substantial damage. Usually, an employer may set a threshold in its internal rules of what would constitute substantial damage. Note that under PRC criminal law, if an employee misappropriated more than RMB 5,000 of the company’s assets, the employee may be pursued for criminal liability.

III. How soon after an internal investigation has revealed an employee’s misconduct must an employer give an extraordinary notice of termination? Where an employee’s misconduct satisfies one of the grounds for immediate 59 termination, the employer may immediately terminate the employment contract. No notice or severance pay is required. The grounds for immediate termination are satisfied where an employee:29 – seriously breaches the employer’s rules and regulations; – commits serious dereliction of duty or practices graft, causing serious harm to the employer; – has his or her criminal liability pursued; – has an employment relationship with another employer that materially affects his or her work for first employer, or he refuses to rectify the matter; or

26 Explanations of Several Articles of the Labor Law ( ‫ޣ‬Ҿljࣣࣘ⌅NJ㤕ᒢᶑ᮷Ⲵ䈤᰾), Art. 25. (“Labor Law Explanation”), issued by the Ministry of Labor and Social Security, effective 5 September 1994. 27 Opinion on Various Issues Regarding the Thorough Implementation of the PRC Labor Law ( ‫ޣ‬ Ҿ䍟ᖫᢗ㹼LJѝॾӪ≁‫઼ޡ‬ഭࣣࣘ⌅Lj㤕ᒢ䰞仈Ⲵ᜿㿱) (“Labor Law Opinion”), issued by the Ministry of Labor and Social Security, effective 4 August 1995, Art. 28. 28 Employment Contract Law, Art. 39.3. 29 Employment Contract Law, Art. 39.

Gon/Zheng

Reemers Publishing Services GmbH O:/Beck/Spehl_Gruetzner/3d/03_China.3d from 06.03.2013 09:25:09 3B2 9.1.580; Page size: 160.00mm  240.00mm

96

§ 3. China

– causes the employment contract to be invalid due to use of coercion, deception or taking advantage of the employer’s difficulties to make the employer sign the employment contract. 60 PRC law is unclear on the timeframe within which an employer must issue a notice of termination to an employee whose misconduct has been revealed by an internal investigation. However, if an employer does not act within a reasonable time, it risks allowing the employee to argue that the employer has waived its right to terminate the employee. 61 An employee is obliged to continue the performance of the employment even after he has been served with a notice of termination until the employment contract is terminated. If the employee had a contractual obligation to cooperate in an internal investigation, he would still be required to do so after being served with a notice of termination.

E. Use of the information obtained through an internal investigation I. Is it permissible to disclose the findings and information obtained through an internal investigation to other group companies? 62

No statutory laws or regulations prohibit a company from disclosing findings and information obtained through internal investigations to other group companies. Nonetheless, if the findings touched on state secrets or privacy of the individual employee, the company should obtain approval from the appropriate authorities or individual before sharing this information with other group companies. 1. State secrets

63

Documents which contain State secrets may not be illegally copied, recorded, saved or disclosed.30 State secrets are defined as bearing on the security and the interests of the state and for a period of time may only be known by certain authorized persons.31 Where a dispute exists as to whether a document contains state secrets, the issue shall be decided by the Administration for the Protection of State Secrets at the central or provincial level.32 Illegal transmission of state secrets may subject a company to administrative and criminal liabilities. 2. Individual privacy

Publicising documents that contain personal data requires the consent of the relevant employee. (See supra paras. 25 et seq.) 65 In China, a citizen’s right to privacy is protected by the right to reputation. Publicising personal data may be deemed an infringement upon a citizen’s right to 64

30 Law of the People’s Republic of China on the Maintenance of State Secrets ( ‫؍‬ᆸഭᇦ〈ᇶ⌅) (“State Secret Protection Law”), promulgated by the National People’s Congress, effective 1 October 2010, Art. 26. 31 State Secret Protection Law, Art. 2. 32 State Secret Protection Law, Art. 20.

Gon/Zheng

Reemers Publishing Services GmbH O:/Beck/Spehl_Gruetzner/3d/03_China.3d from 06.03.2013 09:25:09 3B2 9.1.580; Page size: 160.00mm  240.00mm

E. Use of information obtained through an internal investigation

97

his reputation if it has a negative impact on the individual. PRC law does not, however, provide a clear definition of “privacy.” (See supra paras. 20 et seq.)

II. Is it permissible and advisable to forward findings and information obtained through an internal investigation to public authorities? If an investigation’s findings reveal that a crime has been committed or reveal the 66 identity of a suspected criminal, the investigating company has a statutory obligation to report the matter to the public authorities. If a company is faced with imminent measures initiated by a government 67 authority or is under the investigation of a government authority, it should voluntarily provide findings and information from its internal investigation. This will demonstrate the company’s willingness to cooperate with the government authorities and take active steps to tackle the problems. Such action will be considered favorably by the relevant government authority if the possibility of sanctions against the company arises.

III. Are the findings of internal investigations subject to the attorney-client privilege? There is no such concept as “attorney-client privilege” under PRC evidentiary 68 rules. Rather, the PRC law contains a general confidentiality obligation for attorneys. More specifically, in the course of his practice, an attorney shall keep confidential any information related to state secrets and trade secrets, the information of clients and other persons they do not want to be disclosed (except facts or information concerning ongoing or impending criminal activities) and private information of relevant parties.33 PRC law is unclear as to whether a lawyer may rely on the duty of confidentiality to resist a court’s demand for discovery of such information.

IV. Does the attorney-client privilege also apply to foreign attorneys? As discussed above, the concept of attorney-client privilege does not exist in 69 China. As for the general confidentiality obligation, PRC attorneys and foreign attorneys assume the same confidentiality obligation under PRC law. Thus, foreign attorneys who provide legal services in China should obey the same ethical rules and practice guidelines applicable to Chinese attorneys.34

33 Lawyer’s Law of the People’s Republic of China ( ᖻᐸ⌅) (“Lawyer’s Law”), promulgated by the National People’s Congress, effective 1 June 2008, Art. 38. 34 Regulation Concerning the Administration of Representative Offices of Foreign Law Firms in China (ཆഭᖻᐸһ࣑ᡰ傫ॾԓ㺘ᵪᶴ㇑⨶ᶑֻ) (“Foreign Law Firms Regulation”), promulgated by the State Council, effective 1 January 2002, Art. 3.

Gon/Zheng

Reemers Publishing Services GmbH O:/Beck/Spehl_Gruetzner/3d/03_China.3d from 06.03.2013 09:25:10 3B2 9.1.580; Page size: 160.00mm  240.00mm

§ 3. China

98

F. Following-up on internal investigations I. What does the follow-up to internal investigations entail? As discussed in supra paras. 17 et seq., a company should report to relevant authorities if criminal acts have been discovered within the company. If the company turns a blind eye to or hides possible criminal offences, the company may eventually be charged as an accomplice to the crime or with the offence of covering up a crime. 71 If a company’s internal investigation reveals a possible administrative violation, the company should take remedial measures to correct the problem. Failure to institute such measures may be deemed a breach of the senior management’s fiduciary duties and may subject the members of the senior management to liability for losses suffered by the company.35 72 If an internal investigation reveals an employee’s wrongdoing, the company may take proper measures under labor law or the company rule against the employee. 70

II. May an employer pay its employee’s legal fees if he is being prosecuted under criminal law? 73

There is no prohibition in China on an employer paying for attorney’s services and other legal costs to defend its employee in a criminal case. That said, this is not a common practice in China.

G. Miscellaneous I. Employee fidelity insurance Employee fidelity insurance (EFI) is a credit guarantee insurance that covers direct pecuniary loss suffered by the insured due to an act of the employee involving forgery; embezzlement; larceny; fraud; dishonesty; or fraudulent conversion of money, money’s worth or goods. 75 EFI has been introduced by several major insurance companies in China to cover direct losses caused by employees’ deceptive or fraudulent activities, such as embezzlement or larceny, but not misuse of commercial secrets. 76 Many Chinese companies are interested in purchasing EFI to cover potential losses caused by fraud committed by employees, especially those in positions such as financial accountant, cashier, and warehouse guard. Prior to purchasing EFI, companies must provide the insurance company with the basic credit information of its employees. 74

35

Company Law, Art. 148 & 150.

Gon/Zheng

Reemers Publishing Services GmbH O:/Beck/Spehl_Gruetzner/3d/03_China.3d from 06.03.2013 09:25:11 3B2 9.1.580; Page size: 160.00mm  240.00mm

99

G. Miscellaneous

II. Introduction of PRC evidentiary rules In conducting an internal investigation, a company may wish to preserve evidence 77 for subsequent legal proceedings. The following discussion explores the relevant evidentiary rules in China. 1. Overview There are three types of legal actions in China: administrative action, civil action, 78 and criminal action. Currently, evidentiary rules concerning these three actions are scattered in their respective procedural laws, judicial explanations and evidence provisions. The Supreme Court released the Unified Evidence Rules of the People’s Court 79 (Proposed Draft of Judicial Explanation) (“Draft Unified Evidence Rules”) on 11 April 2008, and launched pilot programs in courts located in five provinces in China for trial implementation. Although the Draft Unified Evidence Rules have not been formally adopted by the Supreme Court, they provide practical guidance for understanding evidentiary rules in China. 2. Forms of admissible evidence Evidence in each action should take the following forms, respectively. Administrative Action36

Civil Action37

Criminal Action38

1

Documentary evidence

Documentary evidence

Physical evidence and documentary evidence

2

Physical evidence

Physical evidence

Testimony of witnesses

3

Audio-visual materials

Audio-visual materials

Statement of victims

4

Testimony of witnesses

Testimony of witnesses

Statement and exculpations of criminal suspects and defendants

5

Statements of the parties

Statements of the parties

Expert conclusions

36 Administrative Procedural Law of the People’s Republic of China ( ѝॾӪ≁‫઼ޡ‬ഭ㹼᭯䇹 䇬⌅) (“Administrative Procedural Law”), enacted by the National People’s Congress, effective 1 October 1990, Art. 31. 37 Criminal Procedural Law of the People’s Republic of China ( ѝॾӪ≁‫઼ޡ‬ഭ≁һ䇹䇬⌅) (“Civil Procedural Law”), amended by the National People’s Congress, effective 1 April 2008, Art. 63. 38 Criminal Procedural Law, Art. 42.

Gon/Zheng

80

Reemers Publishing Services GmbH O:/Beck/Spehl_Gruetzner/3d/03_China.3d from 06.03.2013 09:25:12 3B2 9.1.580; Page size: 160.00mm  240.00mm

§ 3. China

100

Administrative Action

81

Civil Action

Criminal Action

6

Expert conclusions

Expert conclusions

Inspection and examination records

7

Inspection and examination records

Records of inspection

Audio-visual materials

In addition to the above forms, the Draft Unified Evidence Rules additionally allow “electronic evidence”.39 3. Admissibility

82

PRC law does not provide a general statement as to what evidence is admissible. According to the Draft Unified Evidence Rules, all relevant evidence is admissible unless otherwise provided by the Draft Unified Evidence Rules or other laws; irrelevant evidence is inadmissible.40 4. Exclusionary rules a) General exclusion

83

Judges may exclude relevant evidence at their discretion if (1) inclusion of such evidence would result in serious unfair harm to the parties or the judgment that would outweigh its probative value; or (2) inclusion of such evidence may result in repetitive evidence, waste of litigation resources or trial delay.41 b) Specific exclusions aa) Illegally obtained evidence

(1) Criminal action. Oral testimony of criminal suspects or defendants, witness’ testimony and statements of victims are inadmissible if the evidence was obtained illegally through torture, mistreatment, battery, drugs, hypnosis or other inhumane means.42 Physical evidence obtained directly or indirectly may be admissible subject to the judges’ discretion.43 85 (2) Civil action. Evidence obtained by infringing upon the lawful rights and interests of others or by violating laws and regulations is inadmissible.44 However, according to the Draft Unified Evidence Rules, the admissibility of such evidence is 84

39

Draft Unified Evidence Rules, Art. 14.7. Draft Unified Evidence Rules, Art. 12. 41 Draft Unified Evidence Rules, Art. 13. 42 Interpretation of the Supreme People’s Court on Several Issues Concerning the Enforcement of the Criminal Procedural Law of the People’s Republic of China (ᴰ儈Ӫ≁⌅䲒‫ޣ‬Ҿᢗ㹼ljѝॾӪ ≁‫઼ޡ‬ഭࡁһ䇹䇬⌅NJ㤕ᒢ䰞仈Ⲵ䀓䟺) (“Criminal Procedure Interpretation”), effective 8 September 1998, Art. 61; and Draft Unified Evidence Rules, Art. 22. 43 Draft Unified Evidence Rules, Art. 23. 44 Several Provisions of the Supreme People’s Court on the Evidence for Civil Actions ( ᴰ儈Ӫ≁ ⌅䲒‫ޣ‬Ҿ≁һ䇹䇬䇱ᦞⲴ㤕ᒢ㿴ᇊ) (“Civil Evidence Provisions”), effective 1 April 2002, Art. 68. 40

Gon/Zheng

Reemers Publishing Services GmbH O:/Beck/Spehl_Gruetzner/3d/03_China.3d from 06.03.2013 09:25:12 3B2 9.1.580; Page size: 160.00mm  240.00mm

G. Miscellaneous

101

subject to the judge’s discretion based on the specific facts, severity of the violation and fairness of the result.45 (3) Administrative action. Evidence obtained by infringing upon the lawful 86 rights and interests of others or by violating laws and regulations is inadmissible.46 Such means include eavesdropping, secret videotaping, secret recording, duress, fraud, enticement, etc.47 (4) Limited use of excluded evidence. Excluded evidence may be used to prove 87 the existence of illegal conduct through which such evidence was obtained.48 bb) Hearsay evidence Rules on hearsay evidence were first provided in the Draft Unified Evidence Rules. Hearsay is defined as any out-of-court statement of a declarant offered to prove the truth of the matter asserted.49 Hearsay is generally inadmissible, except in certain situations listed in the Draft Unified Evidence Rules and other laws: – Unavailability of the witness; – Documents 20 years or older; – Business records; – Past recollection recorded; and – Self-admission of the party concerned.50 Under PRC law, all units and individuals who have knowledge of a case are obligated to testify in court if asked to do so. When it is truly difficult for a witness to appear in court, he may, with the consent of the court, submit written testimony, audio-visual materials or use audio-visual transmission technology.51 Judges may adopt certain hearsay evidence based on the following factors: (1) such evidence concerns the key facts of the case; (2) such evidence is the most probative evidence available despite reasonable efforts to find other evidence; and (3) exclusion of such evidence may result in an absence of justice.52

88 89

90

91

cc) Character and propensity evidence Rules on character and propensity evidence were first introduced in the Draft 92 Unified Evidence Rules. Character evidence is inadmissible to prove the propensity of a person to commit 93 certain conduct under specific circumstances; however, in criminal cases where the defendant has opened the door to introduce evidence concerning his good character or the victim’s bad character, the prosecutor may rebut such evidence by introducing evidence of the same character.53 45

Draft Unified Evidence Rules, Art. 25.1. Regulations of the Supreme People’s Court on Several Issues Concerning Evidence in Administrative Actions (ᴰ儈Ӫ≁⌅䲒‫ޣ‬Ҿ㹼᭯䇹䇬䇱ᦞ㤕ᒢ䰞仈Ⲵ㿴ᇊ) (“Administrative Evidence Rules”), effective 1 October 2002, Art. 58; and Draft Unified Evidence Rules, Art. 25.2. 47 Administrative Evidence Rules, Art. 57. 48 Draft Unified Evidence Rules, Art. 27. 49 Draft Unified Evidence Rules, Art. 28. 50 Draft Unified Evidence Rules, Art. 29–31. 51 Civil Procedural Law, Art.70; and Civil Evidence Provisions, Art. 56. 52 Draft Unified Evidence Rules, Art. 32. 53 Draft Unified Evidence Rules, Art. 33. 46

Gon/Zheng

Reemers Publishing Services GmbH O:/Beck/Spehl_Gruetzner/3d/03_China.3d from 06.03.2013 09:25:13 3B2 9.1.580; Page size: 160.00mm  240.00mm

102 94

§ 3. China

Propensity evidence, such as a criminal record, is inadmissible to prove the propensity of a person to commit a certain conduct under specific circumstances; however, in criminal cases, propensity evidence concerning modus operandi or criminal intent may be admissible to prove the propensity of preparing for the crime.54 dd) Liability evidence

(1) Subsequent remedial measures. Evidence of repairs or other precautionary measures made following an injury is inadmissible to prove culpable conduct, a defect in a product or its design or a need for a warning or instruction; however, such evidence may be admissible for other purposes such as to prove ownership or control, rebut a claim that the precaution was not feasible or impeach the credibility of a witness.55 96 (2) Admissions offered in settlement negotiations. Evidence of one party’s admissions on the validity or amount of a dispute during compromise negotiations for settlement is inadmissible for use against that party’s interest in subsequent actions.56 97 (3) Offers to pay medical or similar expenses. Payment of or offers to pay the injured party’s medical, hospital or similar expenses are inadmissible to prove liability for a claim.57 98 (4) Admissions offered in settlement negotiations. In civil and administrative actions, one party’s admission of facts of the case during the settlement negotiation may not be used against that party’s interest unless that party waives such right voluntarily.58 95

5. Other concerns a) Original evidence Original documentation or articles should be provided to the court as evidence. If the relevant party needs to keep the original documentation or articles, or it is difficult to provide such documentation or articles, that party may provide a copy or reproduction authenticated by the court.59 100 If a provider of duplicate evidence refuses to offer an original copy or clues regarding the whereabouts of the original copy, and there is no other material to authenticate, and the other party refuses to recognize duplicate evidence, such duplicate evidence should not be admitted for deciding facts.60 99

54

Draft Unified Evidence Rules, Art. 34. Draft Unified Evidence Rules, Art. 35. 56 Draft Unified Evidence Rules, Art. 36. 57 Draft Unified Evidence Rules, Art. 37; and Civil Evidence Provisions, Art. 67. 58 Administrative Evidence Rules, Art. 66; Civil Evidence Provisions, Art. 67; and Draft Unified Evidence Rules, Art. 38. 59 Administrative Evidence Rules, Art. 10; Civil Evidence Provisions, Art. 10; and Criminal Procedural Law, Art. 53. 60 Opinions of the Supreme People’s Court on the Application of the Civil Procedural Law of the People’s Republic of China (ᴰ儈Ӫ≁⌅䲒‫ޣ‬Ҿ䘲⭘ljѝॾӪ≁‫઼ޡ‬ഭ≁һ䇹䇬⌅NJ㤕ᒢ䰞仈 Ⲵ᜿㿱), issued on 14 July 1992, Art. 78. 55

Gon/Zheng

Reemers Publishing Services GmbH O:/Beck/Spehl_Gruetzner/3d/03_China.3d from 06.03.2013 09:25:13 3B2 9.1.580; Page size: 160.00mm  240.00mm

G. Miscellaneous

103

b) Evidence created outside China Evidence created outside China shall be notarized by a notary of the original 101 country and legalized by the PRC embassy in that country.61 c) Electronic evidence Electronic data, emails and other digital data that has been reduced to a fixed 102 carrier or that can be displayed may be admissible if the authenticity of such data is acknowledged by the other party or has been proved authentic by effective means such as notarization. Such data should have the same effect as the original data.62 61 62

Civil Evidence Provisions, Art. 11. Administrate Evidence Rules, Art. 64.

Gon/Zheng

Reemers Publishing Services GmbH O:/Beck/Spehl_Gruetzner/3d/03_China.3d from 06.03.2013 09:25:14 3B2 9.1.580; Page size: 160.00mm  240.00mm

Reemers Publishing Services GmbH O:/Beck/Spehl_Gruetzner/3d/04_United_Kingdom.3d from 06.03.2013 09:25:47 3B2 9.1.580; Page size: 160.00mm  240.00mm

§ 4. England and Wales A. I. II. III. IV. V. B. I. II. C. I. II. III. IV. V. VI. VII. VIII. D. I. II. III. IV. E. I. II. III. IV. F. I.

Para. Initiation of internal investigations . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 1 When and to what extent should internal investigations be initiated? 1 Should the internal investigations be of an open or covert nature? . . . 9 Is it advisable to involve external investigators? . . . . . . . . . . . . . . . . . . . . . . . 13 Is it permitted that foreign attorneys conduct internal investigations in England and Wales? . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 17 When should national authorities be called in? . . . . . . . . . . . . . . . . . . . . . . . 18 Admissibility and implementation of individual measures within the scope of internal investigations . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 36 What measures are admissible within the scope of internal investigations? . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 36 Must employees’ representatives such as the works council be involved in internal investigations? . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 84 Employee interviews . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 85 How should an interview of a witness or a suspect be conducted? . . . . 85 May an employee refuse to provide information if this information would incriminate himself/herself? . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 88 Is an employee obliged to provide information on any misconduct of or criminal offence committed by other employees? . . . . . . . . . . . . . . . . . . 93 May an employee refuse to answer a question if he/she has already answered it within the scope of a previous interview? . . . . . . . . . . . . . . . . . 94 Is an employee entitled to the presence of a member of the works council or an attorney during the interview? . . . . . . . . . . . . . . . . . . . . . . . . . . 95 Is an employee entitled to read the record of his/her interview? . . . . . . 98 Is the employer entitled to request that the employee signs the record of the interview? . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 101 Can the employer instruct an employee to treat the content of his/her interview as confidential? . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 103 Sanctions imposed on employees . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 104 What are the sanctions under employment law that can be imposed on employees refusing to cooperate in internal investigations? . . . . . . . . 104 Is the suspicion of a criminal offence or of a severe violation of duty sufficient for an extraordinary termination? . . . . . . . . . . . . . . . . . . . . . . . . . . . 105 During which period of time must an extraordinary notice of termination be given to employees whose misconduct has been revealed by the internal investigations? . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 106 Must an employee cooperate in internal investigations even after he/ she has been given notice of termination? . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 107 Use of the obtained information . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 108 Is it permissible to disclose the findings and information obtained within the scope of any internal investigations to other group companies? . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 108 Is it permissible and advisable to forward the findings and information obtained within the scope of any internal investigations to public authorities? . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 110 Are the findings made in the scope of internal investigations subject to the attorney-client privilege? . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 112 Does the attorney-client privilege also apply to foreign attorneys? . . . . 141 Following-up on internal investigations . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 142 What is to be observed during the follow-up of internal investigations? . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 142

Ludlam/Garfield

Reemers Publishing Services GmbH O:/Beck/Spehl_Gruetzner/3d/04_United_Kingdom.3d from 06.03.2013 09:25:47 3B2 9.1.580; Page size: 160.00mm  240.00mm

106

§ 4. England and Wales Para. II. May an employer pay its employee’s legal fees if he/she is being prosecuted under criminal law? . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 162 G. Miscellaneous . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 163 I. Document storage, preservation and review . . . . . . . . . . . . . . . . . . . . . . . . . . . 163 II. Insurance . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 166 III. Internal disclosure obligations on a company . . . . . . . . . . . . . . . . . . . . . . . . . 173

A. Initiation of internal investigations I. When and to what extent should internal investigations be initiated? 1 1. A company may commence an internal investigation for any number of reasons

including: a) that a civil claim or criminal charge has been leveled against the company; b) as a result of “whistleblowing”1 allegations; c) to respond to an investigation that has been commenced against the company by a regulatory or prosecuting authority;2 d) in order that the company can “self report”3 allegations of wrongdoing to a prosecution or regulatory authority; and/or e) to check and test the company’s internal systems and controls before any actual wrongdoing has been uncovered; f) to investigate instances of accounting irregularities, employee and/or institutional fraud, procurement fraud, bribery and corruption, IP infringement, money laundering, trade sanction and export control irregularities, health and safety issues, environmental concerns, competition law breaches and data protection infringement. 2 2. Whatever the reason, the decision whether or not to carry out an internal investigation should be made as quickly as possible in order to limit any damage to the company and so as to put itself in the best position possible to respond to the situation. 3 3. The extent of an internal investigation will be determined by factors as such the nature of the problem that is being investigated, the resources that the company wishes to devote to the investigation and the extent to which the company wishes to keep the existence of the investigation confidential. The purpose of the investigation will also be a crucial factor in determining the extent of the investigation. If, for example, the investigation has come to the attention of one of the regulatory and/or prosecuting authorities, they may have significant input into the scope of the investigation. In contrast, if the subject matter of the 1 “Whistleblowing” in this context means the disclosure by an employee of a concern that suggests wrongdoing has is or is likely to be committed in their workplace. Wrongdoing may include (but is not limited to) conduct which breaches civil or criminal law, potential maladministration, danger to the health and safety of individuals, or deliberate concealment of any of the above. 2 In England and Wales relevant regulators and prosecution authorities in this context include the Serious Fraud Office, the Financial Services Authority, the Police, the European Commission, the Office of Fair Trading and the Office of Communications. 3 “Self Report” in this context means bringing the relevant regulator/prosecutor’s attention to an incident of wrongdoing within an organization.

Ludlam/Garfield

Reemers Publishing Services GmbH O:/Beck/Spehl_Gruetzner/3d/04_United_Kingdom.3d from 06.03.2013 09:25:47 3B2 9.1.580; Page size: 160.00mm  240.00mm

A. Initiation of internal investigations

4.

5.

6. 7.

8.

107

investigation is a single instance of employee misconduct, the extent of the investigation may be significantly reduced. It is important to be very clear about the reason for the investigation from the outset, as the reason for the investigation may have a significant impact on the availability of privilege (see infra paras. 112 et seqq.). Under English law, litigation privilege4 is only available when litigation is pending, reasonably contemplated or existing. If there is no anticipated litigation, litigation privilege will almost certainly not apply (although legal advice privilege, which is narrower in scope, may apply).5 Even if there is an actual, threatened or anticipated regulatory investigation underway against the company, it cannot be assumed that an internal investigation carried out in contemplation of that regulatory investigation will attract litigation privilege. In some limited cases it will, but as a general rule you should assume that it will not. It is also important that the company understands the aims and objectives of the internal investigation from the outset as those aims and objectives will also affect the extent of the investigation. In many cases those objectives may be to: a) understand what has happened and why; b) identify any wrongdoing and suggest steps to address that wrongdoing, whether by means of recovery of assets or otherwise; c) secure and preserve any evidence; d) prevent further loss; e) prevent bad publicity; f) minimize disruption, stress and uncertainty for the business and those involved; g) achieve cost savings and efficiencies for the business; and/or h) ensure that the business has safe and secure internal systems and controls. Some internal investigations will seek to achieve all of these aims; others may only seek to achieve one such aim. There is no absolute obligation on directors or managers of a company to carry out an internal investigation. However, employees of a company may be in breach of their employment contracts if they do not carry out an investigation when it is their responsibility to do so (i. e. when a failure to carry out an investigation would amount to a failure to perform their role properly). In addition, directors of any company registered in England and Wales owe fiduciary obligations to the company itself. These include the following statutory duties: a) a duty to promote the success of the company for the benefit of its members as a whole and, in doing so, to have regard to the likely consequences of any decision in the long term and to the desirability of the company maintaining a reputation for high standards of business conduct;6 and b) a duty to exercise reasonable care, skill and diligence.7 As noted above, fiduciary duties are owed to the company and only the company will be able to enforce them. However, there are certain circumstances in which 4

See infra para. 112 for an explanation of the meaning of litigation privilege. See infra para. 112 for an explanation of the difference between litigation privilege and legal advice privilege. 6 Section 172 Companies Act 2006. 7 Section 174 Companies Act 2006. 5

Ludlam/Garfield

4

5

6 7

8

Reemers Publishing Services GmbH O:/Beck/Spehl_Gruetzner/3d/04_United_Kingdom.3d from 06.03.2013 09:25:48 3B2 9.1.580; Page size: 160.00mm  240.00mm

108

§ 4. England and Wales

shareholders may be able to bring a derivative action on the company’s behalf against a director for a breach of fiduciary duty.8

II. Should the internal investigations be of an open or covert nature? 9 1. In most cases, it is preferable for an internal investigation to be carried out covertly

as far as possible. Covert investigations enable the investigation to proceed without alerting any wrongdoers and without providing those wrongdoers with the opportunity to destroy or tamper with evidence. A covert investigation also gives the company greater control over the way in which the existence of the investigation is communicated to the general public (if, indeed, it is) and to its own stakeholders, such as employees, shareholders and other group companies. In cases in which the company finds no wrongdoing or is exonerated, a covert investigation can also help the company avoid unnecessary bad publicity/reputational damage. Finally, a covert investigation also ensures that confidentiality in the investigation is preserved. This helps ensure that, as far as possible, privilege in the investigation is retained. 10 2. However, the extent to which a covert investigation is possible will again very much depend on the reason for the internal investigation, the scale of that investigation and the aims and objectives of the investigation. If, for example, the investigation was commenced in response to a regulatory investigation or in response to a civil claim or criminal charge then the existence of the investigation will be extremely difficult to conceal. A covert investigation may also be impossible where the scale of the investigation is such that a large number of employees need to be interviewed or if a significant quantity of computer equipment needs to be searched. 11 3. In some cases a more open investigation may in fact be beneficial, for example, if news of the wrongdoing has leaked to the press and/or the regulatory or prosecuting authorities and the company needs to be seen to be taking some action to address the problem. 12 4. In cases in which secrecy cannot be maintained the company should consider instructing a public relations company from the outset to manage external publicity. The company should also think very carefully about how it communicates the existence of the investigation to its own stakeholders, especially its employees. It may be appropriate to circulate an email to employees to explain the reason for and the progress of the investigation and to ensure that documents are not inadvertently removed, destroyed or deleted. Sometimes people think it may be helpful to the business to destroy documents, but this can result in a criminal offence if there is reasonable cause to believe that an attempt has been made to interfere with a regulatory investigation. It can also compromise the business if any civil proceedings ensue. However, it may not always be appropriate to circulate such an email if, for example, it could tip off a wrongdoer that an investigation is being carried out and correspondingly result in that individual taking steps to destroy or tamper with evidence.

8

Section 260 Companies Act 2006.

Ludlam/Garfield

Reemers Publishing Services GmbH O:/Beck/Spehl_Gruetzner/3d/04_United_Kingdom.3d from 06.03.2013 09:25:48 3B2 9.1.580; Page size: 160.00mm  240.00mm

A. Initiation of internal investigations

109

III. Is it advisable to involve external investigators? 1. In some cases, smaller internal investigations can be carried out more cost 13 effectively in-house by the internal legal team. In such circumstances, it is advisable that the company’s in-house lawyers run the investigation so that, as far as possible, legal advice privilege and/or litigation privilege9 will apply to the investigation and any documents/correspondence produced by the investigation.10 See infra paras. 112 et seqq. for the application of privilege to in-house counsel. 2. Generally, however, it is recommended that internal investigations are led by 14 external lawyers with assistance from an internal team from within the business. The main advantages of involving external lawyers in the investigation are that: a) It should be easier to argue that legal advice privilege applies in the circumstances if external lawyers provide the legal advice, as there should be less blurring of the distinction between legal advice and other correspondence between the inhouse lawyers and the business relating to the management of the business. b) External lawyers often have greater resources at hand to carry out the investigation (e.g. lawyers and paralegals, interview rooms, document storage facilities). In contrast, the company may not have the resources to, for example, carry out an extensive document review exercise or to interview a number of witnesses. c) External lawyers often have specialist expertise in carrying out internal investigations and the issues that almost always arise during such investigations (e.g. data protection, money laundering and employment issues). d) External lawyers often have pre-existing relationships with the regulatory and/or prosecuting authorities and have an insight into how those bodies may react to the subject matter of the investigation and how those authorities prefer information to be presented to them. e) Generally a written report of an internal investigation will carry more weight with regulators and/or other stakeholders if it has been prepared (or at least had input from) by external lawyers. 3. Although external lawyers should ideally lead the investigation, the company 15 should also establish an internal team to assist the external lawyers. The identity of that internal team should be considered at a very early stage. Usually, appointing an internal team will lead to consistency, greater efficiency and also helps preserve privilege (where privilege applies). In such cases, it is normally appropriate to have representatives on the internal team from the legal, IT, and human resources departments and to appoint an individual with overall responsibility for managing the internal team and for coordinating how the internal team liaises with the external team of lawyers, IT specialists and PR team. 9

See infra para. 112 for an explanation of the meaning of legal advice and litigation privilege. Very generally, as a matter of English law legal advice given by in-house lawyers to the client will attract privilege, however, this is subject to a number of exceptions including when the communication focuses on the in house lawyer’s business management or compliance role and/or in the case of a European competition investigation (see Akzo Nobel Chemicals Ltd and Akcros Chemicals Ltd v European Commission, Case C-550/07P). 10

Ludlam/Garfield

Reemers Publishing Services GmbH O:/Beck/Spehl_Gruetzner/3d/04_United_Kingdom.3d from 06.03.2013 09:25:48 3B2 9.1.580; Page size: 160.00mm  240.00mm

110

§ 4. England and Wales

16 4. Whatever the size of the internal team, it is important to define who from the

company will be the “client” (i. e. who will have practical day to day responsibility and involvement for overseeing the investigation and/or liaising with the external lawyers). This “client” can be more than one person, but must be an identified group from whom instructions will be received and to whom the external lawyers will report. In most cases the “client” will be an in-house lawyer from the client and/or one or two senior directors/managers, however, much will depend on the scope and nature of the investigation. The reason why it is important to identify the client at this early stage is to ensure that confidentiality is maintained in all communications between the external lawyers and the client. Given that confidentiality is an essential element of privilege, it is therefore vital that confidentiality is maintained in all communications between the external lawyers and the client so that legal professional privilege can be maintained and claimed where appropriate.11

IV. Is it permitted that foreign attorneys conduct internal investigations in England and Wales? 17

Foreign attorneys may conduct internal investigations in England and Wales, and privilege will generally apply to foreign lawyers in the same way as it applies to English qualified lawyers. However, use of foreign lawyers to carry out an investigation in England and Wales is not recommended for a number of reasons. First, almost every internal investigation carried out in England and Wales will involve a consideration of English law issues such as privilege, data protection and employee rights. It is vital that each investigator is aware of the English law position in respect of those types of issues, which crop up throughout almost all investigations regardless of the subject matter. Second, investigators should be aware of relevant aspects of English procedure such as the circumstances in which assets may be frozen by the English court and the circumstances in which the English court may grant an injunction. Finally, it is likely that English regulators and/or prosecuting authorities would not give the same weight to an investigation in England and Wales carried out by overseas lawyers. This is not to say that foreign investigators cannot and should not play a role in the investigations (for example by sitting in on interviews of witnesses), however conduct of the investigation itself should also be left to English qualified lawyers.

V. When should national authorities be called in? 18 1. The reporting obligations of a company (i. e. the extent of and the timing of any

report) will vary depending on the nature of its business and the extent to which it operates in a regulated industry. 19 2. Depending on the nature of the investigation and the nature of the company’s business (i. e. whether it is in the regulated sector and who it is regulated by) there may be an obligation for a company to notify a particular regulator (e. g., the Financial Services Authority, the “FSA”) of the suspected or alleged wrongdoing. 11

See Three Rivers District Council v The Governor and Company of the Bank of England No 5 [2003] EWCA Civ 474 (No 5).

Ludlam/Garfield

Reemers Publishing Services GmbH O:/Beck/Spehl_Gruetzner/3d/04_United_Kingdom.3d from 06.03.2013 09:25:48 3B2 9.1.580; Page size: 160.00mm  240.00mm

A. Initiation of internal investigations

111

There may also be a requirement to report suspicions of money laundering to the Serious Organised Crime Agency (“SOCA”), see infra para. 26 for further details. The decision whether and when to notify the appropriate regulators/prosecution authorities is one that the company must consider carefully with its lawyers as the consequences of getting it wrong can be severe. It is a decision that should be considered by the investigation team from the moment that an investigation is contemplated and then at regular intervals throughout the investigation. 3. Usually, self-reporting should not occur before the investigation has begun and 20 an initial view has been taken on the seriousness of the situation.

Disclosure Obligations – private companies 4. Private companies must file annual returns at Companies House and provide 21 shareholders with copies of the annual report and accounts. The obligation to disclose information to auditors is addressed below. There is no obligation to report internal investigations, or the subject matter of any investigation to shareholders. If relevant information has been disclosed to auditors, this will be addressed in the report and accounts provided to shareholders. If the investigation becomes public knowledge, it may be advisable for the company to call a general meeting to provide an explanation to shareholders. In any event, shareholders with at least 5 % of voting rights have the power to require the directors to call a general meeting under s. 303 of the Companies Act 2006.

Disclosure obligations – Public companies 5. Companies listed on UK regulated markets, such as the Main Market of the 22 London Stock Exchange, must disclose “inside information” (a defined term) which would have an effect on the company’s shares (among other things) under the Disclosure and Transparency Rules (“DTR”). In certain circumstances, such as an investigation, disclosure can be delayed, however the text of an announcement should be prepared in case information is leaked that requires disclosure to be made. 6. The Listing Rules (“LR”) also impose obligations on listed companies. LR 9 23 imposes continuing obligations on certain categories of issuer, including a number of disclosure obligations, of which the following would seem to be the most potentially relevant in the context of an internal investigation: a) LR 9.6.11R – requires the issuer to announce the appointment, resignation or removal of any director; and b) LR 9.6.13R – requires the issuer to announce certain information about its directors including, inter alia: details of any unspent convictions for indictable offences; any bankruptcy proceedings; liquidations of a company of which the director was a director at the time of liquidation; and any public criticisms of the director by any regulatory body. 7. Companies listed on the Alternative Investment Market (“AIM”) must issue a 24 notification under AIM Rule 11 of any new developments that are not public knowledge concerning changes relating to their financial condition which are

Ludlam/Garfield

Reemers Publishing Services GmbH O:/Beck/Spehl_Gruetzner/3d/04_United_Kingdom.3d from 06.03.2013 09:25:49 3B2 9.1.580; Page size: 160.00mm  240.00mm

112

§ 4. England and Wales

likely to lead to a substantial movement in its securities (among other things). This disclosure can also be delayed in certain circumstances. 25 8. AIM Rule 17 lists a number of specific situations in which a company is required to notify information to a Regulatory Information Service (“RIS”). In particular, three of those situations might be relevant in the context of an internal investigation: a) the resignation, dismissal, or appointment of any director; b) any material change between the company’s actual trading performance or financial condition and any profit forecast, estimate, or projection previously made public on its behalf; and c) any changes to details disclosed pursuant to sub-paragraphs (iii) to (viii) inclusive of paragraph (g) of Schedule Two. (Paragraph (g) of Schedule Two sets out information about directors of the company that must be made public. This includes, inter alia: details of any unspent convictions for indictable offences; any bankruptcy proceedings; liquidations of a company of which the director was a director at the time of liquidation; and any public criticisms of the director by any regulatory body).

Anti-money laundering 26 9. If money laundering is suspected, the company should consult the Proceeds of

Crime Act 2002 (“POCA”) before contacting the company’s anti-money laundering compliance officer (if one exists) as soon as possible. Obligations vary depending on whether the company is inside or outside the regulated sector. Those outside the regulated sector have no proactive obligations to report knowledge or suspicions of money laundering except in certain circumstances. Companies within the regulated sector are obliged to have a money laundering reporting officer, and those companies also have proactive obligations to report knowledge or suspicions of money laundering. It is a defense for a company if it made a report to the SOCA before the prohibited act, and SOCA gave consent to the act.

Financial Services Authority (“FSA”) 27 10. At present, the FSA is the single financial regulator for all financial firms and

markets in the UK. The main bulk of FSA-regulated firms’ reporting requirements are contained in the FSA Handbook, particularly chapters 16 and 17 of the Supervision Manual (“SUP”) e.g., compliance reports, financial reports etc. The SUP does not contain an exhaustive set of reporting requirements, and obligations in other FSA sourcebooks may apply depending on the type of business the company undertakes. 28 11. The FSA also introduces ad-hoc reporting from time to time on specific matters, for either temporary or permanent periods. Therefore at the beginning of the investigation the company should check the FSA website to see what obligations are relevant at that time. 29 12. The FSA now requires mandatory electronic reporting, and the majority of regulated firms submit their returns via GABRIEL (Gathering Better Regulatory Ludlam/Garfield

Reemers Publishing Services GmbH O:/Beck/Spehl_Gruetzner/3d/04_United_Kingdom.3d from 06.03.2013 09:25:49 3B2 9.1.580; Page size: 160.00mm  240.00mm

A. Initiation of internal investigations

113

Information Electronically – the FSA’s online regulatory reporting system for the collection, validation and storage of regulatory data).

Competition Commission (“CC”) 13. The CC, unlike the FSA, does not have any set form of reporting required, as its 30 function is primarily to act as an investigatory body. However, when the CC is conducting an investigation, detailed information regarding the companies and markets in question is crucial to allow it to take decisions. 14. The CC’s information-gathering procedures are primarily governed by the 31 provisions of The Enterprise Act 2002 and Schedule 7 to the Competition Act 1998. They can impose various sanctions for non-compliance, including the power to impose a monetary penalty. Intentional provision of false or misleading information, or intentional alteration, suppression or destruction of any documents a person is required to produce, also constitutes an offence.

Serious Fraud Office (“SFO”) 15. The SFO uses special legislative powers to obtain the evidence needed to build 32 its cases. It is similar to the CC in that it does not require any compulsory reporting, however it encourages early self-reporting if indications suggest that a very complex or serious fraud is involved. Should the SFO launch its own investigation, it will be harder for the company to control.

Multi-jurisdictional 16. Consideration should be given to whether an investigation of a company will 33 trigger any reporting obligations in other jurisdictions. This may be the case if the company has a parent, subsidiaries or branches in other jurisdictions. Advice should be obtained from local counsel present in the relevant jurisdictions if this is the case. 17. For example, where a company has a US parent, it should consider whether it 34 needs to inform the parent which in turn may need to consider its reporting obligations under the Foreign Corrupt Practices Act 1977 (“FCPA”). Under the FCPA, a US parent company which controls its non-US subsidiary could be liable for any breaches of the FCPA committed by its subsidiary. The FCPA accounting provisions (which are concerned with record-keeping as well as payments) also apply to Securities and Exchange Commission (“SEC”) issuers, and any non-US subsidiaries which they control. The FCPA requires SEC issuers to use good faith efforts to ensure their subsidiaries comply with these provisions. 18. A UK company could also be considered to be a ‘foreign private issuer’ if it is 35 registered with the SEC (or in other circumstances). Foreign private issuers have disclosure obligations with the SEC, which include promptly disclosing any disclosure the company has made under the securities laws in its home country. Therefore, if a UK company discloses inside information under the DTR2 for Ludlam/Garfield

Reemers Publishing Services GmbH O:/Beck/Spehl_Gruetzner/3d/04_United_Kingdom.3d from 06.03.2013 09:25:49 3B2 9.1.580; Page size: 160.00mm  240.00mm

114

§ 4. England and Wales

example, and it is a US foreign private issuer, it will also have to make this disclosure in the US.

B. Admissibility and implementation of individual measures within the scope of internal investigations I. What measures are admissible within the scope of internal investigations? 36 1. The steps that can be taken by a company as part of an investigation are, to a large

extent, governed by UK and European data protection and employment law. 37 2. The Data Protection Act 1998 (“the DPA”) implements EU data protection

legislation and applies to the processing of all personal data in the UK. Any business operating in the UK holding information (known as “personal data”) relating to individuals (known as “data subjects”) will be subject to the provisions of the DPA. This includes data held about both employees (including applicants and former employees) and customers. 38 3. Any investigation will necessarily involve the processing of personal data within the scope of the DPA. Companies must therefore be aware of its provisions before they commence any internal investigation. If a company acts in breach of the DPA, the Information Commissioner’s Office (“ICO”), which is responsible for enforcing the provisions of the DPA, may impose a monetary fine on the offending organization12 or issue an enforcement notice, which can require the data controller to stop processing data in certain ways.

What is “processing” and “personal data”? 39 4. The provisions of the DPA apply where personal data is being processed auto-

matically (e.g. by email, databases, computerized systems or CCTV) or is being held as part of a structured manual filing system (most structured paper personnel files are covered by the provisions of the DPA unless they are sorted only in date order). 40 5. “Personal data” is data which relates to a living individual and includes any expression of opinion about the individual and any indication of the intentions of the data controller or any other person in respect of the individual. Whilst this definition is very broad, case law has limited its scope to some extent. Information will only ‘relate to’ an individual where it is biographical in some significant sense and has the individual as its focus. 41 6. If an individual can be identified partly due to the data held and partly on other information (not necessarily data), the data held will still be ‘personal data’ for the purposes of the DPA. For example: an organization holds data on a spreadsheet detailing which employees are due to receive a bonus that year and how much. The spreadsheet does not identify the employees by name, but by their unique employee number. This number can be matched to a list kept by the

12

Section 55A Data Protection Act 1998.

Ludlam/Garfield

Reemers Publishing Services GmbH O:/Beck/Spehl_Gruetzner/3d/04_United_Kingdom.3d from 06.03.2013 09:25:50 3B2 9.1.580; Page size: 160.00mm  240.00mm

B. Admissibility and implementation of individual measures

115

personnel department, identifying each employee’s unique employee number. The information held on the spreadsheet showing bonuses is personal data. 7. There is an additional category of “sensitive personal data” to which special rules 42 apply. This is personal data which includes information as to racial/ethnic origin, political opinions, religious beliefs (or beliefs of a similar nature), membership of a trade union, health, sex life and/or the commission of any criminal offence. 8. Personal data is processed when it is obtained, recorded or held or any operation 43 or set of operations is carried out on the data. This includes organizing, adapting or altering the data, retrieving, disclosing and erasing/destroying data. 9. The company’s DPA notification should be checked to ensure that it is broad 44 enough to encompass all the processing activities required during the investigation. The company’s Data Protection and IT Use/Electronic Communications policies should also be checked to determine the extent of the company’s latitude to gather information as part of any investigation and the employee’s expectations of privacy.

Key principles of data protection 10. The eight principles contained in the DPA include a requirement that data must 45 be processed lawfully and fairly. The DPA specifies a set number of conditions upon which an employer can rely to ensure that processing is lawful – for example, where the processing is with the consent of the data subject, where it is necessary to perform a legal obligation, where it is necessary to perform a contract or where it is necessary for the purposes of legitimate interests of the data controller (set out in Schedule 2 of the DPA). One of a more limited set of conditions must also be satisfied in order to process sensitive personal data (set out in Schedule 3 of the DPA) – for example, obtaining the explicit consent of the data subject, or where the processing is necessary for compliance with any legal obligation to which the company is subject. 11. The other key principles include requirements: (i) that organizations provide 46 information to data subjects about what data is being processed and why; (ii) that data should not be kept for longer than necessary for the purpose for which it was collected/held; (iii) not to transfer data outside of the EEA unless adequate protection is in place; and (iv) to ensure that data is kept securely/ safely and is not misused, damaged etc. 12. There are a number of exemptions under the DPA which may allow the 47 company to disclose information without complying with all of the data protection principles (for example, if data is processed for the purposes of legal advice and proceedings and/or for the prevention and detection of crime). However, most of these are not blanket exceptions and the processing to be undertaken by the company may still have to fulfill one of the conditions in Schedule 2 (and Schedule 3). The DPA should be consulted carefully. The following website provides a useful overview of the exemptions: www.ico. gov.uk/for_organisations/data_protection/the_guide/exemptions.aspx.

Ludlam/Garfield

Reemers Publishing Services GmbH O:/Beck/Spehl_Gruetzner/3d/04_United_Kingdom.3d from 06.03.2013 09:25:50 3B2 9.1.580; Page size: 160.00mm  240.00mm

§ 4. England and Wales

116

Transfers of data outside the EEA 48 13. There may be a desire for emails and/or other data examined through the

investigation to be sent and reviewed outside the EEA. However, unless one of the specific exemptions set out in the DPA applies, personal data (including emails) cannot be transferred to a country or territory outside the EEA unless that country or territory has an “adequate level of data protection” in place or one of a number of conditions has been satisfied. 49 14. The following non-EEA countries are the only countries which are deemed by the EU to have adequate protection in place: Andorra, Argentina, the Faroe Islands, Canada, Israel, Jersey, Switzerland, the Isle of Man and Guernsey. Note that the US is not included in this list. Any transfer of employee personal data to the US will only be permissible if one of the conditions below is satisfied or if the transferee entity is a member of the US Safe Harbor arrangement. The data controller may also make his/her own assessment that the level of protection offered by the recipient country is adaequate. In doing so the data controller should take into account issues such as the nature of the data being transferred, what and how long it will be used for, the laws of the destination country and whether there is an effective procedure for data subjects to enforce their rights and claim compensation. 50 15. Transfers to non-EEA countries can take place, provided that one of the following exemptions applies: a) the employee has given consent to the transfer; b) the transfer is a step taken at the request of a prospective employee with a view to entering into a contract with a prospective employer; c) the transfer is necessary for the performance of a contract between employer and employee; d) processing is necessary in connection with legal proceedings/obtaining legal advice or is otherwise necessary for the purposes of establishing, exercising or defending legal rights; e) the transfer is made pursuant to a data transfer agreement providing sufficient protection as regards to the data being transferred; or f) the group of companies involved has implemented binding corporate rules (“BCRs”) (these must be approved by the ICO or other relevant national data protection authority). 51 16. In practice, many organizations put in place contractual arrangements with the transferee entity using the EU-approved model clauses (essentially a form of contract entered into by the transferor and transferee which set out how the processing of the personal data will be managed). BCRs (which allow companies to draft their own set of rules to govern the transfer of data intra-group) are also beginning to be used more regularly.

Employee consent 52 17. It can be difficult for employers to rely on the “consent exemption” because

such consent must be freely given and there is some doubt as to whether this Ludlam/Garfield

Reemers Publishing Services GmbH O:/Beck/Spehl_Gruetzner/3d/04_United_Kingdom.3d from 06.03.2013 09:25:50 3B2 9.1.580; Page size: 160.00mm  240.00mm

B. Admissibility and implementation of individual measures

117

can ever be true in an employment context. In any case, given that consent may be refused, consent is rarely the most advisable approach to adopt for an employer who wishes to make regular/systematic transfers of personal data outside the EEA, and may not be appropriate in an internal investigation context.

Whistleblowing hotlines 18. Some investigations may arise as a result of a report made to a “whistleblowing 53 hotline” (i. e. a phone line available for employees to notify senior management of suspected wrongdoing at the company). Whistleblowing hotlines are permissible in the UK provided they meet certain standards. In particular, they should not be used for anonymous reporting (or at least it should be strongly discouraged), the scope of hotlines must be clearly defined, employees should be kept well informed as to the use and purpose of the hotline and they should be tightly controlled and generally only used as a last resort. 19. Typically hotlines are used by US-based companies to ensure Sarbanes-Oxley 54 (“SOX”)/financial compliance. In many EU jurisdictions there are tight controls on what data can be captured through whistleblowing hotlines and must be limited to SOX or financial issues only. In the UK, however, hotlines can also capture other broader “wrong-doings” such as environmental issues or criminal activities or they may also be used to report bullying and harassment etc., although employees should always be encouraged to raise issues with their manager or Human Resources in the first instance.

Employee monitoring 20. Internal investigations will frequently involve monitoring communications. As 55 this involves an intrusion into employees’ privacy, there are a number of statutory provisions that an employer must consider including, alongside the DPA, the Regulation of Investigatory Powers Act 2000 (“RIPA”).

RIPA and the Telecommunications Regulations 2000 21. Under RIPA it is a criminal offence intentionally and without authority to 56 intercept a communication in the course of its transmission on any public or private telecommunication system. There is an additional civil tort in relation to unlawful interception of a private telecommunication system.

Definitions 22. Interception involves the “monitoring or interference” with a telecommunica- 57 tions system so as to make some or all of the contents of the communication available to a person other than the sender or intended recipient whilst the communication is being transmitted (s2(2) RIPA).

Ludlam/Garfield

Reemers Publishing Services GmbH O:/Beck/Spehl_Gruetzner/3d/04_United_Kingdom.3d from 06.03.2013 09:25:50 3B2 9.1.580; Page size: 160.00mm  240.00mm

§ 4. England and Wales

118

58 23. Communication is broadly defined and includes communications between

people, between people and things and even between things and things, such as when an employee requests data from an internet website (s8(1) RIPA). 59 24. The time period involved includes “any time when the system by which the communication is being or has been transmitted is used for storing it such that it enables the intended recipient to collect it or otherwise have access to it” (s2(7) RIPA). This will catch the recording of telephone conversations and systems which block or filter emails and make some of the content (for example, an offending phrase) available to another person. 60 25. RIPA applies to both public and private telecommunication systems. ‘Public’ means that the relevant service (email, telephone etc.) is offered or provided to a substantial section of the public in the UK. RIPA applies to ‘private’ systems which are linked to a public system (for example, an office switchboard).

Exceptions 61 26. There are two principal ways in which communications can be lawfully inter-

cepted under RIPA: a) the warrant system (aimed at the security forces such as the police so not relevant for the purposes of internal investigations); or b) if both the sender and the recipient have consented to the interception (s3(1) RIPA).

Email 62 27. The company’s employment contracts and any published policies on data and

communications should be checked before any monitoring of employee communications is carried out. These may show that employees were aware of (and could be said to have consented to) the interception of their internal communications for certain specified purposes, for example, the prevention of fraud. 63 28. It is generally accepted that opening emails which have already been opened by the intended recipient will not constitute an interception under RIPA, so reviewing an employee’s old emails which have been received and opened or deleted will not give rise to problems under RIPA (although see below for a discussion of DPA compliance). 64 29. However, opening emails before they have been opened by the intended recipient would constitute an interception under the act and would therefore require consent of both the sender and recipient. It will be very difficult to show consent in the case of external emails (emails sent/received by the employee to/ from someone outside of the company).

Telephone 65 30. Calls made or received by employees may be lawfully intercepted if both sender

and recipient have consented to such interception. This may be achieved by, for example, including an automated telephone message informing external parties Ludlam/Garfield

Reemers Publishing Services GmbH O:/Beck/Spehl_Gruetzner/3d/04_United_Kingdom.3d from 06.03.2013 09:25:51 3B2 9.1.580; Page size: 160.00mm  240.00mm

B. Admissibility and implementation of individual measures

119

that the conversation may be recorded for monitoring purposes. As above in the case of email, the company’s employment contracts and published policies on communications should be checked to identify whether staff have consented to such interception.

Voicemail 31. The general opinion is that the interception of voicemails after they have been 66 accessed and heard by the recipient is not an interception under RIPA (following the interpretation in relation to opened emails). However, listening to unopened messages which are stored on voicemail would probably constitute an interception under RIPA, as a message is still regarded as being in the course of transmission if it is being stored on the system that transmitted it (s2(7) RIPA). However no court is yet to consider this. 32. In all of the above cases, the contents of the employment contracts and data/ 67 telecommunications policies will be the key to determining whether the employer reasonably believed all parties had consented to the interception.

Lawful Business Practice Regulations 33. Communications may be lawfully intercepted without consent if the intercep- 68 tion is for a purpose that falls within regulation 3 of the Telecommunications (Lawful Business Practice) (Interception of Communications) Regulations 2000, SI 2000/2699 (“The Regulations”). The purposes permitted by the Regulations are extensive, including interception where the purpose is to prevent or detect crime (reg 3(1)(iii)), and investigating or detecting the unauthorized use of that or any other telecommunications system (reg 3(1)(iv)). 34. In addition to the need for the interception to fall within the permitted purposes, 69 the interception must be solely for the purpose of monitoring or keeping a record of communications relevant to the business, and must take place on a telecommunications system provided for use wholly or partly in connection with that business. Monitoring or recording personal telephone calls or emails will not be permitted. The system controller (someone within the employer with authority to authorize or forbid the use of the system) must also have made all reasonable efforts to inform every person who may use the system that their communications may be intercepted (reg 3(2)(c)). Again, it will be relevant to check employment contracts and published company policies on data and telecommunications to identify whether staff has been adequately informed.

Public systems 35. A public communications system can only lawfully be intercepted with lawful 70 authority (i. e., if a warrant is obtained). Consent will not suffice as it will not be possible to show that the other party has consented to the communications. The Regulations will not apply as the network will not normally be provided for use wholly or partly in connection with the business of the company. Ludlam/Garfield

Reemers Publishing Services GmbH O:/Beck/Spehl_Gruetzner/3d/04_United_Kingdom.3d from 06.03.2013 09:25:51 3B2 9.1.580; Page size: 160.00mm  240.00mm

120

§ 4. England and Wales

If the company is a public body 71 36. “Designated persons” within certain public bodies are lawfully able to obtain

communications data under RIPA if they believe that this is necessary for any of the reasons listed in s22(2) of RIPA, e.g. national security, prevention or detection of crime, public safety, etc. 72 37. Therefore if the company is a public body, and wishes to obtain records of its employees’ communications for the purposes of an internal investigation, it is worth checking whether persons within the company are “designated persons” under RIPA. 73 38. The list of public bodies currently designated by order is relatively extensive and includes: SOCA; the FSA; the Home Office; the Department of Health; and local authorities. Under s25, the Secretary of State has the power to designate by order which persons within which public bodies are “designated persons” for these purposes. 74 39. If these provisions are used by the company to obtain communications data, care must be taken to ensure that such action is both necessary and proportionate, in order to avoid the possibility of a future challenge for breach of the employees’ rights under Article 8 of the European Convention on Human Rights (ECHR).

The DPA and Employment Practices Code 75 40. In addition to the RIPA considerations set out above, monitoring employee use

76

77

of email/the internet/other electronic facilities involves the processing of personal data. The eight data protection principles under the DPA 1998 and Part 3 of the Employment Practices Code (monitoring at work) are therefore both relevant. The key points that the company must consider in the context of any internal investigation are: a) Identification of a Legitimate Purpose – there should be a clearly identified and legitimate purpose for monitoring or searching emails or other IT systems. Legitimate purpose(s) will normally include the following: (i) checking compliance with company or regulatory requirements or policies (e.g. FSA requirements) and/or (ii) investigating or detecting misuse of telecommunications systems (for example, offensive material sent over email). Employers should also consider if there are alternative, less intrusive means of investigating the particular issue. b) Proportionate Search – the monitoring should be conducted in a proportionate manner, minimizing the intrusion into the employees’ privacy. Practically speaking, this involves conducting the searches according to defined parameters e.g. using keywords, targeting only relevant employees, and identifying appropriate date ranges. The individuals who are entrusted to carry out the searches (whether employees or third parties) should also be instructed to disregard personal emails or other documents which are irrelevant to the purpose for which they are reading the emails, to keep the data retrieved secure and to treat it confidentiality.

Ludlam/Garfield

Reemers Publishing Services GmbH O:/Beck/Spehl_Gruetzner/3d/04_United_Kingdom.3d from 06.03.2013 09:25:51 3B2 9.1.580; Page size: 160.00mm  240.00mm

B. Admissibility and implementation of individual measures

121

c) Information to Employees – employees should generally be informed of the 78 fact that they may be monitored or their emails searched, along with an explanation of why it is necessary. At a minimum, employees should be forewarned through the employer’s general policies on IT usage, data protection etc. 41. Although not a strict requirement, employers should consider documenting 79 their consideration of the issues detailed above in an “impact assessment”. An impact assessment would ideally cover the following broad issues: a) Identify the purpose behind the monitoring/testing and the benefits it is likely to deliver. b) Identify the adverse impact of the arrangement on employees. c) Consider alternatives to monitoring/testing (i. e. consider ways in which the objectives of the monitoring could be achieved through less intrusive means). d) Take into account the obligations which arise from monitoring. e) Justify the monitoring (i. e. come to a conclusion on why the benefits justify the intrusion into employees’ privacy). 42. If possible, employees should be informed at the time that a search is carried 80 out. However, in the investigation context there is often a need to keep searches secret (e.g. to maintain confidentiality, or minimize the risk of employees disposing of/tampering with evidence). If there is a significant likelihood of tampering or otherwise, the investigation will be adversely affected by informing the employees, then the employer can decide not to inform. However, employers should address this issue on a case by case basis – there is a risk that conducting covert monitoring could breach the implied term of trust and confidence between the employer and the employee (see below).

Duty of Trust and Confidence 43. As noted above, employers must be careful in the way they conduct monitoring 81 to avoid the risk of an employee suggesting that the employer has breached the implied term of trust and confidence (which is implied into every contract of employment under English law). A breach of the implied term will entitle an employee to resign and pursue a constructive dismissal claim in addition to discharging them from their other contractual obligations e.g. post termination restraints.

Practical Steps 44. In practical terms, there are a number of steps employers undertaking investiga- 82 tions can take to minimize the legal risks involved in monitoring, as follows: a) Check that policies set out clearly the scope of the monitoring activities the employer may undertake (addressing email, other IT systems, entry passes, and telephone systems). b) Document the reason for the searches each time they are carried out.

Ludlam/Garfield

Reemers Publishing Services GmbH O:/Beck/Spehl_Gruetzner/3d/04_United_Kingdom.3d from 06.03.2013 09:25:51 3B2 9.1.580; Page size: 160.00mm  240.00mm

122

§ 4. England and Wales

c) Identify parameters for ensuring that email searches are targeted, and avoid personal intrusion as far as possible. d) Issue instructions to individuals carrying out searches to ignore all irrelevant personal correspondence and to treat all information reviewed as confidential. e) Consider the pros/cons of notifying employees at the time when monitoring of their emails occurs. 83 45. To date, the courts in England and Wales and English Employment Tribunals have not taken the approach of excluding evidence obtained by an employer in breach of data protection legislation. However, employers should still comply with the steps above to avoid a (potentially significant) sanction from a data protection perspective.

II. Must employees’ representatives such as the works council be involved in internal investigations? 84

There is no requirement under English law that a company must either notify or involve an employee representative body or trade union in an internal investigation. However, there may be such a requirement in any agreement in place between the employee representative/trade union and the company and/or in the company’s employment policy and/or in individual employment contracts. Such requirements are rare in the context of a general regulatory investigation; the involvement of a trade union or an employee representative is more likely in the context of a disciplinary process. Either way, all relevant documents should be checked before the internal investigation is commenced so that the company is aware of its obligations as regards employee representatives and/or trade unions. A company may also decide to consult/involve the trade union even if it is not required to do so on the grounds that will maintain good relations with the employees. However, any such benefit must be weighed up against the need, usually, to keep the investigation confidential.

C. Employee interviews I. How should an interview of a witness or a suspect be conducted? 85 1. One of the principal means of gathering evidence in relation to the subject matter

of any internal investigation is by way of interviews of witnesses and potential suspects. Witness interviews should ideally be conducted by two lawyers (one to lead and one to take notes.) As a general rule it is not necessary to “caution” the employee, but at the outset: a) the witness should be informed of the purpose and nature of the interview; b) the witness should be told that the external lawyers conducting the interview do not represent them personally; they represent the company; c) the witness should be told to keep the facts of the interview and its contents confidential and not to discuss it with anyone; and d) the witness should be told that what they say may be used in subsequent legal proceedings.

Ludlam/Garfield

Reemers Publishing Services GmbH O:/Beck/Spehl_Gruetzner/3d/04_United_Kingdom.3d from 06.03.2013 09:25:52 3B2 9.1.580; Page size: 160.00mm  240.00mm

C. Employee interviews

123

2. The interview should always be conducted in private. If the employee does not 86 feel at ease, they are unlikely to reveal much. Consider whether a senior manager of the company needs to be present – an employee may feel able to be more candid if their boss isn’t present. The questions asked of the interviewee should be “open” questions (e. g., questions beginning who, how, what, where, why) if the purpose of the interview is mainly fact-finding; closed questions (e. g., questions requiring just a yes or no answer) may be more appropriate where the witness is also a possible suspect. 3. In most cases, all potential witnesses should be interviewed before any suspect is 87 interviewed so that the interviewer can obtain sufficient background on the matter from the witnesses so as to be in a position to put effective questions and allegations to the suspect(s).

II. May an employee refuse to provide information if this information would incriminate himself/herself? 1. There is a general rule that a person should not be compelled to say anything which might tend to bring him or her into the peril or possibility of being convicted as a criminal. Hence in any civil proceedings, no person, whether a party or not, can be compelled to produce any document or thing or to answer any question, if to do so would tend to expose that person, or his or her spouse, to proceedings for an offence or for the recovery of a penalty. This rule applies only as regards to criminal offences under the law of any part of the UK and penalties provided for by such law, and does not extend to criminal offences under foreign law.13 This is the rule against self incrimination. 2. The rule against self incrimination is framed specifically which means it operates only in the context of legal proceedings. For this reason, where an employer (or the employer’s lawyer) interviews an employee in the context of an internal investigation and as part of a fact gathering exercise, it is generally not open to the employee to refuse to answer questions on the grounds that it may incriminate that person. 3. In any event, Section 13 of the Fraud Act 2006 abrogates the privilege against self-incrimination to the extent that the question is asked in proceedings for an offence under the Fraud Act or a related offence and the proceedings relate to property.14 4. Section 13 provides as follows: a) A person is not to be excused from aa) answering a question put to him in proceedings relating to property; or bb) complying with any order made in proceedings relating to property; on the ground that doing so may incriminate him … of an offence under this Act or a related offence. b) But, in proceedings for an offence under this Act or a related offence, a statement or admission made by the person in aa) answering such a question, or 13

Section 14(1) Civil Evidence Act 1968. Section 13 was considered in detail by the Court of Appeal in the case of Kensington International Ltd v Republic of Congo [2007] EWCA Civ 1128. 14

Ludlam/Garfield

88

89

90

91

Reemers Publishing Services GmbH O:/Beck/Spehl_Gruetzner/3d/04_United_Kingdom.3d from 06.03.2013 09:25:52 3B2 9.1.580; Page size: 160.00mm  240.00mm

124

§ 4. England and Wales

bb) complying with such an order, is not admissible in evidence against him. 92 5. An employer cannot force an employee to provide them with information which would incriminate the employee. However, in a disciplinary context the employer would be able to draw adverse inferences in the event that an employee refused to answer a question on the basis that they believed it would incriminate them. In extreme circumstances, an employer could dismiss an employee for refusal to answer questions put to them.

III. Is an employee obliged to provide information on any misconduct of or criminal offence committed by other employees? 93

Some professions, such as the legal profession, are bound by regulatory obligations to report wrongdoing by fellow employees where serious misconduct comes to light. Employees may have specific contractual obligations to report any misconduct or wrongdoing of which they become aware. Similarly, where employees are employed in roles of a fiduciary nature, common law implied obligations to report misconduct or other criminal offences to the employer would be very likely to apply.

IV. May an employee refuse to answer a question if he/she has already answered it within the scope of a previous interview? 94

In most cases during an internal investigation, interviews are not interviews under caution and so an employer cannot force an employee to answer a question. An employee may, therefore, refer the employer to a previous answer if he feels it is appropriate to do so, however, if the employee appears to be being deliberately obstructive or uncooperative then this may result in disciplinary actions being taken against the employee. An employer which finds itself in this situation would be well advised to explain to the employee the extent to which his/her cooperation is expected and potential consequences if the employee chooses to be obstructive during the course of the interview process.

V. Is an employee entitled to the presence of a member of the works council or an attorney during the interview? 95 1. Where the interview is an investigatory interview only, employees have no strict

entitlement to be accompanied during the interview. If the interview becomes disciplinary in nature, then the employee has a right to be accompanied by either a trade union representative or a work colleague. In those circumstances, an employer should pause the interview process and commence separate disciplinary proceedings as part of which the employee should be given an appropriate right to be accompanied. 96 2. Employees do not generally have the right to be represented by a lawyer as part of any internal investigatory meeting. There are some circumstances in which legal representation will, however, be appropriate. First, where an employee is at risk of Ludlam/Garfield

Reemers Publishing Services GmbH O:/Beck/Spehl_Gruetzner/3d/04_United_Kingdom.3d from 06.03.2013 09:25:52 3B2 9.1.580; Page size: 160.00mm  240.00mm

C. Employee interviews

125

individual criminal sanction as a result of their involvement in the matter being investigated, it can be sensible for the employer to arrange separate representation for that employee and to allow the employee’s lawyer to be present during the interview. This is not, however, a right for the individual employee and is at the employer’s own discretion. Second, in extreme circumstances where a disciplinary process will potentially determine the ability of the individual to continue to work in their chosen profession, it may be appropriate for the individual to be offered the right to legal representation in accordance with protection set out under the Human Rights Act 1998. However, these circumstances are very rare and in most cases employees have no right to insist upon a lawyer being present. 3. Obviously, any advice given to the employee should not be given by the emplo- 97 yer’s external lawyers in case a conflict arises.

VI. Is an employee entitled to read the record of his/her interview? 1. From an ordinary employee relations perspective, it would be usual for an 98 employee to be given a copy of the notes of his/her interview and for any of their comments to be taken into account in producing a final record of the interview. An employer is not obliged to agree with comments made by an employee and it is not uncommon for an employee’s comments to be appended to interview notes rather than incorporated into a final version. If the employer wishes to rely upon the contents of interview notes in order to take action against the employee, it would be sensible for the employee first to be given the opportunity to comment upon the contents of those notes. 2. The interviewee should be told that notes taken of the interview will not be a 99 verbatim record (unless they are being tape recorded). They should be told whether they will be given a copy of the interview notes to allow them to correct any errors but that they are not permitted to add any matters that were not discussed. 3. When considering whether to let an interviewee keep a record of the interview 100 the company should bear in mind the confidentiality of the investigation and whether the interviewers think the witness will keep the document confidential. Be aware that giving the interviewee a copy of the notes is likely to waive privilege in the document, unless disclosure is accompanied by a specific undertaking from the interviewee that they will not disclose the document to anyone else and that they acknowledge privilege in it has not been waived.

VII. Is the employer entitled to request that the employee signs the record of the interview? 1. Witness statements should be prepared from notes of the interview in appro- 101 priate cases. It is preferable to keep these statements in draft as long as possible to ensure privilege is preserved in all jurisdictions (be aware that a “draft” signed statement may be discloseable in the US, although it will still remain privileged until filed/served in the UK). However, if the company believes that a witness may become uncooperative in future, it may wish to have a statement signed as

Ludlam/Garfield

Reemers Publishing Services GmbH O:/Beck/Spehl_Gruetzner/3d/04_United_Kingdom.3d from 06.03.2013 09:25:52 3B2 9.1.580; Page size: 160.00mm  240.00mm

126

§ 4. England and Wales

soon as it is prepared. If other jurisdictions are involved, it will be important to engage local counsel for advice as to the status of un/signed witness statements. 102 2. An employer is entitled to request that the employee signs the record of the interview. If the employee disagrees with the contents of the interview then the employer will be unable to require the employee to sign a record of it. It may amount to a reasonable request (failure to comply with which may result in disciplinary action) to ask an employee to sign a formal record of an interview which is agreed by both the employer and the employee. However, the employee’s signature is unlikely to add significant weight in these circumstances. It would be sufficient for the employee to have been given the opportunity to comment upon the contents of the interview and for there to be a paper trail which confirms that the employee did not have any comments or agreed with the contents of any written record.

VIII. Can the employer instruct an employee to treat the content of his/her interview as confidential? 103

Yes. The employer cannot realistically force the employee to keep the matter confidential, but could make clear that any breach of confidence would be a disciplinary offence in relation to which an employer may impose a sanction up to and including dismissal. An employer would be unlikely to be able to take disciplinary action against an employee for sharing details of the interview with his/her legal representative and, quite possibly, with his or her spouse or partner. There is no particular legal principle which supports this, save that it would go to the question of whether the employee had materially breached the employer’s instruction to keep the contents of the interview confidential. In extreme circumstances an employer could seek a contractual promise of confidentiality from the employee. However, such contractual restrictions have not been used in many cases and it is by no means certain that an employer would be able to obtain an injunction to prevent disclosure of the contents of an interview based upon such a contractual promise. That said, the presence of such a contractual promise would, presumably, provide a significant deterrent against unauthorized disclosure.

D. Sanctions imposed on employees I. What are the sanctions under employment law that can be imposed on employees refusing to cooperate in internal investigations? 104

A request by an employer that an employee cooperates with an internal investigation would be considered a reasonable request made in the context of the employment relationship. If the employee was warned appropriately about the consequences of refusing to cooperate, it would be possible for a disciplinary process to be commenced and for sanctions up to and including dismissal to be imposed in serious circumstances. The extent to which dismissal would be justified in these circumstances would depend very much on the facts. If the employee’s refusal appeared reasonable in the circumstances, then an employer may be unable to Ludlam/Garfield

Reemers Publishing Services GmbH O:/Beck/Spehl_Gruetzner/3d/04_United_Kingdom.3d from 06.03.2013 09:25:53 3B2 9.1.580; Page size: 160.00mm  240.00mm

D. Sanctions imposed on employees

127

dismiss fairly without first following a warning process, possibly with a number of stages.

II. Is the suspicion of a criminal offence or of a severe violation of duty sufficient for an extraordinary termination? Suspicion without proof would be unlikely to justify summary termination. The 105 extent to which an employer would be able to fairly dismiss where it suspects an employee of a criminal offence would depend upon the reasons for the suspicion and upon any explanation put forward by the employee. In general, employees have a right to have the employer’s allegations put to them in a meeting at which they are accompanied and also have the right to have their explanation of any allegations considered. If, having gone through this process, an employer remained of the view that an employee appeared likely to have committed a criminal offence or a severe violation of duty, then dismissal may be justified in the circumstances. This would be the case even if, ultimately, the employee was found not guilty of the criminal offence or evidence came to light that disproved their violation of duty. At the time at which the sanction is imposed, the employer must have conducted a reasonable investigation and made a reasonable decision that the employee was guilty of the offence or misconduct based upon reasonable grounds. The employer must then impose a sanction which is reasonable in all the circumstances. It is clear that the word reasonableness appears a number of times throughout this test. The impact of this is that an employer must consider all of the relevant circumstances and only dismiss where it appears appropriate to do so.

III. During which period of time must an extraordinary notice of termination be given to employees whose misconduct has been revealed by the internal investigations? As set out above, before dismissal an employer would need to go through a 106 disciplinary process and give the employee an opportunity to explain his/her side of the story. There is no hard and fast rule as to how quickly this disciplinary process must take place after misconduct has been revealed by an internal investigation. However, the longer the period left between the internal investigation and the disciplinary process, the harder it will be for an employer to justify a dismissal as fair. Ultimately, a dismissal in these circumstances would result from the employer effectively concluding that it could no longer keep this employee within its workforce. Such a conclusion would potentially be undermined if the employee had been allowed to remain in the workforce for a significant period of time once the allegations had come to light.

IV. Must an employee cooperate in internal investigations even after he/she has been given notice of termination? Whilst an employee remains employed, they can be required by an employer to 107 take part in an internal investigation by being issued with the reasonable instrucLudlam/Garfield

Reemers Publishing Services GmbH O:/Beck/Spehl_Gruetzner/3d/04_United_Kingdom.3d from 06.03.2013 09:25:53 3B2 9.1.580; Page size: 160.00mm  240.00mm

128

§ 4. England and Wales

tions set out above. As the sanction for failure to comply with a reasonable instruction is, ultimately, dismissal, if an employee has already been dismissed it may practically be difficult to force an employee to take part in an investigation at this stage. Once an employee has left employment an employer will have considerable difficulty securing cooperation in internal investigations unless it has secured a contractual commitment to do so as part of any severance agreement.

E. Use of the obtained information I. Is it permissible to disclose the findings and information obtained within the scope of any internal investigations to other group companies? 108 1. Generally, as a matter of English law, there is nothing preventing a company

from sharing the results/findings of an internal investigation with other group companies. However, extreme care should be taken if such a step is envisaged and legal advice should be sought as there are a number of potential pitfalls. 109 2. Companies should bear in mind their data protection obligations if the information that they are sharing contains personal data (see section B. above for further details). Companies should also avoid any disclosure that may potentially risk waiving any privilege that exists in the documents (for example, because the documents may be considered to have lost the element of confidentiality required for privilege to protect a document). Finally, prior to sharing the results of an investigation, companies should be wary of breaching any compliance or regulatory duties. By way of example, it is an offence under the Money Laundering Regulations 2007 for a person to tell another that a disclosure has been made to a nominated officer or the law enforcement agencies, where this is likely to prejudice an investigation or proposed investigation into money laundering. It is also an offence for a person to disclose that an investigation into allegations of money laundering is being contemplated or is being carried out, where this is likely to prejudice that investigation. The maximum penalty for tipping off is two years imprisonment, an unlimited fine or both. Accordingly, if a company was to tell its parent company that it had submitted a suspicious activity report under the Money Laundering Regulations and/or that the Serious Organized Crime Agency was carrying out a money laundering investigation into the company, it would be in breach of the rules prohibiting tipping off.

II. Is it permissible and advisable to forward the findings and information obtained within the scope of any internal investigations to public authorities? 110 1. There is no general prohibition on company’s forwarding data to public autho-

rities, although it must always comply with its data protection obligations in respect of any data forwarded to those authorities. When considering whether to self report or not it is also important to consider the effect on privilege in any documents that might well be needed in subsequent criminal and/or civil litigation. In either case, if the report will be disclosed it should be reviewed carefully before being made final because privilege will be waived in the document as a result of the Ludlam/Garfield

Reemers Publishing Services GmbH O:/Beck/Spehl_Gruetzner/3d/04_United_Kingdom.3d from 06.03.2013 09:25:53 3B2 9.1.580; Page size: 160.00mm  240.00mm

E. Use of obtained information

129

disclosure unless a non-waiver of privilege agreement can be agreed with the recipient. 2. We have dealt above with the circumstances in which it may be advisable to 111 inform public authorities about the findings of the report. Broadly speaking, whether or not it is advisable to forward the findings of an investigation to public authorities would depend on the circumstances of each case. Given the consequences of getting the decision wrong, legal advice should be sought before any documents are forwarded.

III. Are the findings made in the scope of internal investigations subject to the attorney-client privilege? 1. Under English law there are four main types of privilege: 112 a) legal professional privilege which includes: (aa) legal advice privilege; (bb) litigation privilege. b) common interest privilege; and c) joint privilege. When considering whether a document is privileged the courts in England and Wales will look at the substance of the document rather than its form. In other words if a document is marked “privileged” but fails to satisfy the other requirements of privilege, it will not be protected by privilege. Likewise, even if a document is not marked as privileged, yet satisfies the other criteria, that document will be protected from disclosure by privilege.

Legal Advice Privilege 2. Legal advice privilege protects from disclosure confidential communications 113 between a client and their lawyer which have come into existence for the purpose of giving or receiving legal advice about what should prudently and sensibly be done in the relevant legal context.15 A communication that falls within this definition is privileged at all times until privilege is waived or lost and the privilege is the client’s not the lawyer’s. 3. As noted above, it is important to define the “client” (i. e. the individuals within 114 the company that will give instructions to and receive advice from the lawyers) as soon as possible so it is clear to whom documents are restricted. It is prudent to specify the names of the internal team members who will instruct the lawyers and it is recommended that the following text is used on all correspondence between the lawyer and client: “PRIVILEGED & CONFIDENTIAL: SUBJECT TO LEGAL PROFESSIONAL PRIVILEGE”. To ensure privilege is not waived in communications sent outside this team, the company should provide a nonwaiver clause as follows on the covering correspondence forwarding any privileged document.

15

Three Rivers District Council & Ors v The Bank of England [2004] EWCA Civ 218.

Ludlam/Garfield

Reemers Publishing Services GmbH O:/Beck/Spehl_Gruetzner/3d/04_United_Kingdom.3d from 06.03.2013 09:25:53 3B2 9.1.580; Page size: 160.00mm  240.00mm

§ 4. England and Wales

130

“This document is confidential and is subject to legal professional privilege. Provision of the document to you shall not be construed as a waiver of that privilege and we therefore ask that you do not forward or disclose the document to any other person.”

Confidentiality 115 4. This is an essential element of legal professional privilege. Once a privileged

document ceases to be confidential, it will usually no longer attract privilege. Accordingly, no communication between opposing parties will be privileged since they are not confidential (this is different from “without prejudice” communications with an opposing party).

Communication 116 5. Legal advice privilege applies to communications between a lawyer and client,

but the privilege applies differently as between documents produced by lawyers and those produced by clients. 117 6. Generally speaking, if a lawyer authors a document containing information (s)he would only know by virtue of the professional relationship with their client, that document of itself will attract privilege. There is no additional requirement for it to be sent or otherwise communicated to the client.16 This includes factual summaries of information obtained from third parties. 118 7. Internal documents such as summaries prepared in preparation for obtaining legal advice are unlikely to be privileged. Where the client prepares a document it must be sent to the lawyer in order for privilege to apply. However, merely sending a document to a lawyer will not make it privileged unless it also complies with the other requirements of privilege. 119 8. Where information is passed between lawyer and client as a chain of correspondence, for instance, where the purpose is to keep both parties informed of developments so advice can be given on demand, privilege will apply.

Relevant legal context 120 9. Legal advice must be given in the relevant legal context i. e. legal rights, liabilities,

obligations or remedies of the client. It must fall within the policy justifying legal advice privilege according to English law. This would necessarily exclude pure business advice such as advice on investment or finance policy.

In-house counsel 121 10. Broadly, for the purposes of privilege, in-house counsel are treated the same as

external lawyers. However, the work product of in-house counsel that is focused on their business management or compliance roles will not attract legal advice privilege. In-house counsel should avoid producing written documents which 16

Three Rivers (No 5); USP Strategies Plc & Anor v London General Holdings Ltd & ors [2004] EWHC 373 (Ch).

Ludlam/Garfield

Reemers Publishing Services GmbH O:/Beck/Spehl_Gruetzner/3d/04_United_Kingdom.3d from 06.03.2013 09:25:54 3B2 9.1.580; Page size: 160.00mm  240.00mm

E. Use of obtained information

131

include both legal and business advice (or other non-privileged aspects of their role) since this mix could lead to privilege being lost in the whole document (although usually in this case you would seek to disclose the document but redact any legal advice). 11. If it is at all likely that a competition investigation may occur at any point in the 122 future privilege may not attach to communications between in-house counsel and the business in the context of a European Commission competition law investigation.17 Local advice should always be sought regarding the position of in-house counsel in other EU Member States. France, for instance, does not extend legal advice privilege to in-house lawyers.

Communication of privileged advice to the client’s Board 12. Privilege will not be lost if legal advice is forwarded by the client to the company’s 123 board of directors as long as confidentiality is maintained. Similarly, oral advice at a board meeting would also be privileged. The company should be aware that a board minute attaching or summarizing legal advice will be privileged but if there is discussion of the advice noted in the meeting minutes, the privilege may be lost.

Non-lawyers 13. Legal advice privilege will not apply to the work product of non-lawyers (for 124 example, accountants), even where they give legal advice.18

Strategy to minimize non-privileged communications with third parties 14. As legal advice privilege will only extend to communications between the client 125 and lawyer, communications with third parties will therefore not attract legal advice privilege (note this is different to litigation privilege set out below). One way to minimize the amount of confidential information communicated to/from a third party that will not attract privilege is to instruct third parties (i. e. private investigators) to provide their conclusions, findings or recommendations orally to the company’s lawyers and for the lawyers to then provide legal advice to the client concerning that information. Remember that the lawyer’s written summary of information obtained from a third party will attract legal advice privilege. This will also be a useful way of attaching privilege to the (legal) advice of non-lawyers.

17 Akzo Nobel Chemicals Ltd and Akcros Chemicals Ltd v European Commission, Case C-550/07P, judgment of 14 September 2010. In that case the ECJ concluded that advice provided by an inhouse lawyer would not have a comparable degree of independence to that provided by an external lawyer as the employment relationship meant that the in-house lawyer would be economically dependent on the company and would not be permitted to ignore the company’s commercial strategies. 18 R (on the application of Prudential PLC & Anor v Special Commissioner of Income Tax & Anor [2009] EWHC 2494 (Admin) (NB: this case is currently on appeal to the Supreme Court).

Ludlam/Garfield

Reemers Publishing Services GmbH O:/Beck/Spehl_Gruetzner/3d/04_United_Kingdom.3d from 06.03.2013 09:25:54 3B2 9.1.580; Page size: 160.00mm  240.00mm

§ 4. England and Wales

132

Litigation Privilege 126 15. Litigation privilege protects confidential communications between a lawyer and

their client, a lawyer and a third party or the client and a third party, which are made for the dominant purpose of litigation that is pending, reasonably contemplated or existing. At the time of the creation of the document or information, litigation must be a real likelihood rather than just a mere possibility. It should be noted that litigation advice privilege is unlikely relevant in internal investigations. The company should therefore mark all documents as subject to legal professional privilege and must understand the risk that litigation privilege may not be upheld if challenged. 127 16. For the purposes of litigation privilege the communication can be between: a) lawyer and client, b) lawyer and third party; and/or c) client and third party. 128 17. There is much less restriction than with legal advice privilege and therefore there is less need to define the client.

Dominant purpose of litigation 129 18. Documents should be brought into existence for the dominant purpose of use in

the litigation. It is prudent (although not conclusive to ensure privilege) to include a statement in the document that it was prepared to enable the lawyer to advise on the litigation. The following document header is an example: “PRIVILEGED & CONFIDENTIAL: SUBJECT TO LEGAL PROFESSIONAL PRIVILEGE; FOR THE PURPOSE OF PREPARING LITIGATION ADVICE.”

Pending, reasonably contemplated or existing 130 19. The following case law is useful to consider whether litigation is a “real likelihood

rather than a mere possibility”. a) In Mayor and Corporation of Bristol v Cox (1884) 26 Ch D 678 Pearson J found that there is not necessarily a requirement for the relevant cause of action to have arisen at the time. In fact, it does not matter if the litigation never occurs, or ultimately concerns a different subject matter or parties (Aegis Blaze [1986] 1 Lloyd’s Rep 203). b) In United States of America v Philip Morris Inc & Others [2003] EWHC 3028 (Comm), it was found that privilege would not attach to documents where there was a general apprehension of future litigation from a general class of litigators or a distinct possibility of a claim by someone sooner or later. However, there is no requirement for litigation to be likely in the sense of there being a greater than 50 % chance of it occurring. c) In Westminster International BV and Others v Dornoch Limited and Others [2009] EWCA Civ 1323, the Court of Appeal confirmed that the words “in prospect” in the phrase “litigation reasonable in prospect” could mean “may

Ludlam/Garfield

Reemers Publishing Services GmbH O:/Beck/Spehl_Gruetzner/3d/04_United_Kingdom.3d from 06.03.2013 09:25:54 3B2 9.1.580; Page size: 160.00mm  240.00mm

E. Use of obtained information

133

happen”. The following words were said to satisfy the test: “could well give rise to litigation in the future”.

What amounts to “litigation”? 20. Litigation privilege applies to proceedings in the High Court, county court, 131 employment tribunals and arbitrations (if they are subject to English law). 21. There is less certainty about whether it will apply in respect of proceedings before 132 other tribunals, public inquiries or in respect of statutory investigations (i. e. under the Financial Services and Markets Act 2000 or under the Companies Act 1985 or 2006). In Three Rivers District Council v The Governor and Company of the Bank of England [2004] UKHL 48 it was held that to establish litigation privilege the proceedings had to be “adversarial”, among other things, not investigative or inquisitorial (this principle was derived from the House of Lords decision in Re L (A minor) [1997] AC 16). However, no further elaboration was given and the common law remains uncertain. Section 413 of FSMA may work to protect communications between the client, lawyer and third parties during a regulatory investigation under that Act. Equally, in the context of SFO investigations, documents can be protected under s.2(9) of the Criminal Justice Act 1987 if the person being investigated “would be entitled to refuse to disclose or produce [the documents] on grounds of legal professional privilege in proceedings in the High Court.” 22. Companies should be aware that it may be unlikely that they will succeed in 133 arguing that litigation privilege applies in the context of an internal investigation.

Common Interest Privilege 23. Common interest privilege preserves privilege in documents voluntarily dis- 134 closed to a third party who has a common interest in the subject matter of the privileged documents or in the litigation for which the document was produced. The document remains privileged with the third party who can assert the privilege as against the world. Common interest privilege applies to both litigation privilege and legal advice privilege. 24. Note that this privilege may be used to obtain disclosure or to resist production 135 of a document.

When does common interest privilege apply? 25. The common law is unclear as to when it will apply. Guidance has been given in 136 Winterthur Swiss Insurance Company & Anor v AG (Manchester) Ltd & Ors Rev 1 [2006] EWHC 839 (Comm), which suggests it applies in circumstances where: “a communication is produced by or at the instance of one party for the purpose of obtaining legal advice …, then a second party that has a common interest in the subject matter of the communication … can assert a right of privilege over that communication as against a third party. The basis for the

Ludlam/Garfield

Reemers Publishing Services GmbH O:/Beck/Spehl_Gruetzner/3d/04_United_Kingdom.3d from 06.03.2013 09:25:55 3B2 9.1.580; Page size: 160.00mm  240.00mm

§ 4. England and Wales

134

right to assert this ‘common interest privilege’ must be the common interest in the confidentiality of the communication”.

137 26. Situations where this privilege has been held to apply are: co-defendants, insured

and insurer, reinsurer and reinsured, companies in the same group, agent and principal and any parties who share, or might share, the same solicitor.

Ensure non-waiver of privilege 138 27. Given the case law, it is unclear precisely when common interest privilege will

apply in any given situation. If appropriate, a document should be prepared recording the parties’ understanding that common interest privilege will apply in respect of documents produced in the investigation. However, if there is some doubt about the relationship of the two parties involved it may be appropriate to provide documents to the other party only on the basis of an express contractual undertaking that privilege in the documents is not waived.

Joint privilege 139 28. In certain circumstances two or more parties may share a joint or common

interest in the subject matter of a privileged communication. In such circumstances: a) the documents can be shared between the parties without the risk that they have waived privilege by failing to retain the confidentiality in the communications. b) neither party can assert privilege against the other in respect of the communications. c) each party may be able to establish a right to access documents held by the other. d) both parties can assess privilege in respect of the communications against the rest of the world. 140 29. Thanki on the Law of Privilege (Oxford University Press, 2006) states: “in order for joint privilege to arise the joint interest must exist at the time that the communication comes into existence. If the parties subsequently fall out and sue one another, neither of them can claim privilege as against the other in respect of any documents that are caught by the joint privilege, as the original joint interest is not destroyed by a subsequent disagreement between the parties”.19

IV. Does the attorney-client privilege also apply to foreign attorneys? 141

Yes as long as the test for legal advice privilege as set out above is met.

19

Bankim Thanki QC, The Law of Privilege (2006).

Ludlam/Garfield

Reemers Publishing Services GmbH O:/Beck/Spehl_Gruetzner/3d/04_United_Kingdom.3d from 06.03.2013 09:25:55 3B2 9.1.580; Page size: 160.00mm  240.00mm

F. Following-up on internal investigations

135

F. Following-up on internal investigations I. What is to be observed during the follow-up of internal investigations? 1. As soon as the investigation is substantially complete the investigation team 142 should meet to discuss the findings of the investigation report. This is the appropriate time for any conclusions or recommendations given by the external lawyers, investigators or other external experts to be stated and discussed (rather than appearing in writing in the report). 2. At this meeting the investigation team should decide what actions it will take and 143 what further legal advice is required to carry out these actions. The legal advice may inter alia address the following topics:

Litigation – Offensive 3. If the company has lost assets, it should consider what actions can be taken to 144 recover those assets. If assets have been transferred out of the jurisdiction, careful advice is required on the appropriate forum in which to bring any recovery proceedings. If a freezing order was sought during the early part of the investigation the decision on jurisdiction may already have been made, however, it will be necessary to defend any challenge to the freezing order and/or to the jurisdiction of the substantive proceedings. Advice on the prospects of success of the substantive proceedings will also be required (or updated) once the investigation report is available.

Litigation – Defensive 4. Again, in the case of fraud, it may be that the company is being sued by creditors. 145 Further advice will be required on the prospects of successfully defending those proceedings in light of any new information produced by the investigation.

Employees 5. The company should take employment law advice on the actions it wishes to take 146 in respect of any employees implicated by the findings of the investigation, to ensure its actions comply with the law and company policies. Its broad options are to reinstate, dismiss or discipline. It may also be required to defend any subsequent employment tribunal proceedings.

Public Relations Internal 6. The investigation team should report to management/the company board 147 throughout the investigation as appropriate. Ensure privilege is maintained in Ludlam/Garfield

Reemers Publishing Services GmbH O:/Beck/Spehl_Gruetzner/3d/04_United_Kingdom.3d from 06.03.2013 09:25:55 3B2 9.1.580; Page size: 160.00mm  240.00mm

§ 4. England and Wales

136

any legal advice discussed (remember that board minutes attaching or summarizing legal advice received will be privileged, but if a board minute records discussion or the implication of the advice, privilege will be waived). 148 7. The company’s employees may be disrupted by the investigation. While all efforts should be taken to keep the investigation confidential, some employees will be aware of it because they are involved as witnesses or because they know fellow employees have been suspended etc. In these circumstances the head of the investigation team should consider whether ongoing updates are necessary to keep employees informed of basic developments and to address any concerns they may have. These updates may be individual or given to specific groups of employees and should include a final update on completion of the investigation. The aim here is to maintain company stability. External 149 8. Hopefully, the investigation has remained private and confidential while being

carried out. Once completed, the investigation team will decide whether any public statement should be made or action taken. This will depend on the nature of the investigation, for example if it was a bribery investigation the decision to selfreport to the SFO should be considered. Following an investigation into allegations of fraud, decisions will need to be taken as to whether litigious (or further litigious) steps should be taken. 150 9. If the investigation was (or became) a matter of public knowledge, the investigation team will need to consider whether media statements are necessary to show that the problem has been resolved and appropriate action taken. Where appropriate, public relations specialists may be able to assist with this. What if information about a private investigation is leaked? 151 10. In this situation it is better to provide the company’s version of events to the

appropriate media channels before other reports are published which may further damage its reputation or business. In order to do this promptly following the investigation team becoming aware of a leak, a media statement should be prepared and kept on standby. 152 11. Obviously, the source of the leak should be investigated and every effort should be made to keep the remainder of the investigation as confidential as possible. It may be necessary to release continued media reports from this point on. Reporting 153 12. The company should revisit its reporting obligations to consider whether it is

required or obliged to make any further reports or disclosure now that the investigation findings have been established. Future risk management 154 13. Once steps have been taken to address the company’s problem, the investigation

team should consider what actions are necessary to prevent the same problem occurring again in the future. These actions will also be specific to the company’s circumstances, a consideration of the following may be appropriate:

Ludlam/Garfield

Reemers Publishing Services GmbH O:/Beck/Spehl_Gruetzner/3d/04_United_Kingdom.3d from 06.03.2013 09:25:56 3B2 9.1.580; Page size: 160.00mm  240.00mm

F. Following-up on internal investigations

137

Company procedures 14. The company should ensure that all relevant procedures are clearly written into 155 company policies, which are accessible and regularly brought to the attention of employees. Check whether new policies need to be written? For example, in the case of the Bribery Act 2010, a company must demonstrate that it has “adequate procedures” in place to prevent bribery in order to have a defense to the ‘corporate offence’ under s.7 of that Act. Monitoring and compliance 15. In addition, the company should consider whether it has adequate processes in 156 place to ensure that certain risks are monitored? For example, money laundering, bribery, misappropriation of client or company funds, insider dealing. Crisis response 16. The company should review the course of the investigation itself and decide 157 whether any areas could be improved so that it has the best opportunity to respond to any future crisis.

Finalizing the report 17. The next step is to determine whether the matter requires self-reporting. If so, the report should be formalized by the external lawyers. Every effort should be made to ensure privilege is retained in the report itself. If the report simply contains a summary of the facts, it is unlikely to be privileged unless it can be shown it was created for the purpose of seeking the company’s views to enable the lawyers to give legal advice. In the latter case, this should be made clear at the beginning of the report, and it should contain some preliminary legal advice to ensure it is privileged. 18. If the report contains a summary of the facts together with subsequent legal advice, it will be privileged. 19. The report should refer to documents used or discovered during the investigation but not attach them. This is to limit the amount of material in which privilege is waived if the report was to lose privilege for any reason. 20. Ideally, the external lawyers’ recommendations to the company should be discussed orally during a meeting. The reason for this is that if privilege is subsequently lost or waived in the report, the recommendations made to the company would become public. If the company did not follow the recommendations made (for whatever reason) it may not be able to justify any claim that it dealt with the problem adequately once it became aware of it.

158

159 160

161

II. May an employer pay its employee’s legal fees if he/she is being prosecuted under criminal law? As set out above, an employer is not obliged to provide separate legal representa- 162 tion for employees during an investigation. As a matter of fairness, if employees may be exposed to individual liability as distinct from their employer, it may be approLudlam/Garfield

Reemers Publishing Services GmbH O:/Beck/Spehl_Gruetzner/3d/04_United_Kingdom.3d from 06.03.2013 09:25:56 3B2 9.1.580; Page size: 160.00mm  240.00mm

138

§ 4. England and Wales

priate for the employer to offer (and pay for) the employee to be given confidential legal advice as to whether he/she should seek their own legal representation. Obviously, this advice could not be given by the employer’s external lawyers in case a conflict arises.

G. Miscellaneous I. Document storage, preservation and review 163 1. Before the investigation begins, it is vital to establish the nature and location of

any potentially relevant documents. If the documents are located in storage, it may be easier to obtain a copy of the documents, but it may create greater difficulties for the company in locating “relevant” documents. Be aware of this and consider how you intend to identify relevant documents. Further, the nature of the documents is critical. Hard copies may avoid data protection issues, but soft copies are generally easier to locate and search with the right tools. There are pros and cons to both. The nature of the documentation is likely to have a big impact on the duration and complexity of the investigation. 164 2. Once the location and nature of the documents have been identified, a preservation plan should be agreed. 165 3. Once all materials have been located and a preservation plan put in place, consider at the outset how those documents should be stored. With hard copies, they should all be kept in a separate location and preserved. They should then be copied and only copies should be circulated thereafter, so that the originals remain exactly as they are. With soft copies, discuss with the company’s IT department and/or the electronic service provider how the documents should be preserved and stored (for example, on back up tapes).

II. Insurance Insurance against liability/loss 166 1. This is often overlooked, but it is important to consider at the outset. 167 2. It is recommended that the company proceeds on the basis that what it suspects

has happened has in fact happened. On that basis, the company should check its insurance policy to determine whether the company would be insured against any liability or loss that it may have been suffered. If so, it is important to determine the point at which the insurer needs to be notified. The company might also check whether the costs of an investigation may be covered and, if so, whether the insurer agrees to cover the company’s costs. 168 3. Some company policies may insure against employee fraud (e.g., banker’s blanket board policies and fidelity insurance policies), and others may not. The terms of the policy should be checked carefully. 169 4. No insurance policy will cover criminal conduct by the company, but it may cover the costs of fighting a criminal prosecution. 170 5. The company should consider whether and when its insurers should be notified. Ludlam/Garfield

Reemers Publishing Services GmbH O:/Beck/Spehl_Gruetzner/3d/04_United_Kingdom.3d from 06.03.2013 09:25:56 3B2 9.1.580; Page size: 160.00mm  240.00mm

G. Miscellaneous

139

Individual’s insurance 6. Most insurance policies will not pay for employees to seek separate legal advice. 171 7. As for directors, sometimes they have D&O (directors and officers) insurance 172 which will indemnify them in respect of any legal costs expended, but these are recoverable from the director if he/she is found guilty of the offence concerned.

III. Internal disclosure obligations on a company 1. Once an issue has come to light that requires an investigation to be commenced, 173 a company in England and Wales may have to report the existence of the investigation and/or the outcome to other internal stakeholders:

Auditors 2. Company directors have an obligation to disclose all ‘relevant audit information’ 174 to external auditors and failure to do so may result in a breach of section 501 of the Companies Act 2006. There is no provision in the Act as to when information must be disclosed. Therefore, the investigation can be completed before a decision is made as to whether any ‘relevant audit information’ needs to be disclosed. If the company’s auditors are preparing their report at the same time as the investigation, a decision must be made as to whether the directors have any relevant audit information they must disclose immediately.

Banking covenants 3. Loan agreements to which the company is a party should be reviewed to see 175 whether any facts established by the investigation (or that may be established) are likely to trigger an obligation pursuant to an Information Covenant or an Event of Default. The consequences of disclosure or non-disclosure to the lender should be considered and a decision made taking into account the company’s obligations and best interests. For example, if disclosure of certain facts discovered in an investigation would lead to questions in the market about the company’s solvency, the consequences of non-disclosure may be preferable.

Ludlam/Garfield

Reemers Publishing Services GmbH O:/Beck/Spehl_Gruetzner/3d/04_United_Kingdom.3d from 06.03.2013 09:25:56 3B2 9.1.580; Page size: 160.00mm  240.00mm

Reemers Publishing Services GmbH O:/Beck/Spehl_Gruetzner/3d/05_France.3d from 06.03.2013 09:26:24 3B2 9.1.580; Page size: 160.00mm  240.00mm

§ 5. France Para. Initiation of internal investigations . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 1 When and to what extent should internal investigations be initiated? 1 Should an internal investigation be of an open or covert nature? . . . . . 4 Is it advisable to involve external investigators? . . . . . . . . . . . . . . . . . . . . . . . 7 Are foreign attorneys allowed to conduct internal investigations in France? . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 10 V. When should National Authorities be called in? . . . . . . . . . . . . . . . . . . . . . . 12 B. Admissibility and implementation of individual measures within the scope of internal investigations . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 15 I. What measures are admissible within the scope of internal investigations? . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 15 1. Employee interviews . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 16 2. Email and (electronic or physical) file screening . . . . . . . . . . . . . . . . . . . . 19 a) Conditions governing the access and use of an employee’s emails . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 25 aa) Prior formalities . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 25 bb) Conditions of access . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 32 b) Access to and use of professional files . . . . . . . . . . . . . . . . . . . . . . . . . . . 34 3. Video surveillance of employees . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 37 a) Employee information and works council consultation prior to implementing video surveillance . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 40 b) The requirement of justified and proportionate control . . . . . . . . . 46 4. Tapping of telephone conversations . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 49 5. Amnesty programs . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 57 II. Must employee representatives such as the works council and the Hygiene and Safety Committee be involved in internal investigations? . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 63 1. Works council and Hygiene and Safety Committee’s right to be informed and consulted . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 63 2. Sanctions for violation of the works council’s and Hygiene and Safety Committee’s rights . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 68 C. Employee interviews . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 70 I. May an employee refuse to provide information if the information would incriminate him/her? . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 70 1. Providing information relating to the employment relationship . . . . 71 2. Providing information not relating to the employment relationship . 76 II. Is an employee obliged to provide information regarding any misconduct or criminal offence committed by another? . . . . . . . . . . . . . . 81 1. Reporting . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 84 2. Whistleblowing . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 90 III. May an employee refuse to answer a question if he/she has already answered it during a previous interview? . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 94 IV. Is an employee entitled to have a member of the works council or attorney present at an interview? . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 95 1. Employee’s right to have an employee representative present (“de´le´gue´ du personnel”) . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 95 2. Employee’s right to have an attorney present to protect his/her rights . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 97 V. Is an employee entitled to read the record of his/her interview? . . . . . . 100 VI. Is the employer entitled to request that the employee sign the interview record? . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 101

A. I. II. III. IV.

Charlot/Dallais/Desoutter/De Guillebon/Lebeau-Marianna

Reemers Publishing Services GmbH O:/Beck/Spehl_Gruetzner/3d/05_France.3d from 06.03.2013 09:26:24 3B2 9.1.580; Page size: 160.00mm  240.00mm

142

§ 5. France Para. VII. Can the employer instruct an employee to treat the content of his/her interview as confidential? . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 102 D. Sanctions imposed on employees . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 107 I. The absence of an obligation to cooperate in internal investigations under French law . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 107 II. What sanctions can be imposed on employees for inaccurate or misleading testimonies? . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 113 III. Is the suspicion of a criminal offence or of several violations of duty sufficient for termination? . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 116 1. Suspicion of several violations of duty . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 116 2. Suspicion of a criminal offence . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 118 3. What is the statute of limitations period? . . . . . . . . . . . . . . . . . . . . . . . . . . . 123 E. Use of information obtained . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 127 I. Is it permissible to disclose the findings and information obtained from an internal investigation to other group companies? . . . . . . . . . . . . 127 1. Data privacy requirements for sharing internal investigation findings . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 127 2. Transfer of data to other group companies . . . . . . . . . . . . . . . . . . . . . . . . . 130 II. Is it permissible and advisable to forward the findings and information obtained from an internal investigation to Public Authorities? . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 134 III. Are the findings from internal investigations subject to attorney-client privilege? . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 139 IV. Does attorney-client privilege also apply to foreign attorneys? . . . . . . . . 143 F. Following-up on internal investigations . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 150 I. What is to be observed during the follow-up of internal investigations? . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 150 II. May an employer pay its employee’s legal fees if he/she is being prosecuted under criminal law? . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 152 G. Summary of key results . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . .

A. Initiation of internal investigations I. When and to what extent should internal investigations be initiated? 1

Internal investigations serve to reveal a company’s weaknesses, with the purpose of then rectifying such weaknesses and attempting to avoid any further damage to the company. In detail: – If employee or management misconduct becomes public, confidence in the company will ultimately decline and its reputation as a whole, as well as that of any of its individual brands will suffer. Internal investigations are aimed at restoring the public, customers and business partners’ faith and confidence in the company. – The company must make it clear not only to third parties, but also to its employees, that it will not tolerate any type of misconduct. By conducting internal investigations, companies are able to implement a “zero tolerance” stance and ensure that misconduct and violations will be exposed and appropriate sanctions imposed. – The purpose of internal investigations is to reveal a company’s weaknesses and to remove them once and for all. In order to prevent employees from violating any laws, an efficient control system should be set in place.

Charlot/Dallais/Desoutter/De Guillebon/Lebeau-Marianna

Reemers Publishing Services GmbH O:/Beck/Spehl_Gruetzner/3d/05_France.3d from 06.03.2013 09:26:24 3B2 9.1.580; Page size: 160.00mm  240.00mm

A. Initiation of internal investigations

143

Under French law, misconduct by management and/or an employee can have 2 several serious consequences for both the company and its management. Under French Criminal Law, legal entities are considered criminally liable for the offences committed on their behalf by their representatives.1 The maximum fine applicable to legal entities is five times the amount of the standard fine set forth in the French Criminal Code. The amount of the standard fine depends on the exact nature of the offence. For instance, in the event a company is found liable of corruption, a maximum fine of 750.000 EUR could be imposed. The company may also be subject to a number of other measures, such as liquidation/winding up, disqualification from taking part in public procurement bids, prohibition to use bank checks, court supervision and publication of the court judgment. A company may also be found liable in tort (i. e. “civilement responsable”) for offences committed by its employees. In this case, the employer is generally ordered to pay damages to the victim, however it may even be ordered to pay the applicable fine instead of the convicted employee under the theory that the employee acted during his employment and using the means placed at his/her disposal by the company, the employer is thus liable in tort. The employer is deemed to have breached the obligation of proper supervision of the employee. If the company has already conducted internal investigations to correct weaknesses, the findings of such investigations may be decisive for the discretionary decision of the Public Authorities as to whether and to what extent it will take measures or initiate an official investigation. If management is involved in misconduct, its members may be directly subject to criminal sanctions. Company management is personally liable for its own misconduct. Executives may also be found liable for offences committed by company employees – in particular when occupational health and safety rules have been disobeyed within the company. From a more general perspective, based on their supervision obligations, members of management may be liable for the offences committed by employees. Company management must therefore address all indications of possible offences and take all the necessary measures to restore compliance. Management is responsible for initiating and defining how and to what extent 3 internal investigations are to take place. It is important however, that when management is contemplating an internal investigation, it carefully considers all possible negative factors and or consequences which could result from such an investigation and whether it would ultimately be worthwhile. If an internal investigation is not thorough, it may give the impression that nothing is out of order. As a result, misconduct left uncovered may be reinforced or even continued. Furthermore, if an investigation reveals negative results at a later stage, it may be assumed that management was trying to cover up a transgression and as a result, backfire. Internal investigations may be carried out with respect to individuals as well as individual departments. Additionally, if there is a suspicion of widespread misconduct throughout the company – or even that criminal structures are in place – a more comprehensive internal investigation beyond the scope of individual departments or divisions is recommended.

1

Art. L. 121–2 of the French Criminal Code.

Charlot/Dallais/Desoutter/De Guillebon/Lebeau-Marianna

Reemers Publishing Services GmbH O:/Beck/Spehl_Gruetzner/3d/05_France.3d from 06.03.2013 09:26:25 3B2 9.1.580; Page size: 160.00mm  240.00mm

144

§ 5. France

II. Should an internal investigation be of an open or covert nature? If suspicions arise that employees are misappropriating funds and/or giving or taking bribes, a covert internal investigation should be initiated. A covert internal investigation is necessary in order to effectively identify the offenders and possible accomplices, without risking the destruction of evidence. Data protection laws can be a special challenge when it comes to conducting covert investigations, as certain measures within the scope of an investigation are only admissible if the employee concerned is given prior notice. 5 In some cases, however, it can be important for a company to openly communicate that an internal investigation is to take place; in particular by informing employees. An open investigation would for example be necessary when rumors circulate that an internal investigation is being conducted or that the Authorities have begun initial enquiries. A company must always assess whether the advantages of conducting an open investigation outweigh the risk of certain individuals concealing or even destroying evidence. 6 Depending on the information available, investigations may firstly be carried out covertly, then partially and finally completely open. 4

III. Is it advisable to involve external investigators? The involvement of external investigators basically depends on the company involved, the specific circumstances and the suspected breaches of the law. 8 One advantage in favor of using internal investigators, such as a legal department or an auditing department, as opposed to external investigators, is the cost. Internal personnel are more familiar with the internal operations and activity of the company than external investigators. There are, however, strong arguments in favor of external investigators, such as attorneys and auditors. External personnel often specialize in conducting such investigations and therefore have the necessary expertise and know how to construct a comprehensive solution to ongoing breaches. Very few companies have internal investigators who are equally qualified. 9 Additionally and more importantly, external investigators enjoy special privileges. For example, they have the right to refuse to give evidence (professional secrecy of attorney for example). With limited exceptions, client-related records may not be seized. Furthermore, external investigators are – as a general rule – viewed as more credible than internal investigators. The use of external investigators makes it easier to convince the Authorities that management is genuinely determined to resolve the current situation. With this in mind, company management should preferably select external investigators from firms who have not dealt extensively with the company in the past. 7

IV. Are foreign attorneys allowed to conduct internal investigations in France? 10

Foreign attorneys may conduct internal investigations in France, provided they do not disclose to third parties any collected information and/or documents “of an Charlot/Dallais/Desoutter/De Guillebon/Lebeau-Marianna

Reemers Publishing Services GmbH O:/Beck/Spehl_Gruetzner/3d/05_France.3d from 06.03.2013 09:26:25 3B2 9.1.580; Page size: 160.00mm  240.00mm

A. Initiation of internal investigations

145

economic, commercial, industrial, financial or technical nature” which may then constitute evidence in the framework of foreign judicial or administrative proceedings. According to Art. 1bis of the French “Blocking Statute” (i. e. Act dated 26 July 1968, as amended by the Act dated 16 July 1980), “Subject to treaties or international agreements and the law and regulations in force, any person is prohibited from requesting, seeking or disclosing, in writing, verbally or by any other means, any documents or information of an economic, commercial, industrial, financial or technical nature tending to constitute evidence in view of foreign judicial or administrative proceedings or in the framework of such proceedings”. Therefore, except in investigations based on specific proceedings authorized by international treaties, the possibility for foreign attorneys to take part in internal investigations in France is limited. Their investigations must be conducted in accordance with the limitations of the Blocking Statute, breach of which is criminally punishable. As an illustration, a French attorney acting as correspondent attorney for a US colleague was recently ordered by the French Supreme Court to pay a fine for having requested information from a French company within the framework of judicial proceedings that were ongoing in the United States.2 However, apart from the exception established by the Blocking Statute, foreign 11 attorneys may conduct internal investigations within French companies.

V. When should National Authorities be called in? The earlier the better. Early involvement of National Authorities shows that the 12 company is serious and sincere about remedying misconduct and finding a solution. Involving Public Authorities early can serve as a confidence building tool. This will particularly be the case where the accusations against the company or its employees are of a serious nature and the matter attracts significant public attention. A company should however only call in the Authorities when an internal investigation has already produced specific results. The premature involvement of Public Authorities e.g., when only vague suspicions exist, can be counterproductive and may lead the Authorities to initiate their own criminal investigations. Official investigations additionally attract great public interest and the company 13 will inevitably have media exposure. There is also a strong possibility that evidence will be destroyed once it is known that Public Authorities are involved. Additionally, if criminal investigations are opened, the company will no longer 14 have access to the investigation results until it becomes a party to the proceedings; either when charged of an offence or as the victim thereof. As soon as National Authorities are involved, it becomes more difficult to correct bad or even illegal practices within the company.

2

French Supreme Court (Criminal section), December 12, 2007.

Charlot/Dallais/Desoutter/De Guillebon/Lebeau-Marianna

Reemers Publishing Services GmbH O:/Beck/Spehl_Gruetzner/3d/05_France.3d from 06.03.2013 09:26:25 3B2 9.1.580; Page size: 160.00mm  240.00mm

§ 5. France

146

B. Admissibility and implementation of individual measures within the scope of internal investigations I. What measures are admissible within the scope of internal investigations? 15

In order to investigate French employees, employers must comply with strict labor law, criminal law and data privacy regulations. 1. Employee interviews

Employee interviews constitute the key instrument and the starting point of internal investigations. 17 Employee interviews within the scope of internal investigations are permissible in the workplace during working hours and the employee cannot refuse to respond if the employer’s request concerns his/her personal work space. 18 The employee can only be interviewed alone if the company knows that no disciplinary sanction will be taken (otherwise the employee may be assisted by an employee representative and the employer must comply with the disciplinary process pursuant to the applicable Internal Regulations). 16

2. Email and (electronic or physical) file screening 19

20 21

22

23

Email and file screening, e.g. electronic monitoring of employees’ professional emails and files may be carried out to ensure that employees collectively comply with French law and with company policies. Access to an employee’s professional emails and (electronic or hard copy) files during an investigation may be performed for evidentiary purposes. Such access is however strictly regulated under French law and monitoring an employee’s individual activity or accessing professional emails (i. e., those not marked as private or personal) must be justified by legitimate business reasons. All personal emails are protected in the same manner as private correspondence. French labor and criminal law as well as data privacy regulations and applicable case law strictly protect a person’s right to privacy.3 Secrecy of correspondence is protected erga omnes and may be enforced in all situations. In order to investigate an employee’s emails and files, two key distinctions must be made: – distinguish between personal and professional (or business related) documents and files; – distinguish between files (whether electronic or physical) and emails. Failure to observe the above rules may result in: 1. significant fines for breach of the secrecy of correspondence, which is sanctioned by up to one year imprisonment and by a fine of up to 45.000 EUR (a fine of up to 225.000 EUR for a company); and/or

3

Art. 8 of the European Convention of Human Rights, Art. 9 of the French Civil Code and Art. L. 1121–1 of the French Labor Code.

Charlot/Dallais/Desoutter/De Guillebon/Lebeau-Marianna

Reemers Publishing Services GmbH O:/Beck/Spehl_Gruetzner/3d/05_France.3d from 06.03.2013 09:26:26 3B2 9.1.580; Page size: 160.00mm  240.00mm

B. Admissibility and implementation of individual measures

147

2. significant fines for breach of data privacy regulations (e.g., unfair collection of personal data is sanctioned by a fine of up to 300.000 EUR and up to five years imprisonment, and a fine of up to 1.500.000 EUR for a company); and/or 3. damages for breach of privacy; and/or 4. any collected evidence being considered inadmissible from a procedural standpoint. The evidence obtained by the employer through such employee monitoring may 24 be declared unlawful, and consequently may not be used against the employee. Furthermore, the employee concerned could claim for damages if his/her right to privacy has been unlawfully infringed. a) Conditions governing the access and use of an employee’s emails aa) Prior formalities (1) Labor Consultation with the works council and Work Health and Safety Committee. Under French labor law, the employer must consult with the Work’s Council prior to the implementation of a system of monitoring the employees’ activity. If the Information Technology (IT) Policy provides for sanctions in cases of non compliance by the employees of its provisions, the IT Policy must be attached to the company’s Internal Regulations in order to be enforceable against the employees. This would in particular require modifying the Internal Regulations and consulting with the Works Council and filing same with the Labor inspector. (2) Notification with the French data protection authority (the CNIL). The company must duly notify the CNIL of any human resources data processing, in accordance with applicable law. If the company monitors its employees, a specific notification to the CNIL for monitoring purposes must be made with the CNIL. The French Supreme Court considers that no means of evidence may be used by the employer against employees if the means of control were not previously known by the employees. Under the above conditions, the employer may access and use evidence employees’ professional emails, i. e., not marked as personal. (3) Prior informing of the employees through the implementation of an IT Policy. The employer must implement an IT Policy in order to comply with the information and transparency principle set forth under both the French Labor Code and the Data Protection Act. This IT Policy must provide that emails and files sent/ received or stored on the information system provided by the company are deemed to be for business purposes. However, in accordance with French case law, it is not possible to prohibit total personal use of computers (as long as such use in reasonable). Employees are required to clearly identify their personal emails and files. The IT Policy must set out the conditions under which the employer may be entitled to access professional and/or exceptionally personal files and/or emails.

25

26

27

28 29

30

31

bb) Conditions of access Generally speaking, access by the employer (or its representatives) to emails 32 identified as “personal” (i. e. not for business use) is normally not allowed, unless:

Charlot/Dallais/Desoutter/De Guillebon/Lebeau-Marianna

Reemers Publishing Services GmbH O:/Beck/Spehl_Gruetzner/3d/05_France.3d from 06.03.2013 09:26:26 3B2 9.1.580; Page size: 160.00mm  240.00mm

§ 5. France

148

– There exists a risk or particular event for the company that necessitates access to private folders (e.g. security of the IT systems, bribery or anti-competitive acts which may affect the company); and – Either: (1) access is granted subject to a court order obtained by the employer before accessing the private folder, in order to protect evidence that may be destroyed if the employee becomes aware of the investigation and attempts to delete such evidence. Such access is allowed and possible only under specific conditions, such as an authorization from a French judge in the context of ex parte proceedings based on Art. 145 of the New Code of Civil Proceedings (NCPC), allowing certain investigations before the introduction of a legal action, or consent of the employee in certain cases, etc., or (2) these documents may be opened in the presence of the employee concerned or the latter duly called to assist in the investigation (the employee should have received a prior notification). If the employee is not present, it is recommended that a bailiff be present during the company’s accessing of the personal emails. 33 Under specific conditions to be determined on a case by case basis, emails that contain both business and private content should be deemed to be personal. b) Access to and use of professional files Data files created by employees within the information system of their employer and stored on said information systems are deemed to be professional (whether an IT Policy has been implemented or not). Hard copies of files are also deemed to be professional. Access to such files or data by the employer is authorized. 35 By contrast, access by the employer (or its representatives) to files identified as “personal” that are stored in the information system or in hard copy is normally not allowed, unless the same conditions for accessing personal emails are met as identified in supra paras. 25 to 33. Furthermore, if the employee’s file mentions a topic which is clearly personal (e.g. vacation, home bills, etc.), then it can reasonably be assumed that these files must be considered as having been “identified” as “personal” or “private” and treated as such. 36 In this respect, even if a large number of professional emails are filed in these personal files and even if certain professional emails have been wrongfully stored in the personal files, there is a significant risk that access by the company to such emails may be considered by a court as unauthorized. Employees may nonetheless be sanctioned for violation of their obligation of loyalty towards their employer, by wrongfully naming files and emails as personal. 34

3. Video surveillance of employees With respect to video surveillance of employees, two fundamental principles must be reconciled: – respect of individual freedom; – need for the employer to monitor the employees’ activity in light of the company’s legitimate business interests. 38 Under French law, the employer is permitted to implement a video surveillance system within the company. 37

Charlot/Dallais/Desoutter/De Guillebon/Lebeau-Marianna

Reemers Publishing Services GmbH O:/Beck/Spehl_Gruetzner/3d/05_France.3d from 06.03.2013 09:26:26 3B2 9.1.580; Page size: 160.00mm  240.00mm

B. Admissibility and implementation of individual measures

149

Video surveillance is therefore permitted, yet subject to limitations: 39 – Respect of the employee’s individual rights and freedom, which must also be complied with within the company; – Transparency requirement: conditions for video surveillance involve informing employees, consultation of the works council and the submission of a CNIL declaration. – Proportionality requirement: control must be justified by a legitimate interest such as for safety reasons and must not be excessive or systematic. a) Employee information and works council consultation prior to implementing video surveillance The works council must be informed and consulted prior to the implementation of systems such as video surveillance or any other means of surveillance.4 Depending on the impact of the systems on the employees’ health, the Hygiene and Safety Committee should also be informed and consulted prior to the works council consultation. These obligations are enforceable even if the camera is visible to employees.5 The employer must first inform employees of the implementation of the video surveillance means and of the exact purpose of the video surveillance (Art. L. 1221–9 of the French Labor Code). Under very specific conditions, the employer may implement video surveillance without first informing and consulting the works council and employees if the system is implemented on premises where employees do not work. For example, the French Supreme Court held that a video surveillance system, which had been set up by the employer in a goods depot, could be validated and used as evidence, without the condition of first informing employees and the works council since in this case the employees had no reason to be present in this depot.6 Similarly, it was ruled that a video surveillance system, which has been set up in a room where employees do not normally have access, and at the request of the employer’s customer, is lawful.7

40

41 42

43

44

45

b) The requirement of justified and proportionate control It is not sufficient for the employer to simply comply with the information 46 obligation with respect to employees’ rights and freedom; video surveillance systems must additionally serve a legitimate interest and be proportionate. Indeed, Art. L. 1121–1 of the French Labor Code states that “any restrictions to 47 individual rights and freedom are prohibited, unless justified by the nature of the task assigned or proportionate to the goal sought”. Failure by the employer to meet these two requirements may give rise to the 48 following consequences: – criminal sanctions (in case of offences such as obstruction of the works council’s rights, infringement of right to privacy, non-declaration with the CNIL); 4

Art. L. 2323–32 of the French Labor Code. French Supreme Court (Labor section), May 15, 2001, n 04-43866. 6 French Supreme Court (Labor section), January 31, 2001, n 98-44290. 7 French Supreme Court (Labor section), April 19, 2005, n 02-46295. 5

Charlot/Dallais/Desoutter/De Guillebon/Lebeau-Marianna

Reemers Publishing Services GmbH O:/Beck/Spehl_Gruetzner/3d/05_France.3d from 06.03.2013 09:26:26 3B2 9.1.580; Page size: 160.00mm  240.00mm

§ 5. France

150

– civil liability risk, that is, damages if harm is established; – risk that evidence obtained via a video surveillance system may be dismissed as inadmissible and excluded from hearings, notably if sanctions have been taken against an employee on the basis of said evidence. 4. Tapping of telephone conversations 49

50

51

52

53

54

55

56

Under French law, the implementation of a system to tap employees’ telephone conversations is prohibited except when ordered by a court or by a governmental order (e.g. rules governing companies working in the banking sector). However, subject to specific labor law and data privacy requirements, tapping an employee’s work phone may be allowed if the measure is deemed proportionate and justified for the achievement of a certain purpose. The system must be implemented exclusively for legitimate and proportionate purposes. It is however important to highlight that the private use of a work phone is tolerated as long as the employee does not abuse this privilege. The CNIL provides examples of legitimate purposes such as the evaluation of employees for whom the use of the telephone is the main work tool (e.g. operator) or to ensure the quality of customer relations by the employees. The system must not be implemented on a continuous basis and, in general, the recorded data must not be retained for longer than 2 months. Also, employees must have access to an alternative phone or a button to block the screening for personal use or for any other professional use not related to the recording’s purpose. The employer must comply with various requirements including prior notification with the CNIL, informing the employees concerned prior to implementation, and prior consultation with the works council. The notification to the employees must include the duration of the measure and should also mention the sanctions for any abuse of the work phone. Tapping of a specific employee for illegitimate surveillance purposes constitutes a breach of the employee’s right to privacy, and is a criminal offence sanctioned by fines for breach of data privacy regulations, e.g. unfair collection of personal data is sanctioned by a fine of up to 300.000 EUR and up to five years imprisonment, and by a fine of 1.500.000 EUR for a company. The evidence obtained by the employer through such phone tapping may be declared unlawful and consequently may not be used against the employee in the event of an investigation and in the framework of a disciplinary sanction. Furthermore, the employees concerned could claim damages if their right to privacy has been unlawfully infringed. Moreover, controlling the employee’s use of the work phone by analyzing the telephone company’s bill is legitimate, even if the employee is not previously notified, since the employer is the owner of the telephone line. 5. Amnesty programs

French labor law does not provide for organized amnesty programs whereby the employer may grant amnesty in relation to an employee’s breach/misconduct. 58 The employer remains of course free to decide whether to sanction the employee, making decisions on a case-by-case basis. However, a decision not to sanction 57

Charlot/Dallais/Desoutter/De Guillebon/Lebeau-Marianna

Reemers Publishing Services GmbH O:/Beck/Spehl_Gruetzner/3d/05_France.3d from 06.03.2013 09:26:27 3B2 9.1.580; Page size: 160.00mm  240.00mm

B. Admissibility and implementation of individual measures

151

should be recorded in writing, be detailed and motivated in order to avoid any misunderstandings, in particular any belief, in other employees’ minds, that they will not be sanctioned for similar breaches. The employee in breach must not believe that amnesty has been granted in full and for any breach, past or future. Therefore, the employer must be prudent if it decides not to sanction an employee’s breach or misconduct. Moreover, a specific and historical presidential amnesty exists in France, which is traditionally enacted following the presidential elections (i. e. every 5 years). Under such amnesty, employers generally have to destroy any evidence of disciplinary sanction(s) taken against employees within a certain period of time prior to the amnesty. Such disciplinary sanctions are deemed to have never existed and it is no longer possible to refer to them in the future (for instance as evidence in other disciplinary procedures, in a dismissal process or before a Labor court, etc.). However, this amnesty does not cover many offences. For example, cases of discrimination, harassment or infringement of the employee representatives’ rights (“de´lit d’entrave”) are of course exclusive of any kind of amnesty.8 Moreover, the last presidential amnesty law was adopted in 2002. There was no amnesty granted in 2007 and no amnesty law was adopted for the next presidential elections in 2012. Employers must however be particularly careful when an amnesty is in force, bearing in mind that submission to a court of a sanction which was granted amnesty does not constitute admissible evidence in civil proceedings while it constitutes a criminal offence.

59 60

61

62

II. Must employee representatives such as the works council and the Hygiene and Safety Committee be involved in internal investigations? 1. Works council and Hygiene and Safety Committee’s right to be informed and consulted Art. L. 2323–13 and L. 2323–14 of the French Labor Code require the employer to 63 inform and consult the works council on the means and techniques of control of the employees’ activities, prior to any decision on the implementation of control measures within the company and, in particular, new technologies (in a broad sense) that may have an impact on employment, qualification, remuneration, training or working conditions or a new means of control of the employees. The works council must obtain the relevant information a month before the meeting with the employer. However, the employer may, under certain conditions, not be required to consult 64 and re-consult the Work’s Council if pre-existing techniques of control are modified assuming that the concerned change cannot be considered as a major change. In any case, the question of the re-consultation of the works council should be appreciated on a case by case basis. In addition to first consulting the works council, the employer will also be 65 required to consult the Hygiene and Safety Committee when implementing measures such as, in particular, new technologies or a new means of control of the employees. This is pursuant to Art. L. 4612–8 of the French Labor Code, if the project is likely to impact the employees’ health, in particular mental health. 8

Art. 14 of the Act of August 6, 2004, that provides for the exhaustive list of exclusions.

Charlot/Dallais/Desoutter/De Guillebon/Lebeau-Marianna

Reemers Publishing Services GmbH O:/Beck/Spehl_Gruetzner/3d/05_France.3d from 06.03.2013 09:26:27 3B2 9.1.580; Page size: 160.00mm  240.00mm

152

§ 5. France

In this respect, when implementing a pass or video-surveillance system aimed at securing property and persons within the company, the employer is required to first consult the Hygiene and Safety Committee. 67 The CNIL verifies, when asked to give an opinion or to validate a declaration of automated processing of nominal information for the purpose of control, that such consultations have taken place prior to its being seized; a prerequisite for validating the project of processing declared to the Commission (CNIL Report dated 5 February 2002). 66

2. Sanctions for violation of the Work’s Council and Hygiene and Safety Committee’s rights Failure to comply with the works council’s rights may give rise to criminal and civil sanctions. 69 Indeed, any action by the management likely to hinder the functioning of any of the employee representatives may render the legal representative of the company liable for a maximum fine of up to 3.750 EUR and one-year imprisonment. Companies as legal entities can be liable for a maximum fine of 18.750 EUR. 68

C. Employee interviews I. May an employee refuse to provide information if the information would incriminate him/her? 70

One has to determine whether this information concerns facts relating to professional or extra-professional relations. 1. Providing information relating to the employment relationship

Employees must report to their employer regarding their professional activity. This principle governs the contractual employment relationship. 72 The question whether this obligation goes as far as requiring the employee to report information that could be self-incriminating remains difficult to answer. 73 Unless the employee spontaneously and truthfully provides such information, the employer must take a strong position in order to address the employee’s refusal to self-incriminate. Accordingly, an employer was deemed entitled to dismiss a secretary who prevented access to the company’s computer software, such action having disrupted payment of the employees’ monthly pay.9 74 The line between the private and professional sphere could be at times difficult to draw. For example, it was deemed that an employee who had not advised the employer of his/her new personal address had failed to fulfill his/her obligation to perform the work contract in good faith; the employer was prevented from implementing medical control measures. The dismissal of the employee for a real and serious ground was therefore justified in this situation.10 71

9

French Supreme Court (Labor section), October 11, 2000, n 98-43.655. French Court of Appeal, Metz, April 24, 2001 n 96-3965.

10

Charlot/Dallais/Desoutter/De Guillebon/Lebeau-Marianna

Reemers Publishing Services GmbH O:/Beck/Spehl_Gruetzner/3d/05_France.3d from 06.03.2013 09:26:28 3B2 9.1.580; Page size: 160.00mm  240.00mm

C. Employee interviews

153

Similarly, where an employee lies about his/her position with another employer, 75 there can be a breach of probity and honor which in turn, prevents the continuation of the contractual employment relationship if the misleading information was of significant importance.11 2. Providing information not relating to the employment relationship The employee has, in principle, no obligation to respond to the employer’s questions unrelated to the employment relationship or to communicate with him spontaneously. Indeed, the employer cannot pose questions regarding the employee’s personal life, if not justified by the company’s own purpose and/or the employee’s occupation. For instance, during the recruitment interview: “No information concerning an employee personally or a candidate for a job can be gathered through a device which has not been made aware to the employee or the candidate for the job.”12 Accordingly, an employee may not be liable for answering in bad faith questions regarding personal matters. For example, an employee can go as far as lying to the employer about his/her matrimonial status.13 Obviously, the scope of information to be obtained in the employment relationship may vary depending on the employee’s duties. Therefore, acceptable questions and responses given should be considered on a case-by-case basis. In view of the foregoing, even if employees are not required to disclose personal information, they should, given the general principle of good faith in performing the employment contract, consider providing information which they deem important for the employer.

76

77

78

79

80

II. Is an employee obliged to provide information regarding any misconduct or criminal offence committed by another? Under French law, the employer cannot compel an employee to speak. 81 In addition, the legislator and state courts are particularly keen to promote and 82 protect employees’ freedom of speech. However, denunciation and whistleblowing subject to very stringent conditions 83 are more and more frequent. 1. Reporting For a long period of time, there was no legal regime governing denunciation in 84 labor law. Denunciation has been progressively encouraged within the company, either in the framework of the employee’s freedom of speech, allowing him/her to report on the poor organization of the company,14 or through the employee representatives whose role is to report any violation of the employee’s rights, any 11

French Court of Appeal, December 16, 1997 Nowack c/Silit Werke. Art. L. 1221–9 of the French Labor Code. 13 French Court of Appeal, Nancy, February 6, 2008 n 05–532 Bragard c/Veil. 14 Art. L. 2281–1 to 3 of the French Labor Code; French Supreme Court (Labor section), March 14, 2000, n 97-43.268. 12

Charlot/Dallais/Desoutter/De Guillebon/Lebeau-Marianna

Reemers Publishing Services GmbH O:/Beck/Spehl_Gruetzner/3d/05_France.3d from 06.03.2013 09:26:28 3B2 9.1.580; Page size: 160.00mm  240.00mm

§ 5. France

154

85

86

87 88

89

damage to their physical and mental health, or to individual freedoms within the company. Regarding denunciation from employees more specifically, the French Labor Code provides that employees reporting facts constituting illegal discrimination15 or acts of moral and/or sexual harassment,16 are granted immunity such meaning that they cannot be dismissed for having reported such facts. Similarly, the statute of 13 November 2007 enacted new provisions17 granting the employee immunity “for having narrated or testified in good faith, either to the employer or to judicial or administrative authorities, corruption facts of which he/ she was aware in his/her capacity.” There can by no means be an obligation to report, but simply an encouragement to do so. However, the company should be cautious if it encourages reporting since this could facilitate unfair denunciations which are subject to criminal fines. In addition, denunciation must not be based on a lie made in bad faith. As another illustration, it was deemed that an employee had not committed any breach by reporting to his/her supervisor in good faith, racist language used by the Human Resources Director.18 2. Whistleblowing

In the U.S., the statute of 30 July 2002 known as “Sarbanes-Oxley” required all public companies listed in the New York Stock Exchange and their subsidiaries to implement internal control measures aimed at encouraging employees to report fraud or corruption. 91 In France, this type of alert system is most often implemented as a supplement to internal codes of ethics or to the company’s Internal Regulations (i. e. re`glements inte´rieurs) in which the employer defines certain obligations imposed upon employees towards the company (e.g. discipline). Alert systems may also result from collective bargaining with social partners. 92 Whistleblowing is used in France under numerous conditions. Unlike under U.S. legislation, an employee is not required to report on any facts, even if he/she is aware that they constitute an offence. 93 The protection granted against sanction or discrimination related to a valid denunciation has been seriously criticized since it prevents the person accused from knowing the identity of the person accusing him/her, thereby violating Art. 6–3 of the European Convention of Human Rights. 90

III. May an employee refuse to answer a question if he/she has already answered it during a previous interview? 94

French law does not appear to have contemplated this situation. Therefore, nothing prevents the employee from being asked questions which he/she has 15

Art. L. 1132–3 of the French Labor Code. Arts. L. 1152–2 and L1153-3 of the French Labor Code. 17 Art. L. 1161–1 of the French Labor Code. 18 French Supreme Court (Labor section), November 8, 2006, n 05-41.504. 16

Charlot/Dallais/Desoutter/De Guillebon/Lebeau-Marianna

Reemers Publishing Services GmbH O:/Beck/Spehl_Gruetzner/3d/05_France.3d from 06.03.2013 09:26:28 3B2 9.1.580; Page size: 160.00mm  240.00mm

C. Employee interviews

155

already responded to in a previous interview. It is however recommended to avoid asking the same questions on multiple occasions and/or too often to avoid the risk of the employee claiming against his/her employer any moral harassment. It is also recommended, as of the first interview, to have the employee acknowledge in writing his/her given answers, preferably by way of an affidavit compliant with legal requirements, or to have a transcript of the interview established by means validated and certified by the employee himself/herself.

IV. Is an employee entitled to have a member of the works council or attorney present at an interview? 1. Employee’s right to have an employee representative present (“de´le´gue´ du personnel”) An employee may be assisted by an employee representative only if he/she is 95 interviewed prior to a contemplated dismissal, redundancy or disciplinary sanction.19 Except in those cases previously mentioned, the employer may object to an employee being assisted by an employee representative. This is notably when the employee requests an interview with the employer to make a personal complaint. Similarly, in the case of an external investigation conducted within the company, 96 the employee has no right to be assisted by an employee representative; such assistance being narrowly permitted under French labor law. 2. Employee’s right to have an attorney present to protect his/her rights The assistance of a lawyer within the framework of employee interviews con- 97 ducted as part of investigations on the performance of the employment contract is not clearly prohibited by law. Courts take a position on a case by case basis. An attorney however, is for example not authorized during a pre-dismissal meeting. In the case of external investigations conducted by Public Authorities relating to 98 tortuous or criminal facts, interviews will seldom be held in the workplace. Most often, the employee is summoned by Administrative Authorities as an 99 assisted witness (“te´moin assiste´”) or in the context of police custody (“garde a` vue”). In both instances, the employee may be assisted by an attorney.

V. Is an employee entitled to read the record of his/her interview? Investigators may proceed in this manner, after having advised the auditioned 100 employee and obtained his/her consent to record the interview. The employer is however under no legal obligation to grant the employee’s request to read/hear the record/recording after the interview. However, in the event of a dispute with the employee, negative inferences may be made from the employer’s refusal.

19

Arts. L. 1232–4, L. 1232–2 and L. 1237–12 of the French Labor Code.

Charlot/Dallais/Desoutter/De Guillebon/Lebeau-Marianna

Reemers Publishing Services GmbH O:/Beck/Spehl_Gruetzner/3d/05_France.3d from 06.03.2013 09:26:28 3B2 9.1.580; Page size: 160.00mm  240.00mm

156

§ 5. France

VI. Is the employer entitled to request that the employee sign the interview record? 101

To avoid any later challenge, it would be in the employer’s best interest to have the employee read or listen to the record/recording, so that the latter can subsequently confirm the content in writing. This applies even if the employee’s prior consent to the recording is sufficient and already contains a waiver of the employee’s right to challenge the validity of the record.

VII. Can the employer instruct an employee to treat the content of his/her interview as confidential? 102 103 104

105

106

There is no special rule permitting the employer to request the employee to keep the content of the interview confidential. The employer can however, if the employee accepts, obtain from him/her an express agreement to keep the interview confidential. Furthermore, as a general matter, the employee is subject to a confidentiality obligation within the performance of his/her employment contract covering information related to the company’s activities. This obligation does not cover verbal discussions during an interview with the employer within an internal investigation, unless the questions asked and the responses given are considered to be related to the company’s activities. With reference to the distinction between the private sphere and the professional sphere, it is worth mentioning that the employee is also subject to Art. 368–1 of the French Criminal Code relating to the offence regarding the violation of privacy. However, this offence is deemed to be committed only if (i) there is a recording of the person’s discussion in a private place and without his/her consent, and (ii) the discussion relates to said person’s privacy. Consequently, an employee who has allegedly recorded a discussion held by the employer in the office of the latter during interviews relating to the employee’s redundancy, cannot be prosecuted for violation of the right to privacy insofar as the employer’s discussion related to professional matters.

D. Sanctions imposed on employees I. The absence of an obligation to cooperate in internal investigations under French law French labor law does not provide any obligation regarding any obligation for the employee to cooperate within internal investigations. However, the employees are bound by a general loyalty and good faith obligation. 108 The general rule of “freedom of evidentiary means” (i. e. “liberte´ de la preuve”) applies however under French labor law; notably in labor disputes between an employee and his/her employer. Provided the employee’s rights are not violated, the employer is therefore free to use any evidentiary means, including information 107

Charlot/Dallais/Desoutter/De Guillebon/Lebeau-Marianna

Reemers Publishing Services GmbH O:/Beck/Spehl_Gruetzner/3d/05_France.3d from 06.03.2013 09:26:29 3B2 9.1.580; Page size: 160.00mm  240.00mm

D. Sanctions imposed on employees

157

obtained through internal investigations, to support a dismissal for instance. In this framework, the employee is not subject to any kind of cooperation obligation. However, if the employee does not cooperate in establishing the truth, his/her behavior may be detrimental to him/herself, given that it is also in the employee’s interests to demonstrate that he/she has not committed any breach in performing his/her employment contract and/or taken part in any act of misconduct or illegal action. Accordingly, in a dispute regarding the absence of the employee at work, the employee must prove the employer’s alleged prior consent to this absence.20 In any case, the employer cannot compel an employee to cooperate with internal investigations and there are no French provisions providing for sanctions applicable to an employee for refusing to cooperate. On the contrary, if the employer threatens the employee with sanctions for refusing to cooperate, evidence obtained thereby may be declared unlawful and thus be excluded from judicial proceedings in the same manner as if evidence had been obtained without the employee’s knowledge. Therefore, from a French perspective the main question is not whether sanctions are applicable to employees who refuse to cooperate but rather which sanctions are applicable regarding inaccurate or abusive testimonies.

109

110

111

112

II. What sanctions can be imposed on employees for inaccurate or misleading testimonies? In labor disputes, employees’ testimonies are often used either in support of the 113 employer’s allegations or in support of the employee’s claims. The employer can produce employees’ affidavits made further to an employee’s termination, justifying the grounds raised in the dismissal letter.21 Testimonies in favor of an employee do not constitute grounds for dismissal,22 except if they are abusive. Such witness statements are clearly acceptable provided they are not voluntarily 114 inaccurate (i. e., misleading). French law provides for safeguards regarding the use of witness statements. Thus, 115 witness statements must be produced in the form of affidavits of certification, in accordance with formal requirements, under which, notably, the witness must expressly declare being aware of the fact that in the event of making of false statements, criminal sanctions are applicable.23 The affidavit must be handwritten, dated and signed by the author, who must attach a copy of any documentation proving his/her identity. The affidavit must relate to the disputed facts which the author “witnessed or personally observed”. However, even though the affidavit does not satisfy such formal requirements, French courts may, nonetheless, consider taking it into account under its sovereign power in evaluating facts that have been presented to them.

French Supreme Court (Labor section), June 12, 1986 n 1598, Juris Data: 1986-700408. French Supreme Court (Labor section), May 31, 2006 n 05-43.197. 22 French Supreme Court (Labor section), November 23, 1994 n 1994 Sellem c Labonde, n 9141.434. 23 Art. 202 of the French Civil Procedure Code. 20 21

Charlot/Dallais/Desoutter/De Guillebon/Lebeau-Marianna

Reemers Publishing Services GmbH O:/Beck/Spehl_Gruetzner/3d/05_France.3d from 06.03.2013 09:26:29 3B2 9.1.580; Page size: 160.00mm  240.00mm

§ 5. France

158

III. Is the suspicion of a criminal offence or of several violations of duty sufficient for termination? 1. Suspicion of several violations of duty Before taking any measures, and in particular proceeding with a dismissal, the employer must justify such dismissal on the basis of real and precise facts. Mere doubts are not sufficient and do not constitute legal grounds to justify a fair dismissal. Moreover, since the Act n 89–549 dated August 2, 1989, Art. L. 1235–1 of the French Labor Code provides that, where doubt remains as to the real and serious nature of the grounds to justifying a dismissal, doubt must favor the employee. This provision was upheld by the French Constitutional Supreme Court when asked whether the Act breached the principle of equality of citizens before the law. The Constitutional Supreme Court held that the principle that doubt favors the employee should apply only where it is impossible for the court, after hearing both parties involved in the dispute, to rule in all certainty on the existence of real and serious grounds for dismissal.24 This is a fundamental rule which may be invoked against employers in all disputes brought before French Labor jurisdictions. 117 Suspicion of a violation of duty is therefore insufficient to justify the dismissal of the employee under suspicion. 116

2. Suspicion of a criminal offence 118

119

120

121

122

In the case of suspicion of a criminal offence, the employer must take action in particular if suspicion of harassment. Where the criminal offence has been committed within the employment relationship and/or at the workplace, the employer must seriously consider bringing criminal action so that a final determination is made on. If the dismissal is challenged before the Labor court where a criminal action is pending, the Labor court which will have to make a decision on the basis of the same facts presented to the Criminal court may defer its decision until the latter has made a ruling on the case from a criminal standpoint (“sursis a` statuer”).25 Prior criminal decisions could also bind Labor courts in their assessment of the real and serious nature of the dismissal (“autorite´ de la chose juge´e”). Thus, a criminal judgment finding that the employee did indeed steal from the Company is binding on the Labor court when deciding on whether the dismissal based on theft was justified.26 On the contrary, a decision not to prosecute (“classement sans suite”) or to dismiss a charge (“ordonnance de non-lieu”) does not bind Labor courts in their appreciation of the case. In any case, notwithstanding the Criminal court’s findings on the facts, it does not prevent the Labor court from assessing the seriousness of the breach under the employment contract. Thus, it is within the sovereign power of the court to assess the seriousness of the claim of theft and therefore to hold that the dismissal was based on French Constitutional Supreme Court n 89–25 of July 25, 1989 JO 28 p. 9503. French Supreme Court (Labor section), March 12, 1991 n 989 Sapin c SA Clinique Saint Gre´goire, n 88-45.431. 26 French Supreme Court (Labor section), July 6, 1999 n 3164, n 94-40.882. 24 25

Charlot/Dallais/Desoutter/De Guillebon/Lebeau-Marianna

Reemers Publishing Services GmbH O:/Beck/Spehl_Gruetzner/3d/05_France.3d from 06.03.2013 09:26:29 3B2 9.1.580; Page size: 160.00mm  240.00mm

E. Use of information obtained

159

real and serious grounds but not on gross negligence (“faute grave”) – even after a criminal ruling – taking into consideration the seniority of the employee, the small amount stolen and the satisfaction of his/her supervisors.27 3. What is the statute of limitations period? When the dismissal of an employee is being contemplated, a pre-dismissal meeting must be conducted with the employee, as the first mandatory measure before serving the termination notice. The dismissal process need to be started within a two-month time period.28 The 2-month statute of limitations period starts to run once the employer has become fully informed of all the facts. If internal investigations are made by a committee at the employer’s request, the statute of limitations period starts on the date the investigation report was submitted to the employer.29 It was deemed that, even if the employer knew of certain facts allegedly committed by the employee, the employer was not time-barred until the report revealing the scope and seriousness of the facts had been submitted to him/her at a subsequent date.30 During internal investigations, it is recommended that the employee cooperates with the employer to demonstrate that he/she has not committed the alleged facts or minimize same.

123

124

125

126

E. Use of information obtained I. Is it permissible to disclose the findings and information obtained from an internal investigation to other group companies? 1. Data privacy requirements for sharing internal investigation findings Disclosing information, which contains personal data, obtained during an inter- 127 nal investigation to other group companies is subject to French Data Privacy law requirements. Such disclosure must be justified by the company’s legitimate interest which 128 must not be incompatible with the employee’s interest or fundamental rights or liberties, or by the company’s obligation to comply with applicable law. For example, the disclosure of findings to employees of another company within the group can result from the organization of the group and may therefore be legitimate. In any case, the company’s justified interests must be weighed against the employee’s legitimate interests. If disclosure of the employee’s personal data is not necessary, it is recommended that the employer anonymizes the information if the company’s interests are still protected. French Supreme Court (Labor section), March 3, 2004 n 02–41583 Carrefour c/Le Peru. Art. L. 1332–4 of the French Labor Code. 29 French Supreme Court (Labor section), May 27, 1998 n 2694, n 96-40.871, French Supreme Court (Labor section), June 26, 1994. 30 French Supreme Court (Labor section), October 28, 1997 n 3842, n 94-45.434. 27 28

Charlot/Dallais/Desoutter/De Guillebon/Lebeau-Marianna

Reemers Publishing Services GmbH O:/Beck/Spehl_Gruetzner/3d/05_France.3d from 06.03.2013 09:26:30 3B2 9.1.580; Page size: 160.00mm  240.00mm

160 129

§ 5. France

If disclosure of personal data is justified by the company’s legitimate interest, the company must comply with privacy requirements, such as proportionality of the processing, e.g. only personal data which is necessary for the purpose of the transfer should be disclosed, and any other personal data should be anonymized. Only the appropriate personnel who have a need to know may access the data. Technical and organizational security measures must be implemented in order to ensure data confidentiality. Data must be retained only for the period necessary for the data processing, i. e. for the term of the investigation and proceedings. 2. Transfer of data to other group companies

Any transfer of data to group companies located in countries that do not provide for a sufficient level of data protection, i. e., countries that are located outside the European Union, must observe the following requirements. 131 For data transferred to a Member State of the European Union or of the European Economic Area (EEA), or to a third country with an adequate level of data protection; the same requirements stipulated in supra paras. 127 et seqq. apply as if the data was disclosed to a local recipient. 132 The disclosure of personal data to a company in a third country that does not provide an adequate level of data protection (notably the United States) is subject to the same requirements as previously mentioned in the case of disclosure of data to a local recipient, as long as the recipient has undertaken to comply with the SafeHarbor-Privacy principles or if the sender and the foreign recipient agree on the use of unmodified standard contractual clauses approved by the European Commission and the transfer is based on these clauses. 133 Under the French Data Protection authority’s (CNIL) recommendation n 2009– 474 of July 23, 2009, transfer of data in the context of a US discovery procedure is admitted provided the transfer is a unique and non massive transfer of pertinent and necessary data for the purpose of the recognition, protection or defense of a legal claim of the data controller, and provided the CNIL is notified of the transfer. In case of massive transfers of data, specific safeguards must be implemented (such as a Safe Harbor certification of the recipient in the US, or the conclusion of EC model clauses) and the data controller must obtain the CNIL’s authorization before transferring the data. 130

II. Is it permissible and advisable to forward the findings and information obtained from an internal investigation to Public Authorities? If French Public Authorities, such as the public prosecutor’s office, or a French judge, request the disclosure of data on a legal basis, the company must disclose the data. The Authorities must inform the company of the legal basis or the Authorities must inform the company that disclosure is strictly voluntary. 135 If there is a legal obligation to disclose data, French Data Protection law considers that Public Authorities are deemed authorized recipients of the data. If the data is transferred on a voluntary basis, the same requirements shall apply as in the case of disclosure to third parties as previously mentioned, i. e. the disclosure of personal data to local Authorities is permissible, provided that it is required to safeguard the 134

Charlot/Dallais/Desoutter/De Guillebon/Lebeau-Marianna

Reemers Publishing Services GmbH O:/Beck/Spehl_Gruetzner/3d/05_France.3d from 06.03.2013 09:26:30 3B2 9.1.580; Page size: 160.00mm  240.00mm

E. Use of information obtained

161

company’s justified interests and that there is no reason to assume that the employee’s legitimate interests or fundamental rights or liberties prevail. A company’s justified interests to disclose data to a public authority may take the form of the discovery of violations of the law by one of its employees or imminent measures initiated by a public Authority. For disclosure to foreign Authorities, such as the US Securities and Exchange 136 Commission (SEC) or the US Department of Justice (DoJ), the French Law of 26 July 1968 (also known as the “blocking statute”) relating to the disclosure of documents and information of an economic nature prohibits the disclosure of such information by a French company or by French nationals if it is intended to be provided to a foreign court or authority or if it is likely or even possible that such information could end up in the hands of a foreign Authority. Please refer to our comments under supra para. 10. Pursuant to the 1970 Hague Convention, any information injunction issued by 137 US judiciary or administrative authorities, must be subject to a request for international judicial cooperation filed with the relevant department at the Ministry of Justice. After investigation, the request may be either rejected or transferred to the jurisdiction having geographic competence over its enforcement. A Mutual Assistance Agreement has been signed between the French “Commis- 138 sion des Ope´rations de Bourse” (COB), now “Autorite´ des Marche´s Financiers” (AMF), and the US Securities Exchange Commission (SEC), under which French companies requested by the SEC to disclose information must file a prior information request to the AMF, in order to protect themselves from any subsequent risk of criminal prosecution.

III. Are the findings from internal investigations subject to attorney-client privilege? Legal professional privilege (“secret professionnel”) includes attorney-client privilege law which protects communications between a client and his/her attorney. Unlike external attorneys, in-house counsels conducting or contributing to internal investigations may not refuse to provide evidence in civil or criminal proceedings. Nevertheless, where investigations are conducted by external attorneys31 or auditors,32 the latter are under an obligation of confidentiality, pursuant to which they may refuse to provide evidence in civil and criminal proceedings. In principle, attorney-client privilege is broad enough to prohibit any disclosure at any time. The client cannot release an attorney or legal advisor from the privilege. An attorney must not disclose or share privileged information with any of his/her colleagues, not even in an attempt to protect his/her client’s interests. The law however, provides for two major exceptions. First, privileged information may be disclosed if the attorney is a party to a criminal offence. Second, search of the attorney’s premises is permitted in the case of a flagrant violation of the law. A judge may only search the attorney’s office for purposes of finding the main object of a criminal offence, in which case, however, attorney-client privilege still applies by virtue of mandatory rules of procedure as specified in the French Criminal Code.33 31

Art. 226–13 of the French Criminal Code and Art. 160 of Decree of 27 November 1991. Code of conduct for Auditors. 33 Arts. 56 and 57 of the French Code of Criminal Procedure. 32

Charlot/Dallais/Desoutter/De Guillebon/Lebeau-Marianna

139

140

141

142

Reemers Publishing Services GmbH O:/Beck/Spehl_Gruetzner/3d/05_France.3d from 06.03.2013 09:26:30 3B2 9.1.580; Page size: 160.00mm  240.00mm

162

§ 5. France

IV. Does attorney-client privilege also apply to foreign attorneys? 143

144 145

146

147

148

149

Within the European Union, there are no specific provisions requiring foreign attorneys to comply with French rules of confidentiality applicable to attorneys (e.g. legal professional privilege). Therefore, it is recommended to expressly specify the confidentiality of correspondence between attorneys or with clients. The code of ethical conduct of European bars provides for general principles of good conduct but its provisions are not directly enforceable in France. Therefore, where a French attorney sends correspondence to a foreign attorney who is member of the European Union, he/she must clearly indicate that the correspondence is confidential. Failing to so indicate the confidential nature will result in the correspondence not being regarded as confidential (i. e. privileged).34 Within the European Union, in the absence of any specific rule in this respect, it is appropriate that both parties agree upon clear confidentiality rules to be applied before exchanging any correspondence. With respect to the attorney-client privilege, foreign attorneys are not subject to French Bar rules. Therefore, information gathered in France by foreign attorneys in an investigation of a French company is in principle – subject to applicable foreign bar rules –, unprotected. However, the French Supreme Court (Civil section) very recently ruled that a letter from a Swiss attorney covered by the attorney-client privilege applicable under Swiss Bar rules could not be disclosed within French proceedings.35 The French Supreme Court thus did not refer to French Bar rules but rather to foreign Bar rules. The question whether attorney-client privilege would apply to foreign attorneys would therefore depend on the national Bar rules applicable to the foreign attorney. It is however difficult to predict whether such a solution will be confirmed by the French Supreme Court. In addition, the criminal section of the French Supreme Court could have another position. It is therefore not clear whether the attorney-client privilege would apply to foreign attorneys in case of French criminal investigations. It is therefore recommended to have a French attorney participate in the internal investigations so that the attorney-client privilege provided under the French Bar rules applies.

F. Following-up on internal investigations I. What is to be observed during the follow-up of internal investigations? If, during investigations, poor management is shown, the Board must take any action to prevent future misconduct, and if need be, by sanctioning members of management in default. 151 The employer may also sanction employees for breaching applicable rules, for example, those provided under the French Labor Code as well as Internal Regula150

34 35

Arts. 5-3-1 et 5-3-2 of the European Bars Code of conduct. French Supreme Court, February 5, 2009, n 07-17.525.

Charlot/Dallais/Desoutter/De Guillebon/Lebeau-Marianna

Reemers Publishing Services GmbH O:/Beck/Spehl_Gruetzner/3d/05_France.3d from 06.03.2013 09:26:30 3B2 9.1.580; Page size: 160.00mm  240.00mm

G. Summary of key results

163

tions of the company. However,36 fines and other pecuniary sanctions are strictly prohibited. Any provision to the contrary is deemed to not exist (“re´pute´e non ´ecrite”). This is a general prohibition applying to deductions on the employee’s salary by reason of his/her breach or intentional poor performance of the employment contract. Violation of this general prohibition is subject to criminal sanctions: a fine of 3.750 EUR, increased to 7.500 EUR for second offences.37

II. May an employer pay its employee’s legal fees if he/she is being prosecuted under criminal law? Given his/her statutorily-conferred powers of direction and control over emplo- 152 yees as legal subordinates, the employer is required to guarantee any acts made or committed within the performance of the employment contract. Therefore, the employer must bear attorney’s fees and legal costs incurred by the employee when faced by a criminal action brought by a customer of the employer.38

G. Summary of key results 1. If companies have reason to suspect that material breaches of duties or criminal offences are being or have been committed, management should launch internal investigations in order to avoid any further damage for the company or the members of its management. 2. Prior to conducting individual measures within the scope of internal investigations, the employer must carefully verify or have a third party verify whether and to which extent these individual measures are actually permitted. Generally, limitations under Criminal, Labor and Data Protection law must be observed. 3. Notwithstanding the fact that it is generally in their best interest, employees are not obliged to actively cooperate in internal investigations. They are however, required to report to the employer about their professional activities within the performance of the employment contract, and failing which, are subject to disciplinary sanctions. 4. If there is no legal obligation to disclose the findings made in the scope of the internal investigations, it must be carefully examined whether the disclosure of these findings to other group companies and Public Authorities is in fact admissible in particular when it the group companies and authorities are in foreign jurisdictions. 36

Art. L. 1331–2 of the French Labor Code. Art. L.1334-1 of the French Labor Code. 38 Art. 1135 of the French Civil Code and French Supreme Court (Labor Section), October 18, 2006 n 04–48612). 37

Charlot/Dallais/Desoutter/De Guillebon/Lebeau-Marianna

Reemers Publishing Services GmbH O:/Beck/Spehl_Gruetzner/3d/05_France.3d from 06.03.2013 09:26:31 3B2 9.1.580; Page size: 160.00mm  240.00mm

Reemers Publishing Services GmbH O:/Beck/Spehl_Gruetzner/3d/06_Deutschland.3d from 06.03.2013 09:27:51 3B2 9.1.580; Page size: 160.00mm  240.00mm

§ 6. Germany Para. A. Introduction . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 1 B. The 25 key questions in connection with internal investigations . . . . 3 I. Initiation of internal investigations . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 3 1. When and to what extent should internal investigations be initiated? . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 3 2. Should internal investigations be of an open or covert nature? . . . . . 13 3. Is it advisable to involve external investigators? . . . . . . . . . . . . . . . . . . . . 16 4. Are foreign attorneys permitted to conduct internal investigations in Germany? . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 19 5. When should public authorities be called in? . . . . . . . . . . . . . . . . . . . . . . . 20 II. Admissibility and implementation of individual measures within the scope of internal investigations . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 21 1. What measures are admissible within the scope of internal investigations? . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 21 a) Requirements for admissibility under the BDSG . . . . . . . . . . . . . . . . 24 b) Employee interviews . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 43 c) Screening of email log files and email content . . . . . . . . . . . . . . . . . . . 46 aa) Differentiation of email log files and email content . . . . . . . . . 47 bb) Differentiation between exclusive official business use and (also) private use . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 49 cc) Aspects to consider . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 55 dd) Practical considerations . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 56 d) Data screening/data mining . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 57 e) Handover, inspection and processing of files, letters and documents of employees . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 61 f) Handover, and “mirroring” of the computer . . . . . . . . . . . . . . . . . . . . 63 g) Inspection of the personnel files of employees . . . . . . . . . . . . . . . . . . . 66 h) Video surveillance of employees . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 70 aa) Admissibility of open surveillance on publicly accessible premises . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 71 bb) Admissibility of covert surveillance on publicly accessible premises . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 74 cc) Admissibility of open surveillance on not publicly accessible premises . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 75 dd) Admissibility of secret surveillance on not publicly accessible premises . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 78 i) Telephone surveillance . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 80 j) Search of the workplace . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 84 k) Covert listening in on conversations (other than telephone conversations) on the business premises . . . . . . . . . . . . . . . . . . . . . . . . . 85 l) Investigations carried out in the surroundings of employees under suspicion . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 86 m) “Mock investigations” . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 87 n) Side Note: Amnesty programs . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 88 2. Must employee representatives such as the works council be involved in internal investigations? . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 95 a) The works council’s rights of co-determination and information 96 b) The works council’s rights regarding individual measures . . . . . . . 100 aa) Employee Interviews . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 100 bb) Monitoring, copying and processing of documents and emails . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 103

Spehl/Gru¨tzner

Reemers Publishing Services GmbH O:/Beck/Spehl_Gruetzner/3d/06_Deutschland.3d from 06.03.2013 09:27:51 3B2 9.1.580; Page size: 160.00mm  240.00mm

166

§ 6. Germany Para. cc) Data screening/data mining . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 107 dd) Surveillance measures . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 108 ee) Search of the workplace . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 109 ff) Investigations carried out in the surroundings of employees 110 gg) Amnesty programs . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 111 c) Consequences if rights of co-determination are not observed . . . 112 3. Overview . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 113 III. Employee interviews . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 114 1. May an employee refuse to provide information if this information would incriminate himself/herself? . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 114 a) Duty to provide information on the tasks directly assigned to the employee or carried out by the employee . . . . . . . . . . . . . . . . . . . . . . . . 115 b) Duty to provide information in indirect connection with the scope of work . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 117 c) Duty to provide information outside the scope of work . . . . . . . . . 118 d) Transfer of information to authorities if employee is obliged to incriminate himself/herself . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 119 2. Is an employee obliged to provide information on any misconduct on behalf of criminal offences committed by other employees? . . . . 120 3. May an employee refuse to answer a question if he/she has already answered it within the scope of a previous interview? . . . . . . . . . . . . . . 121 4. Is an employee entitled to the presence of a member of the works council or an attorney during an interview? . . . . . . . . . . . . . . . . . . . . . . . . 124 a) The employee’s right to the presence of a member of the works council . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 124 b) The employee’s right to the presence of an attorney representing the employee’s rights . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 127 5. Is an employee entitled to read the record of his/her interview? . . . . 130 6. Is the employer entitled to have the employee sign the record of his/her interview? . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 131 7. Can the employer instruct an employee to treat the content of his/ her interview as confidential? . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 132 IV. Sanctions imposed on employees . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 136 1. What are the sanctions under employment law that can be imposed on employees refusing to cooperate in internal investigations? . . . . . 136 a) Retention or reduction of remuneration . . . . . . . . . . . . . . . . . . . . . . . . . 137 b) Warning letter and termination . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 139 2. Is the suspicion of a criminal offence or of a severe violation of duty sufficient for giving extraordinary notice of termination? . . . . . . . . . . 141 3. During which period of time must extraordinary notice of termination be given to employees whose misconduct has been revealed by the internal investigations? . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 143 4. Must an employee cooperate in internal investigations even after he/she has been given notice of termination? . . . . . . . . . . . . . . . . . . . . . . . 145 V. Use of the obtained information . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 148 1. Is it permissible under data protection law to transfer the findings and information obtained within the scope of internal investigations to other group companies? . . . . . . . . . . . . . . . . . . . . . . . . . . . 148 2. Is it permissible and advisable to transfer the findings and information obtained within the scope of internal investigations to public authorities? . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 157 a) Admissibility of transfer of personal data . . . . . . . . . . . . . . . . . . . . . . . . 157 b) Is it advisable to voluntarily transfer data to public authorities? . 160 3. Are the findings made in the scope of internal investigations subject to the attorney-client privilege? . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 164 a) No attorney-client privilege for in-house counsel involved in the investigations . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 164

Spehl/Gru¨tzner

Reemers Publishing Services GmbH O:/Beck/Spehl_Gruetzner/3d/06_Deutschland.3d from 06.03.2013 09:27:52 3B2 9.1.580; Page size: 160.00mm  240.00mm

§ 6. Germany

167

Para. b) Privileges of external investigators? . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 165 4. Does the attorney-client privilege also apply to foreign attorneys? . . . 169 VI. Following-up on internal investigations . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 170 1. What is to be observed during the follow-up of internal investigations? . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 170 2. May an employer pay its employee’s legal fees if he/she is being prosecuted under criminal law? . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 175 C. Summary of key results . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 176 Bibliography: Achenbach/Ransiek, Handbuch Wirtschaftsstrafrecht, 3rd ed. (2011); Annuß/Pelz, Amnestieprogramme – Fluch oder Segen?, BB Special 4 (relating to BB 2010, issue 50), 14; Barton, ¨ bung und private Nutzung des Internetarbeitsplatzes, “Arbeitsrechtliche AlternatiBetriebliche U ven” zur Wiedereinfu¨hrung der alleinigen dienstlichen Verwendung, NZA 2006, 460; Baumbach/ Lauterbach/Albers/Hartmann, Kommentar ZPO, 70th ed. (2011); Bayreuther, Videou¨berwachung am Arbeitsplatz, NZA 2005, 1038; Beckschulze, Internet-, Intranet- und E-Mail-Einsatz am Arbeitsplatz, DB 2007, 1526; Beckschulze/Henkel, Der Einfluss des Internets auf das Arbeitsrecht, DB 2001, 1491; Behrendt/Kaufmann, Whistleblowing-Hotlines aus arbeits- und datenschutzrechtlicher Sicht – Lo¨sungswege im Unternehmen, CR 2006, 642; Behrens, Internal Investigations: Hintergru¨nde und Perspektiven anwaltlicher “Ermittlungen” in deutschen Unternehmen, RIW 2009, 22; Bo¨hm, Strafrechtliche Verwertbarkeit der Ausku¨nfte von Arbeitnehmern bei unternehmensinternen Untersuchungen, WM 2009, 1923; Bohnert, Kommentar OWiG, 3rd ed. (2010); Breßler/Kuhnke/ Schulz/Stein, Inhalte und Grenzen von Amnestien bei Internal Investigations, NZG 2009, 721; Bru¨ckner, Die Aufarbeitung von Compliance-Versto¨ßen – Praktische Erfahrungen und Fallstricke, BB Special 4 (relating to BB 2010, issue 50), 21; Dahns, Das Berufsgeheimnis von Syndikusanwa¨lten in Europa, NJW-Spezial 2007, 526; Dann/Schmidt, Im Wu¨rgegriff der SEC? Mitarbeiterbefragungen und die Selbstbelastungsfreiheit, NJW 2009, 1851; Da¨ubler, Internet und Arbeitsrecht, 3rd ed. (2004); Da¨ubler, Das neue Bundesdatenschutzgesetz und seine Auswirkungen im Arbeitsrecht, NZA 2001, 874; de Wolf, Kollidierende Pflichten: zwischen Schutz von E-Mails und “Compliance” im Unternehmen, NZA 2010, 1206; Deutsch/Diller, Die geplante Neuregelung des Arbeitnehmerdatenschutzes in § 32 BDSG, DB 2009, 1462; Diller, Der Arbeitnehmer als Informant, Handlanger und Zeuge im Prozess des Arbeitgebers gegen Dritte, DB 2004, 313; Diller, “Konten-Ausspa¨hSkandal” bei der Deutschen Bahn – Wo ist das Problem?, BB 2009, 438; Do¨lling, Handbuch Korruptionspra¨vention, 2nd ed. (2007); Erbs/Kohlhaas, Strafrechtliche Nebengesetze, ed. June 2011; Erfurter Kommentar Arbeitsrecht, 10th ed. (2010); Erfurth, Der “neue” Arbeitnehmerdatenschutz im BDSG, NJOZ 2009, 2914; Erman, Kommentar BGB, 13th ed. (2011); Go¨hler, Kommentar OWiG, 15th ed. (2009); Gola, Die Einwilligung als Legitimation fu¨r die Verarbeitung von Arbeitnehmerdaten, RDV 2009, 109; Gola/Schomerus, Bundesdatenschutzgesetz Kommentar, 9th ed. (2007); Gola/Wronka, Handbuch zum Arbeitnehmerdatenschutz, 5th ed. (2009); Go¨pfert/ Merten/Siegrist, Mitarbeiter als “Wissenstra¨ger” – Ein Beitrag zur aktuellen Compliance-Diskussion, NJW 2008, 1703; Grimm/Schiefer, Videou¨berwachung am Arbeitsplatz, RdA 2009, 329; Gru¨tzner/Jakob, Compliance A-Z, 2010; Hauschka, Corporate Compliance, 2nd ed. (2010); Haußmann/Krets, EDV-Betriebsvereinbarungen im Praxistest, NZA 2005, 259; Heinson, Compliance durch Datenabgleich, BB 2010, 3084; Heldmann, Betrugs- und Korruptionsbeka¨mpfung zur Herstellung von Compliance, DB 2010, 1235; Hoeren/Sieber, Handbuch Multimedia-Recht, last updated 12/2011; Hoppe/Braun, Arbeitnehmer-E-Mails: Vertrauen ist gut – Kontrolle ist schlecht – Auswirkungen der neuesten Rechtsprechung des BVerfG auf das Arbeitsverha¨ltnis, MMR 2010, 80; Hromadka, Das allgemeine Weisungsrecht, DB 1995, 2601; Jahn, Ermittlungen in Sachen Siemens/ SEC, Legitimer Baustein des globalisierten Wirtschaftsstrafverfahrens oder rechtswidriges Parallelverfahren zur Strafprozessordnung? – Eine Problemskizze, StV 2009, 41; Karlsruher Kommentar zum OWiG, 3rd ed. (2006); Karlsruher Kommentar zur StPO, 6th ed. (2008); Klengel/Mu¨ckenberger, Internal Investigations – typische Rechts- und Praxisprobleme unternehmerinterner Ermittlungen, CCZ 2009, 81; Kock/Francke, Mitarbeiterkontrolle durch systematischen Datenabgleich zur Korruptionsbeka¨mpfung, NZA 2009, 646; Kopke, Heimliches Mitho¨renlassen eines Telefongespra¨chs, NZA 1999, 917; Krieger/Schneider, Handbuch Managerhaftung, 2007; Ku¨ttner, Personalbuch, 19th ed. (2012); Lange/Vogel, Verdachtsku¨ndigung: Teilnahmerecht des Rechtsanwalts an der Anho¨rung, DB 2010, 1066; Leupold/Glossner, Mu¨nchener Anwaltshandbuch IT-Recht, 2nd ed. (2011); Lomas/Kramer, Corporate Internal Investigations, 2008; Lunk, Prozessuale Verwertungs-

Spehl/Gru¨tzner

Reemers Publishing Services GmbH O:/Beck/Spehl_Gruetzner/3d/06_Deutschland.3d from 06.03.2013 09:27:52 3B2 9.1.580; Page size: 160.00mm  240.00mm

168

§ 6. Germany

verbote im Arbeitsrecht, NZA 2009, 457; Lu¨tzeler/Mu¨ller-Sartori, Die Befragung des Arbeitnehmers – Auskunftspflicht oder Zeugnisverweigerungsrecht?, CCZ 2011, 19; Ma¨hner, Neuregelung des § 32 BDSG zur Nutzung personenbezogener Mitarbeiterdaten am Beispiel der Deutschen Bahn AG, MMR 2010, 379; Maschmann, Zuverla¨ssigkeitstests durch Verfu¨hrung illoyaler Mitarbeiter?, NZA 2002, 13; Mengel, Compliance und Arbeitsrecht (2009); Mengel, Arbeitsrechtliche Besonderheiten der Implementierung von Compliance-Programmen in internationalen Konzernen, CCZ 2008, 85; Mengel/Ullrich, Arbeitsrechtliche Aspekte unternehmensinterner Investigations, NZA 2006, 240; Meyer-Goßner, Kommentar StPO, 55th ed (2012); Momsen, Internal Investigations zwischen arbeitsrechtlicher Mitwirkungspflicht und strafprozessualer Selbstbelastungsfreiheit, ZIS 2011, 508; Momsen/Gru¨tzner, Verfahrensregeln fu¨r interne Ermittlungen, BD 2011, 1792; Mu¨ller-Bonanni, Arbeitsrecht und Compliance – Hinweise fu¨r die Praxis, AnwBl 2010, 651; Mu¨nchener Anwaltshandbuch Verteidigung in Wirtschafts- und Steuerstrafsachen (2006); Mu¨nchener Handbuch zum Arbeitsrecht, volume 1, 2nd ed. (2000); Mu¨nchener Kommentar zum BGB, volume 4, 5th ed. (2009); Mu¨nchener Kommentar zur ZPO, 3rd ed. (2008); Palandt, BGB Kommentar, 71st ed. (2012); Pfeiffer, Kommentar StPO, 5th ed. (2007); Richardi, Betriebsverfassungsgesetz, 13th ed. (2012); Richters/Wodtke, Schutz von Betriebsgeheimnissen aus Unternehmenssicht – “Verhinderung von Know-how Abfluss durch eigene Mitarbeiter”, NZA-RR 2003, 281; Rieble, Schuldrechtliche Zeugenpflicht von Mitarbeitern, ZIP 2003, 1273; Salvenmoser/Hauschka, Korruption, Datenschutz und Compliance, NJW 2010, 331; Schaar, Datenschutzrechtliche Einwilligung im Internet, MMR 2001, 644; Schaffland/Wiltfang, Bundesdatenschutzgesetz Kommentar, update 2/09; Schaub, Arbeitsrechts-Handbuch, 14th ed. (2011); Scheben/Klos/Geschonneck, Evidence and Disclosure Management (EDM) – Eine (datenschutz-)rechtliche Analyse, CCZ 2012, 13; Schimmelpfennig/Wenning, Eingeschra¨nkter Zugriff auf elektronische Gescha¨ftskorrespondenz bei zugelassener Privatnutzung von E-Mail und Internet am Arbeitsplatz, DB 2006, 2290; Schmidl, Rechtma¨ßigkeit internationaler Datentransfers, Information Security Management, 2007; Schneider, Investigative Maßnahmen und Informationsweitergabe im konzernfreien Unternehmen und im Konzern, NZG 2010, 1201; Scho¨ttler, Schutz von E-Mail-Daten durch das Fernmeldegeheimnis, jurisPR-ITR 4/2009, annotation 2; Schu¨rrle/Olbers, Praktische Hinweise zu Rechtsfragen bei eigenen Untersuchungen im Unternehmen, CCZ 2010, 178; Seitz, Der Vertraulichkeitsschutz der Anwaltskorrespondenz im europa¨ischen Wettbewerbsverfahren – Zu Umfang und Ausgestaltung des Anwaltsgeheimnisses nach der neuen europa¨ischen Rechtsprechung, EuZW 2008, 204; Simitis, Bundesdatenschutzgesetz Kommentar, 6th ed. (2006); Spehl, Rezension zu Wolf-Tassilo Bo¨hm, Non-Compliance und Arbeitsrecht, Interne Ermittlungen, Sanktionen und Regressanspru¨che nach Rechts- und Regelversto¨ßen von Arbeitnehmern, CCZ 6/2011, VIII; Spindler/Stilz, Kommentar zum Aktiengesetz (2007); Steinku¨hler, BB-Forum: Kein Datenproblem bei der Deutschen Bahn? Mitnichten!, BB 2009, 1294; Stu¨ck, Rechtliche Aspekte kritischer Personalgespra¨che, DB 2007, 1137; Thu¨sing, Arbeitnehmerdatenschutz und Compliance (2010); Thu¨sing, Datenschutz im Arbeitsverha¨ltnis – Kritische Gedanken zum neuen § 32 BDSG, NZA 2009, 865; Trittin/Fischer, Datenschutz und Mitbestimmung, NZA 2009, 343; Tscho¨pe, Anwalts-Handbuch Arbeitsrecht, 7th ed. (2011); Vogel/Glas, Datenschutzrechtliche Probleme unternehmensinterner Ermittlungen, DB 2009, 1747; Vogt, Compliance und Investigations – Zehn Fragen aus Sicht der arbeitsrechtlichen Praxis, NJOZ 2009, 4206; von Rosen, Internal Investigations bei Complianceversto¨ßen, Praxisleitfaden fu¨r die Unternehmensleitung (2010); von Rosen, Rechtskollision durch grenzu¨berschreitende Sonderermittlungen, BB 2009, 230; ¨ bung?, NZA 2007, 529; Waltermann, Anspruch auf private Internetnutzung durch betriebliche U Wastl/Litzka/Pusch, SEC-Ermittlungen in Deutschland – eine Umgehung rechtsstaatlicher Mindeststandards!, NStZ 2009, 68; Wastl/Pusch, Haftungsrechtliche Konsequenzen einer so genannten Mitarbeiter-Amnestie – dargestellt am Beispiel “Siemens”, RdA 2009, 376; Weißgerber, Das Einsehen kennwortgeschu¨tzter Privatdaten des Arbeitnehmers durch den Arbeitgeber, NZA 2003, 1005; Wellho¨ner/Byers, Datzenschutz im Betrieb – allta¨gliche Herausforderung fu¨r den Arbeitgeber?, BB 2009, 2310; Wisskirchen/Jordan/Bissels, Arbeitsrechtliche Probleme bei der Einfu¨hrung internationaler Verhaltens- und Ethikrichtlinien (Codes of Conduct/Codes of Ethics), DB 2005, ¨ berwachung von E-Mail-Korrespondenz am Arbeitsplatz, 2190; Wolf/Mulert, Die Zula¨ssigkeit der U BB 2008, 442; Wybitul, Wie viel Arbeitnehmerdatenschutz ist “erforderlich”? BB 2010, 1085; Wybitul/Bo¨hm, Beteiligung des Betriebsrats bei Ermittlungen durch Unternehmen, RdA 2011, 362; Zimmer/Heymann, Beteiligungsrecht des Betriebsrats bei unternehmensinternen Ermittlungen, BB 2010, 1853; Zimmer/Stetter, Korruption und Arbeitsrecht, BB 2006, 1445; Zo¨ller, ZPO, 29th ed. (2012).

Spehl/Gru¨tzner

Reemers Publishing Services GmbH O:/Beck/Spehl_Gruetzner/3d/06_Deutschland.3d from 06.03.2013 09:27:52 3B2 9.1.580; Page size: 160.00mm  240.00mm

B. The 25 key questions in connection with internal investigations

169

A. Introduction Over the past few years, various cases of companies that have violated anti-trust, 1 anti-bribery, export control or embargo-related legislation have gone public. It may well be that the management was aware of the corresponding practices or even acted itself in the majority of cases. It is, however, also perceivable that key employees were at the root of these activities without management knowledge or support. For the companies concerned, the outcome may be the same. In cases where employees acted on their own initiative, a company’s management might not be responsible at all. It is equally serious, however, if a company’s management is criticized for not being able to control its key personnel. In both of these exemplary constellations, i. e. where violations are committed by a company’s management or by insufficiently controlled key personnel, the company itself might risk being investigated by law enforcement authorities. Faced with the potential threat of an intrusive government investigation or other investigators disrupting business operations trying to find evidence on the company’s premises, more and more companies have instituted prophylactic compliance programs. The idea behind such programs is very straightforward: The company faces less financial and immaterial damage if illegal, potentially damaging activities are discovered internally and stopped in a discrete manner than if the discovery takes place as a consequence of law enforcement activities and thus becomes publicly known. This reasoning constitutes the main impetus for internal investigations which 2 aim at the timely discovery of general non-compliance and in particular illegal conduct as described above. The stringency with which such internal audits are carried out is dictated by the actual level of suspicion that wrongdoing has occurred. No matter how urgent the investigation may be perceived, from a legal point of view it is advisable to carefully prepare for the internal investigation. Such preparation does not need to be overly time-consuming. The following section deals with the 25 most frequently asked questions in the context of internal investigations. The questions and answers are listed in chronological order, starting with the first steps to take when preparing for an internal investigation.

B. The 25 key questions in connection with internal investigations I. Initiation of internal investigations 1. When and to what extent should internal investigations be initiated? a) The main purpose of internal investigations is to uncover wrongdoings within a 3 company1 and, by means of rectifying such wrongdoings, to avert or limit further damage to the company. In detail: 1 To the extent that the external relationship with public authorities or third parties is concerned, the company is hereinafter referred to as the “company”. To the extent that the employment relationship between an employee and his/her company is concerned, the company will be referred to as “employer”.

Spehl/Gru¨tzner

Reemers Publishing Services GmbH O:/Beck/Spehl_Gruetzner/3d/06_Deutschland.3d from 06.03.2013 09:27:52 3B2 9.1.580; Page size: 160.00mm  240.00mm

170

§ 6. Germany

4 aa) If the misconduct of employees or the management becomes publicly known,

confidence in the company will decline and the reputation of the company or individual brands of the company will suffer. By means of internal investigations, the company can regain impaired or lost confidence of the public, customers and business partners.2 5 bb) A company’s management must demonstrate vis-a`-vis its own employees that

it will not tolerate any misconduct. Internal investigations are the most suitable measure to make it clear to the employees that the company intends to uncover any misconduct and impose sanctions in case of any violations (“zero tolerance”).3 6 cc) Internal investigations serve to identify weaknesses within the company and

remove them once and for all. An efficient control mechanism is important for a company to avoid that employees violate any laws and prevent that the management and the company have to bear the corresponding sanctions.4 7 In cases of breach of trust (§ 266 StGB) or breaches of administrative duties, such sanctions can be imposed directly on the company’s representative bodies (e.g. the managing board etc.) or other company individuals. In addition, a company official can be hold accountable due to a violation of his/her obligatory supervision according to § 130 OWiG (= Ordnungswidrigkeitengesetz = Administrative Offenses Act). 8 There is no criminal liability for legal entities and therefore for companies under German law. However, administrative monetary fines can be imposed directly on legal entities and thus also on companies. This is the case, if a company representative or representative body commits a criminal or administrative offence and the company hereby breaches a company duty or profits in an illegal manner (§ 30 OWiG). If a company representative’s violation of obligatory supervision occurs, this breach of duty can be attributed to the company, whereby a monetary fine can be imposed on the company under these circumstances as well (§ 130 OWiG). 9 Moreover, in cases of criminal or administrative law violations by employees/ representatives of the company, a court can order the forfeiture “of the acquired something” (§§ 73, 73 a StGB, § 29 a OWiG) against the company, meaning that the company has to release all assets resulting from the commission of the unlawful act. 10 b) It depends on the circumstances of the individual case at what point in time the

management must initiate internal investigations.5 The management is obliged to intervene if, otherwise, it violates its supervisory obligation. Due to its supervisory and control obligation, the management board of a stock corporation and the management of a limited liability company, for instance, must look into any indications of violations of law or of obligations by employees without undue 2 Salvenmoser/Schreier, in: Achenbach/Ransiek, Handbuch Wirtschaftsstrafrecht, chapter XV, para. 15; Kremer/Klahold, in: Krieger/Schneider, Handbuch Managerhaftung, § 18, para. 6, Behrens, RIW 2009, 22, 32; Gerst, CCZ 2012, 1,2. 3 Salvenmoser/Schreier, in: Achenbach/Ransiek, Handbuch Wirtschaftsstrafrecht, chapter XV, para. 15. Regarding the term “zero tolerance”, cf. Gru¨tzner/Jakob, Compliance A-Z, p. 158. 4 Gerst, CCZ 2012, 1, 2. 5 According to Gerst, CCZ 2012, 1, 2 internal investigations are often initiated due to transnational governmental investigations, for instance such investigations of the American Securities and Exchange Commission (SEC).

Spehl/Gru¨tzner

Reemers Publishing Services GmbH O:/Beck/Spehl_Gruetzner/3d/06_Deutschland.3d from 06.03.2013 09:27:53 3B2 9.1.580; Page size: 160.00mm  240.00mm

B. The 25 key questions in connection with internal investigations

171

delay.6 In case of concrete evidence of misconduct or suspected irregularities due to past controls, the management must carry out or have carried out a comprehensive and thorough examination and take precautions against further violations of law.7 If such evidence or suspicion exists, the management must decide on the appropriate measures to be taken to clarify and put an end to the violations of law. The management has a certain scope of discretion when making this decision. It knows the company and its business processes and can best assess which measures might prove successful. This scope of discretion ends where, due to their intensity, complexity and scope, suspected violations of law can only be fully clarified with the help of an internal investigation and no longer with the help of other, less drastic measures such as talks with superiors. c) If the management has decided to conduct an internal investigation, the necessary 11 content and scope of the internal investigation shall also be determined at the management’s discretion. When deciding on the content and scope of the internal investigation, however, the management should take into account its obligation to examine any breaches of duties with the given diligence and depth.8 In this context, the fulfillment of the supervisory obligations, the failure of which constitutes an administrative offence, serves only as a minimum limit because a breach of management duties is also conceivable below the administrative offence threshold. Another factor to consider in this context is the negative consequences the company and the management would have to face if the management conducted internal investigations proved to be insufficient. If the internal investigations do not cover the entire scope of the wrongdoings, business partners and the public might have the impression that everything is alright. The employees whose misconduct remains unrevealed will feel confirmed in their actions. If official investigations reveal the wrongdoings at a later point in time, the accusations against the management can be much more severe because this quickly creates the impression that the management wanted to cover up (known) wrongdoings in the past. Considering the above, internal investigations can be conducted against indivi- 12 dual persons or individual departments if suspicious facts only point to individual employees or an individual department, e.g. the purchasing department. If it is suspected that there are more widespread wrongdoings or even criminal structures within the company, comprehensive internal investigations extending beyond individual departments and divisions or – in view of the possible responsibility under group law – even group-wide internal investigations are recommended.9 2. Should internal investigations be of an open or covert nature? a) If suspicions arise within a company that employees have misappropriated funds 13 or have given or taken bribes, the internal investigations should initially be 6 BGH GmbHR 1985, 143, 144; OLG Celle, decision of February 24, 1987, file no. 2 Ss (OWi) 342/ 86, (juris); Fleischer, in: Spindler/Stilz, AktG, § 93, para. 97; Behrens, RIW 2009, 22, 29. 7 OLG Koblenz ZIP 1991, 870, 871; OLG Celle, decision of February 24, 1987, file no. 2 Ss (OWi) 342/86, (juris). 8 OLG Koblenz ZIP 1991, 870, 871; OLG Celle, decision of February 24, 1987, file no. 2 Ss (OWi) 342/86, (juris). 9 Lampert, in: Hauschka, Corporate Compliance, § 9, para. 33.

Spehl/Gru¨tzner

Reemers Publishing Services GmbH O:/Beck/Spehl_Gruetzner/3d/06_Deutschland.3d from 06.03.2013 09:27:53 3B2 9.1.580; Page size: 160.00mm  240.00mm

172

§ 6. Germany

conducted in a covert manner. Only by means of covert investigations can the potential offenders be identified and comprehensive information gathered without risking that the offenders cover up their actions and destroy evidence.10 Covert investigations help to identify not yet known accomplices. 14 b) Open communication is necessary if there are already rumors that internal

investigations are being conducted within the company or if public authorities have already conducted initial investigations. Before a company makes the internal investigations public, the management must always verify in each individual case whether the advantages of open communication outweigh the risks that employees will try to conceal their actions in breach of their duties or their criminal offences, as applicable.11 15 c) Depending on how much information is available already at the beginning of the

internal investigations, the internal investigations can be conducted covertly at first, then half-covertly and finally openly. 3. Is it advisable to involve external investigators? 16 a) Whether a company should involve internal or external investigators for the

internal investigations depends on the specific circumstances, the affected company and the suspected violations of law.12 17 b) Lower costs, in particular, are an argument in favor of internal investigators,

such as the legal department or the internal auditing department. In addition, internal investigators are more familiar with the business activity, interrelations and the business processes within the company as compared to external investigators. If only vague suspicions exist at the beginning of an investigation, there is the risk that the involved internal investigators lack the necessary distance to the accusations.13 For internal investigators, a thorough investigation of accusations could be problematic if, in case the accusations prove to be unfounded, internal investigators have to continue working together with the accused employees or if there are certain compunctions due to a long-time cooperation. 18 c) An argument in favor of the involvement of external investigators, such as

attorneys or auditors, lies in the fact that external investigators are specialized in conducting internal investigations. They have the necessary personnel and professional expertise to ensure a prompt and comprehensive resolution of the suspected violations of law14 and to make legal evaluations arising in the course of the internal investigations. Only external investigators enjoy special privileges. External attorneys and auditors have a right to refuse to give evidence in an ongoing lawsuit (Zeugnisverweigerungsrecht). As a matter of principle, law enforcement and anti10

Cf. Klengel/Mu¨ckenberger, CCZ 2009, 81, 82. Klengel/Mu¨ckenberger, CCZ 2009, 81, 82. 12 Behrens, RIW 2009, 22, 32. 13 Bru ¨ ckner, BB Special 4 (relating to BB 2010, issue 50), 21, 23. 14 Kremer/Klahold, in: Krieger/Schneider, Handbuch Managerhaftung, § 18, para. 50; Lomas/ Kramer, Corporate Internal Investigations, para. 6.74. 11

Spehl/Gru¨tzner

Reemers Publishing Services GmbH O:/Beck/Spehl_Gruetzner/3d/06_Deutschland.3d from 06.03.2013 09:27:53 3B2 9.1.580; Page size: 160.00mm  240.00mm

B. The 25 key questions in connection with internal investigations

173

trust authorities may not seize their client-related records.15 However, in investigative proceedings against employees of the company these records are seized because, as a general rule, the prohibition of seizure only applies in favor of the company retaining the respective attorney or auditor and does not automatically extend to investigative proceedings against members of the company whose misconduct is to be revealed in the internal investigations.16 In most cases, public authorities, shareholders and the public consider internal investigations conducted by external investigators to be more credible.17 In particular if the accusations made include the management, the involvement of external investigators demonstrates a stronger determination of the company to resolve the matter.18 For the same reason, if the management decides to involve external investigators, it may be recommendable to select a law firm or an audit firm so far not significantly involved in the matters of the company.19 4. Are foreign attorneys permitted to conduct internal investigations in Germany? Foreign attorneys may conduct internal investigations in Germany. The support 19 services necessary for the determination of facts within the scope of internal investigations do not qualify as a provision of legal services (Rechtsberatung) within the meaning of the German act on legal advice (Rechtsdienstleistungsgesetz). Therefore, they do not require an admission to the German Bar. Although the internal investigations are closely interrelated with legal issues and procedures and cannot be conducted without a detailed knowledge of the legal background, the conducting of internal investigations does not qualify as a provision of legal advice.20 5. When should public authorities be called in? Certain objectives of internal investigations, such as the repatriation of funds 20 withdrawn from the company and transferred to bank accounts of third parties abroad cannot be achieved without involving public authorities. The involvement of public authorities is expedient if the accusations against the company or its employees, as the case may be, are of a serious nature and the matter is of great interest to the public. For tactical reasons, the management should call in the public authorities only after the internal investigation has produced first results. If the public authorities are contacted in case of just a vague initial suspicion, the public authorities, e.g. law enforcement authorities, may initiate their own investigations. Official investigations usually arouse great public interest and thus result in the affected company being denounced in the media. Last but not least, the early involvement of public authorities always involves the risk that evidence that could have been obtained by means of covert investigations is promptly destroyed upon disclosure of the involvement of the authorities. For this reason, the management 15

Cf. infra paras. 65 et seq. for details. LG Hamburg NJW 2011, 942, 943. 17 Lomas/Kramer, Corporate Internal Investigations, para. 6.73. 18 Behrens, RIW 2009, 22, 32 et seq.; Spehl, CCZ 6/2011, VIII. 19 Lomas/Kramer, Corporate Internal Investigations, para. 6.78. 20 BVerfG NJW 2002, 3531, 3532. 16

Spehl/Gru¨tzner

Reemers Publishing Services GmbH O:/Beck/Spehl_Gruetzner/3d/06_Deutschland.3d from 06.03.2013 09:27:54 3B2 9.1.580; Page size: 160.00mm  240.00mm

174

§ 6. Germany

should carefully deliberate whether and at what stage of an internal investigation, public authorities should be called in.

II. Admissibility and implementation of individual measures within the scope of internal investigations 1. What measures are admissible within the scope of internal investigations? A factor which needs to be considered in particular is the employees’ rights in the protection of their personal data. Internal investigations may also affect third parties’ personal data. It must therefore be verified prior to the implementation of investigative measures whether the specific measure is admissible under the relevant data protection laws, in particular under the Federal Data Protection Act (Bundesdatenschutzgesetz = BDSG) and the German Telecommunications Act (Telekommunikationsgesetz = TKG), in terms of the collection, processing and use of personal data.21 If the specific measure is implemented using anonymized22 data, neither the BDSG nor the TKG are applicable23 and the measure is not subject to data protection rules and restrictions. In many cases, however, the option to anonymize data in internal investigations is not of much use. The anonymization of all potentially relevant data prior to the beginning of the internal investigation is rarely practicable. Differentiating between anonymized and non-anonymized data which are to be scanned and analyzed in the course of an internal investigation is likewise rarely possible. 22 A violation of the provisions of the BDSG can be punished by a fine of up to 300.000 EUR.24 A willful violation of the data protection law provisions for a consideration or an action taken with the intention to enrich oneself or another person or to harm another person may even be punished with imprisonment of up to two years or a monetary fine.25 If the private use of the company’s telephone or email system is admissible, a violation of the TKG may also result in the imposition of a fine of up to 300.000 EUR.26 In addition, the competent data protection agency may order a skimming-off of profits.27 23 Furthermore, the unlawful access to, modification of, or disclosure of personal data can also result in criminal liability according to the German Criminal Code (Strafgesetzbuch = StGB). If an employee of the company discloses data to another person without being authorized by statute, consent or otherwise to do so, he/she may be punished with imprisonment of up to five years or a fine.28 This will be especially relevant if the private use of company email-accounts is permitted or 21

21

Vogel/Glas, DB 2009, 1747 et seqq. Anonymization means that personal data are modified in such way that they can no longer or only with a disproportionate amount of time, labor and costs, be attributed to an individual, § 3 (6) BDSG. 23 Heinson, BB 2010, 3084, 3088. 24 § 43 BDSG. 25 § 44 (1) BDSG. 26 § 149 (1) no. 16 and 17 TKG. 27 § 43 (3) sentence 2 and sentence 3 BDSG, § 149 (2) sentence 2 and 3 TKG; § 10 UWG (= Gesetz gegen den unlauteren Wettbewerb = Law Against Unfair Competition). 28 § 206 (1) StGB. However it should be noted, that § 206 (1) StGB only penalizes the intentional violation of the postal and telecommunications secret. 22

Spehl/Gru¨tzner

Reemers Publishing Services GmbH O:/Beck/Spehl_Gruetzner/3d/06_Deutschland.3d from 06.03.2013 09:27:54 3B2 9.1.580; Page size: 160.00mm  240.00mm

B. The 25 key questions in connection with internal investigations

175

tolerated by the company. Other criminal offences which could be relevant in case of the unlawful access to modification of, or disclosure of personal data are §§ 201 et seq. StGB. a) Requirements for admissibility under the BDSG aa) The BDSG sets forth framework conditions for internal investigations. There- 24 fore, it is important for the planning and implementation of internal investigations to obtain a general overview of the BDSG and the term “personal data” (personenbezogene Daten). The territorial scope of application of the BDSG mainly depends on whether personal data are collected, processed and used in Germany.29 Hence, if personal data are collected, processed or used by or through a legal entity which is located in Germany then the BDSG generally applies to this activity. Personal data as defined in the BDSG means any particulars concerning the personal or material circumstances of an identified or identifiable individual, the so-called data subject (Betroffener).30 Examples of personal data are external physical features like height, weight, hair color etc, personal wishes or beliefs or monetary features like legal estate or an individual’s assets.31 This does not include particulars on legal entities and partnerships, such as a German AG, GmbH, OHG or KG.32 However, the particulars only qualify as personal data if they relate to an individual who has already been identified (e.g. by name, email address) or can be identified by means of the particulars (e.g. unique position within a company, attributable telephone number or the combination of the individual items of information). Particulars comprise all information that is attributable to such individual.33 As anonymized particulars are not attributable to an individual, they do not constitute personal data; aliased data, however, do in fact constitute personal data. Aliasing means replacing the data subject’s name or other identifying features with a code (e.g. replacing the individual names by consecutive letters or numbers) in order to make it impossible or extremely difficult to identify the data subject;34 the main element distinguishing anonymizing from aliasing is that aliasing can be undone, thus allowing re-identification of the respective individual. bb) The term “controller” (verantwortliche Stelle) used in the BDSG plays an 25 important role when conducting internal investigations. In the BDSG, a controller is defined as the person or body collecting, processing or using personal data for his/her/its own purposes or commissioning a third party to do so.35 In the context of an internal investigation, the controller generally is the legal entity that employs the persons whose data are relevant to the investigation or that is concerned by § 1 (5) BDSG. § 3 (1) BDSG. 31 § 3 (1) BDSG. 32 Dammann, in: Simitis, BDSG, § 3, para. 17. The scope of protection under the TKG, however, is wider. Pursuant to § 91 (1) sentence 2 TKG, particulars on the circumstances of an identified or identifiable legal entity or partnership that are subject to telecommunications privacy, provided that such legal entity or partnership is capable of acquiring rights or undertaking commitments (e.g. a German AG, GmbH or OHG), is deemed equivalent to personal data. 33 Dammann, in: Simitis, BDSG, § 3, para. 10; Schaffland/Wiltfang, BDSG, § 3, para. 5. 34 § 3 (6a) BDSG. 35 § 3 (7) BDSG. 29 30

Spehl/Gru¨tzner

Reemers Publishing Services GmbH O:/Beck/Spehl_Gruetzner/3d/06_Deutschland.3d from 06.03.2013 09:27:54 3B2 9.1.580; Page size: 160.00mm  240.00mm

176

§ 6. Germany

subject-matter of the investigation, for instance in that the investigation relates to that entity’s business activities. In the case of internationally operating groups of companies, it must be determined whether it is the affected group company and/or the parent company that will conduct the internal investigation.36 If the internal investigation is triggered solely by local circumstances and events, while the parent company has its seat in another country, the affected group company should conduct the internal investigation. This approach is even recommendable if the internal investigation is initiated upon the parent company’s request. As a thumb rule, only the results of the internal investigation should be disclosed to the parent company. In the event that the internal investigation is conducted on a group-wide level (e.g. in case of circumstances or events affecting the entire group), it can be advisable and permissible to have the investigation steered by the parent company. However, it must be considered that, as a general rule, the group company is the controller of its own employees’ personal data analyzed in the scope of the internal investigation (which may mean that both entities are data collectors). In order to properly conduct the internal investigation, the group company must first and in an admissible manner transfer the personal data to be analyzed to the parent company. The admissible transfer requires an evaluation of the justification of the transfer from a data protection law perspective and, if necessary, the establishment of an adequate level of data protection at the level of the parent company.37 26 cc) The collection, processing and use of personal data is only admissible38 if the

data subject has consented or if permitted or prescribed by the BDSG or any other legal provision.39 A legal provision may not necessarily be a statutory law, but can for instance also be a shop agreement.40 Without a legal justification, the conduct of the internal investigation and the related investigative measures, to the extent that these concern personal data, are inadmissible. 27 dd) It is usually neither recommendable nor sufficient to base the admissibility of

the collection, processing and use of personal data in the scope of internal investigations on the consent41 of the employees and third-party data subjects.42 First, the data subjects could refuse or revoke their consent. In this case, according to a widespread view among German data protection agencies (= DPA), the data collection or 36 Regarding the admissibility under data protection law of a transfer of the findings made and information gathered in internal investigations to other group companies, cf. infra para. 63. 37 Cf.§§ 4 (1), 4 b (2) BDSG. The establishment of an adequate level of data protection is generally necessary if the parent company has its seat in a non-European country. This can in particular be implemented by means of binding corporate rules, a safe harbor registration of the parent company or the conclusion of EC standard contractual clauses. Exceptions to § 4 b (2) BDSG are set forth in § 4 c BDSG. 38 § 4 (1) BDSG. 39 Vogel/Glas, DB 2009, 1747. 40 Gola/Schomerus, BDSG, § 4, para. 7; Sokol, in: Simitis, BDSG, § 4, para. 11. 41 According to the draft of a new employee data protection act in the so-called BDSG-E (see also 1.1 f) and footnote 69), § 321 (1) BDSG-E is to provide that the collection, processing and use of employee data by the employer is admissible on the basis of the respective employee’s consent only to the extent that this is provided for in the new provisions of §§ 32 to 321 BDSG-E. A provision on the consent with regard to internal investigations does not exist so that in the future consent cannot serve as justification. 42 Vogel/Glas, DB 2009, 1747, 1748; Gola, RDV 2002, 109 et seqq.; Heinson, BB 2010, 3084, 3085.

Spehl/Gru¨tzner

Reemers Publishing Services GmbH O:/Beck/Spehl_Gruetzner/3d/06_Deutschland.3d from 06.03.2013 09:27:54 3B2 9.1.580; Page size: 160.00mm  240.00mm

B. The 25 key questions in connection with internal investigations

177

processing could no longer be based on other legal provisions43 and the personal data of these data subjects could then not be (further) used in connection with the internal investigation.44 Second, according to the prevailing opinion of the data protection agencies and in literature, any consent given by employees may prove invalid based on the argument that it is coerced.45 According to such opinion,46 an employee’s consent is invalid if it is considered to have been given involuntarily due to the subordinate status vis-a`-vis the employer and the fear of measures should the employee refuse to give his/her consent. Another argument against the consent approach lies in the fact that in many cases the consent of third parties who are not employed with the company but affected by the internal investigations47 cannot be obtained for practical reasons. As third parties will generally expect that their data, created as a result of their business dealings with the company, are being processed in the scope of an internal investigation, this argument is however somewhat less relevant than the ones above. Specific care should be exercised where the data is particularly sensitive and/or designated for the eyes of the recipient only, such would typically be true for health data or information conveyed under professional secrecy obligations, to mention just a few examples. ee) An explicit legal provision permitting the collection, processing and use of 28 personal data specifically in the context of an internal investigation does not exist (§ 32 (1) sentence 2 BDSG arguably being the only exception48). The sets of circumstances allowing for a collection, processing and use of personal data set forth in the BDSG49 can be invoked for justification purposes. They are the subject matter of controversial discussions50 and there will likely be further legislative reforms.51 If any doubt with the regard to internal investigation measures exists, it Sokol, in: Simitis, BDSG, § 4, para. 6. Schaar, MMR 2001, 644, 648. 45 Cf. inter alia Gola, RDV 2002, 109, 111 et seqq. 46 Cf. inter alia Gola, RDV 2002, 109, 111 et seqq. 47 This includes, inter alia, the contact persons at the level of business partners or customers in case of a data synchronization or the external senders of emails in case of an email screening. 48 The requirements of § 32 (1) 2 BDSG are illustrated in B. II. 1.1 i) bb). 49 The relevant provisions are § 28 (1) sentence 1 no. 1, no. 2 and § 32 BDSG. 50 § 32 BDSG, which, according to its heading, governs the data collection, processing and use for employment-related purposes, was introduced with effect as of September 1, 2009 as a specification of § 28 (1) sentence 1 no. 1 BDSG. Pursuant to § 3 (11) BDSG, employees are (no. 1) persons in a regular employment relationship, (no. 2) persons employed for the purpose of occupational training, (no. 3) persons participating in measures to integrate them into the labor market or to clarify their ability or suitability for work (rehabilitation measures), (no. 4) persons employed at certified workshops for persons with a disability, (no. 5) persons employed under the Youth Volunteer Service Act (Jugendfreiwilligendienstegesetz), (no. 6) persons comparable to employees due to their economic dependence, including home-based workers and persons of similar status, (no. 7) applicants for employment and those whose employment has ended, civil servants, federal judges, military personnel and persons in the alternative civilian service. 51 The German federal government (Bundesregierung) has already published a government bill for a comprehensive employment-related data protection act, on which the German federal council (Bundesrat) has provided its comments; cf. Bundesrat paper 535/10. Hereinafter, the intended amendments of law in the current BDSG-E are described in the footnotes. At the same time, with the preparation of a Data Protection Regulation on the European level, which is intended to replace the current Data Protection Directive, it is unclear if Germany will eventually sign the draft data protection act into law. Also, it cannot be foreseen with certainty if and to what extent the Data Protection Regulation would move the yardsticks for national data protection legislation. 43 44

Spehl/Gru¨tzner

Reemers Publishing Services GmbH O:/Beck/Spehl_Gruetzner/3d/06_Deutschland.3d from 06.03.2013 09:27:55 3B2 9.1.580; Page size: 160.00mm  240.00mm

178

§ 6. Germany

will be advisable to seek legal advice or to ask the data protection agencies for their opinion concerning the admissibility of a data collecting measure – if necessary also on an anonymous basis. In the case that personal data of employees are affected, the relationship between the different statutory rules allowing for a collection, processing and use of employee data under the currently applicable law52 need to accessed carefully. To the extent that internal investigations affect the personal data of other third parties (i. e. not the employees’ data), the admissibility of data processing can often be rooted in § 28 (1) sentence 1 no. 1 or no. 2 BDSG, sometimes in combination to § 28 (2) Nr. 2 BDSG, or § 28 (2) Nr. 2 BDSG. The wording of § 28 (1) sentence 1 no. 1 and no. 2 is as follows (convenience translation): “(1) 1The collection, storage, modification or transfer of personal data or their use as a means of fulfilling one’s own business purposes shall be admissible 1. if necessary to create, perform or terminate a legal relationship or a relationship similar to a legal relationship with the data subject, 2. to the extent necessary to safeguard justified interests of the controller and to the extent that there is no reason to assume that the data subject has an overriding legitimate interest in his/her data being excluded from processing or use, or (…) 2When collecting personal data, the purposes for which the data are to be processed or used shall be stipulated in concrete terms. (…)”

29

If the internal investigation is directed at all employees as a preventive measure or specific employees as a result of a specific incident, the collection, processing and use of these employees’ personal data are primarily governed by § 32 BDSG which reads as follows53 (convenience translation): “(1) 1Personal data of an employee may be collected, processed and used for purposes of the employment relationship if this is required for a decision on the establishment of an employment relationship or, after the employment relationship has been established, for its performance or termination. 2Personal data of an employee may only be collected, processed or used to reveal criminal offences if there are actual indications, which are to be documented, giving rise to the suspicion that the data subject has committed a criminal offence in the scope of his/her employment relationship, if the collection, processing or use is necessary to reveal such criminal offence and if the data subject has no overriding legitimate interest in the exclusion from the collection, processing or use, in particular if type and scope of the collection, processing or use are not inappropriate in view of the event.

§ 28 (1) sentence 1 no. 1 and no. 2 BDSG as well as § 32 BDSG. § 32 c (1) BDSG-E on the data collection in the context of employment relationships is intended to read as follows: “1Employment data may be collected subject to §§ 32 e through 32 i if this is required for the performance, termination or settlement of the employment relationship. 2This is in particular the case if the employer must have knowledge of these data in order to be able to (no. 1) comply with statutory collection, reporting, notification, disclosure or payment obligations, (no. 2) comply with the obligations vis-a`-vis the employee or (no. 3) exercise the employer’s rights vis-a`-vis the employee, including performance and conduct monitoring. 3§ 32 (2) sentence 2 and (6) BDSG-E shall apply mutatis mutandis.” § 32 c (4) BDSG-E requires that the type and scope of the data collection must be appropriate in view of the purpose. Pursuant to § 32 (6) BDSG-E, the data must be collected directly from the employee. Provided that the employer has notified the employee thereof prior to the collection, the employer may collect publicly available data without involving the employee. This does not apply if the employee’s legitimate interest in the exclusion from the collection outweighs the employer’s justified interest. With the employee’s consent, the employer may also collect personal data of the employee from other third parties. Upon request, the employee must be informed about the content of the collected data. §§ 32 e through 32 i contain special provisions which are explained in the context of the individual investigative measures. 52 53

Spehl/Gru¨tzner

Reemers Publishing Services GmbH O:/Beck/Spehl_Gruetzner/3d/06_Deutschland.3d from 06.03.2013 09:27:55 3B2 9.1.580; Page size: 160.00mm  240.00mm

B. The 25 key questions in connection with internal investigations

179

(2) Subsection (1) shall also apply if personal data are collected, processed and used without being processed in an automated manner or without being processed or used in or from a non-automated file or without being collected in such file for processing or use. (3) The participation rights of the employees’ representative bodies shall remain unaffected.”

ff) According to the legislative history, § 32 BDSG specifies the purposes of data 30 collection, processing and use in view of employment relationships and, thus, blocks or supersedes other provisions setting forth the requirements for admissibility in this regard.54 The in many ways central question of whether and in which cases § 32 (1) BDSG 31 still permits the parallel application of § 28 (1) sentence 1 no. 2 BDSG has not yet been clarified in every detail. It must, however, be assumed that § 28 (1) sentence 1 no. 2 BDSG remains applicable where § 32 (1) BDSG does not apply because there is no nexus between the data and the employment relationship.55 To the extent that the internal investigations affect the personal data of third parties (in particular business partners and customers of the company), § 32 BDSG does not apply so that the measures will usually have to be assessed in light of § 28 (1) sentence 1 no. 1 or no. 2 BDSG. gg) As a matter of principle, the BDSG is applicable to private bodies – such as 32 companies – only to the extent that they (1) process or use the personal data in an automated manner by means of data processing systems or collect the personal data for this purpose or (2) process or use the data in or from non-automated files that are similarly structured and can be accessed and analyzed in accordance with specific characteristics or collect the data for this purpose.56 § 32 (2) BDSG57 makes an exception to this principle for the personal data of employees and, thus, widens the scope of application of the BDSG. According to such provision, § 32 (1) BDSG is to apply if personal data are collected, processed or used without being processed in an automated manner or without being processed or used in or from a nonautomated file or without being collected in such file for processing or use. Thus, § 32 BDSG does not only apply to personal data in EDP systems or in the personnel file or any other structured accumulation of personal data but for example also to personal data on telephone memos or post-its lying around.58 Employee interviews in the scope of an internal investigation or searches of the workplace are, therefore, subject to § 32 BDSG. hh) In case internal investigations affect so-called sensitive59 data, the data collect- 33 ing, processing or using measures will only be admissible, if the data subject consents60 to the data measure within the scope of § 4 a (3) BDSG or if one of the special reasons of § 28 (6) no. 1 to no. 4 BDSG exists.61 Religious beliefs, racial For instance, § 28 (1) sentence 1 no. 1 BDSG. Bundestag paper 16/13657, 20 et seq. 56 Cf. § 1 (2) no. 3, § 3 (2) BDSG. 57 In future, this aspect is to be provided for in § 27 (3) sentence 2 BDSG-E. 58 Vogel/Glas, DB 2009, 1747, 1750. 59 § 3 (9) BDSG. 60 But note that there are concerns regarding the collection, processing and use of personal data on the basis of consent, cf. infra para 56. 61 § 28 (6) BDSG. 54 55

Spehl/Gru¨tzner

Reemers Publishing Services GmbH O:/Beck/Spehl_Gruetzner/3d/06_Deutschland.3d from 06.03.2013 09:27:55 3B2 9.1.580; Page size: 160.00mm  240.00mm

180

§ 6. Germany

heritage and political opinions are, for instance, so-called sensitive data. § 28 (6) BDSG shall serve as justification for the collection, processing or use of this sensitive data – even in employment relationships.62 34 ii) To the extent that § 32 BDSG is applicable the admissibility of investigative 35

measures depends on the preventive or repressive nature of the respective measure. (1) The admissibility of preventive measures (also for the purpose of preventing criminal offences63) that are carried out without specific indications for a violation of law and for control purposes in the scope of risk/compliance management is determined pursuant to § 32 (1) sentence 1 BDSG as regards the collection, processing and use of employee data. According to this provision, personal data of an employee may be collected, processed or used for purposes of the employment relationship if this is required for the performance or termination of the employment relationship. The admissibility of the measure depends on whether the employees’ personal data must be collected, processed and used because it is necessary with regards to the justified interests directly arising from the employment relationship and whether the data subject has no overriding interest.64 The collection, processing and use must serve the intended purpose of the employment relationship.65 It is unclear whether a weighing of interests is to be carried out in the scope of the requirements stipulated in § 32 (1) sentence 1 BDSG66 or whether only the necessity of the data collection, processing and use is to be determined.67 According to the prevailing opinion,68 measures pursuing a legitimate purpose and proving suitable, necessary and adequate to achieve such purpose are admissible.69 This approach corresponds to a weighing of interests, i. e. the interests of the controller and the interests of the employees affected by the data processing.70 At the level of the employer (= the company), the weighing of interests must take into account the potential interest of monitoring the employees’ performance, his potential interest regarding the protection of the professional secrets and company assets, the company’s reputation and his potential interest regarding the prevention of paying damages or administrative fines.71 The employee, on the other hand, has a justified interest in the best possible protection of his/her general personal rights.

62 Cf. Opinion of the German lawyers’ association (Deutscher Anwaltsverein) via the labor law committee in coordination with the information law committee concerning employees’ data protection, January 2010: www.anwaltverein.de/downloads/stellungnahmen/SN-10/SN0210.pdf. 63 Schneider, NZG 2010, 1201, 1206. 64 Ma ¨ hner, MMR 2010, 379, 381. 65 Gola/Schomerus, BDSG, § 32, para. 12. 66 Cf., BB 2010, 1085, 1086; Thu ¨ sing, Arbeitnehmerdatenschutz und Compliance, para. 59; Erfurth, NJOZ, 2009, 2914, 2918 et seqq. 67 Vogel/Glas, DB 2009, 1747, 1751; apparently also Hoppe/Braun, MMR 2010, 80. 68 Thu ¨ sing, Arbeitnehmerdatenschutz und Compliance, para. 70; Wank, Erfurter Kommentar zum Arbeitsrecht, § 32 BDSG, para. 6; Wybitul, BB 2010, 1085, 1086; Heldmann, DB 2010, 1235, 1238. § 32 c (4) BDSG-E is intended to always require a weighing of interests in the future (see footnote 70 above regarding § 32 c BDSG-E). 69 Gola/Wronka, Handbuch zum Arbeitnehmerdatenschutz, para. 398; Thu ¨ sing, Arbeitnehmerdatenschutz und Compliance, para. 59; Wybitul, BB 2010, 1085, 1086. 70 Gola/Wronka, Handbuch zum Arbeitnehmerdatenschutz, para. 398; Thu ¨ sing, Arbeitnehmerdatenschutz und Compliance, para. 59; Wybitul, BB 2010, 1085, 1086. 71 Vogel/Glas, DB 2009, 1747, 1751.

Spehl/Gru¨tzner

Reemers Publishing Services GmbH O:/Beck/Spehl_Gruetzner/3d/06_Deutschland.3d from 06.03.2013 09:27:55 3B2 9.1.580; Page size: 160.00mm  240.00mm

B. The 25 key questions in connection with internal investigations

181

The type of the affected personal data, the number of data subjects and the duration and type of the investigative measure must particularly be taken into account.72 Generally, processing of data in aliased form is an argument in favor of an overriding interest on the part of the employer because it reduces the level of interference with the employee’s rights. When analyzing email log files, data could be aliased by not saving the email log files under the names of the affected employees but only under the related MAC address. An identification of the respective employee should then only be made in the event of a positive result of the analysis via the MAC address. (2) Within the scope of § 32 (1) sentence 2 BDSG,73 repressive measures to reveal 36 criminal offences committed by employees are only admissible if (a) there are actual indications, which are to be documented, giving rise to the suspicion that (b) the data subject has committed a criminal offence in the scope of his/her employment relationship, (c) the collection, processing or use is necessary to reveal such criminal offence, (d) the employee has no overriding legitimate interest in the exclusion from the collection, processing or use, which involves in particular ensuring that the type and scope of the collection, processing or use are not inappropriate in view of the event.74 In case of investigative measures (also to reveal criminal offences) with regard to 37 third parties, the justification provision to collect, process and use personal data cannot be derived from § 32 BDSG (which only applies to employee data) but must be found elsewhere (e.g. § 28 (1) sentence 2 BDSG).75 72

Heinson, BB 2010, 3084, 3088. In future, § 32 c (1) sentence 2 no. 3 and § 32 d (1) BDSG-E are to apply with regard to the investigation of criminal offences unless §§ 32 e through 32 i BDSG-E take precedence. Pursuant to § 32 c (1) sentence 2 no. 3, § 32 d (1) BDSG-E, the collection, processing and use of the employee data must be required for the exercise of the employer’s rights vis-a`-vis the employees, including performance and conduct monitoring, provided that the data collection is commensurate. An automated comparison of employee data in anonymized or aliased form with files kept by the employer may be carried out to reveal criminal offences or other serious breaches of duties by employees in the scope of their employment relationship, in particular to reveal criminal offences under §§ 266, 299, 331 through 334 StGB. The circumstances of the comparison must be documented in detail. If the comparison gives rise to suspicion, the data may be personalized (§ 32 d (3) BDSG-E). Pursuant to § 32 e (2) BDSG-E, employee data may only be collected to reveal criminal offences and other serious breaches of duties without the respective employee’s consent if (no. 1) facts give rise to a suspicion that the employee committed a criminal offence or another serious breach of duties in the scope of his/her employment relationship that would entitle the employer to a termination for cause and (no. 2) the collection is necessary to reveal the criminal offence or other serious breach of duties or to prevent any related further criminal offences or serious breaches of duties on the part of the employee. In addition, the collection must be commensurate and the investigation of the facts and circumstances in any other way must be more difficult or less successful (§ 32 e (3)). Pursuant to § 32 e (4) sentence 1 BDSG-E, however, a collection without the respective employee’s knowledge is to be inadmissible if it is carried out by means of (no. 1) an observation scheduled to last more than 24 hours without interruption or to take place on more than four days, (no. 2) technical means to listen in on or record the not publicly spoken word or (no. 3) other special technical means for observational purposes. 74 § 32 (1) sentence 2 BDSG. 75 Bundestag paper 16/13657, 20, in which the Bundestag states that other justification provisions should still be applicable in addition to § 32 BDSG, if the data processing, collecting or using measures do not concern employment relationships. 73

Spehl/Gru¨tzner

Reemers Publishing Services GmbH O:/Beck/Spehl_Gruetzner/3d/06_Deutschland.3d from 06.03.2013 09:27:56 3B2 9.1.580; Page size: 160.00mm  240.00mm

182

§ 6. Germany

§ 32 (1) sentence 2 BDSG can only apply if the data collection, processing and use serve to reveal criminal offences already committed. It is not entirely clear what criteria apply to an internal investigation to reveal administrative offences or breaches of contract as § 32 (1) sentence 2 BDSG expressly only mentions criminal offences. In the absence of another special provision, § 32 (1) sentence 1 BDSG may be seen as a potential justification for data collecting or processing measures as it relates to employee data and § 28 (1) sentence 2 BDSG may be seen as a potential justification for data collecting or processing measures with regard to third party data.76 However, the principle of proportionality in cases of attempting to reveal administrative offences must follow the same criteria as in cases of attempting to reveal criminal offences.77 Otherwise the requirements for data collecting, processing or using measures would be stricter in the case of a concrete suspicion of a criminal offence than in cases of a general suspicion of some other kind of offence.78 39 Before a measure may be carried out under § 32 (1) sentence 2 BDSG, there must be robust fact-based indication suggesting that the affected employee has committed a criminal offence in the scope of his/her employment relationship. Abstract suspicions alone are not sufficient in this context.79 The employer must document the specific reasons for suspicion of a criminal offence. It is irrelevant whether the criminal offence to be investigated is directly related to the employment relationship or whether it was committed by the employee while he/she happened to be performing his/her duties.80 § 32 (1) sentence 2 BDSG sets special standards to be observed by the controller in particular with regard to the documentation of the indications for a criminal offence and requires a special proportionality review in the sense of a weighing,81 i. e. a weighing of the conflicting interests of employer and employee. The proportionality assessment must take account of the employee’s personal rights.82 Therefore, the investigative measure must relate to a specific employee with respect to whom there are actual and documented indications for a criminal offence committed by him/her in connection with his/her employment relationship and this measure must be suitable, necessary (i. e. the equally suitable least drastic means) and proportionate in a narrower sense to reveal the violation of law. Without overstretching the term of the principle of necessity,83 it can be assumed that control measures are necessary in this sense if they serve to verify whether the employee fulfills his/her employment contract. Considering the fact that the purpose of § 32 BDSG was not to establish a new law but to summarize the principles set forth by case law,84 the collection, processing and use of data serving to ensure that the obligations under the respective employment contract are properly performed, can be considered admissible. The controller is always (i. e. also in case of a preventive measure) obliged to thoroughly analyze why a specific 38

Gola/Schomerus, BDSG, § 32, para. 29. Thu¨sing, Arbeitnehmerdatenschutz und Compliance, para. 70; pleading for even stricter requirements in the case of suspicion of administrative offences: Heinson, BB 2010, 3084, 3087. 78 Thu ¨ sing, NZA 2009, 865, 868. 79 Thu ¨ sing, Arbeitnehmerdatenschutz und Compliance, para. 261. 80 Deutsch/Diller, DB 2009, 1462, 1464; cf. § 32 (1) sentence 2 BDSG. 81 Cf. also Gola/Schomerus § 32, paras. 24 et seqq. 82 Erfurth, NJOZ 2009, 2914. 83 Cf. § 32 (1) sentence 1 BDSG. 84 Cf. Bundestag paper 16/13657, 20. 76 77

Spehl/Gru¨tzner

Reemers Publishing Services GmbH O:/Beck/Spehl_Gruetzner/3d/06_Deutschland.3d from 06.03.2013 09:27:56 3B2 9.1.580; Page size: 160.00mm  240.00mm

B. The 25 key questions in connection with internal investigations

183

measure is supposed to be necessary and whether there might not be a less intrusive measure to achieve the same purposes. In case of an incidental finding it is therefore not only recommendable but also mandatory to comply with the special requirements regarding the documentation of the reasons for the necessity of a measure and the proportionality assessment set forth in § 32 (1) sentence 2 BDSG and not only with the requirements of § 32 (1) sentence 1 BDSG. Should a preventive check give rise to the suspicion of a criminal offence due to indications suggesting a criminal offence, the company may have to switch from one justification to another in that, henceforth, the permissibility of the measure started on the basis of § 32 (1) sentence 1 BDSG will have to be tested against the criteria of § 32 (1) sentence 2 BDSG.85 When carrying out a proportionality review under § 32 (1) sentence 2 BDSG, the seriousness of the potential criminal offence suggested by the indications must particularly be considered.86 As a rule of thumb, control and surveillance measures can be intensified in analogy to the seriousness of the potential criminal offence suggested by the documented indications. The documentation obligation pursuant to § 32 (1) sentence 2 BDSG is not merely an end in itself. The assessment of whether a measure used to reveal a violation of law is admissible is, thus, a decision to be made in each individual case on the basis of the individual circumstances. When applying these standards, the following particularities must be taken into account: (1) The transfer of personal data is only required if the company’s justified interests cannot be satisfied in another, equally effective way. If the company’s interests can be satisfied on an equal footing where the data are rendered anonymously87 or aliased88 before being transferred, a transfer of the personal data is not admissible.89 (2) When balancing the justified interests of the company and the legitimate interests of the employee, the employee’s right to informational self-determination and the extent to which the respective legal interests are jeopardized must be taken into consideration.90 In less serious cases and in the case the employee’s private and intimate spheres are affected, the employees’ legitimate interests will often prevail.91 In such cases, a collection, processing or transfer of personal data is not permitted. jj) As a general rule, employees and third parties whose personal data are being 40 collected, processed and used in the scope of the internal investigation must be notified of the purposes of the data processing, the affected categories of personal data, the categories of data subjects and the categories of the recipients of the 85

Cf. Thu¨sing, NZA 2009, 865, 868. Cf. also Gola/Schomerus, § 32, para. 27. 87 “Rendering anonymous” means the modification of personal data so that the information concerning personal or material circumstances can no longer or only with a disproportionate amount of time, expense and labor be attributed to an identified or identifiable individual (§ 3 (6) BDSG). 88 “Aliasing” means replacing a person’s name and other identifying characteristics with a label, in order to preclude identification of the data subject or to render such identification substantially difficult (§ 3 (6a) BDSG). 89 Gola/Schomerus, BDSG, § 28, para. 33. 90 Gola/Schomerus, BDSG, § 1, para. 10. 91 Behrendt/Kaufmann, CR 2006, 642, 646; Mengel, CCZ 2008, 85, 90. 86

Spehl/Gru¨tzner

Reemers Publishing Services GmbH O:/Beck/Spehl_Gruetzner/3d/06_Deutschland.3d from 06.03.2013 09:27:56 3B2 9.1.580; Page size: 160.00mm  240.00mm

184

§ 6. Germany

personal data in advance (i. e. before the investigation starts).92 A subsequent notification may be admissible; however, if otherwise the success of the investigation is jeopardized. Already due to this notification obligation, covert investigative measures such as telephone or video surveillance in the scope of internal investigations are admissible only in exceptional cases. 41 kk) If external investigators93 are to be commissioned with the conduct of the

internal investigations, it must be verified whether the external investigators, due to their auxiliary function, (i) will act as data processors in accordance with § 11 BDSG – only upon the instructions of the company – or (ii) will conduct the internal investigations independently and have decision-making powers (data controller). A written agreement has to be concluded if the external investigator acts as a data processor.94 42 ll) The described admissibility requirements under the BDSG apply to all measures

within the scope of internal investigations to the extent that they concern personal data. The description of the individual measures is, therefore, confined to particularities and aspects material for an admissibility check. b) Employee interviews 43 aa) Employee interviews, whether in the form of questionnaires or in a personal

conversation, constitute a key instrument within the scope of internal investigations.95 A personal conversation prepared with the aid of identified documents is the best opportunity for the investigators to understand and discern (illegal) structures and interrelations within a company and to get a true impression of the person of the individual employee. 44 bb) The admissibility of the collection, processing and use of employee data (relating

to both the interviewed employees and third parties) by means of questionnaires or interviews depends on the subject matter of the questions and the connection to the specific employment relationship.96 Preventive questionnaires regarding family or other close ties between the employees and civil servants or customers/suppliers to reveal potential corruption risks may be inadmissible for lack of necessity and proportionality.97 The subject matter of the questions must concern facts and circumstances required for the performance of the employment relationship and must be directly or indirectly related to the employee’s personal area of work.98 45 Even though under labor law, the employee is generally obliged to furnish information in such case,99 the rules and restrictions of data protection law, i. e. Cf. § 4 (3) BDSG. This includes other group companies acting on behalf of the investigating group company. 94 § 11 BDSG. 95 Vogel/Glas, DB 2009, 1747, 1749; Mu ¨ ller-Bonanni, AnwBl 2010, 651, 653; Lu¨tzeler/Mu¨llerSartori, CCZ 2011, 19. 96 Vogt, NJOZ 2009, 4206, 4212. 97 According to a German data protection authority in reply to an anonymous inquiry. 98 Vogel/Glas, DB 2009, 1747, 1750. 99 BAG NZA 1996, 637, 638; NZA 1997, 41; LAG NZA 1993, 27; LAG BB 1962, 1285; Preis, in: Erfurter Kommentar zum Arbeitsrecht, § 611 para. 23; Hromadka, DB 1995, 2601, 2605; Go¨pfert/ 92 93

Spehl/Gru¨tzner

Reemers Publishing Services GmbH O:/Beck/Spehl_Gruetzner/3d/06_Deutschland.3d from 06.03.2013 09:27:57 3B2 9.1.580; Page size: 160.00mm  240.00mm

B. The 25 key questions in connection with internal investigations

185

the requirements according to § 32 BDSG, always have to be maintained as well. To the extent that the investigations concern the employee’s area of work, according to labor law the employer may instruct him/her100 to (actively) participate in interviews within the scope of internal investigations,101 which may also be conducted by external investigators.102 In case of specific suspicions of criminal conduct, the employer’s interest will generally prevail.103 c) Screening of email log files and email content104 Besides employee interviews (and also for the preparation of these interviews), 46 email screening, i. e. the electronic and/or manual review of the log files of the email accounts provided by the employer and of the content of the employees’ emails is a commonly used measure for the clarification of wrongdoing within a company. In the scope of email screening, a differentiation must be made between whether the employer wishes to review the so-called email log files or the content of the emails. Furthermore, the legal parameters depend on whether the employee is permitted or tolerated to use the email system for private purposes, which would result in the applicability of the German Telecommunications Act (Telekommunikationsgesetz, TKG).105 aa) Differentiation of email log files and email content Email log files are protocol files containing information on the connections used 47 in email communication.106 The sender’s address, the recipient’s address, the time when the email was sent and the size of the email are stored in the protocol files. This information is referred to as traffic data within the meaning of § 96 (1) TKG. Under certain circumstances, the subject line of the emails may also be recorded in the email log files. As the subject line already provides general information on the content of the email and can even contain detailed information, it should in any event be treated in the same way as the content of the email in the scope of internal investigations.107 Merten/Siegrist, NJW 2008, 1703, 1705; Diller, DB 2004, 313; Jahn, StV 2009, 41, 43; Mengel, Compliance und Arbeitsrecht, chapter 4, para. 20. 100 § 106 GewO (= Gewerbeordnung = German Industrial Code), § 315 BGB (= Bu ¨ rgerliches Gesetzbuch = German Civil Code). 101 LAG Hamm MDR 2001, 1361 on the participation in meetings with employees; Mengel/ Ullrich, NZA 2006, 240, 243; v. Rosen, Internal Investigations bei Complianceversto¨ßen, p. 93. 102 Go ¨ pfert/Merten/Siegrist, NJW 2008, 1703, 1706; Mengel, Compliance und Arbeitsrecht, chapter 4, para. 23; v. Rosen, Internal Investigations bei Complianceversto¨ßen, p. 94; other opinion Jahn, StV 2009, 41, 43, who holds the view that the duty to provide information exists only vis-a`-vis the employer because he incorrectly assumes that the employer had to assign its claim to be provided with information to the investigators. In fact, the employer only instructs its employees to provide the information owed to it to a third party. 103 Vogel/Glas, DB 2009, 1747, 1750. 104 In the future, § 32 i BDSG-E is to govern the use of telecommunications services within the scope of the employment relationship, including the respective surveillance measures. For further details, see Fn. 126. 105 Cf. Scheben/Klos/Geschonneck, CCZ 2012, 13, 14. 106 Thu ¨ sing, Arbeitnehmerdatenschutz und Compliance, para. 198. 107 Disputed, detailed information on the different opinions: Thu ¨ sing, Arbeitnehmerdatenschutz und Compliance, paras. 293 et seqq.

Spehl/Gru¨tzner

Reemers Publishing Services GmbH O:/Beck/Spehl_Gruetzner/3d/06_Deutschland.3d from 06.03.2013 09:27:57 3B2 9.1.580; Page size: 160.00mm  240.00mm

186 48

§ 6. Germany

The initial purpose of the storage and review of email log files is merely to provide information on the traffic data. The traffic data becomes important if they provide information on the employees’ activities. For example, the employer can determine whether an employee has forwarded larger data volumes to competitors or press agencies without having any business-related reason to do so. This could be an indication for an illegal transfer of trade and business secrets and may constitute a corresponding violation of the German Act against Unfair Competition (Gesetz gegen den unlauteren Wettbewerb = UWG). A similar approach is conceivable to fight corruption in case of suspected payments of bribes between employees and customers/suppliers. bb) Differentiation between exclusive official business use and (also) private use

Whether and to what extent and intensity the screening of emails is admissible depends on the statutory provisions applicable to the data collection, processing and use. The measures are governed by the BDSG or the TKG, depending on whether the private use of emails is prohibited or permitted to the employees. If the TKG is applicable, it will supersede the BDSG. The scope of protection under the TKG, unlike the scope of protection under the BDSG, also covers legal entities and associations of persons with partial legal capacity.108 50 According to the prevailing opinion, the screening of private emails for compliance purposes is prohibited under the TKG if private use of the email account is permitted.109 Insofar, the employer acts as a telecommunications services provider vis-a`-vis the employee and is consequently subject to telecommunications secrecy, § 88 TKG. A telecommunications services provider is anyone who provides telecommunications services on a commercial basis or participates in the provision of telecommunications services110 on a commercial basis.111 The telecommunications services provider (= employer) is obliged to maintain telecommunications secrecy vis-a`-vis the employees.112 Therefore, the email content may only be used in the cases provided for by statutory law. But the TKG does not contain a provision permitting a review of personal data for compliance purposes.113 Yet, according to one of the opinions held in legal literature, a review is to be admissible if there is a 49

§ 91 (1) sentence 2 TKG. Beckschulze/Henkel, DB 2001, 1491, 1494; Gola/Schomerus, BDSG, § 28, para. 20 a; Mengel/ Ullrich, NZA 2006, 240, 242; Salvenmoser/Schreier, in: Achenbach/Ransiek, Handbuch Wirtschaftsstrafrecht, chapter XV, para. 109; Go¨pfert/Merten/Siegrist, NJW 2008, 1703, 1705; Wolf/Mulert, BB 2008, 442, 444; Lomas/Kramer, Corporate Internal Investigations, para. 6.139; de Wolf, NZA 2010, 1206, 1208; Scho¨ttler, jurisPR-ITR 4/2009, annotation 2. Other opinion: Haußmann/Krets, NZA 2005, 259, 260; Schimmelpfennig/Wenning, DB 2006, 2290 et seqq.; Thu¨sing, Arbeitnehmerdatenschutz und Compliance, para. 209 with further references; Scheben/Klos/Geschonneck, CCZ 2012, 13, 16; LAG Berlin-Brandenburg BB 2011, 2298; LAG Niedersachsen NZA-RR 2010, 406. 110 Provision of telecommunications services on a commercial basis means the sustainable offering of telecommunication to third parties, with or without the intention of generating a profit. § 3 no. 10 TKG. 111 § 3 no. 6 TKG. 112 § 88 (2) TKG. 113 Klengel/Mu ¨ ckenberger, CCZ 2009, 81, 84. 108 109

Spehl/Gru¨tzner

Reemers Publishing Services GmbH O:/Beck/Spehl_Gruetzner/3d/06_Deutschland.3d from 06.03.2013 09:27:57 3B2 9.1.580; Page size: 160.00mm  240.00mm

B. The 25 key questions in connection with internal investigations

187

specific suspicion of a criminal offence or a disclosure of business secrets.114 Nevertheless, there is also no statutory provision permitting such review, either.115 Since telecommunications privacy does not only protect email content, but also the external circumstances of the communication, it is also forbidden to carry out any data collecting measures with regard to email log files in the case of a privately used email account. In addition, it would first have to be possible to lawfully create and store the email log files to be screened.116 The unauthorized use of connection data can constitute a criminal offence.117 This is the case if an employee of the company discloses to another person (also within the company) facts relating to the connection data in the scope of the internal investigation without being authorized to do so.118 The traffic data has to be deleted immediately after having been used for a specific data collecting or processing measure.119 Such data collecting or processing purposes are (i) providing the ‘services’ and related billing, (ii) detecting, locating and remedying system errors, and (iii) discovering and stopping a surreptitious use or other unlawful use of ‘service’.120 Other opinions hold that the employer does not act as telecommunications provider if the private usage of the email account is permitted.121 Consequently, pursuant to this opinion the TKG should not be applicable in the case of private email account use, whereby the telecommunications secrecy would not be relevant and the data collecting or processing measure would only have to meet the requirements of the BDSG. This opinion is supported by the following argument that one purpose of the TKG is to liberalize the market and to support fair competition between market competitors. The employer, however, never acts as a competitor, if he allows the employees’ private use of email accounts.122 Yet, following the prevailing opinion, it is crucial whether the private usage of the email account is permitted or not. Generally speaking, the employee does not have the right to use his or her email account privately.123 If the employer prohibits the private usage of the email accounts and ensures that this prohibition is observed, the employer will not be considered a telecommunications provider and the TKG will not be applicable.124 Therefore, in this case all data collecting,

114 Wolf/Mulert, BB 2008, 442, 446; Beckschulze, DB 2007, 1526, 1528; Mengel/Ullrich, NZA 2006, 240, 242. 115 Hoppe/Braun, MMR 2010, 80, 81. 116 Hoeren/Sieber, Handbuch Multimedia-Recht, part 22.1 paras. 102 et seqq. 117 § 206 StGB. 118 In § 206 (5) StGB, facts subject to telecommunications privacy are defined as the content and detailed circumstances of telecommunications, in particular the fact of whether or not a person is or was engaged in a telecommunications activity and also the detailed circumstances of unsuccessful attempts to make a connection. 119 § 96 (1) sentence 3 TKG. 120 No. (iii) only relates to ‘unauthorized’ users and can thus not be used as a basis for monitoring if employees have violarted applicable laws or company policies, 121 Haußmann/Krets, NZA 2005, 259, 260; Schimmelpfennig/Wenning, DB 2006, 2290 et seq.; Thu¨sing, Arbeitnehmerdatenschutz und Compliance, paras. 226 et seq.; Scheben/Klos/Geschonneck, CCZ 2012, 13, 16; LAG Berlin-Brandenburg BB 2011, 2298; LAG Niedersachsen NZA-RR 2010, 406. 122 Thu ¨ sing, Arbeitnehmerdatenschutz und Compliance, para. 240; Haußmann/Krets, NZA 2005, 259, 260. 123 Hegewald, in: Leupold/Glossner, Part 7, para. 12. 124 Heldmann, DB 2010, 1235, 1238.

Spehl/Gru¨tzner

51

52

53

54

Reemers Publishing Services GmbH O:/Beck/Spehl_Gruetzner/3d/06_Deutschland.3d from 06.03.2013 09:27:57 3B2 9.1.580; Page size: 160.00mm  240.00mm

188

§ 6. Germany

processing or usage measures will only have to meet the less strict criteria of (in the case of an employment relationship) § 32 BDSG respectively § 28 BDSG regarding third party data. Nonetheless, as soon as the emails evidently include private content, any data collecting, processing or usage measures shall be forbidden.125 If the employer does not ensure, that the email account is only used for business purposes, but instead tolerates the private usage, any measures concerning personal data collecting and processing will be impermissible.126 The case of tolerated private usage is put on a level with the case of explicitly allowed private usage of email accounts. Consequently, the employer should make sure, that the email account is only used for business purposes. cc) Aspects to consider 55

If the admissibility of an email-screening has to be determined by a weighing of interests according to § 32 BDSG, one can conclude that the use of email log files data is generally a less drastic measure, since log files do not interfere as much with personal rights of the employee as email content.127 Email log files only establish an initial suspicion for an offence or are used as a foundation for further data processing measures. Other criteria during the weighing of interests process are the indications that create a suspicion of the employee and the severity of the offence that is assumed. Overall, each individual case will have to be weighed out on its own merits. dd) Practical considerations

56

In case of explicitly allowed or of tolerated private email accounts use, it will be difficult to distinguish between private and business emails without inspecting the emails and thereby will most probably violate the telecommunications secrecy as even the email header of personal emails is protected by telecommunication secrecy.128 Therefore, as one possible solution, the employer could make sure that the business email account is used for business purposes only. In addition, the employer can allow the private email account use (e.g. gmail, gmx etc.) via internet browser. If this solution is not possible for the employer, it might be advisable to have the employees sign a waiver, i. e. that the employee gives his consent, allowing the employer to carry out certain data collecting, processing or usage measures. However, it must be pointed out that this solution is always risky due to the possible invalidity of the waiver.129

125 Salvenmoser/Schreier, in: Achenbach/Ransiek, Handbuch Wirtschaftsstrafrecht, chapter XV, para107; Klengel/Mu¨ckenberger, CCZ 2009, 81, 83. 126 Da ¨ ubler, Internet und Arbeitsrecht, para. 185; Beckschulze/Henkel, DB 2001, 1491; 1492; Barton, NZA 2006, 460 et seq.; Salvenmoser/Schreier, in: Achenbach/Ransiek, Handbuch Wirtschaftsstrafrecht, chapter XV, para. 105; different opinion: Waltermann, NZA 2007, 529; Thu¨sing, Arbeitnehmerdatenschutz und Compliance, para. 215. 127 Thu ¨ sing, Arbeitnehmerdatenschutz und Compliance, para. 283. 128 Similar Scheben/Klos/Geschonneck, CCZ 2012, 13, 16. 129 Cf. para. 25 and 26.

Spehl/Gru¨tzner

Reemers Publishing Services GmbH O:/Beck/Spehl_Gruetzner/3d/06_Deutschland.3d from 06.03.2013 09:27:58 3B2 9.1.580; Page size: 160.00mm  240.00mm

B. The 25 key questions in connection with internal investigations

189

d) Data screening/data mining130 aa) Data screening or data mining means the comparison of data as the basis for 57 entrepreneurial decisions.131 Within the scope of internal investigations, large data sets, originating in particular from the accounting department, are searched for anything that might suggest a breach of duty or a criminal offence on the part of an employee. Analyzers compare the data on the basis of predefined indicators, at the same time searching for anomalies.132 If an employee is, for instance, under the suspicion of having been involved in corrupt business practices, a comparison of the names of account holders at the level of a customer with the names of employees or relatives of employees could confirm or refute the suspicion.133 bb) Within the scope of the admissibility check relating to a comparison of employee 58 data with customer data, one needs to distinguish in particular between the different categories of data subjects in the individual case: If the data subject is an individual, then the processing may potentially based on, for instance, § 28 (1) sentence 1 no. 1 or no. 2 BDSG.134 The processing of employee data is subject to § 32 (1) BDSG.135 The balancing of interests has to take account of the circumstances of the individual case, in particular the evaluation of the facts suggesting a violation of law.136 The comparison of all employee data with customer data as a precautionary measure and global act is inadmissible;137 comparisons that are carried out at random or as a result of a specific suspicion are usually admissible.138 Where possible, comparisons of such kind should also be carried out on the basis of aliased data.139 cc) If there are in fact circumstances suggesting a breach of duties or criminal offence 59 on an employee’s part, the conflicting interests of the employer and the employee must be weighed up against each other.140 As regards the data of employees under suspicion, the employer has a strong and legitimate interest to investigate illegal 130 § 32 d (3) BDSG-E provides for the possibility for an employer to carry out an automated comparison of employee data in anonymized or aliased form with files kept by the employer to reveal criminal offences or other serious breaches of duties by employees within the scope of their employment relationship, in particular to reveal criminal offences under §§ 266, 299, 331 through 334 StGB. If the comparison gives rise to a suspicion, the data may be personalized. The employer has to document the circumstances that led it to perform the comparison as specified in sentence 1. The employees have to be notified of the content, scope and purpose of the automated comparison as soon as such notification no longer puts the purpose of the comparison at risk. 131 Gru ¨ tzner/Jakob, Compliance A-Z, p. 55. 132 Salvenmoser/Hauschka, NJW 2010, 331, 332; Heinson, BB 2010, 3084. 133 Cf. the interim report prepared by Deutsche Bahn AG to investigate whether the anti-corruption measures taken in the years 1998–2007 were appropriate, which can be downloaded under www.deutschebahn.com/site/shared/de/dateianhaenge/presse/zwischenbericht__090210.pdf (last update: August 2010), pp. 16 et seqq. 134 The requirements that have to be met in order to comply with § 28 BDSG are pointed out in supra para 28. 135 Heinson, BB 2010, 3084, 3085. The requirements that have to be met in order to comply with § 32 BDSG are pointed out in supra para 28. 136 Heinson, BB 2010, 3084, 3087. 137 Steinku ¨ hler, BB 2009, 1294; Heinson, BB 2010, 3085, 3087; Vogt, NJOZ 2009, 4206, 4214; BVerfGE 115, 320, 354; BAG NZA 2008, 1187, 1190. 138 Kock/Francke, NZA 2009, 646, 648. 139 Kock/Francke, NZA 2009, 646, 648. 140 Cf. § 32 (1) sentence 2 BDSG; Heinson, BB 2010, 3084, 3086.

Spehl/Gru¨tzner

Reemers Publishing Services GmbH O:/Beck/Spehl_Gruetzner/3d/06_Deutschland.3d from 06.03.2013 09:27:58 3B2 9.1.580; Page size: 160.00mm  240.00mm

190

§ 6. Germany

conduct.141 In this case, the employee’s interest in the protection of his/her personal data will generally not outweigh the employer’s interest in obtaining clarity because a data comparison constitutes a relatively harmless interference with the data subject’s general personal rights. 60 In case of nonobservance of data protection law regulations and the weighing of interests process, there is a risk of high administrative fines. For instance, in 2009 the Deutsche Bahn AG had to pay the highest administrative fine ever having been paid due to such nonobservance.142 e) Handover, inspection and processing of files, letters and documents of employees 61 aa) According to labor law, the employer may access business-related files, letters

and documents of its employees within the scope of internal investigations.143 Upon the employer’s request, the employee must hand these items over to the employer.144 Nevertheless, the data protection law regulations have to be obliged in these cases as well. Internal and external145 investigators commissioned by the employer may inspect, review and process business-related documents containing an employee’s personal data within the scope of investigations of such kind146 because the employer’s interests outweigh the employees’ interests.147 The employee who has compiled or maintains the files is not permitted to refuse inspection or even to destroy the files.148 The evaluation of print-outs of business-related emails forming part of files in print form is carried out in accordance with the rules of the evaluation of (non-electronic) documents.149 62 bb) The investigators are not permitted to access private files, letters and docu-

ments within the scope of internal investigations.150 If the investigators do not comply with this rule, their actions can constitute a criminal offence within the meaning of § 202 StGB.151 141 Information on the potential consequences of illegal conduct for the company and the company’s management can be found above under paras. 3 et seqq. 142 Cf. www.zeit.de/wirtschaft/unternehmen/2009-10/bahn-bussgeld. The Deutsche Telekom AG had to pay an administrative fine in 2008 also due to nonobservance of data protection law regulations, www.stern.de/politik/deutschland/spitzelaffaere-telekom-zahlt-strafe-aus-porto-kasse622348.html. 143 Klengel/Mu ¨ ckenberger, CCZ 2009, 81, 83. 144 Lunk, NZA 2009, 457, 460; Klengel/Mu ¨ ckenberger, CCZ 2009, 81, 83. 145 Mengel/Ullrich, NZA 2006, 240, 241; Mengel, Compliance und Arbeitsrecht, chapter 4, para. 7. 146 Mengel/Ullrich, NZA 2006, 240, 241; Salvenmoser/Schreier, in: Achenbach/Ransiek, Handbuch Wirtschaftsstrafrecht, chapter XV, para. 137; Go¨pfert/Merten/Siegrist, NJW 2008, 1703, 1705; BAG NZA 1990, 933. 147 Vogel/Glas, DB 2009, 1747, 1752. 148 Mengel/Ullrich, NZA 2006, 240, 241; Go ¨ pfert/Merten/Siegrist, NJW 2008, 1703, 1705; Mengel, Compliance und Arbeitsrecht, chapter 4, para. 7; in general LAG Berlin NJW 1986, 2528. 149 Mengel/Ullrich, NZA 2006, 240, 242. 150 BGH NJW-RR 1990, 764; Maschmann, in: Do ¨ lling, Handbuch Korruptionspra¨vention, chapter 3, para. 100; Salvenmoser/Schreier, in: Achenbach/Ransiek, Handbuch Wirtschaftsstrafrecht, chapter XV, para. 137; Schmalenberg, in: Tscho¨pe, Anwaltshandbuch Arbeitsrecht, 2 A, para. 741 a; Klengel/Mu¨ckenberger, CCZ 2009, 81, 83; Mengel, Compliance und Arbeitsrecht, chapter 4, para. 10; Vogel/Glas, DB 2009, 1747, 1752. 151 Klengel/Mu ¨ ckenberger, CCZ 2009, 81, 83. However it should be noted, that § 202 StGB only penalizes the violation of the written word if committed intentionally.

Spehl/Gru¨tzner

Reemers Publishing Services GmbH O:/Beck/Spehl_Gruetzner/3d/06_Deutschland.3d from 06.03.2013 09:27:58 3B2 9.1.580; Page size: 160.00mm  240.00mm

B. The 25 key questions in connection with internal investigations

191

f) Handover and “mirroring” of the computer and subsequent processing of the 63 business-related data and electronically stored business-related documents of employees (other than emails). aa) As a matter of course, the employer may also request from the employee the 64 handover of the company-owned computer used for business purposes within the scope of internal investigations. A “mirroring” of the computer (or its hard drive) within the meaning of copying the data stored on the computer to another storage medium is classified as a form of processing personal data. As such, it has to be carried out in accordance with the principles as set forth in § 32 (1) sentence 2 BDSG provided that it does not involve any emails subject to telecommunications privacy.152 bb) Pursuant to § 202 a StGB, the intentional inspection of the employee’s private 65 data protected by a password constitutes a criminal offence.153 A password protection means that the individual files or a separate private drive, as applicable, are protected by passwords. A password protection of the entire computer, however, does not result in the files stored on it qualifying as password-protected private files.154 In any case, if the employees are expressly prohibited from using the company-owned computer for private purposes, the inspection of private files protected by passwords does not constitute a criminal offence.155 However, regardless of any password protection, the investigators may only inspect files on the company-owned computer that are marked as “private” if there is a specific suspicion of a material breach of duties or criminal offence relating to the employment relationship.156 g) Inspection of the personnel files of employees aa) Within the scope of internal investigations, the personnel files of employees 66 often constitute an interesting source of information. The personnel files can contain indications of previous breaches of duties on the part of employees but also provide details on the employees’ personal data.157 The processing and use of these personal data are subject to the requirements specified in § 32 (1) BDSG. bb) Personnel files can also contain sensitive data, such as information on religious 67 affiliation, sick leave or maternity leave. These sensible data will generally be irrelevant for purposes of an internal investigation. Prior to an inspection of a personnel file within the scope of an internal investigation, these sensible data have to be blackened out by a member of the human resources department.

152

Cf. supra para. 46 with respect to email attachments. Weißgerber, NZA 2003, 1005, 1008; Salvenmoser/Schreier, in: Achenbach/Ransiek, Handbuch Wirtschaftsstrafrecht, chapter XV, para. 97; Klengel/Mu¨ckenberger, CCZ 2009, 81, 85. 154 LAG Hamm, decision of February 4, 2004, file no. 9 Sa 502/03, BeckRS 2004, 30460285. 155 Salvenmoser/Schreier, in: Achenbach/Ransiek, Handbuch Wirtschaftsstrafrecht, chapter XV, para. 97. 156 Salvenmoser/Schreier, in: Achenbach/Ransiek, Handbuch Wirtschaftsstrafrecht, chapter XV, para. 96. 157 Vogt, NJOZ 2009, 4206, 4210. 153

Spehl/Gru¨tzner

Reemers Publishing Services GmbH O:/Beck/Spehl_Gruetzner/3d/06_Deutschland.3d from 06.03.2013 09:27:59 3B2 9.1.580; Page size: 160.00mm  240.00mm

192

§ 6. Germany

68 cc) The employer is obliged to keep the circle of employees having access to

personnel files as restricted as possible.158 In addition to the competent employees in the human resources department or management, employees in the (company’s) internal auditing department may, to a certain extent, inspect the personnel files within the scope of internal investigations159 if the other requirements specified in § 32 (1) BDSG are met. 69 dd) So far, there have been no court rulings as to whether external investigators may

access personnel files within the scope of internal investigations. It is important that the employees of the group’s auditing department also are qualified as external investigators within the scope of an internal investigation carried out at the level of a group company. If the external investigators are obliged to maintain data confidentiality160 or are subject to a professional confidentiality obligation (e.g. attorneys at law and certified public accountants), they may be granted at least partial access to the personnel files provided that the information in the personnel files is relevant to the investigations in the individual case.161 In that event, the employer’s interest in the information prevails over the employee’s interest not to have his/her data disclosed.162 In the event that they act in the capacity as data processors, the external investigators, however, must have entered into an agreement on commissioned processing163 with the company beforehand. h) Video surveillance of employees 70

Subjecting employees to video surveillance constitutes a considerable interference with the rights of the employees under surveillance and may constitute a criminal offence.164 This does not only apply to internal investigations. According to § 201 a (1) no. 1 and no. 2 StGB, any person who records the words unofficially spoken by another person on a sound storage medium without being authorized to do so or uses or makes available to a third party a recording thus obtained may be liable to imprisonment of up to three years or a fine. The evaluation of the admissibility of a video surveillance measure depends on (i) whether the video surveillance takes place in premises that are publicly accessible or not accessible to the public and (ii) whether the surveillance is kept a secret or conducted in the open. This is also the case when it comes to internal investigations. aa) Admissibility of open surveillance on publicly accessible premises165

71

If the video surveillance is carried out on publicly accessible premises, it does not only affect the rights of the employees but also the rights of the persons who are 158 BAG NZA 2007, 269, 272; Linck, in: Schaub, Arbeitsrechts-Handbuch, § 148, para. 3; Mengel, Compliance und Arbeitsrecht, chapter 4, para. 11. 159 BAG NZA 1990, 933; 934; Mengel, Compliance und Arbeitsrecht, chapter 4, para. 12. 160 Cf. § 5 BDSG. 161 Mengel/Ullrich, NZA 2006, 240, 242; Klengel/Mu ¨ ckenberger, CCZ 2009, 81, 85; Mengel, Compliance und Arbeitsrecht, chapter 4, para. 13; Vogt, NJOZ 2009, 4206, 4210. 162 Mengel/Ullrich, NZA 2006, 240, 242. 163 Cf. § 11 BDSG. 164 Cf. § 201 a StGB. 165 Pursuant to § 32 et seq. (1) sentence 1 BDSG-E, video surveillance will only be admissible in the future if it serves one of the purposes specified in § 32 et seq. (1) sentence 1 BDSG-E (access

Spehl/Gru¨tzner

Reemers Publishing Services GmbH O:/Beck/Spehl_Gruetzner/3d/06_Deutschland.3d from 06.03.2013 09:27:59 3B2 9.1.580; Page size: 160.00mm  240.00mm

B. The 25 key questions in connection with internal investigations

193

(also) filmed (e.g. customers). Publicly accessible premises are premises that are available to the public (e.g. showrooms). This does not include the business premises of a company that are not open to the public.166 The video surveillance of publicly accessible premises is admissible if the video surveillance is necessary for the protection of the owner’s right of undisturbed possession or for the protection of justified interests for specifically determined purposes and if nothing suggests the existence of prevailing legitimate interests of the affected persons.167 Video surveillance as a means of pursuing minor objectives is usually neither necessary nor reasonable.168 Open video surveillance in publicly accessible premises is necessary if there is no other equally efficient option.169 Video surveillance is reasonable if an evaluation of the facts and circumstances of the individual case reveals that the employer’s interests pursued by means of the video surveillance outweigh the protection of the general personal rights of the employee and the third parties.170 Blanket surveillance by camera is unreasonable in any case.171 The evaluation standard, which is important for the use of video surveillance in 72 internal investigations, consists in particular in the intensity of the interference with the general personal right. This intensity is measured according to the following criteria:172 – How many persons are affected by the surveillance measure? – How intensive is the surveillance in terms of time and covered space? – Do the affected persons stay anonymous or will they be identified? – What are the disadvantages the persons concerned could have as a result of the video surveillance measure? – Does the video surveillance measure also concern unsuspicious third parties? Those affected by a video surveillance measure in publicly accessible premises 73 must be able to recognize that they are being monitored and who is monitoring them.173 bb) Admissibility of covert surveillance on publicly accessible premises174 Secret video surveillance of an employee on publicly accessible premises is 74 inadmissible. This is because the carried out surveillance measure and the identity of the controller have to be made transparent with the help of suitable measures.175 control, exercise of right of undisturbed possession, protection of a person’s property, safety of employees, protection of equipment or quality control) and is not outweighed by the legitimate interests of the employee concerned. 166 BAG NZA 2004, 1278, 1282; Gola/Schomerus, BDSG, § 6 b, para. 9; Maschmann, in: Do ¨ lling, Handbuch Korruptionspra¨vention, chapter 3 para. 94. 167 § 6 b (1) BDSG. 168 Thu ¨ sing, Arbeitnehmerdatenschutz und Compliance, para. 355. 169 Bayreuther, NZA 2005, 1038, 1040; Grimm/Schiefer, RdA 2009, 329, 331; Thu ¨ sing, Arbeitnehmerdatenschutz und Compliance, para. 356. 170 Thu ¨ sing, Arbeitnehmerdatenschutz und Compliance, para. 356. 171 Vogt, NJOZ 2009, 4206, 4211. 172 Cf. BAG NZA 2003, 1193, 1195; NZA 2004, 1278, 1283; NZA 2008, 1187, 1190; Grimm/ Schiefer, RdA 2009, 329, 331; Thu¨sing, Arbeitnehmerdatenschutz und Compliance, para. 362. 173 § 6 b (2) BDSG. 174 § 32 et seq. (1) sentence 2 BDSG-E provides for a general prohibition of secret video surveillance in the future. 175 Cf. § 6 b (2) BDSG; Da ¨ ubler, NZA 2001, 874, 878; Maschmann, NZA 2002, 13, 17; Vogt, NJOZ 2009, 4206, 4211; cf. BAG NJW 2003, 3436.

Spehl/Gru¨tzner

Reemers Publishing Services GmbH O:/Beck/Spehl_Gruetzner/3d/06_Deutschland.3d from 06.03.2013 09:27:59 3B2 9.1.580; Page size: 160.00mm  240.00mm

194

§ 6. Germany

cc) Admissibility of open surveillance on not publicly accessible premises176 The open video surveillance of employees on not publicly accessible premises is admissible if there has been a specific suspicion of a criminal offence or another serious misconduct to the employee’s detriment and if less drastic measures to clarify the suspicion have been exhausted.177 76 An open video surveillance on not publicly accessible premises is only reasonable if it is suitable to achieve the intended purpose. The intensity of the interference with the general personal rights of the relevant person caused by the video surveillance measure, in particular the duration and intensity of the surveillance measure, has to be taken into account within the scope of the proportionality review on the basis of the criteria specified above.178 Restrooms, showers and dressing rooms must not be monitored by the employer.179 A video surveillance of such kind could constitute a criminal offence even if carried out within the scope of internal investigations.180 77 It is questionable whether an open video surveillance measure on not publicly accessible premises is suitable to investigate breaches of duty and criminal offences. Anyone who has acted in breach of his/her duties or committed a criminal offence in the past will not repeat this conduct when under open surveillance.181 75

dd) Admissibility of secret surveillance on not publicly accessible premises182 Secret video surveillance on not publicly accessible premises is admissible if there has been a specific suspicion of a criminal offence or any other serious misconduct to the employer’s detriment, less drastic measures to clarify the suspicion have been exhausted and the covert video surveillance is the only measure left to obtain clarification.183 Unlike the open video surveillance, the covert or secret surveillance is a suitable measure to uncover breaches of duty and criminal offences. Due to the fact that the employees concerned do not expect to be the subject of surveillance, they have no reason to abstain from any further illegal conduct. 79 The fact, that the requirements to be met in order to render secret video surveillance on not publicly accessible premises legal are stricter than the standards applied to an open video surveillance, is also true for internal investigations. The 78

176 Pursuant to § 32 et seq. (1) sentence 1 BDSG-E, video surveillance will only be admissible in the future if it serves one of the purposes specified in § 32 et seq. (1) sentence 1 BDSG-E (access control, exercise of right of undisturbed possession or protection of a person’s property) and is not outweighed by the legitimate interests of the employee concerned. 177 Cf. § 32 (1) sentence 2 BDSG; Maschmann, NZA 2002, 13, 17; Salvenmoser/Schreier, in: Achenbach/Ransiek, Handbuch Wirtschaftsstrafrecht, chapter XV, para. 130; Klengel/Mu¨ckenberger, CCZ 2009, 81, 85. 178 Vogt, NJOZ, 2009, 4209, 4211; Grimm/Schiefer, RdA 2009, 329, 337; cf. supra paras. 34 et seqq. 179 Thu ¨ sing, Arbeitnehmerdatenschutz und Compliance, para. 357 with reference to BVerfGE 109, 279; Wybitul, BB 2010, 1085, 1088. 180 Cf. § 201 a StGB. 181 Thu ¨ sing, Arbeitnehmerdatenschutz und Compliance, para. 360. 182 § 32 et seq. (1) sentence 2 BDSG-E provides for a general prohibition of secret video surveillance in the future. 183 Cf. § 32 (1) sentence 2 BDSG; ArbG Freiburg, judgment of September 7, 2004–4 Ca 128/04, LSK 2005, 040641; Grimm/Schiefer, RdA 2009, 329, 335; BAG NJW 2003, 3436, 3437; BAG NZA 2004, 1278, 1282; Maschmann, NZA 2002, 13, 17; Maschmann, in: Do¨lling, Handbuch Korruptionspra¨vention, chapter 3, paras. 91 et seqq.; Dietrich/Schmidt, in: Erfurter Kommentar Arbeitsrecht, Art. 2 GG, para. 98; Klengel/Mu¨ckenberger, CCZ 2009, 81, 85.

Spehl/Gru¨tzner

Reemers Publishing Services GmbH O:/Beck/Spehl_Gruetzner/3d/06_Deutschland.3d from 06.03.2013 09:28:00 3B2 9.1.580; Page size: 160.00mm  240.00mm

B. The 25 key questions in connection with internal investigations

195

secret nature of the investigation measures intensifies the restriction of freedom.184 The admissibility of such secret video surveillance is also subject to the evaluation criteria applied to open video surveillance in publicly accessible premises in case law.185 However, when considering the facts and circumstances of the individual case, the interference with the employees’ rights plays an important role. The employer may, therefore, only revert to the secret video surveillance as a last resort.186 It would be well advised to record the considered evaluation criteria in writing in internal investigations.187 i) Telephone surveillance aa) If private use of the telephone is admissible or tolerated, even the collection of 80 the connection data, such as date, time, duration of the call and the resulting costs is generally only admissible under the TKG188 if these data are required for purposes of settling the costs of private telephone conversations.189 Even if the collection of such data is admissible for purposes of settling the costs, any other use, e.g. within the scope of internal investigations, is inadmissible due to the applicability of the TKG.190 If the use of the telephone has been effectively prohibited for private conversations, these connection data can be monitored in accordance with the principles stipulated in § 32 (1) BDSG, i. e. at random or in case of a suspicion. bb) Whether or not the content of telephone conversations may be monitored 81 depends on the specific circumstances of the individual case and the type of the measure. (1) The covert listening in on private or business-related telephone conversations 82 constitutes a criminal offence.191 The “covert listening in on telephone conversations” is a measure that is unrecognizable to any of the persons involved in the telephone conversation. In individual cases, it might be justified to listen in on a telephone conversation on grounds of self-defense192 if this is necessary to avert a present, i. e. imminent, unlawful violation of a legally protected interest of the employer (e.g. the employer’s property, trade or business secrets).193 However, even the law enforcement authorities in their capacity as the government’s prosecuting body may only revert to a covert listening in on telephone conversations if the requirements of § 100 a StPO (= Strafprozessordnung = Criminal Procedure Code) are met, specifically only in the

184

Cf. BVerfG NJW 2008, 1505, 1507 et seq.; BAG NZA 2008, 1187, 1190. Thu¨sing, Arbeitnehmerdatenschutz und Compliance, para. 369. 186 Thu ¨ sing, Arbeitnehmerdatenschutz und Compliance, para. 369. 187 Vogt, NJOZ 2009, 4206, 4211. 188 Cf. supra paras. 49 et seqq. 189 Heldmann, DB 2010, 1235, 1239. 190 Cf. supra paras. 49 et seqq. 191 Cf. § 201 StGB; Vogt, NJOZ 2009, 4206, 4213; Klengel/Mu ¨ ckenberger, CCZ 2009, 81, 84. 192 Cf. § 32 StGB. 193 BVerfG NJW 1992, 815; Weißgerber, NZA 2003, 1005, 1006; Maschmann, in: Do ¨ lling, Handbuch Korruptionspra¨vention, chapter 3, para. 97; Salvenmoser/Schreier, in: Achenbach/Ransiek, Handbuch Wirtschaftsstrafrecht, chapter XV, para. 117; Schmalenberg, in: Tscho¨pe, Anwaltshandbuch Arbeitsrecht, 2 A, para. 739; Klengel/Mu¨ckenberger, CCZ 2009, 81, 84; Wank, in: Erfurter Kommentar zum Arbeitsrecht, § 32 BDSG, para. 23. 185

Spehl/Gru¨tzner

Reemers Publishing Services GmbH O:/Beck/Spehl_Gruetzner/3d/06_Deutschland.3d from 06.03.2013 09:28:00 3B2 9.1.580; Page size: 160.00mm  240.00mm

196

§ 6. Germany

event of a suspicion of a listed offence (Katalogtat) under § 100 a (2) StPO;194 these measures generally require a court hearing. For this reason, the tapping of telephone conversations initiated by the employer within the scope of internal investigations will only be required in rare and severe exceptional cases. If at all, tapping could most likely qualify as a required measure if the suspicion relates to a criminal offence within the meaning of § 100 a (1) StGB which has a strong impact in the specific individual case as well and is justified for reasons of self-defense and, thus, meets the requirements of § 32 (1) sentence 2 BDSG. Tapping as a preventive measure against criminal offences is generally inadmissible.195 83 (2) Listening in on an employee’s telephone conversation is likewise admissible in individual cases only.196 Within the scope of internal investigations, investigators may only deliberately listen in on a conversation in exceptional cases. Within the scope of internal investigations, listening in on a conversation means that an employee under suspicion is engaged in a telephone conversation – usually with another employee – with an investigator eavesdropping without the knowledge of the employee under suspicion.197 If an investigator deliberately listens in on a conversation between two employees without the knowledge of the employee under suspicion, the act of listening in interferes with the respective employee’s general personal rights under civil law. This violation of the employee’s general personal rights198 usually results in an exclusion of evidence improperly obtained in subsequent proceedings under civil law or labor law.199 The violation of the rights of the employee under suspicion is less severe if an investigator does not deliberately listen in on a conversation but by chance. If the person, the employee under suspicion is having the conversation with, is in the same room and does not take any measures to prevent the investigator from listening in, the violated general personal rights of the employee must be balanced against the employer’s legitimate interests. If the employer’s interests outweigh the employee’s general personal rights, there will be no exclusion of evidence improperly obtained.200 All in all, the investigators should only consider listening in on telephone conversations if the employer’s interests considerably outweigh the protected general personal rights to a considerable extent. The only scenario in which the employer’s legitimate interests have been firmly established to outweigh the interests of the targeted employee is self-defense. Based on the principles of self-defense, it may, for instance, be justified to listen in on a telephone conversation if a specific employee is under the substantiated suspicion of having committed a criminal offence that has a significant effect on the employment relationship.201 The 194 For instance in the event of a particularly severe case of fraud pursuant to § 263 (3) sentence 2 StGB, money laundering pursuant to § 261 (1), (2) StGB or restrictive practices offences pursuant to § 298 StGB, but not in the event of a simple theft. 195 Maschmann, NZA 2002, 13, 18; Maschmann, in: Do ¨ lling, Handbuch Korruptionspra¨vention, chapter 3, para. 97. 196 BVerfG NJW 2002, 3619, 3624; BAG NZA 1998, 307; BVerfG NJW 1992, 815; Maschmann, in: Do¨lling, Handbuch Korruptionspra¨vention, 2007, chapter 3, para. 98. 197 Cf. Maschmann, NZA 2002, 13, 18; Maschmann, in: Do ¨ lling, Handbuch Korruptionspra¨vention, chapter 3, para. 96; Klengel/Mu¨ckenberger, CCZ 2009, 81, 84. 198 Cf. Klengel/Mu ¨ ckenberger, CCZ 2009, 81, 84. 199 BAG NJW 2010, 104, 106. 200 BAG NJW 2010, 104, 108. 201 Wellho ¨ ner/Byers, BB 2009, 2310, 2312; Klengel/Mu¨ckenberger, CCZ 2009, 81, 84.

Spehl/Gru¨tzner

Reemers Publishing Services GmbH O:/Beck/Spehl_Gruetzner/3d/06_Deutschland.3d from 06.03.2013 09:28:00 3B2 9.1.580; Page size: 160.00mm  240.00mm

B. The 25 key questions in connection with internal investigations

197

requirements of § 32 (1) sentence 2 BDSG also have to be taken into account when it comes to the listening in on telephone conversations. j) Search of the workplace The employer may grant internal and external investigators permission to inspect 84 the employees’ offices. This is based on its right to undisturbed possession of the business premises. The inspection, however, constitutes a collection of personal data of the employee concerned.202 For this reason, the principles set forth in § 32 (1) BDSG have to be complied with. However, in most cases, the interference with the employee’s personal rights should be so remote that it will be admissible to open and unlocked filing cabinets or desks of employees.203 Subject to the principles developed for the handover, inspection and processing of files, letters and documents of employees,204 the investigators are allowed to make copies of businessrelated documents205 and take pictures provided that these documents are not connected to the employee’s private sphere as reflected at his/her workplace. Documents or belongings that are clearly part of an employee’s private sphere may not be inspected or used for further investigations. If the investigators open private documents kept under lock, they may be liable to prosecution due to a violation of the privacy of the written word (§ 202 StGB).206 k) Covert listening in on conversations (other than telephone conversations) on the business premises Covert audio recordings of or the covert listening in on the spoken word on the 85 company’s business premises constitute a criminal offence.207 These measures can only be justified within a very narrow scope, on grounds of, for instance, selfdefense or necessity and the legitimate protection of higher-ranking interests.208 l) Investigations carried out in the surroundings of employees under suspicion If certain requirements are met, internal or external investigators may interview 86 third parties in any way related to an employee under suspicion and use the findings against the employee within the scope of labor disputes or civil proceedings.209 Given the fact that in most cases the interview will probably result in an automated processing of the third parties’ personal data,210 the requirements stipulated in the Cf. § 32 (2) BDSG. Salvenmoser/Schreier, in: Achenbach/Ransiek, Handbuch Wirtschaftsstrafrecht, chapter XV, para. 90; Klengel/Mu¨ckenberger, CCZ 2009, 81, 85. Inspections of private belongings such as coats, briefcases or handbags are, however, treated differently. 204 Cf. supra paras. 61 et seq. 205 Salvenmoser/Schreier, in: Achenbach/Ransiek, Handbuch Wirtschaftsstrafrecht, chapter XV, para. 90. 206 Salvenmoser/Schreier, in: Achenbach/Ransiek, Handbuch Wirtschaftsstrafrecht, chapter XV, para. 90; Klengel/Mu¨ckenberger, CCZ 2009, 81, 85. 207 Cf. § 201 (2) sentence 1 no. 1 StGB. 208 §§ 32, 34 StGB; LAG Berlin DB 1988, 1024; Salvenmoser/Schreier, in: Achenbach/Ransiek, Handbuch Wirtschaftsstrafrecht, chapter XV, para. 123; cf. also the principles on secret video surveillance as set forth under supra paras. 70 et seq. 209 Klengel/Mu ¨ ckenberger, CCZ 2009, 81, 86. 210 Cf. § 3 (2) BDSG. 202 203

Spehl/Gru¨tzner

Reemers Publishing Services GmbH O:/Beck/Spehl_Gruetzner/3d/06_Deutschland.3d from 06.03.2013 09:28:01 3B2 9.1.580; Page size: 160.00mm  240.00mm

198

§ 6. Germany

BDSG with respect to the admissibility of this measure also have to be complied with in connection with the interviewed third party. To the extent that the data subject is a third party voluntarily participating in an interview, the data processing of such third party’s personal data is justified pursuant to § 28 (1) sentence 1 no. 2 BDSG. To the extent that the data subject is the employee under suspicion, the justification requirements of § 32 (1) BDSG and the principle of the direct collection of personal data from the data subject stipulated in § 4 (2) sentence 1 BDSG have to be complied with.211 Collecting personal data of the suspected employee from a third party without its cooperation is only admissible if the requirements for an exception from the principle of the direct collection of personal data from the data subject212 are met.213 Without the employee’s cooperation, personal data may, therefore, inter alia only be collected if the business purpose requires such collection from other persons or bodies and nothing suggests an interference with the data subject’s overriding legitimate interests. For purposes of obtaining all available evidence, the requirements for this exception should usually be met within the scope of an internal investigation.214 m) “Mock investigations” 87

Companies are showing increasing interest in so-called “mock investigations”. The term “mock investigation” refers to an internal investigation carried out for test purposes and as contingency training. However, for purposes of the protection of data privacy, the collection, processing and use of personal data within the scope of these mock investigations is inadmissible. In all likelihood, employers will not be able to successfully argue that the data processing involved in mock investigations is required to perform the employment relationship or reasonable.215 n) Side Note: Amnesty programs

88 aa) If employees are suspected of having breached their duties systematically and on

a company-wide level or of having committed a criminal offence, an amnesty program for employees can contribute substantially to the clarification of the situation. Corruption offences are often and especially surrounded by a wall of silence. This is because of fear of sanctions under labor or criminal law, which precludes internal investigations.216 Within the scope of an amnesty program, the company makes a promise to those employees willing to cooperate that the company will not impose certain sanctions against them if they help clarify the situation. 89 bb) An amnesty program can be set up as a commitment to the employees not to

assert any claims or enforce sanctions under labor law in court if the employee 211

Personal data have to be collected from the data subject. Cf. § 4 (2) sentence 2 BDSG. 213 § 32 a (6) BDSG-E provides that in the future any employee data have to be directly collected from the respective employee. Any collection of an employee’s personal data from other third parties on the employer’s part will require the employee’s consent; upon a corresponding request, the employee will then have to be informed about the content of the collected data. 214 Vogel/Glas, DB 2009, 1747, 1750. 215 Cf. § 32 (1) sentence 1 BDSG. 216 Annuß/Pelz, BB Special 4 (relating to BB 2010, issue 50), 14; Schu ¨ rrle/Olbers, CCZ 2010, 178, 182. 212

Spehl/Gru¨tzner

Reemers Publishing Services GmbH O:/Beck/Spehl_Gruetzner/3d/06_Deutschland.3d from 06.03.2013 09:28:01 3B2 9.1.580; Page size: 160.00mm  240.00mm

B. The 25 key questions in connection with internal investigations

199

contributes to the clarification or agrees to contribute up to a certain point in time. In the event that the employer initiates a corresponding legal dispute in spite of the commitment made, the employee may rely on the employer’s commitment.217 An amnesty program can also take the form of an offer to enter into a release agreement.218, 219 cc) The employer must make sure that the amnesty program is target-oriented. The 90 employer may not globally waive its right to assert claims for damages or give notices of termination vis-a`-vis all employees involved in the wrongdoings.220 Amnesty arrangements of such kind would be detrimental to the company. They would be equivalent to management measures based on an incorrect assessment of the situation.221 dd) Amnesty provisions containing specific incentives for particular insiders in the 91 form of a “leniency program” in order to obtain information kept secret up to a certain point in time are admissible provided that certain principles are complied with in the development of such a program.222 The waiver of claims or disciplinary action must be appropriate. The waiver is only deemed appropriate if the specific disadvantages of the waiver outweigh the advantages of the employee’s cooperation in the investigation.223 It is therefore advisable not to make the decision as to whether or not the employer will waive its right to assert claims against the employee until after the employee has provided his/her statement.224 It is likewise recommendable to set a time limit after which the employees can no longer take advantage of the amnesty program.225 Without consulting the law enforcement authorities, access to the amnesty program should be limited to mid-level and junior executives.226 ee) A waiver of disciplinary action only takes effect if the employees participating in 92 the amnesty program are already under a specific suspicion of a certain conduct. The employer must not haphazardly waive its right to give notice for cause.227 When developing the details of amnesty programs, it must be considered that a waiver of claims or disciplinary action may set a negative example. The other employees could get the impression that the employer will not sanction violations of law.228 An extensive amnesty program can also raise concerns with the authorities.229 217

Wastl/Pusch, RdA 2009, 376, 377. § 397 BGB. 219 Wastl/Pusch, RdA 2009, 376, 377. 220 Annuß/Pelz, BB Special 4 (relating to BB 2010, issue 50), 14. 221 Go ¨ pfert/Merten/Siegrist, NJW 2008, 1703, 1704; Breßler/Kuhnke/Schulz/Stein, NZG 2009, 721, 723 et seq.; Schu¨rrle/Olbers, CCZ 2010, 178, 181; v. Rosen, Internal Investigations bei Complianceversto¨ßen, p. 98. 222 Under German civil law (§ 276 (3) BGB), only the advance waiver of claims for damages caused intentionally is prohibited. A subsequent waiver of such claims is admissible. 223 Schu ¨ rrle/Olbers, CCZ 2010, 178, 181. 224 Schu ¨ rrle/Olbers, CCZ 2010, 178, 182. 225 Schu ¨ rrle/Olbers, CCZ 2010, 178. 226 Schu ¨ rrle/Olbers, CCZ 2010, 178, 182. 227 BAG BB 2003, 314, 315; Breßler/Kuhnke/Schulz/Stein, NZG 2009, 721, 724. 228 Go ¨ pfert/Merten/Siegrist, NJW 2008, 1703, 1704; Schu¨rrle/Olbers, CCZ 2010, 178, 182. 229 Breßler/Kuhnke/Schulz/Stein, NZG 2009, 721, 726. 218

Spehl/Gru¨tzner

Reemers Publishing Services GmbH O:/Beck/Spehl_Gruetzner/3d/06_Deutschland.3d from 06.03.2013 09:28:01 3B2 9.1.580; Page size: 160.00mm  240.00mm

200

§ 6. Germany

93 ff) The company’s waiver of claims or disciplinary action can be made subject to

the fulfillment of certain requirements such as e.g. the employee’s full cooperation in the clarification of the situation. As criminal prosecution cannot be initiated by the employer, the only available option in the majority of cases is the promise that the company will abstain from reporting the offence to the police or demanding prosecution.230 If the employee does not cooperate as agreed, the amnesty agreement will become invalid with retroactive effect.231 Depending on the incentive to be offered to the individual employees, different amnesty offers, such as waiving only the right to assert claims for damages or only the right to take disciplinary action, can be determined for individual employees. 94 gg) The principles and ideas underlying an amnesty program have to be documen-

ted in order to ensure the transparency and verifiability of the criteria applied to determine the appropriateness of the waiver of claims or disciplinary measures. 2. Must employee representatives such as the works council be involved in internal investigations? 95

The works council does not have a general right of co-determination as regards to the issue of whether or not a company may conduct internal investigations and how exactly these are structured.232 When it comes to individual measures within the scope of the internal investigations, the employer must, however, obtain the works council’s consent or inform the works council of these upcoming measures. a) The works council’s rights of co-determination and information

96 aa) Prior to introducing certain measures, such as the implementation of video

surveillance, the employer must obtain the works council’s consent. In such cases, the works council has a vote equal to that of the employer enabling the works council to co-determine as to whether and how the measure is to be implemented. This is called a right of co-determination.233 97 bb) For other issues, the employer is only obliged to inform the works council

of the upcoming measures.234 The main objective of this right to information is to enable the works council to attend to its supervisory duties.235 The works council ensures that the legal provisions and agreements concluded for the benefit of the employees are adhered to.236 The works council has a right to information

230 231

Breßler/Kuhnke/Schulz/Stein, NZG 2009, 721, 722. § 158 (2) BGB; Breßler/Kuhnke/Schulz/Stein, NZG 2009, 721, 723; Wastl/Pusch, RdA 2009, 376,

379. 232 Zimmer/Heymann, BB 2010, 1853. In the event that personal data are collected, used or processed within the scope of internal investigations, it might be recommendable to enter into a works agreement in order to obtain the required consent to the collection, use or processing within the meaning of § 4 (1) BDSG. 233 Richardi, BetrVG, Introduction to Part 4, paras. 21, 28 et seq. 234 Richardi, BetrVG, Introduction to Part 4, para. 22 235 Richardi, BetrVG, § 105, para. 7. 236 § 80 (1) no. 1 German Works Constitution Act (Betriebsverfassungsgesetz = BetrVG).

Spehl/Gru¨tzner

Reemers Publishing Services GmbH O:/Beck/Spehl_Gruetzner/3d/06_Deutschland.3d from 06.03.2013 09:28:02 3B2 9.1.580; Page size: 160.00mm  240.00mm

B. The 25 key questions in connection with internal investigations

201

to the extent that there is a potential requirement for it to exercise its supervisory duty.237 cc) If the measures conducted in the scope of the internal investigations affect 98 company officers, the works council generally238 does not have any rights of codetermination or information.239 According to case law, employees at the level of “Head of Department” and above are usually considered company officers.240 dd) The works council always has the right to co-determination and information 99 irrespective of whether or not the internal investigation is being conducted by internal or external investigators.241 b) The works council’s rights regarding individual measures242 aa) Employee Interviews (1) The works council must be informed prior to and after any interview with an 100 employee as to its scope and content.243 (2) The works council does not have a co-determination right with regard to the 101 employees’ conduct concerning his or her working duties. Its rights are restricted to the employees’ proper conduct in business.244 This means that the works council does not have a co-determination right as to the execution or the content of employee interviews: (a) The execution of interviews exclusively concerns the employees’ working duties and, therefore, does not give rise to a co-determination right of the works council.245 By participating in the interview, the employee complies with his/her duties under the employment contract. (b) The content of an interview does not give rise to a co-determination right of the works council.246 The co-determination right of the works council in matters of proper conduct with regard to the overall business organization serves the purpose of prospectively and collectively shaping proper employee conduct in the employer’s business.247 The facts and circumstances covered by the inter237

BAG NZA 1999, 1345, 1346. Exceptions pursuant to §§ 75 (1), 105, 107, 108 BetrVG. 239 § 3 BetrVG. 240 Eisemann/Koch, in: Erfurter Kommentar Arbeitsrecht, § 5 BetrVG, para. 41 with references to case law. 241 BAG NZA 1987, 747; Maschmann, in: Do ¨ lling, Handbuch Korruptionspra¨vention, chapter 3, para. 20. 242 Overview concerning the works council’s rights with regard to the different investigation measures: Wybitul/Bo¨hm, RdA 2011, 362, 367. 243 Cf. § 80 (2) BetrVG; BAG NZA 1999, 1345, 1346; Mengel, Compliance und Arbeitsrecht, chapter 4, para. 32; Mengel/Ullrich, NZA 2006, 240, 244; Vogt, NJOZ 2009, 4206, 4218. 244 § 87 (1) no. 1 BetrVG; BAG NJW 1982, 404. 245 Mengel/Ullrich, NZA 2006, 240, 244; Go ¨ pfert/Merten/Siegrist, NJW 2008, 1703, 1709; Vogt, NJOZ 2009, 4206, 4218; Zimmer/Heymann, BB 2010, 1853, 1854. 246 Zimmer/Heymann, BB 2010, 1853, 1854. If the employee is asked to provide information with regard to other employees Wybitul/Bo¨hm, RdA 2011, 362, 365 plead for the existence of a codetermination right since in this case not only the employee’s working duties are affected, but also the overall business organization. 247 Kania, in: Erfurter Kommentar, § 87 BetrVG, para. 18. 238

Spehl/Gru¨tzner

Reemers Publishing Services GmbH O:/Beck/Spehl_Gruetzner/3d/06_Deutschland.3d from 06.03.2013 09:28:02 3B2 9.1.580; Page size: 160.00mm  240.00mm

202

§ 6. Germany

view do not concern the future development of the employment relationship but the clarification of past conduct. The conduct requiring clarification is therefore closely linked to the fulfillment of work duties.248 102 (3) If questionnaires are used to interview the employees, the works council has a right of co-determination.249 The works council even has a right of co-determination if the investigators interview an employee on personal issues using a standardized questionnaire and record the questions in writing.250 The right of co-determination, however, is not given in the case when external investigators conduct the interview and pass on the results of the interview or investigations, respectively to the employer by rendering these both anonymous and untraceable to a specific individual.251 Because the co-determination right does not extend to individual questions but only to questions addressed in the same manner to a larger group of persons, the preparation of separate questionnaires or lists of questions for the standardized and the individual questions is advisable.252 bb) Monitoring, copying and processing of documents and emails (1) Business-related documents and emails of employees. (a) The works council’s right of co-determination is not triggered when the employer instructs its employees to hand over business-related documents, files (in paper or electronic form), business-related letters or emails or should the employer, at a later point in time, inspect, copy, process or evaluate the business-related documents, files, letters or emails.253 The employer is merely obliged to inform the works council of the inspection and evaluation of any business-related documents, letters, files and emails to the extent that this is required by the works council in order to exercise its right of supervision.254 104 (b) The introduction or operation of data-processing systems enabling the employer to collect data regarding the usage of email or the Internet or to access the emails of its employees are subject to the works council’s consent.255 The employer must fully inform the works council on all aspects of the measure 103

248

Zimmer/Heymann, BB 2010, 1853, 1854; in favor of a partial co-determination right in the event that issues relating to an employee’s conduct are addressed Mengel/Ullrich, NZA 2006, 240, 244; Go¨pfert/Merten/Siegrist, NJW 2008, 1703, 1709; Vogt, NJOZ 2009, 4206, 4218; Mengel, Compliance und Arbeitsrecht, chapter 4, para. 37. 249 § 94 (1) BetrVG. 250 BAG NZA 1994, 375, 376; Mengel, Compliance und Arbeitsrecht, chapter 4, para. 37; Zimmer/ Heymann, BB 2010, 1853, 1854. 251 Mengel/Ullrich, NZA 2006, 240, 245; Mengel, Compliance und Arbeitsrecht, chapter 4, para. 37. 252 Zimmer/Heymann, BB 2010, 1853, 1854. 253 BAG DB 1981, 1144; DB 1982, 1116; Mengel/Ullrich, NZA 2006, 240, 244; Go ¨ pfert/Merten/ Siegrist, NJW 2008, 1703, 1709; Vogt, NJOZ 2009, 4206, 4218 et seq.; Mengel, Compliance und Arbeitsrecht, chapter 4, para. 34; Zimmer/Heymann, BB 2010, 1853, 1855. 254 The works council monitors compliance with the legal provisions put in place for the employees’ benefit, including the employee-specific regulations as specified in the German Federal Data Protection Act (BDSG). 255 § 87 (1) no. 6 BetrVG, Kania, in: Erfurter Kommentar Arbeitsrecht, § 87 BetrVG, para. 48 et seq.; Maschmann, in: Do¨lling, Handbuch Korruptionspra¨vention, chapter 3, para. 21, 95; Salvenmoser/Schreier, in: Achenbach/Ransiek, Handbuch Wirtschaftsstrafrecht, chapter XV, para. 166; Wolf/Mulert, BB 2008, 442, 444; Klengel/Mu¨ckenberger, CCZ 2009, 81, 85; Mengel, Compliance und Arbeitsrecht, chapter 4, para. 34.

Spehl/Gru¨tzner

Reemers Publishing Services GmbH O:/Beck/Spehl_Gruetzner/3d/06_Deutschland.3d from 06.03.2013 09:28:02 3B2 9.1.580; Page size: 160.00mm  240.00mm

B. The 25 key questions in connection with internal investigations

203

already during the initial planning stages.256 Co-determination is not required if the technical infrastructure needed to access, for instance, business-related emails is already in place and the works council was properly involved in its development.257 (2) Private documents, letters or files and private emails of employees. If, due 105 to a specific suspicion, the employer is exceptionally permitted to ask an employee to hand over documents, letters, files or emails of a private nature in order to verify whether a material breach of duty or a criminal offence has been committed, the works council must be informed (of this) to the extent that this information is required for the works council to be able to exercise its supervisory duty.258 If the employees are not permitted to use their email account for private purposes, the works council must consent to the email screening as the monitoring process can reveal whether the employee is adhering to the corporate computer usage policy.259 The works council does not have a right of co-determination if the relevant works agreement already contains provisions as to the measures the employer may take in order to monitor compliance with its email usage policy. In this case, the internal investigations must be conducted in accordance with the provisions laid down in the works agreement.260 (3) Inspection of the personnel files of employees. When it comes to inspecting 106 the personnel file of an employee, the works council does not have any rights of codetermination. It has a right to be informed about any processing of the employees’ personal data. cc) Data screening/data mining Data mining does not require the works council’s consent.261 The purpose of data 107 mining is not to monitor the employees’ proper conduct in business.262 The comparison of existing data by means of computer software does not involve a “technical device”.263 As it involves the processing of personal employee data, the works council must be notified of any data mining. dd) Surveillance measures The works council has a right of approval if video surveillance264 or data 108 processing systems enabling the employer to collect data pertaining to the tele-

256 § 80 (2) BetrVG; BAG DB 1988, 50; Ku ¨ ttner, Personalhandbuch, Kontrolle des Mitarbeiters, para. 11. 257 Zimmer/Heymann, BB 2010, 1853, 1855. 258 § 80 (1) no. 1 BetrVG. 259 § 87 (1) no. 1 BetrVG; Go ¨ pfert/Merten/Siegrist, NJW 2008, 1703, 1708; Mengel, Compliance und Arbeitsrecht, chapter 4, para. 35. 260 Mengel, Compliance und Arbeitsrecht, chapter 4, para. 35. 261 ArbG Dessau-Roßlau, decision of June 17, 2009, file no. 1 BV 1/09, BeckRS 2009, 69201. 262 § 87 (1) no. 1 BetrVG; Diller, BB 2009, 438. 263 § 87 (1) no. 6 BetrVG; Diller, BB 2009, 438. 264 BAG NJW 2005, 313; NZA 2008, 1187.

Spehl/Gru¨tzner

Reemers Publishing Services GmbH O:/Beck/Spehl_Gruetzner/3d/06_Deutschland.3d from 06.03.2013 09:28:03 3B2 9.1.580; Page size: 160.00mm  240.00mm

204

§ 6. Germany

phone usage of its employees265 are to be introduced or operated.266 The employer must fully inform the works council on all aspects of the measure already during the initial planning stages.267 ee) Search of the workplace 109

The works council must consent to any search conducted in an employee’s work place.268 ff) Investigations carried out in the surroundings of employees

110

Investigations being carried out in the surroundings of an employee suspected of wrongdoing do not trigger the works council’s rights to information or of codetermination. gg) Amnesty programs

111

The employer alone decides whether an amnesty program is to be introduced. Should the employer decide to introduce an amnesty program, it may be required, and in any case make sense, to obtain the works council’s consent to the program’s content and structure.269 c) Consequences if rights of co-determination are not observed

112

If the employer does not observe the works council’s rights of co-determination,270 the works council may demand from the employer to abstain from introducing the planned or impending measures due to the violation of the relationship between employer and works council (Betriebsverha¨ltnis).271 Should the employer systematically violate the works council’s rights of co-determination, the works council may obtain a court injunction.272 If the employer violates the court injunction, the labor court can impose an administrative fine of up to EUR 10.000 in each case against the employer.273

265 Kania, in: Erfurter Kommentar Arbeitsrecht § 87 BetrVG, paras. 48 et seq.; Maschmann, in: Do¨lling, Handbuch Korruptionspra¨vention, chapter 3, paras. 21, 95; Salvenmoser/Schreier, in: Achenbach/Ransiek, Handbuch Wirtschaftsstrafrecht, chapter XV, para. 166; Wolf/Mulert, BB 2008, 442, 444; Klengel/Mu¨ckenberger, CCZ 2009, 81, 85; Vogt, NJOZ 2009, 4206, 4218; Grimm/ Schiefer, RdA 2009, 329, 337. 266 § 87 (1) no. 6 BetrVG. 267 § 80 (2) BetrVG; BAG DB 1988, 50; Ku ¨ ttner, Personalhandbuch, Kontrolle des Mitarbeiters, para. 11. 268 § 87 (1) no. 1 BetrVG; BGH NJW 2008, 2732. 269 § 87 (1) no. 1 BetrVG; against a co-determination right Breßler/Kuhnke/Schulz/Stein, NZG 2009, 721, 725; Zimmer/Heymann, BB 2010, 1853, 1855; in favor of a duty to cooperate Go¨pfert/ Merten/Siegrist, NJW 2008, 1703, 1708. 270 §§ 87 (1), 94 BetrVG. 271 BAG NJW 1995, 1044; Kania, in: Erfurter Kommentar Arbeitsrecht, § 87 BetrVG, para. 138; Maschmann, in: Do¨lling, Handbuch Korruptionspra¨vention, chapter 3, para. 22. 272 § 23 (3) sentence 1 BetrVG. 273 § 23 (3) sentences 2, 5 BetrVG.

Spehl/Gru¨tzner

Reemers Publishing Services GmbH O:/Beck/Spehl_Gruetzner/3d/06_Deutschland.3d from 06.03.2013 09:28:03 3B2 9.1.580; Page size: 160.00mm  240.00mm

B. The 25 key questions in connection with internal investigations

205

3. Overview The following table provides a summary on the findings mentioned in the previous 113 two questions regarding the admissibility of individual measures taken within the scope of internal investigations and the works council’s participation in these measures. The table only provides an overview and serves as a general indication of the facts and circumstances forming the subject matter of the detailed statements. Measure

Admissibility

Works council’s participation rights

Employee interviews

generally admissible, § 32 BDSG to be observed where applicable

– always right to information – right of co-determination if interviews focus on employee’s conduct or if employee questionnaires focus on personal situation

Email screening if the business email account is used exclusively for business purposes

– monitoring of email log files admissible – viewing of content generally admissible § 32 BDSG to be observed where applicable; TKG not to be observed

– right to information if this affects works council’s supervisory duties – right of co-determination in case of installation of technical surveillance devices

Email screening if the business email account may be used for private purposes

prevailing opinion: – monitoring of email log files inadmissible, because of the telecommunications secrecy (TKG must be observed) – viewing of content inadmissible one opinion: – monitoring of email log files admissible – monitoring of content generally admissible in the event of a specific suspicion of a criminal offence – TKG not be obeserved

one opinion: – right to information if this affects works council’s supervisory duties – right of co-determination in case of installation of technical surveillance devices other opinion: – right to information if this affects works council’s supervisory duties – right of co-determination if private usage of email account is not permitted

Spehl/Gru¨tzner

Reemers Publishing Services GmbH O:/Beck/Spehl_Gruetzner/3d/06_Deutschland.3d from 06.03.2013 09:28:04 3B2 9.1.580; Page size: 160.00mm  240.00mm

§ 6. Germany

206

Measure

Admissibility

Works council’s participation rights

Email screening if private usage of the business email account is not permitted but tolerated

– corresponds to permitted private usage with respect to both screening of log files and screening of email content

one opinion: – right to information if this affects works council’s supervisory duties – right of co-determination in case of installation of technical surveillance devices other opinion: – right to information if this affects works council’s supervisory duties – right of co-determination if private usage of email account is not permitted

Data screening/ data mining

– processing of customer data (if the customer is an individual) within the scope of § 28 (1) sentence 1 no. 1 or no. 2 BDSG admissible – processing of employee data within the scope of § 32 (1) BDSG admissible – processing of data of employee’s relatives within the scope of § 28 (1) sentence 1 no. 2 BDSG admissible – synchronization of business partners with consolidated anti-terrorist list of European Union advisable (for reasons of § 34 (4) no. 1 German Foreign Trade and Payments Act (Außenwirtschaftsgesetz, AWG)); admissibility of synchronization with other anti-terrorist lists depends on circumstances of the individual case

– right to information if this affects works council’s supervisory duties – no right of co-determination

Spehl/Gru¨tzner

Reemers Publishing Services GmbH O:/Beck/Spehl_Gruetzner/3d/06_Deutschland.3d from 06.03.2013 09:28:04 3B2 9.1.580; Page size: 160.00mm  240.00mm

B. The 25 key questions in connection with internal investigations

Measure

Admissibility

207

Works council’s participation rights

Handover, inspection and processing of business-related documents, files and letters

generally admissible, § 32 BDSG to be observed where applicable

– right to information if this affects works council’s supervisory duties – no right of co-determination

Handover, inspection and processing of private documents, files and letters

generally inadmissible

./.

Handover and “mirroring” of the PC and processing of business-related data files and electronic documents (other than emails)

generally admissible, § 32 BDSG to be observed where applicable

– right to information if this affects works council’s supervisory duties – no right of co-determination

Handover and “mirroring” of the PC and processing of private data files and electronic documents (other than emails)

generally admissible if not password-protected; § 32 BDSG to be observed

right of co-determination

Inspection of employee’s personnel file

Within the scope of § 32 BDSG – admissible for internal investigators – possible for external investigators

no right of co-determination

Spehl/Gru¨tzner

Reemers Publishing Services GmbH O:/Beck/Spehl_Gruetzner/3d/06_Deutschland.3d from 06.03.2013 09:28:05 3B2 9.1.580; Page size: 160.00mm  240.00mm

§ 6. Germany

208

Measure

Admissibility

Works council’s participation rights

Video surveillance of employees

– open video surveillance in publicly accessible premises within the scope of § 6 b BDSG admissible – covert video surveillance in publicly accessible premises inadmissible – open video surveillance in premises not publicly accessible within the scope of § 32 (1) BDSG admissible – secret video surveillance in premises not publicly accessible within the scope of § 32 (1) BDSG admissible.

right of co-determination

Tapping of telephone conversations

– tapping of phone conversations inadmissible – listening in on phone conversations admissible under certain circumstances

right of co-determination

Search of the workplace

admissible within the scope of § 32 BDSG as long as search does not include any private belongings or belongings that are locked up

right of co-determination

Listening in on employee conversations on business premises

inadmissible

./.

Investigations carried out in the surroundings of employees under suspicion

admissible within the scope of § 32 (1) and § 4 (2) sentence 1 BDSG in the case of employees; in case of third parties admissible in the scope of § 28 BDSG

no right of co-determination

Amnesty programs

only admissible if incentive program is target-oriented

right of co-determination

Spehl/Gru¨tzner

Reemers Publishing Services GmbH O:/Beck/Spehl_Gruetzner/3d/06_Deutschland.3d from 06.03.2013 09:28:05 3B2 9.1.580; Page size: 160.00mm  240.00mm

B. The 25 key questions in connection with internal investigations

209

III. Employee interviews 1. May an employee refuse to provide information if this information would incriminate himself/herself? Interviews are, above all, to be conducted with employees who are suspected of a 114 breach of duty or a criminal offence by their employer. This leads to the question whether or not the investigators may demand that employees also provide answers to questions concerning their own misconduct. a) Duty to provide information on the tasks directly assigned to the employee or carried out by the employee aa) If the employer requests information on matters concerning the personal 115 scope of work, in particular the personal activities conducted at the workplace and the corresponding work results of the employee, the employee must provide this information.274 In this core area of the employment relationship, the employee must provide the requested information even if he/she had to incriminate himself/ herself.275 In each individual case, the conflicting interests of the employer and the employee must be balanced against one another. If the information request concerns the employee’s direct scope of work and if it serves to investigate material breaches of duty or criminal offences in connection with the immediate obligations of the employee under his/her employment contract, the interest of the employer in the clarification of the facts prevails.276 The employee’s right not to be obliged to incriminate himself/herself must not serve the purpose of preventing the employer – who has suffered damage – from asserting its claims arising from the breach of duties under the employment contract.277 A security guard, for instance, who neglected his supervisory duties and fell asleep during his working hours, may not refuse to provide information on his observations as regards a burglary that took place during his working hours because he would have to admit to a breach of duty at the same time. The same applies to an employee working as a bookkeeper who, at the employer’s request, must respond to the allegation that he/she had competed with his/her employer by rebooking incoming orders in the system to be able to carry these out for his/her own account.278 An employer may ask its sales representative whether he/she accepted any impermissible gifts or other benefits.279 274 §§ 666, 675 BGB in analogy; BAG NZA 2002, 618; LAG Berlin NZA 1993, 27; Preis, in: Erfurter Kommentar Arbeitsrecht, § 611 BGB, para. 23; Diller, DB 2004, 313; Go¨pfert/Merten/ Siegrist, NJW 2008, 1703, 1705; Jahn, StV 2009, 41, 43; Bo¨hm, WM 2009, 1923, 1924; Mengel, Compliance und Arbeitsrecht, chapter 4, para. 21; v. Rosen, Internal Investigations bei Complianceversto¨ßen, p. 95; Spehl, CCZ 6/2011, VIII; Gerst, CCZ 2012, 1, 3 et. seq. 275 LAG Hamm CCZ 2010, 237; BGHZ 41, 318, 322; BGH NJW 1990, 510, 511 (both on the contractual relationship); Sprau, in: Palandt, BGB, § 666, para. 1; Diller, DB 2004, 313, 314; Lu¨tzeler/Mu¨ller-Sartori, CCZ 2011, 19, 20; v. Rosen, Internal Investigations bei Complianceversto¨ßen, p. 96;; with a critical view Jahn, StV 2009, 41, 43; Wastl/Litzka/Pusch, NStZ 2009, 68, 70; Vogt, NJOZ 2009, 4206, 4212. 276 Lu ¨ tzeler/Mu¨ller-Sartori, CCZ 2011, 19, 20; other opinion Dann/Schmidt, NJW 2009, 1851, 1853. 277 ArbG Saarlouis, ZIP 1984, 364, 365. 278 LAG Hamm, CCZ 2010, 237. 279 Lu ¨ tzeler/Mu¨ller-Sartori, CCZ 2011, 19, 20.

Spehl/Gru¨tzner

Reemers Publishing Services GmbH O:/Beck/Spehl_Gruetzner/3d/06_Deutschland.3d from 06.03.2013 09:28:05 3B2 9.1.580; Page size: 160.00mm  240.00mm

210

§ 6. Germany

116 bb) If criminal proceedings are taking place at the same time as the internal

investigations, this does not affect the employer’s information request. The employer’s option to request the public prosecutor to provide information on ongoing criminal proceedings if the employer has a justified interest in the information280 does not eliminate the employee’s contractual duty to provide information. b) Duty to provide information in indirect connection with the scope of work 117

Outside the scope of the tasks directly assigned to an employee or carried out by an employee, the employer’s claim to be provided with information no longer results from the employment contract, but rather is derived from the principle of good faith (§ 242 BGB = Bu¨rgerliches Gesetzbuch = German Civil Code).281 Criminal offences and material breaches of duties are indirectly linked to the employment relationship if the employee commits them whilst fulfilling his/her duties under the employment contract. Whether or not the employee must also provide information on his/her own criminal behavior in this area must be decided in each individual case. In scenarios like these, the interests of the employee must be attributed more weight and they may prevail over the employer’s interest to investigate facts if the information request does not concern the employee’s immediate contractual duties.282 The employer’s interests prevail if an employee, for instance, uses a vacation trip to a foreign country to hand over bribes in large amounts to a third party in this country. In such cases, the employee is also obliged to prevent his/her employer from suffering any damage.283 c) Duty to provide information outside the scope of work

118

The employee is only obliged to answer questions on criminal offences that exclusively relate to the employee’s private life if the employer has a predominant interest.284 Generally, the employee is not obliged to answer questions regarding his/her conduct outside the scope of work if the employee would have to incriminate himself/herself.285 An obligation to incriminate oneself is excluded even if criminal offences committed by the employee in his/her private life are related to the employment relationship due to special contractual provisions, thus potentially justifying his/her dismissal. For example, even if an employee undertakes to renounce violence under his/her employment contract, he/she is not obliged to provide information on any potential involvement as a private individual in an assault resulting in bodily injury.286

§ 475 StPO. BAG NZA 1996, 637, 638; NZA 1997, 41. 282 Described in more detail in Dann/Schmidt, NJW 2009, 1851, 1853. 283 Bo ¨ hm, WM 2009, 1923, 1925. 284 Rieble, ZIP 2003, 1273, 1277; Diller, DB 2004, 313, 318; Mengel/Ullrich, NZA 2006, 240, 243; Wastl/Litzka/Pusch, NStZ 2009, 68, 70. 285 BAG NZA 1996, 637, 640; BAG NJW 2009, 1897; Diller, DB 2004, 313, 314; Go ¨ pfert/Merten/ Siegrist, NJW 2008, 1703, 1706. 286 BAG NJW 2009, 1897. 280 281

Spehl/Gru¨tzner

Reemers Publishing Services GmbH O:/Beck/Spehl_Gruetzner/3d/06_Deutschland.3d from 06.03.2013 09:28:06 3B2 9.1.580; Page size: 160.00mm  240.00mm

B. The 25 key questions in connection with internal investigations

211

d) Transfer of information to authorities if employee is obliged to incriminate himself/herself Companies may, for instance, transfer the information and documents obtained to 119 the law enforcement authorities in connection with the filing of a complaint. Companies may also transfer the information to the law enforcement authorities if the information concerned originates from an employee who had to incriminate himself/herself due to a contractual duty to provide information.287 The nemo tenetur principle only protects against a governmental obligation to make a statement,288 but not against an employee’s self-incrimination within the scope of his/her contractual duty to provide his/her employer with information. There are no statutory provisions stipulating the exclusion of information revealed by an employee who is obliged to provide such information as evidence. The economic pressure the employee might feel does not equal the constraint of governmental proceedings and cannot justify an exclusion of evidence improperly obtained.289 The information revealed as a result of an employee’s self-incrimination may be used against the employee in disputes under civil or criminal law.290 Only in very few exceptional cases, for instance in the case of collusion between the employer and the law enforcement authorities, the information revealed by the employee might not be used against him/her due to the fair-trial principle.291 2. Is an employee obliged to provide information on any misconduct on behalf of criminal offences committed by other employees? The employee’s obligation to provide information is limited to his/her immediate 120 scope of work. An employee only has to inform the employer at his/her own initiative of any breach of duty of other employees to the extent that this concerns the employee’s scope of work and if there is the risk of repeated misconduct.292 Knowledge of any breach of duties by other employees or of a behavior constituting a criminal offence that an employee gains on the occasion of but not within the scope of actually fulfilling his/her duties does not have to be disclosed.293 The driver or the secretary of a managing director, for instance, does not have to provide information on a conversation of the managing director they might have overheard by chance during which the disclosure of business or trade secrets was discussed.294 The employee may be obliged to notify his/her employer of any breach of duties by other employees or of behavior constituting a criminal offence if the employer is at

287 Other opinion LAG Hamm, judgment of March 3, 2009, file no. 14 Sa 1689/08, wrongly referring to BVerfGE 56, 37; for a prohibition to use information improperly obtained in criminal proceedings ArbG Saarlouis ZIP 1984, 364. 288 Restrictively BGHSt 42, 139 (151 et seq.); BGHSt 37, 340 (343). 289 A corresponding decision was made by the criminal law panel of the 67th German Jurists Forum, cf. www.djt.de/files/djt/67/djt_67_beschluesse.pdf. 290 With a critical view Jahn, StV 2009, 41, 43 et seq.; other opinion Bo ¨ hm, WM 2009, 1923, 1928. 291 Momsen, ZIS 2011, 508, 515 et seq.; Momsen/Gru ¨ tzner, DB 2011, 1792, 1795. 292 BAG NJW 1970, 1861; LAG Hamm BB 1994, 2352; LAG Berlin BB 1989, 630; Klengel/ Mu¨ckenberger, CCZ 2009, 81, 82; Lu¨tzeler/Mu¨ller-Sartori, CCZ 2011, 19, 20. 293 BGH NJW-RR 1989, 614, 615; LAG Berlin BB 1989, 630. 294 Examples taken from Diller, DB 2004, 313, 315; Lu ¨ tzeler/Mu¨ller-Sartori, CCZ 2011, 19, 20.

Spehl/Gru¨tzner

Reemers Publishing Services GmbH O:/Beck/Spehl_Gruetzner/3d/06_Deutschland.3d from 06.03.2013 09:28:06 3B2 9.1.580; Page size: 160.00mm  240.00mm

212

§ 6. Germany

risk of suffering considerable damage.295 The employee may, however, only refuse to provide such information; he/she may not lie.296 3. May an employee refuse to answer a question if he/she has already answered it within the scope of a previous interview? 121 a) In case of extensive and time consuming internal investigations it may happen

that the investigators only gradually gain knowledge of certain pieces of information. This may require that individual employees are interviewed more than once. Whether the employee may rightfully invoke that he/she has already answered specific questions in a previous interview depends on the subject matter to which the question relates. 122 b) If the employer’s information request concerns the employee’s duties, part of

the employee’s obligations under the employment contract is to provide the requested information several times if necessary. In this core area, the employee can not refuse to provide the information by arguing that he/she has already provided the requested information.297 Yet, the internal and external investigators act unlawfully if they inappropriately request a piece of information again and again, for example, because they did not properly record the previously provided information in writing.298 123 c) If the employer’s information request does not relate to the employee’s scope of

work, the employee is not always obliged to provide the information again. Outside the employee’s scope of work, the employer’s claim to be provided with information is derived from the principle of good faith.299 The claim to be provided with information derived from the principle of good faith is subject to the condition that the employer is not aware of the requested information for justifiable reasons.300 The claim to be provided with information derived from the principle of good faith, therefore, does not exist if the employer’s lack of knowledge is self-inflicted. If the employee has already provided the information and the employer has merely lost the information or has not documented it properly, its lack of knowledge is self-inflicted. The claim to be provided with information is not excluded if the investigators have been able to gain new information and the purpose of the repeated questioning is to establish whether the employee has answered truthfully when being interviewed for the first time. In these cases, it may be unlawful to inappropriately insist on the right to be provided with information.301

295

BGH NJW-RR 1989, 614, 615; LAG Berlin BB 1989, 630. Lu¨tzeler/Mu¨ller-Sartori, CCZ 2011, 19, 20. 297 BGH NJW 1990, 510, 511; BGH NJW-RR 1988, 1072, 1073 (on § 666 BGB); Ehmann, in: Erman BGB, § 666, para. 49; Diller, DB 2004, 313, 315. 298 Seiler, in: Mu ¨ nchener Kommentar BGB, § 666, para. 7. 299 Cf. § 242 BGB. 300 BAG NZA 1996, 637, 638; NZA 1997, 41. 301 Seiler, in: Mu ¨ nchener Kommentar BGB, § 666, para. 7. 296

Spehl/Gru¨tzner

Reemers Publishing Services GmbH O:/Beck/Spehl_Gruetzner/3d/06_Deutschland.3d from 06.03.2013 09:28:06 3B2 9.1.580; Page size: 160.00mm  240.00mm

B. The 25 key questions in connection with internal investigations

213

4. Is an employee entitled to the presence of a member of the works council or an attorney during an interview? a) The employee’s right to the presence of a member of the works council aa) The employee is generally not entitled to have a member of the works council 124 present during an interview. If internal investigators interview an employee, the employee may involve a member of the works council302 if the interview also serves as a performance evaluation and development discussion.303 Performance evaluations and professional development opportunities should, therefore, not be the subject matter of interviews conducted within the scope of internal investigations.304 bb) Company officers are not entitled to have a member of the committee of 125 spokespersons present. Company officers do not need any more protection than the other employees.305 cc) Despite the fact that employees do not have the right to have a member of the 126 works council or committee of spokespersons present, the authority conducting the internal investigations may allow the bodies to be present if it hopes that this might increase its chances of a successful investigation.306 b) The employee’s right to the presence of an attorney representing the employee’s rights aa) If company-internal investigators conduct the interviews within the scope of 127 internal investigations, the employee is usually not entitled to have his/her own attorney present during the interview.307 Normally, interviews of this kind concern the scope of work directly assigned to or performed by the interviewed employees. The employee is obliged to provide information on all matters related to his/her personal scope of work without a legal representative being present.308 The duty to provide information is part of his/her immediate duties under the employment contract. The employee must perform his/her duties under the employment contract in person.309 The strictly personal character of the employment relation§ 82 (2) sentence 2 BetrVG. § 82 (2) sentence 1 BetrVG; BAG NZA 2005, 416, 418 et seq.; Zimmer/Heymann, BB 2010, 1853, 1854; in favor of the works council’s regular involvement Salvenmoser/Schreier, in: Achenbach/Ransiek, Handbuch Wirtschaftsstrafrecht, chapter XV, para. 168; Mengel, Compliance und Arbeitsrecht, chapter 4, para. 25; Lange/Vogel, DB 2010, 1066. 304 Zimmer/Heymann, BB 2010, 1853, 1854. 305 § 26 (1) German Executives’ Committee Act (Sprecherausschussgesetz, SprAuG); Zimmer/ Heymann, BB 2010, 1853, 1854. 306 Lu ¨ tzeler/Mu¨ller-Sartori, CCZ 2011, 19, 21. 307 LAG Hamm MDR 2001, 1361; Go ¨ pfert/Merten/Siegrist, NJW 2008, 1703, 1708; Lange/Vogel, DB 2010, 1066; Lu¨tzeler/Mu¨ller-Sartori, CCZ 2011, 19, 22; in favor of the right to have an attorney present during business-related discussions about health matters ArbG Mu¨nster, NJW 1989, 793, 794; v. Rosen, Internal Investigations bei Complianceversto¨ßen, p. 102. Schu¨rrle/Olbers, CCZ 2010, 178, 179 recommend to allow the presence of an attorney counseling the employee despite being under no obligation to do so. 308 §§ 666, 675 BGB in analogy; LAG Berlin NZA 1993, 27; LAG Du ¨ sseldorf BB 1962, 1285; Preis, Erfurter Kommentar Arbeitsrecht, § 611 BGB, para. 23; Diller, DB 2004, 313. 309 § 613 BGB. 302 303

Spehl/Gru¨tzner

Reemers Publishing Services GmbH O:/Beck/Spehl_Gruetzner/3d/06_Deutschland.3d from 06.03.2013 09:28:07 3B2 9.1.580; Page size: 160.00mm  240.00mm

214

§ 6. Germany

ship prohibits that the employee involves an external person to carry out his/her duties under the employment relationship against the employer’s opposition.310 Even if criminal offences committed by the employee are duly revealed, his/her rights remain protected due to the fact that the employer may not transfer and the law enforcement authorities may not use this information. In the event that the employer accuses the employee of a criminal offence, it may prove useful to allow the employee to have an attorney present.311 128 bb) If investigators with no ties to the company, i. e. external investigators,

conduct the interviews within the scope of internal investigations, one might come to a different conclusion. Case law has yet to decide on this issue. However, it is argued that, if the employer entrusts external investigators with the conducting of internal investigations, it must also allow the employee to involve an attorney at his/her own expense.312 The argument most often used to support this view is “a fight with equal weapons” since by commissioning an external investigator the employer is said to leave the sphere of the strictly personal relationship between the employer and the employee.313 129 cc) It may make sense to allow the employee to have a legal representative present

if the employee otherwise refuses to cooperate in the interview and the employee’s information is of material relevance for the internal investigations. An otherwise necessary judicial enforcement of the duty to provide information is time consuming and expensive and any measures under labor law that may be taken promptly, e. g. a warning letter, rarely lead to the desired result in this context.314 5. Is an employee entitled to read the record of his/her interview? 130

The investigators usually document the results of an interview. Occasionally, the interviewed employee may have an interest in viewing the results. However, the employer is not obliged to grant the employee access to the record of the relevant interview. The employer must provide the employee with the information that the employee needs to fulfill his/her duties under the employment contract or to exercise his/her rights. But the only purpose of the record of the interview is to record the facts. As the employee is obliged under the employment contract to state the “true facts”, these facts should be known to him/her, thus eliminating any requirement for him/her to view the records of any interviews.

310 LAG Hamm MDR 2001, 1361 et seq. (on appraisal meetings); Mengel/Ullrich, NZA 2006, 240, 244; Stu¨ck, DB 2007, 1137, 1139; Go¨pfert/Merten/Siegrist, NJW 2008, 1703, 1709; Klengel/Mu¨ckenberger, CCZ 2009, 81, 82; Vogt, NJOZ 2009, 4206, 4213; Mengel, Compliance und Arbeitsrecht, chapter 4, para. 25; Lange/Vogel, DB 2010, 1066; other opinion ArbG Mu¨nster NJW 1989, 793 in the context of business-related discussions of health matters. 311 ArbG Berlin, judgment of July 8, 2005, file no. 28 Ca. 10016/05 (juris). 312 LAG Hamm MDR 2001, 1361 et seq. (on appraisal meetings); Mengel, Compliance und Arbeitsrecht, chapter 4, para. 25; Lange/Vogel, DB 2010, 1066, 1067; Lu¨tzeler/Mu¨ller-Sartori, CCZ 2011, 19, 22. 313 Mengel, Compliance und Arbeitsrecht, chapter 4, para. 25. 314 Go ¨ pfert/Merten/Siegrist, NJW 2008, 1703, 1708; Mengel, Compliance und Arbeitsrecht, chapter 4, para. 25.

Spehl/Gru¨tzner

Reemers Publishing Services GmbH O:/Beck/Spehl_Gruetzner/3d/06_Deutschland.3d from 06.03.2013 09:28:07 3B2 9.1.580; Page size: 160.00mm  240.00mm

B. The 25 key questions in connection with internal investigations

215

6. Is the employer entitled to have the employee sign the record of his/her interview? The employer might have an interest in the employee signing the record of his/ 131 her interview to ensure that no future disputes will arise regarding the determination of the facts. On the basis of the right to give instructions,315 the employer may instruct the employee to sign the record of his/her interview. If the employer instructs the employee to sign the record of his/her interview, the employer must, as a matter of course, grant the employee the right to carefully read the record. 7. Can the employer instruct an employee to treat the content of his/her interview as confidential? a) It may be pivotal for the success of internal investigations that details are treated 132 as confidential. For the internal investigations to be as efficient as possible, the subject matter of the internal investigations should remain secret. Therefore, it is important for the employer to know whether it may instruct employees to treat the content of the interviews conducted within the scope of internal investigations as confidential. Gaining knowledge of the issues discussed during an interview with an employee might enable other employees to draw conclusions on whether they or their conduct are the subject matter of the investigations. b) The confidentiality obligation is a collateral duty under the employment con- 133 tract.316 The employee must maintain secrecy on the matters he/she gains knowledge of in connection with his/her position in the company and in regard to which the employer has a justified interest to keep these confidential.317 To the extent that the employee is committed to confidentiality due to the duty of consideration (Ru¨cksichtnahmepflicht) under the employment contract, the employer may specify the duty in more detail by giving instructions. The employer may extend the scope of the facts that are to be treated as confidential by expressly marking specific information, such as the content of an interview conducted within the scope of the internal investigations, as confidential.318 If the employer instructs the employee to treat the information he/she obtained during the interview as confidential, the employee must maintain secrecy vis-a`-vis third parties. The employer may also instruct the employee not to disclose the content of the interview and the conclusions drawn by the employee with regard to the internal investigation to his/her colleagues if such disclosure would jeopardize the purpose of the investigation or could result in concerted statements. As the instruction to maintain secrecy only refers to the employee’s conduct relating to work, the employer’s instruction given to the employee to maintain secrecy on the content of the internal investigations does not require the works council’s consent.319

§ 106 GewO, § 315 BGB. § 242 BGB; Preis, in: Erfurter Kommentar Arbeitsrecht, § 611 BGB, para. 710; Linck, in: Schaub, Arbeitsrechts-Handbuch, § 55 para. 51. 317 Linck, in: Schaub, Arbeitsrechts-Handbuch, § 55, para. 52; Richters/Wodtke, NZA-RR 2003, 281, 282. 318 Blomeyer, in: Mu ¨ nchener Handbuch zum Arbeitsrecht, § 53, para. 57. 319 Wisskirchen/Jordan/Bissels, DB 2005, 2190 et. seq. 315 316

Spehl/Gru¨tzner

Reemers Publishing Services GmbH O:/Beck/Spehl_Gruetzner/3d/06_Deutschland.3d from 06.03.2013 09:28:07 3B2 9.1.580; Page size: 160.00mm  240.00mm

216

§ 6. Germany

134 c) The employees are obliged to maintain secrecy vis-a`-vis colleagues and third

parties even if the internal investigations concern illegal secrets,320 such as criminal offences of employees, in regard to which an employee generally does not have to maintain silence.321 Due to the general duty to be considerate, the employee may only disclose illegal secrets vis-a`-vis third parties if he/she fails to put things right within the company and if public interests are concerned.322 Internal investigations serve the purpose of discovering and rectifying wrongdoings so that the employees must treat even illegal secrets as confidential. 135 d) Despite the fact that it is permissible to unilaterally instruct the employee to

maintain secrecy, it is advisable if the duty to maintain secrecy within the scope of internal investigations is not only unilaterally imposed by the employer but that a written agreement is also concluded with the respective employees which states that they must treat any information they receive in connection with the internal investigations as confidential.323

IV. Sanctions imposed on employees 1. What are the sanctions under employment law that can be imposed on employees refusing to cooperate in internal investigations? 136

Employees who have acted in violation of their duties or have committed criminal offences against their employer in the past will often refuse to cooperate within the scope of internal investigations in order to avoid incriminating themselves. The employer has two options available to exert pressure on these employees and to motivate them to actively cooperate: a) Retention or reduction of remuneration

137 aa) The employee’s cooperation in internal investigations is a collateral duty under

his/her employment contract. For the time the employee refuses to cooperate during the internal investigations, the employer may thus retain a part of his/her remuneration.324 How much the employer may retain from the employee’s remuneration depends on the significance of the employee’s cooperation with the internal investigations and how strong the coercive effect on the employee is intended to be.325 138 bb) If the employer intends to retain a part of the employee’s remuneration as

sanction (for his/her nonparticipation) it must first carefully examine the admissibility of the measure in each individual case. For the employee, the reduction of his/ 320 Illegal secrets are such secrets that relate to criminal offences, violations of fair competition or other violations of statutory provisions. 321 Linck, in: Schaub, Arbeitsrechts-Handbuch, § 55, para. 52; Preis, in: Erfurter Kommentar Arbeitsrecht, § 611 BGB, para. 713. 322 BGH NJW 1981, 1089; Linck, in: Schaub, Arbeitsrechts-Handbuch, § 55, para. 55. 323 Cf. LAG Hamm DB 1989, 783, 784. 324 § 273 (1) BGB; Go ¨ pfert/Merten/Siegrist, NJW 2008, 1703, 1706; Dann/Schmidt, NJW 2009, 1851, 1854; Mengel, Compliance und Arbeitsrecht, chapter 4, para. 27; Lu¨tzeler/Mu¨ller-Sartori, CCZ 2011, 19, 24. 325 Go ¨ pfert/Merten/Siegrist, NJW 2008, 1703, 1706.

Spehl/Gru¨tzner

Reemers Publishing Services GmbH O:/Beck/Spehl_Gruetzner/3d/06_Deutschland.3d from 06.03.2013 09:28:07 3B2 9.1.580; Page size: 160.00mm  240.00mm

B. The 25 key questions in connection with internal investigations

217

her remuneration is a drastic measure. In this context, the protected earnings rate provided for in the ZPO must also be observed.326 To avoid rendering itself liable for damages and in order to avoid providing the employee with a cause for termination, the employer must also clarify the legal issue whether the employee refused the cooperation without justification.327 b) Warning letter and termination aa) The employer may issue a warning letter for the violation of a collateral duty 139 under the employment contract to an employee who refuses to cooperate in internal investigations by, for example, not handing over business-related documents or emails or failing to show up for an interview or by violating his/her duty to maintain secrecy.328 bb) If the employee refuses to cooperate even after having received a warning 140 letter, the employer may give notice of termination to the employee for reasons of misconduct on the part of the employee. Depending on how significant the employee’s cooperation is for the internal investigations, the employer may give an ordinary or extraordinary notice of termination.329 An extraordinary notice of termination may be considered if the employee’s refusal to cooperate has destroyed the trust between employer and employee in such a way that the employer cannot reasonably be expected to continue the employment relationship. 2. Is the suspicion of a criminal offence or of a severe violation of duty sufficient for giving extraordinary notice of termination? a) The above-mentioned sanctions that are all based on the fact that the employee 141 refuses to cooperate in the internal investigations must be differentiated from such measures that are based on any misconduct of the employee. If there is sufficient evidence for a severe violation of duties or criminal offences committed by individual employees vis-a`-vis the employer this usually justifies an extraordinary notice of termination. Internal investigations often only give an indication or establish a suspicion that employees have acted in gross violation of their duties or committed criminal offences. The question arises for the employer whether it may give extraordinary notice of termination to an employee despite the fact that the employee is merely suspected of misconduct. According to case law, an extraordinary termination on grounds of suspicion (Verdachtsku¨ndigung) is admissible if there are solid facts which lead to the strong suspicion that an employee has violated his/her duties under the employment contract in a material way or that he/she committed a

326

Mengel, Compliance und Arbeitsrecht, chapter 4, para. 27. Maschmann, in: Do¨lling, Handbuch der Korruptionspra¨vention, chapter 4, para. 70; Go¨pfert/ Merten/Siegrist, NJW 2008, 1703, 1707; Mengel, Compliance und Arbeitsrecht, chapter 4, para. 27; Lu¨tzeler/Mu¨ller-Sartori, CCZ 2011, 19, 24. 328 Go ¨ pfert/Merten/Siegrist, NJW 2008, 1703, 1707; Mengel, Compliance und Arbeitsrecht, chapter 4, para. 28; Lu¨tzeler/Mu¨ller-Sartori, CCZ 2011, 19, 22. 329 Maschmann, in: Do ¨ lling, Handbuch der Korruptionspra¨vention, chapter 4, para. 70; Go¨pfert/ Merten/Siegrist, NJW 2008, 1703, 1707; Mengel, Compliance und Arbeitsrecht, chapter 4, para. 28; Lu¨tzeler/Mu¨ller-Sartori, CCZ 2011, 19, 24. 327

Spehl/Gru¨tzner

Reemers Publishing Services GmbH O:/Beck/Spehl_Gruetzner/3d/06_Deutschland.3d from 06.03.2013 09:28:08 3B2 9.1.580; Page size: 160.00mm  240.00mm

218

§ 6. Germany

criminal offence.330 There must be a strong likelihood that the dismissed employee has committed the criminal offence or, respectively, has violated his/her duties.331 If criminal proceedings are carried out against the employee at the same time as the internal investigations, the outcome of the criminal proceedings does not necessarily affect the validity of the termination on grounds of suspicion.332 Not all breaches of duties or criminal offences justify an extraordinary termination on grounds of suspicion. Embezzlement, disclosure of business secrets or theft e.g. all justify a termination on grounds of suspicion.333 Termination without notice is only admissible if it cannot reasonably be expected from the employer to continue the employment relationship until the end of the regular notice period. In case of an extraordinary termination on the grounds of suspicion the basis of trust between the employer and the employee must have been destroyed due to a breach of duty or a criminal offence.334 142 b) Before the employer may terminate any employee on the basis of the mere

suspicion that a breach of duties or criminal offence has occurred, the employer must have used all reasonable efforts to clarify the facts and circumstances of the case. In order to fully clarify the facts and circumstances of the case, the employer must allow the employee to comment on and possibly invalidate the allegations brought forward against him/her.335 It is mandatory that the respective employee be heard before a notice of termination is issued. If the employer fails to hear the employee, a termination cannot be issued on the mere suspicion of a criminal offence.336 The hearing cannot be conducted retrospectively.337 The employer is not obliged to hear the employee if the employee refuses from the outset to comment on the accusations brought against him/her and to cooperate in the ensuing investigation. If the employee informs the employer that he/she will not comment on the accusations and fails to state any relevant reasons for his/her refusal to cooperate, the employer is not obliged to disclose details of the suspicion to the employee in the scope of the hearing.338 3. During which period of time must extraordinary notice of termination be given to employees whose misconduct has been revealed by the internal investigations? 143 a) An extraordinary notice of termination must be received by the employee within

two weeks.339 The two-week notice period commences as soon as the employer has 330

BAG NZA-RR 2008, 344. BAG NZA 2005, 1056. 332 Mu ¨ ller-Glo¨ge, in: Erfurter Kommentar Arbeitsrecht, § 626 BGB, para. 179; Dann/Schmidt, NJW 2009, 1851, 1854. 333 Mu ¨ ller-Glo¨ge, in: Erfurter Kommentar Arbeitsrecht, § 626 BGB, para. 177 with references to case law. 334 BAG NZA-RR 2008, 344; BAG, decision of November 27, 2008, 2 AZR 98/07. 335 BAG NZA 2008, 809. 336 BAG NZA-RR 2008, 344. 337 BAG NZA 1987, 699. 338 BAG NZA 2008, 809, 810. 339 § 626 (2) sentence 1 BGB; BAG NJW 1978, 2168; Mu ¨ ller-Glo¨ge, in: Erfurter Kommentar Arbeitsrecht, § 626 BGB, para. 219. 331

Spehl/Gru¨tzner

Reemers Publishing Services GmbH O:/Beck/Spehl_Gruetzner/3d/06_Deutschland.3d from 06.03.2013 09:28:08 3B2 9.1.580; Page size: 160.00mm  240.00mm

B. The 25 key questions in connection with internal investigations

219

obtained reliable knowledge to the fullest extent possible of the underlying facts for giving notice of termination, thus enabling the employer to decide whether it would be acceptable to continue the employment relationship until the end of the regular notice period.340 If the employer has commissioned a committee to carry out the internal investigations, the commencement of the notice period depends on the committee’s knowledge of the underlying facts.341 b) In order to obtain full knowledge of the underlying facts for the termination, the 144 employer may carry out internal investigations.342 As long as the employer carries out such measures or has commissioned someone to do so in order to clarify the underlying facts for the termination, the two-week notice period shall be discontinued.343 The internal investigations must be carried out swiftly,344 however, in the case of extensive investigations they may take up to two months pursuant to case law.345 Due to the fact that, as of recently, the cases have become more and more complex, it can be assumed that case law will change accordingly further enabling an interruption of the notice period should further investigations be required to clarify facts and circumstances. If the employee admits to actually having breached his/her duties, an interruption of the notice period for extraordinary termination no longer applies as any further investigation of the facts and circumstances is no longer required or possible.346 If further investigation to clarify the circumstances of the case is no longer required, the two-week notice period applicable for an extraordinary termination shall commence.347 4. Must an employee cooperate in internal investigations even after he/she has been given notice of termination? Neither the dismissal nor a later termination of the employment relationship, i. e. 145 whilst internal investigations are being carried out, shall release the employee per se from his/her collateral duty under the employment contract to cooperate during internal investigations. There is no generic answer to the question of whether and to what extent the (former) employee has a collateral duty to cooperate in the internal investigation; this must rather be determined in consideration of the relevant facts and circumstances of each individual case. The following facts and circumstances must be examined when answering this question: (i) is the relevant employee (among those) accused and investigated in the scope of the internal investigation or (ii) has the employee gained knowledge of specific facts in the scope of his/her employment that are not available to the company in any documented or otherwise secured form? The fact that an employee accused in the scope of an internal investigation 146 terminates his/her employment contract does not release him/her from his/her duty 340 § 626 (2) sentence 2 BGB; BAG NZA 2006, 1, 211; Mu ¨ ller-Glo¨ge, in: Erfurter Kommentar Arbeitsrecht, § 626 BGB, para. 205. 341 Go ¨ pfert/Merten/Siegrist, NJW 2008, 1703, 1707. 342 BAG NZA 2007, 744, 746. 343 BAG NZA 1994, 409; NZA 2003, 1055; NZA 2007, 744, 746. 344 BAG NZA 1996, 419, 423; NZA 2007, 744, 746. 345 BAG NZA 2007, 744, 747. 346 BAG NZA 2007, 744, 746. 347 § 626 (2) sentence 1 BGB.

Spehl/Gru¨tzner

Reemers Publishing Services GmbH O:/Beck/Spehl_Gruetzner/3d/06_Deutschland.3d from 06.03.2013 09:28:08 3B2 9.1.580; Page size: 160.00mm  240.00mm

220

§ 6. Germany

to cooperate in the internal investigations. Otherwise, the employee could in such a case release himself/herself from the duty to cooperate by giving notice of termination.348 Similarly, the obligation to cooperate remains effective if the employer gives notice of termination to the employee. And even in the case that the employee takes legal action against the employer regarding the claim for protection against dismissal, the employee’s obligation to cooperate in the internal investigations remains in effect. While it is true that the employer must prove in the legal proceedings that there is a valid reason to dismiss the employee,349 the proceedings will in no way affect the employee’s duty under his/her employment contract to cooperate in investigations.350 147 If a former employee is to be heard in the scope of an internal investigation who is not personally accused of wrongdoing, he/she is not automatically obliged to cooperate in the investigation, attend the hearing or answer questions based on a collateral duty under his/her former employment contract. The collateral duties may be reduced to zero after the termination of the employment relationship. Even after the termination of the employment relationship, however, the employee should remain obliged to cooperate in an internal investigation, to attend a hearing and to answer questions of internal and external investigators, if he/she has acquired certain specific knowledge in the scope of his/her employment that is not documented or otherwise secured within the company. In other cases, the scope of application of the collateral duties under the employment contract must be examined carefully. In practice, however, it should often be the case that a (former) employee who is not personally the focus of the investigation and refuses to cooperate will not face any disadvantages. Not only would it be time consuming and cost-intensive to enforce an alleged cooperation obligation in court – the outcome of such proceedings would be entirely unpredictable as well.

V. Use of the obtained information 1. Is it permissible under data protection law to transfer the findings and information obtained within the scope of internal investigations to other group companies? 148 a) The “transfer” of personal data obtained in the scope of internal investigations

to other group companies is deemed a disclosure to a third party and thus qualifies as a transfer;351 the form in which the data are transferred to the group company is not relevant in this context.352 It is also irrelevant whether or not the personal data are in fact “sent” to the other group company or merely held available by the controller on a server for retrieval by another group company. The BDSG defines a “transfer” as a disclosure to a third party of personal data stored or obtained by means of data processing either (i) through transfer of the data to the third party or (ii) through the third party inspecting or retrieving data held available for inspec348

Cf. Go¨pfert/Merten/Siegrist, NJW 2008, 1703, 1707. § 1 KSchG. 350 Go ¨ pfert/Merten/Siegrist, NJW 2008, 1703, 1708. 351 Cf. § 3 (4) sentence 2 no. 3 BDSG. 352 Gola/Schomerus, BDSG, § 3, para. 32; Thu ¨ sing, Arbeitnehmerdatenschutz und Compliance, para. 404. 349

Spehl/Gru¨tzner

Reemers Publishing Services GmbH O:/Beck/Spehl_Gruetzner/3d/06_Deutschland.3d from 06.03.2013 09:28:08 3B2 9.1.580; Page size: 160.00mm  240.00mm

B. The 25 key questions in connection with internal investigations

221

tion or retrieval.353 The key basis of this assessment is that the BDSG treats affiliated enterprises (= group company) as other bodies, irrespective of whether they are established in or outside the European Union or the EEA. Transfers to other group companies are subject to the same legal provisions that apply to data transfers to third parties. According to this definition, a third party means any person or body other than the controller.354 This phenomenon is often referred to as the absent “group privilege”, since intra-group transfers are not privileged as compared to transfers to third parties.355 These provisions do not apply if the information is transferred to other units of the group that are not legally independent. It should be noted however that the involvement of a subsidiary not resident in Germany may lead to the application of the data protection laws of the jurisdiction in which the subsidiary is established.356 With respect to Germany, this implication regarding the applicable jurisdiction is established under § 1 (5) sentence 1 BDSG. b) Pursuant to § 4 (1) BDSG the (processing by means of) transfer of personal data 149 to other group companies requires that the transfer is legally permitted or prescribed or that the data subject has consented. If such permission or consent is absent and the personal data are nevertheless transferred to the parent company or another group company, this may constitute an administrative offence pursuant to § 43 (2) no. 1 BDSG.357 This provision stipulates that it will be deemed an administrative offence to intentionally or through negligence collect or process personal data that are not generally accessible without being authorized accordingly. According to § 43 (3) sentence 1 BDSG, this may trigger a fine of up to EUR 300.000.358 The fine should exceed the financial benefit the perpetrator derived from committing the administrative offence.359 The fine may exceed the maximum amount of EUR 300.000, if this amount is insufficient to extinguish the benefit derived.360 c) Even though the wording of § 4 (1) BDSG (“…or if the data subject has 150 consented”) in conjunction with § 4 c (1) no. 1 BDSG (“…1. the data subject has given his consent”) suggests that national and international data transfers could be justified by means of the employee’s consent, this approach is generally assumed to be very risky.361 The German supervisory authorities and the “Article 29 Data Protection Working Party” share the opinion that it is generally doubtful whether the consent given in the scope of an employment relationship can in fact be deemed voluntary.362 The government bill on planned amendments to the BDSG to improve employee data protection shows the same tendencies. Addressing these doubts Cf. § 3 (4) sentence 2 no. 3 BDSG; Gola/Schomerus, BDSG, § 3, para. 32 with further evidence. § 3 (8) sentence 2 BDSG. 355 Cf. Trittin/Fischer, NZA 2009, 343. 356 Schmidl, Rechtma ¨ßigkeit internationaler Datentransfers, Information Security Management, p. 3. 357 Cf. Ambs, in: Erbs/Kohlhaas, Strafrechtliche Nebengesetze, para. 19. 358 Regarding the amount of the administrative fine cf. Ambs, in: Erbs/Kohlhaas, Strafrechtliche Nebengesetze, para. 29. 359 Cf. § 43 (3) sentence 2 BDSG. 360 Cf. § 43 (3) sentence 3 BDSG; cf. Gola/Schomerus, BDSG, § 43, para. 29. 361 Cf .Schmidl, DUD 2007, 756. 362 Cf. Schmidl, Rechtma ¨ßigkeit internationaler Datentransfers, Information Security Management, p. 3. 353 354

Spehl/Gru¨tzner

Reemers Publishing Services GmbH O:/Beck/Spehl_Gruetzner/3d/06_Deutschland.3d from 06.03.2013 09:28:09 3B2 9.1.580; Page size: 160.00mm  240.00mm

222

§ 6. Germany

regarding the voluntary nature of the consent given by an employee in the scope of an employment relationship, this bill drafted by the government provides under § 32 l (1) BDSG to permit the consent only in the cases expressly provided for under the BDSG.363 The government bill does not provide for a set of circumstances, however, under which the consent would be permissible either in the context of internal investigations or in the context of international data transfers.364 151 d) The potential bases to legitimize data transfers to other group companies are

thus confined to the sets of circumstances allowing for a transfer as set forth under statutory law. Apart from § 32 BDSG, which was created to specifically address data transfers in the context of employment relationships and to this extent takes the place of § 28 (1) sentence 1 no. 1 BDSG, § 28 (1) sentence 1 no. 2 and § 28 (2) no. 2 a BDSG represent potential sets of circumstances under which a transfer is admissible.365 If the recipient (i. e. the parent company or the other subsidiary) is not established in the European Union or the European Economic Area (and not established in a third country for which the European Commission has acknowledged an adequate level of data protection), it is important not only to have a set of circumstances allowing for a transfer but also to create an adequate level of data protection at the level of the recipient.366 152 e) If the company wishes to transfer personal data of employees to foreign group

companies within the scope of internal investigations, it must observe additional requirements. §§ 4 b, 4 c BDSG require that an adequate level of data protection is established at the level of the recipient.367 153 aa) Countries outside the EU or the EEA ensure an adequate level of data protection,

if the European Commission has made a corresponding general acknowledgement in accordance with Art. 25 (6) of the Directive 95/46/EC and if this acknowledgement is effective vis-a`-vis everybody. After an analysis of the local data protection laws in place in the respective countries, a negative list in accordance with Art. 25 (4) of the EU data protection directive and a white list in accordance with Art. 25 (6) of the directive (e.g. including Canada and Switzerland)368 were drawn up. In the event of data transfers to white-listed countries, the exporting controller may assume that the level of data protection is adequate without having to perform its own examination of the data protection level existing in the receiving country. 154 bb) In the absence of uniformly applicable data protection laws throughout the

United States, the European Commission took a different approach to data transfers 363 Regarding the government bill and the statement of the Bundesrat and counter-statement of the government cf. Bundestag paper 17/4230. 364 Regarding the government bill and the statement of the Bundesrat and counter-statement of the government cf. BT-Drucks. 17/4230. 17/4230. 365 Cf BT-Drs. 16/13657, p. 20 et seq. 366 Cf. Schmidl, Rechtma ¨ßigkeit internationaler Datentransfers, Information Security Management, p. 53 et seq. and supra para. 25. 367 Cf. Schmidl, Rechtma ¨ßigkeit internationaler Datentransfers, Information Security Management, p. 53 et. seq. 368 http://ec.europa.eu/justice/policies/privacy/workinggroup/wpdocs/index_en.htm#adequacy.

Spehl/Gru¨tzner

Reemers Publishing Services GmbH O:/Beck/Spehl_Gruetzner/3d/06_Deutschland.3d from 06.03.2013 09:28:09 3B2 9.1.580; Page size: 160.00mm  240.00mm

B. The 25 key questions in connection with internal investigations

223

to the U.S. This approach included establishing certain principles.369 Enterprises that undertake to adhere to this agreement are included in a “safe harbor” list. The safe harbor list is meant to ensure that the exchange of personal data with the United States and in particular with U.S.-based parent companies of German subsidiaries takes place in compliance with European data protection laws. The safe harbor list is kept and updated by government bodies and documents the self-commitment of the listed enterprises (data recipients) to comply with the agreed (minimum) standards. The safe harbor list warrants that data processed by the listed companies are adequately protected. The safe harbor list is available for review and research on the Internet.370 Although the data recipient assumes an obligation vis-a`-vis the competent U.S. authorities to comply with certain fundamental data protection principles, the protection granted in the scope of the safe harbor list is merely based on a selfcommitment, which renders data protection a corporate duty but not a task directly incumbent upon the respective government. Registration on the list is further reserved for enterprises that are subject to the authority of the U.S. Federal Trade Commission or the U.S. Department of Commerce371 while banks and financial services providers372 cannot obtain a safe harbor registration. Safe harbor has been increasingly criticized also for another reason. The German supervisory authorities for example lament that many companies in fact fail to adhere to the requirements imposed under the safe harbor principles. This is the reason why the resolution adopted by the German supervisory authorities on April 28/29, 2010373 stipulates several conditions for making use of the safe harbor option. cc) Standard contract language is another way to establish an adequate level of data 155 protection at the level of the (data) recipient. For this purpose, the European Commission drafted standard contractual clauses covering both data transfers among controllers and transfers between controllers and data processors. Data transfers between controllers and data processors in the scope of an internal investigation will only occur if the receiving company merely renders support services in the internal investigation and has no business interest of its own in conducting the investigation.374 The standard contractual clauses are published on the Internet.375 The wording of the standard contractual clauses must not be changed or amended. Although it is generally possible to make minimal modifications that do not alter the original meaning of the clauses, any interference with the wording always poses a risk that a supervisory authority might assume that the modifications made render the model contracts invalid in terms of their original purpose of establishing an adequate level of data protection at the level of the recipient.376 369

Cf. http://ec.europa.eu/justice_home/fsj/privacy/thirdcountries/index_de.htm. Cf. https://safeharbor.export.gov/list.aspx. 371 Cf. www.export.gov/safeharbor/eg_main_018245.asp. 372 Cf. http://ec.europa.eu/justice_home/fsj/privacy/thirdcountries/adequacy-faq1_de.htm#8. 373 Cf. www.ldi.nrw.de/mainmenu_Service/submenu_Entschliessungsarchiv/Inhalt/Beschluesse_ Duesseldorfer_Kreis/Inhalt/2010/Pruefung_der_Selbst-Zertifizierung_des_Datenimporteuers/ Beschluss_28_29_04_10neu.pdf. 374 Cf. Schmidl, Rechtma ¨ßigkeit internationaler Datentransfers, Information Security Management, 2007, p. 56. 375 Cf http://ec.europa.eu/justice/policies/privacy/modelcontracts/index_en.htm. 376 Cf. Schmidl, Rechtma ¨ßigkeit internationaler Datentransfers, Information Security Management, p. 57. 370

Spehl/Gru¨tzner

Reemers Publishing Services GmbH O:/Beck/Spehl_Gruetzner/3d/06_Deutschland.3d from 06.03.2013 09:28:09 3B2 9.1.580; Page size: 160.00mm  240.00mm

224

§ 6. Germany

156 dd) Another option to establish an adequate level of data protection are the so-

called Binding Corporate Rules.377 2. Is it permissible and advisable to transfer the findings and information obtained within the scope of internal investigations to public authorities? a) Admissibility of transfer of personal data 157 aa) If a public authority, such as the public prosecutor’s office, requests the

transfer of data based on a legal power,378 the company is permitted or even obliged to transfer the data. The authority must inform the company of the legal basis of the transfer.379 Otherwise the authority must inform the company that the transfer will occur on a strictly voluntary basis.380 It must be noted that only German public authorities may be authorized by law to demand the transfer of personal data.381 158 bb) If there is no legal obligation requiring the transfer of personal data to the

authorities, data transfers are subject to the same provisions that apply to transfers to other third parties as set forth in the above. That means that a transfer of personal data to a domestic authority is admissible to the extent that it is necessary to safeguard the company’s justified interests and there is no reason to assume that the employee’s legitimate interests may prevail.382 The same applies to transfers of personal data to public authorities of a member state of the EU/EEA383 and to transfers to third countries for which an adequate level of data protection has been acknowledged.384 159 cc) More stringent regulations apply for authorities in all other countries, including

the U.S.385 In general, it is not permitted to transfer the personal data of an employee to a public authority in a third country which does not dispose of an adequate level of data protection.386 b) Is it advisable to voluntarily transfer data to public authorities? 160

If the internal investigations have revealed any violations of law, it may be in the company’s interest to inform public investigative authorities of these violations.

377 Cf. Working Papers nos. 153 – 155 of the Art. 29 Working Party under http://ec.europa.eu/ justice/policies/privacy/workinggroup/wpdocs/2008_en.htm. 378 E.g. §§ 100 a, 100 b StPO. 379 § 13 (1a) BDSG. 380 Lomas/Kramer, Corporate Internal Investigations, paras. 6,123. 381 Lomas/Kramer, Corporate Internal Investigations, paras. 6,124. 382 § 28 (1) sentence 1 no. 2 BDSG. 383 §§ 4 b (1), 4 (1), 28 (1) BDSG; Schmidl, Rechtma ¨ßigkeit internationaler Datentransfers, Information Security Management, p. 51; Go¨pfert/Merten/Siegrist, NJW 2008, 1703, 1706. 384 § 4 b (2) sentence 2 BDSG; Schmidl, Rechtma ¨ßigkeit internationaler Datentransfers, Information Security Management, p. 54 et seq. 385 § 4 c BDSG. 386 Lomas/Kramer, Corporate Internal Investigations, paras. 6,136; v. Rosen, BB 2009, pp. 230, 232.

Spehl/Gru¨tzner

Reemers Publishing Services GmbH O:/Beck/Spehl_Gruetzner/3d/06_Deutschland.3d from 06.03.2013 09:28:10 3B2 9.1.580; Page size: 160.00mm  240.00mm

B. The 25 key questions in connection with internal investigations

225

aa) Where a company is faced with imminent measures initiated by an authority it 161 is advisable to inform the investigating public authorities. In this case, the company should present the authorities with complete details of the facts and activities in order to demonstrate its willingness to cooperate.387 The findings of the internal investigations and the voluntary sharing of this information may prove decisive for the discretionary decision of the public authority whether and to what extent it will take administrative measures or initiate official investigations. The same applies as to the determination of the penalty to be imposed.388 bb) If the internal investigations are initiated at the request of the U.S. SEC 162 (Securities and Exchange Commission) or the U.S. Department of Justice (DoJ) it is advisable to fully cooperate with these authorities in order to avoid any high penalties being imposed on the company. Apart from the waiver of the attorneyclient privilege, the required – and in any case requested – measures of cooperation include the transfer of documents or obtained information.389 It is self-evident that in each and every case it has to be verified whether the transfer of the information is permitted. As the United States does not belong to those third countries that provide for an adequate level of data protection, it is generally inadmissible and thus problematic to transfer personal data.390 cc) Irrespective of the fact that it is often in the company’s best interest to 163 cooperate, the management should fully weigh the legal risks as well as the advantages and any other risks, prior to transferring any information. There is the risk that, for example, the SEC or the DoJ may pass on information to other foreign supervisory authorities or public prosecutor’s offices. The disclosure of information may result in liability claims under civil law as well as sanctions under criminal and supervisory law.391 3. Are the findings made in the scope of internal investigations subject to the attorney-client privilege? a) No attorney-client privilege for in-house counsel involved in the investigations Unlike external attorneys, in-house counsels conducting internal investigations 164 are not entitled to refuse to give evidence (Zeugnisverweigerungsrecht) in civil or criminal law proceedings.392 Documents held in the custody of an in-house counsel are not subject to any prohibition of seizure.393

Kremer/Klahold, in: Krieger/Schneider, Handbuch Managerhaftung, § 18, para. 56. Behrens, RIW 2009, 22, 30 et seq. 389 Behrens, RIW 2009, 22, 28. 390 Cf. Schmidl, Rechtma ¨ßigkeit internationaler Datentransfers, Information Security Management, p. 2, p. 55 et seq. 391 Behrens, RIW 2009, 22, 28. 392 § 383 (1) no. 6 ZPO or § 53 (1) sentence 1 no. 3 StPO; LG Bonn NStZ 2007, 605, 606. 393 ECJ, decision of September 17, 2009, file no. T-125, 253/03, EuR 2008, 541; LG Bonn NStZ 2007, 605, 606; Dahns, NJW-Spezial 2007, 526; Seitz, EuZW 2008, 204, 207 et seq. 387 388

Spehl/Gru¨tzner

Reemers Publishing Services GmbH O:/Beck/Spehl_Gruetzner/3d/06_Deutschland.3d from 06.03.2013 09:28:10 3B2 9.1.580; Page size: 160.00mm  240.00mm

226

§ 6. Germany

b) Privileges of external investigators? 165 aa) External attorneys394 or auditors395 involved in an investigation are subject to the

confidentiality obligations applicable to their professions.396 External attorneys and auditors involved in carrying out internal investigations are entitled to refuse to give evidence in civil and criminal law proceedings.397 Written correspondence between an attorney or an auditor and his/her client or any other client-related items may not be seized by the law enforcement authorities,398 if 166 bb) said correspondence is held in custody by the attorney or the auditor and 167 cc) the correspondence is not linked to a criminal offence or has not been used or was not intended to be used in order to commit a criminal offence or does not originate from a criminal offence.399 168 As a general rule, the prohibition of seizure only applies in favor of the company retaining the respective attorney or auditor and does not automatically extend to investigative proceedings against employees of the company who have committed a criminal offence and whose misconduct is to be revealed by the internal investigations.400 4. Does the attorney-client privilege also apply to foreign attorneys? 169

The attorney-client privilege only applies to those attorneys who are admitted to practice law in Germany.401 Foreign attorneys may not claim the attorney-client privilege if they are involved in carrying out any internal investigations in Germany. Consequently, any documents held in custody by a foreign attorney may be seized by the law enforcement authorities. The foreign attorneys are not entitled to refuse to give evidence in civil or criminal law proceedings.

VI. Following-up on internal investigations 1. What is to be observed during the follow-up of internal investigations? 170 a) Should the findings made by the internal investigations reveal any weaknesses

within the company, the management must take specific measures to prevent any further violations of the law. If the management fails to put such measures into place, its members may hold the management liable for damages in the case of any further § 43 a (2) BRAO and § 2 BORA. § 43 (1) sentence 1 WPO and § 9 (1) of Professional rules for auditors (BS WP) 396 Mengel/Ullrich, NZA 2006, 240, 241; Salvenmoser/Schreier, in: Achenbach/Ransiek, Handbuch Wirtschaftsstrafrecht, chapter XV, para. 12; Klengel/Mu¨ckenberger, CCZ 2009, 81, 87; cf. also BGHZ 122, 115 et seqq.; OLG Ko¨ln NJW 1992, 2,772, 2,773. 397 § 383 (1) no. 6 ZPO resp. § 53 (1) sentence 1 no. 3 StPO; Damrau, in: Mu ¨ nchener Kommentar ZPO, § 383, para. 37; Baumbach/Lauterbach/Albers/Hartmann, ZPO, § 383, para. 12; Greger, in: Zo¨ller, ZPO, § 383, para. 19; Salvenmoser/Schreier, in: Achenbach/Ransiek, Handbuch Wirtschaftsstrafrecht, chapter XV, paras. 149 et seqq.; OLG Du¨sseldorf MDR 1985, 507. 398 § 97 (1) in conjunction with § 53 (1) sentence 1 no. 3 StPO. 399 § 97 (2) sentence 1 StPO; Salvenmoser/Schreier, in: Achenbach/Ransiek, Handbuch Wirtschaftsstrafrecht, chapter XV, paras. 154 et seqq. 400 LG Hamburg NJW 2011, 942, 943. 401 Senge, in: Karlsruher Kommentar StPO, § 53, para. 15; Meyer-Goßner, StPO, § 53, para. 15; Pfeiffer, StPO, § 53, para. 3. 394 395

Spehl/Gru¨tzner

Reemers Publishing Services GmbH O:/Beck/Spehl_Gruetzner/3d/06_Deutschland.3d from 06.03.2013 09:28:10 3B2 9.1.580; Page size: 160.00mm  240.00mm

B. The 25 key questions in connection with internal investigations

227

violations.402 Furthermore, the management may be fined up to EUR 1 million per offence.403 b) Should the findings of the internal investigations confirm that employees have 171 breached their duties or committed criminal offences as suspected, measures under labor or civil law may be taken against these employees; this is unless the employer offers an amnesty program in which these employees participate.404 Under certain circumstances, the employer may demand that the affected emplo- 172 yees compensate for the costs incurred by the internal investigations.405 The relevant case law refers to the retention of private investigators. As the general circumstances regarding the parties’ interests are comparable, the principles determined in these case law decisions should be applicable analogously to law and auditing firms. A claim against an employee for reimbursement of the costs of external in- 173 vestigators only arises if the employer has retained the external investigators to investigate the employee based on a specific suspicion of a criminal act and if the investigation confirms that the employee has intentionally violated a contractual duty. In such a case, the costs of the external investigators do not qualify as precautionary costs that would constitute permanent business expenses and must be borne by the employer irrespective of specific damage events. If there is a specific suspicion of a criminal act, any expenses incurred by the injured party in order to avert imminent disadvantages will also be part of the damage eligible for compensation. The amount of the compensation obligation depends on what is expedient and necessary from an economic perspective.406 c) Depending on their respective objectives, the internal investigations may trigger 174 claims for information or claims for damages of (or vis-a`-vis) clients, competitors, suppliers as well as information and notification obligations. In particular when it comes to continuing business relationships, these risks must be carefully considered when following-up on the findings of the internal investigations. 2. May an employer pay its employee’s legal fees if he/she is being prosecuted under criminal law? The employer may commit itself vis-a`-vis its respective employee to pay his/her 175 fees incurred in litigation.407 In each individual case the employer should make the payment of legal fees subject to further conditions, e.g. that the employee is not accused of (intentionally) committing an offence or that the employee accepts the OLG Koblenz ZIP 1991, 870; Fleischer, in: Spindler/Stilz, AktG, § 93, para. 97. § 130 OWiG; Ko¨nig, in: Go¨hler, OWiG, § 130 para. 6; Bohnert, OWiG, § 130, para. 143; Rogall, in: Karlsruher Kommentar OWiG, § 130, para. 32. 404 Kremer/Klahold, in: Krieger/Schneider, Handbuch Managerhaftung, § 18, para. 55. 405 Cf. BAG NZA 2009, 1300; BB 1987, 689 f.; NZA 1998, 1334 et seqq.; NJW 1999, 308 et seqq.; in each case regarding the replacement of costs for private investigators Go¨tz/Gording, DB 2010, 559, 560; Salvenmoser/Schreier, in: Achenbach/Ransiek, Handbuch Wirtschaftsstrafrecht, Chapter XV, paras. 172 et seqq. 406 BAG NZA 2009, 1300, 1301 et seq.; NZA 1998, 1334; BB 1987, 689. 407 Zimmer/Stetter, BB 2006, 1445, 1451; Wessing, in: Mu ¨ nchener Anwaltshandbuch Verteidigung in Wirtschafts- und Steuerstrafsachen, § 11, para. 220; Go¨pfert/Merten/Siegrist, NJW 2008, 1703, 1704 et seq. 402 403

Spehl/Gru¨tzner

Reemers Publishing Services GmbH O:/Beck/Spehl_Gruetzner/3d/06_Deutschland.3d from 06.03.2013 09:28:11 3B2 9.1.580; Page size: 160.00mm  240.00mm

228

§ 6. Germany

employer’s defense strategy.408 The employer should also document the corporate policy reasons for paying the legal fees.409

C. Summary of key results 176 I.

If companies have reason to suspect that material breaches of duties or criminal offences are being or have been committed, the management should launch internal investigations in order to avert any further damage to the company and to members of its management. II. Prior to conducting individual measures within the scope of internal investigations, the employer must carefully verify or have a third party verify, whether and to which extent these individual measures are actually permitted. Criminal, labor and data protection law provisions have to be observed in this context. III. There is no generic answer to the question of whether or not the (former) employee has a collateral duty to cooperate in the internal investigation; this must rather be determined in consideration of the relevant facts and circumstances of each individual case. The following facts and circumstances must be examined when answering this question: (i) is the relevant employee (among those) accused and investigated in the scope of the internal investigation or (ii) has the employee gained knowledge of specific facts during his/her employment relationship that are not available to the company in any documented or otherwise secured form? IV. If there is no legal obligation to transfer the findings made in the scope of the internal investigations, it must be carefully examined whether the transfer of these findings to other group companies or public authorities, is actually admissible, in particular when it comes to group companies and authorities in foreign jurisdictions. 408 409

Go¨pfert/Merten/Siegrist, NJW 2008, 1703, 1704 et seq. Zimmer/Stetter, BB 2006, 1445, 1451.

Spehl/Gru¨tzner

Reemers Publishing Services GmbH O:/Beck/Spehl_Gruetzner/3d/07_Indonesia.3d from 06.03.2013 09:28:27 3B2 9.1.580; Page size: 160.00mm  240.00mm

§ 7. Indonesia Para. Introduction . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 1 Initiation of internal investigations . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 5 When and to what extent should internal investigations be initiated? 5 Should the internal investigations be of an open or covert nature? . . . 12 Is it advisable to involve external investigators? . . . . . . . . . . . . . . . . . . . . . . . 15 Is it permitted that foreign attorneys conduct internal investigations in Indonesia? . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 16 V. When should national authorities be called in? . . . . . . . . . . . . . . . . . . . . . . . 17 C. Admissibility and implementation of individual measures within the scope of internal investigations . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 18 I. What measures are admissible within the scope of internal investigations? . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 18 1. Interviews . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 19 2. Access to company documents (including electronic data) . . . . . . . . . 21 II. Must employees’ representatives such as the works council be involved in internal investigations? . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 36 D. Employee interviews . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 39 I. May an employee refuse to provide information if this information would incriminate himself/herself? . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 39 II. Is an employee obliged to provide information on any misconduct of or criminal offence committed by other employees? . . . . . . . . . . . . . . . . . . 40 III. May an employee refuse to answer a question if he/she has already answered it within the scope of a previous interview? . . . . . . . . . . . . . . . . . 42 IV. Is an employee entitled to the presence of a member of the works council or an attorney during the interview? . . . . . . . . . . . . . . . . . . . . . . . . . . 43 V. Is an employee entitled to read the record of his/her interview? . . . . . . 44 VI. Is the employer entitled to request that the employee signs the record of the interview? . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 45 VII. Can the employer instruct an employee to treat the content of his/her interview as confidential? . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 46 E. Sanctions imposed on employees . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 47 I. What are the sanctions under employment law that can be imposed on employees refusing to cooperate in internal investigations? . . . . . . . . 47 II. Is the suspicion of a criminal offence or of a severe violation of duty sufficient for an extraordinary termination? . . . . . . . . . . . . . . . . . . . . . . . . . . . 52 III. During which period of time must an extraordinary notice of termination be given to employees whose misconduct has been revealed by the internal investigations? . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 53 IV. Must an employee cooperate in internal investigations even after he/ she has been given notice of termination? . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 54 F. Use of the obtained information . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 55 I. Is it permissible to disclose the findings and information obtained within the scope of any internal investigations to other group companies? . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 55 II. Is it permissible and advisable to forward the findings and information obtained within the scope of any internal investigations to public authorities? . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 58 III. Are the findings made in the scope of internal investigations subject to the attorney-client privilege? . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 59 IV. Does the attorney-client privilege also apply to foreign attorneys? . . . . 62 A. B. I. II. III. IV.

Sukirno/Hirdarisvita

Reemers Publishing Services GmbH O:/Beck/Spehl_Gruetzner/3d/07_Indonesia.3d from 06.03.2013 09:28:27 3B2 9.1.580; Page size: 160.00mm  240.00mm

230

§ 7. Indonesia Para. G. Following-up on internal investigations . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 63 I. What is to be observed during the follow-up of internal investigations? . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 63 II. May an employer pay its employee’s legal fees if he/she is being prosecuted under criminal law? . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 65

A. Introduction Corporate internal investigation is a relatively new concept in Indonesia. There is not yet a specific set of rules governing the mechanism of an internal investigation for companies. However, this is not to say that corporate internal investigations are uncommon. The increasing enforcement of the US Foreign Corrupt Practices Act brings impacts to businesses outside the US jurisdiction – this includes Indonesia, where one of the impacts is the flourishing exercise of internal investigations. 2 In addition to the above, Good Corporate Governance (“GCG”) awareness in Indonesia has been gradually increasing over the past few years. The Indonesian government first considered the importance of ensuring the implementation of GCG around the same time when public agitation on corruption within government ensued. The National Committee on GCG was established in 1999 with the initial aim to enforce GCG in public companies, state-owned enterprises and companies utilizing or managing public funds.1 As the fight against corruption continues intensely with the enactment of various laws,2 GCG principles in Indonesia are developing as well. For example, aside from the establishment of the National Committee on Governance, the government, through the Ministry of State Administrative Reform established a forum called the Three Pillars of Partnership (“Three Pillars”) as a response to the Presidential Instruction No. 5 of 2004 on the Acceleration of Corruption Eradication. The Three Pillars is a cooperation forum consisting of three elements, i. e. the government, businessmen and civil society which are actively providing education on corruption eradication. It has adopted various modules to be used as guidelines for state administrators, businessmen and the public. Examples are Module on GCG, Module on Good Public Governance, Module on Corruption Prevention, Module on Business without Bribe, and Module on the Whistleblowing System. However, as with the National Committee on Governance, the Three Pillars’ modules are more popular amongst public companies rather than private companies. 3 Now, with the global economic crisis, public and private corporations all around the world are getting into shape and are beginning to diligently enforce GCG. Indonesia, albeit not directly affected by the crisis, followed suit. Hence, it is 1

1 The National Committee on GCG was established pursuant to the Decree of the Coordinating Minister for Economy, Finance and Industry No.: KEP-10/M.EKUIN/08/1999 dated 19 August 1999 with the task of formulating and recommending a national policy on GCG. This committee was then transformed into the National Committee on Governance in 2004. 2 To name a few, Law No. 31 of 1999 on the Eradication of the Criminal Act of Corruption as lastly amended with Law No. 20 of 2001 (“Anti-Corruption Law”); Law No. 1 of 1999 on the Ratification of the Treaty between the Republic of Indonesia and Australia on Mutual Assistance in Criminal Matters; Law No. 30 of 2002 on the Commission for the Eradication of Corruption; Law No. 7 of 2006 on the Ratification of the United Nations Convention against Corruption, 2003; Law No. 8 of 2010 on the Prevention and Eradication of Money Laundering (“Anti-Money Laundering Law”).

Sukirno/Hirdarisvita

Reemers Publishing Services GmbH O:/Beck/Spehl_Gruetzner/3d/07_Indonesia.3d from 06.03.2013 09:28:28 3B2 9.1.580; Page size: 160.00mm  240.00mm

B. Initiation of internal investigations

231

becoming more common, though not yet widespread, for private companies in Indonesia to also apply GCG in their internal policies. As GCG implementation in private companies is still gaining popularity in 4 Indonesia, many aspects of GCG are not yet regulated in national legislation, including matters relating to corporate internal investigations. The National Committee on Governance has issued several guidelines to better promote the implementation of GCG in companies. In terms of internal investigations, the National Committee on Governance does not provide guidelines on the specific matter but it does discuss internal investigations in its guideline on Whistleblowing System issued on 10 November 2008 (“WBS Guideline”). Similarly, the Three Pillars also give some exposure on internal investigations in its Module on the Whistleblowing System (“WBS Module”) and Module on Business Ethics (“Business Ethics Module”). In the absence of a specific regulation on corporate internal investigations, the following questionnaire is based mostly on such guidelines provided by the National Committee on Governance and the Three Pillars.

B. Initiation of internal investigations I. When and to what extent should internal investigations be initiated? Art. 1 (2) of the Indonesian Criminal Procedural Code defines an investigation as 5 follows: “A series of acts by an investigator in matters and by means regulated in this law to seek and gather evidence which will clarify whether a criminal act has occurred and to identify the suspect.”

Art. 1 (4) of the Indonesian Criminal Procedural Code further defines an investigator as the Indonesian National Police authorized by the Code to carry out any investigation. From the above provision the party authorized to carry out an investigation in relation to a potential allegation of a criminal act in accordance with the above Code is the Indonesian National Police. Investigation of a potential allegation of a criminal act by the Indonesian National Police is based on a report of a certain party who is aware of, witness to or is a victim of a criminal act. The characteristics of investigation by the Indonesian National Police are: – the investigation is conducted based on a report from any party who is aware of, witness to or is a victim of a criminal act; – the person to be interrogated must be summoned with an official letter sent by the Indonesian National Police; – investigation must be conducted in the police office (except in certain circumstances); – during an interrogation, the Indonesian National Police may apply certain pressures in order to obtain confession from the interrogated person; – only the Indonesian National Police who are authorized to conduct searches and confiscation of documents or assets from a court warrant, for the interest of the investigation. The Indonesian Criminal Procedural Code does not recognize the existence of private investigators, although in practice (informally) they may exist, however, Sukirno/Hirdarisvita

6

7

8

9

Reemers Publishing Services GmbH O:/Beck/Spehl_Gruetzner/3d/07_Indonesia.3d from 06.03.2013 09:28:28 3B2 9.1.580; Page size: 160.00mm  240.00mm

232

§ 7. Indonesia

only to the extent for gathering data or information as requested by the client. Data or information gathering may be conducted, among others, by interviewing the relevant person and accessing documents as in a due diligence exercise. 10 In Indonesia, internal investigations are set out as part of the operational aspect in the Whistleblowing System; as a follow up to a report of an offence.3 The investigation unit of a company should be a function or unit independent of the company’s daily operational unit which has access to the company’s highest authority. 11 Upon receiving a report, an internal investigation should be conducted to find and collect the evidence necessary to assess the reported offence. If there is sufficient evidence, the investigators should take their recommendation to the Board of Directors. Otherwise, the investigation process should be ceased and any report on the offence should be discontinued.4

II. Should the internal investigations be of an open or covert nature? As corporate internal investigations in Indonesia are mainly discussed within the framework of the whistleblower system, the available guidelines recommend internal investigations to be conducted covertly. The Business Ethics Module divides internal investigation into 3 stages, all of which are to be conducted confidentially: – Interview with the whistleblower, if the identity is known. If report is made anonimously, the preliminary evidence has to be examined. – Interview with the people who know or are considered to know the reported offence to gather further supporting evidence. – Interview with the person reported to have conducted an offence. 13 In all of the above stages, the whistleblower’s name must be kept confidential by the investigator. 14 Although internal investigations in practice are almost always difficult to be kept low profile, as a practical consideration, an open internal investigation would more likely cause tension among the employees compared to a covert one. If an internal investigation is conducted openly, employees would likely become defensive or uncooperative and in turn make it difficult to identify the investigated issues. 12

III. Is it advisable to involve external investigators? 15

The use of an independent external investigator/auditor should be considered in serious and sensitive cases. For example, the WBS Guideline recommends using independent external investigators/auditors if the offence is conducted by the members of the Board of Directors or the Board of Commissioners.

3

WBS Guideline, WBS Module, Business Ethics Module. The WBS Module adopts Gerald D. Bloch’s approach in his writing, “Shaping Your Whistleblower System”, The Corporate Board: Journal of Corporate Governance, May-June 2003. Bloch suggests that if the internal investigation does show that a fraud has occurred, the case should be submitted to the authority. 4

Sukirno/Hirdarisvita

Reemers Publishing Services GmbH O:/Beck/Spehl_Gruetzner/3d/07_Indonesia.3d from 06.03.2013 09:28:28 3B2 9.1.580; Page size: 160.00mm  240.00mm

C. Admissibility and implementation of individual measures

233

IV. Is it permitted that foreign attorneys conduct internal investigations in Indonesia? There is no expressed prohibition for foreign attorneys to conduct internal 16 investigations in Indonesia. Art. 23 (1) of Law No. 18 of 2003 on Advocates (“Advocate Law”) specifically sets out the prohibition for foreign advocates to appear before court, practice law and/or open a law firm or its representative in Indonesia. This prohibition does not include internal investigation in terms of GCG implementation. Further, as noted above, investigators in charge of internal investigations should be those who are independent of the company’s daily operational unit and who have access to the company’s highest authority. Using the service of attorneys – including foreign attorneys – may be the common option to resolve the independence issue in conducting internal investigations. Conceivably, foreign attorneys are permitted to conduct internal investigations in Indonesia insofar as the investigation is not based on Indonesian legal issues. Alternatively, they can conduct the investigation in conjunction with Indonesian lawyers.

V. When should national authorities be called in? As elaborated earlier, the role of private investigators (which include internal 17 investigators as well) are limited to the finding and gathering of data and information on a reported offence. If the data and information gathered are sufficient to identify a criminal act under Indonesian laws, the investigation should then be delegated to the police as they are the ones who are authorized to determine the occurrence of a criminal action as well as to identify suspects and to take further action.

C. Admissibility and implementation of individual measures within the scope of internal investigations I. What measures are admissible within the scope of internal investigations? Investigations by private investigators shall only be conducted with the objective 18 to gather data/information as required by the client but shall not be for the purpose of determining the occurrence of a criminal action and identifying a suspect. Permissible investigations should only be conducted as in a due diligence exercise over data or information of a company/an individual through, among others, documents gathering or interview. 1. Interviews Interviews conducted during a private investigation should not be directed in a 19 manner, so as to create a perception that the person being interviewed has been accused of having conducted a criminal act. Interviews in order to gather general information from a person are allowed. However, one must be very cautious in questioning the history of an event alleged as a criminal act. The interviewee may Sukirno/Hirdarisvita

Reemers Publishing Services GmbH O:/Beck/Spehl_Gruetzner/3d/07_Indonesia.3d from 06.03.2013 09:28:29 3B2 9.1.580; Page size: 160.00mm  240.00mm

234

§ 7. Indonesia

feel pressured, accused, or humiliated by questions or statements made by the private investigators. It should be noted that under the Indonesian Criminal Code, any party who feels that he/she has been questioned during an interview in such a way that he/she felt humiliated or accused as a suspect of or a party to a criminal action, can file a claim to the Indonesian National Police or file a civil claim on the basis of an unpleasant act or defamation.5 Obtaining the interviewee’s prior consent for the interview does not eliminate his/her right to file an unpleasant or defamation claim against the investigators. 20 Characteristics of permissible interviews are: – it must obtain prior consent from the person to be interviewed; – the investigator must explain the purpose of the investigation to the person being interviewed. The explanation shall not give the perception that the interviewee is being accused; – there must not be any threat, humiliation, duress, accusation or any kind of force or pressure during the investigation or interview; – it must be conducted in a place where the person being interviewed does not feel that they are being investigated for a criminal act. 2. Access to company documents (including electronic data) As a general rule, under the Indonesian Criminal Procedural Code, the Indonesian National Police in conducting an investigation are prohibited from accessing and consfiscating documents (including electronic data) that must be kept confidential by the person who is keeping them as required by the prevailing laws or his/her contractual obligation, unless by a specific court order. 22 Based on the above provision and considering that only the Indonesian National Police can access and confiscate the documents (including electronic data) in conducting investigations based on a court order, any private person, including private law firms or accounting firms are therefore not allowed to access, copy and confiscate a company’s documents (including electronic data) in the framework of an investigation in relation to the allegation of criminal actions without the permission of the relevant company. The company may be able to decline handing over documents (including electronic data) that should be concealed by them due to their contractual obligations. Access to company’s documents/data/information requires prior approval of the company. 23 As long as the company has given its consent, the private investigators may access such company documents, data or information or make any copies of the documents, data or information. Company documents may also include information or documents created or established or formed by the employees in relation to their work in the company. Access to employees’ personal data/information/documents which have been given to the company, although considered as property of the company, still require the relevant employees’ approval. 21

5 The criminal act of unpleasant act is defined in Art. 335 (1) of the Indonesian Criminal Code as an unlawful act of forcing other people to do, not to do or omit something, with violence or with threat of violence, an act or unpleasant act against that person or other people; and the act of forcing other people to do, not to do or omit something with threat of defamation. Defamation under Art. 310 of the Indonesian Criminal Code is defined as an act of attacking a person’s honor or good will by accusing him/her with the intention to be known by the public.

Sukirno/Hirdarisvita

Reemers Publishing Services GmbH O:/Beck/Spehl_Gruetzner/3d/07_Indonesia.3d from 06.03.2013 09:28:29 3B2 9.1.580; Page size: 160.00mm  240.00mm

C. Admissibility and implementation of individual measures

235

Various regulations under Indonesian law also suggest that it would be prudent 24 to secure consents from the employees with respect to the use of their personal data. – Law No. 11 of 2008 on Electronic Information and Transaction (“EIT Law”) The EIT Law does not specifically define categories of persons who own certain 25 personal data. However, Art. 26 of the EIT Law provides: “(1) Unless provided otherwise in the Laws and Regulations, the use of information through electronic media which involves a person’s personal data must be based on the consent of such relevant person. (2) Anyone whose rights as referred to in paragraph (1) are violated can lodge a claim for losses incurred pursuant to this Law.”

Based on the above provision, if the information obtained from the company 26 contains personal data of the employees, the private investigators must first obtain consent from the employees. – Law No. 39 of 1999 on Human Rights (“Human Rights Law”) Art. 32 of the Human Rights Law provides that:

27

“Freedom and secrecy of correspondence including communication through electronic means may not be violated, except by a court order or other valid authority in accordance with the prevailing laws and regulations.”

Conceivably, if personal data is deemed to have been gathered from various 28 correspondences between the company and the employees, this provision under the Human Rights Law might in some circumstances need to be taken into account. – Indonesian Criminal Code There is a general prohibition in the Indonesian Criminal Code that makes it a 29 crime to disclose certain information which is meant to be confidential. Art. 322 (1) of the Indonesian Criminal Code stipulates that: “Anyone who intentionally discloses confidential information that is under an obligation to be kept secret by him/her by virtue of his/her present or past position or employment, is subject to imprisonment of 9 months or a fine of a maximum of nine thousand Rupiah.”

Proving the elements of “intentionally” disclosing information that is “secret” or 30 confidential and which is under an obligation of being kept confidential can be difficult. As such, even if consent is not sought, the risk of criminal liability arising would be mitigated (in the absence of specific personal data protection legislation). This is a dated provision (the penalty of 9,000 Rupiah in dollar terms today would amount to approximately one dollar) and we are not aware of any prosecution of any employer in this context. It is not clear whether this Art. 322 (1) would apply to an employer who discloses 31 employees’ data to a third party (including, for example, private investigators) in the absence of a specific non-disclosure obligation under the applicable company regulation, collective labor agreement or employment agreement which stipulates that: – employee data is categorized as confidential information; – employee data must be kept confidential by the company; and/or – whether a company requires an employee’s approval/consent to disclose his/her personal data to a third party.

Sukirno/Hirdarisvita

Reemers Publishing Services GmbH O:/Beck/Spehl_Gruetzner/3d/07_Indonesia.3d from 06.03.2013 09:28:29 3B2 9.1.580; Page size: 160.00mm  240.00mm

236 32

§ 7. Indonesia

In the absence of specific regulations on data privacy, in practice, companies sometimes include policies on human resources data privacy in their company regulation, collective labor agreement or employment agreements. The policy may stipulate among other things that: – the policy covers the personal information of current and former employees of the company located around the world; – the company maintains high standards to safeguard personal information, by treating the personal information with care, maintaining and monitoring its physical, electronic and procedural safeguards, taking into account technical and organizational security measures; – the possibility of sharing the employee’s personal information both internally and externally (i. e. with a third party private investigator); and – the employee’s approval to disclose his/her personal data to a third party.

– Indonesian Civil Code Art. 1365 of the Indonesian Civil Code provides for the general law of tort. Pursuant to this article, an aggrieved party may claim for damages caused by an unlawful action of the other party, as long as such unlawful action has caused actual losses to the aggrieved party. 34 In this context “unlawful” acts could be interpreted broadly, including violations of statutory law, moral duties or the duty of care owed to other people’s interest. There is no clear definition in Indonesian law on what violates “public morals” and “duty of care”. These definitions vary with time and place. “Public morals” could depend on society’s view at a certain place and time, and “duty of care owed to other people’s interest” could depend on the duty rendered, business ethics and the like. The data which contains some personal data of employees could conceivably be construed as the personal interests if a specific person, which should not be used without authorization from that person. 35 Consequently, violation of a duty of care for another person’s interest could possibly be construed as an unlawful action and used as the basis for aggrieved employees to claim damages from the company for misusing their personal data. Of course, such aggrieved employees would have to prove the losses or damages caused by such an unlawful act. 33

II. Must employees’ representatives such as the works council be involved in internal investigations? 36

The common body that serves as employees’ representative in Indonesia is the labor union. Under Art. 104 (1) of Law No. 13 of 2003 on Labor (“Labor Law”), every employee/labor is entitled to form and become a member of an employee/ labor union. Law No. 21 of 2000 on Employee/Labor Union (“Labor Union Law”) more specifically stipulates the functions of a labor union as follows: – to serve as a party in concluding a collective employment agreement and in industrial dispute resolution; – to serve as the employees’ representative in a cooperation organization in the field of labor;

Sukirno/Hirdarisvita

Reemers Publishing Services GmbH O:/Beck/Spehl_Gruetzner/3d/07_Indonesia.3d from 06.03.2013 09:28:30 3B2 9.1.580; Page size: 160.00mm  240.00mm

D. Employee interviews

237

– to create a harmonious dynamic and fair industrial relations pursuant to the prevailing laws and regulations; – to distribute aspiration in fighting for its members’ rights and interest; – to serve as the planner, executor and the body in charge for the employees’ strike pursuant to the prevailing laws and regulations; – to serve as the employees’ representative in fighting for share ownership in the company. Further, Labor Union Law also sets forth the rights of a labor union, i. e.: 37 – to make a collective employment agreement with the employer; – to represent the employees in settling an industrial dispute; – to represent the employees in labor institutions; – to form an institution or to act in relation with the efforts to improve the employees’ welfare; – to do other acts in the manpower field that do not violate the prevailing laws and regulations. However, neither Labor Law nor the Labor Union Law provides regulation on 38 corporate internal investigations or the role of a labor union in such internal investigations. Arguably, it is not mandatory to have a labor union involved in internal investigations.

D. Employee interviews I. May an employee refuse to provide information if this information would incriminate himself/herself? Labor Law, the WBS Guideline and the GCG Code do not oblige employees to 39 provide information for the purpose of internal investigations, irrespective of whether the information would incriminate the employees or not. The duty to provide information may be covered in the employment agreement, company regulation or the collective labor agreement. However, since an internal investigation is not conducted by an investigator as authorized by the Indonesian Criminal Procedural Code, employees who are being interviewed have the right to decline answering questions without sanction, unless regulated otherwise in the employment agreement, company regulation or the collective labor agreement.

II. Is an employee obliged to provide information on any misconduct of or criminal offence committed by other employees? In terms of a formal investigation conducted by the Indonesian National Police 40 pursuant to the Indonesian Criminal Procedural Code, every person is obliged to report felonious conspiracy to the Indonesian National Police.6 However, this is not the case with internal investigations. Similar to the preceding 41 paragraph, there are currently no provisions that oblige employees to provide 6 Art. 108 (2) of the Criminal Procedural Code: “Every person who has knowledge of a felonious conspiracy to conduct a criminal act against the public peace and security or against life or against proprietary rights is obliged to immediately report such matter to the investigator.”

Sukirno/Hirdarisvita

Reemers Publishing Services GmbH O:/Beck/Spehl_Gruetzner/3d/07_Indonesia.3d from 06.03.2013 09:28:30 3B2 9.1.580; Page size: 160.00mm  240.00mm

238

§ 7. Indonesia

information on offences committed by other employees. In fact, under the GCG Code, the providing of information is more of a right than an obligation.7

III. May an employee refuse to answer a question if he/she has already answered it within the scope of a previous interview? 42

As provided in number 1 above, during an internal investigation employees have the right to decline answering questions. This right also applies to further interviews.

IV. Is an employee entitled to the presence of a member of the works council or an attorney during the interview? 43

As the role of a labor union is basically to represent the employees of a company, it is generally accepted that in an internal investigation interview employees may be accompanied by their labor union. Likewise, employees can also be accompanied by their attorney during an interview.

V. Is an employee entitled to read the record of his/her interview? 44

Although there is currently no legal obligation for the employer to provide records of an interview, the employee should be entitled to read the record of his/ her own interview when he/she asks for it. The employee has the right to ensure that the information recorded by the investigators is the same with what he/she provided in the interview.

VI. Is the employer entitled to request that the employee signs the record of the interview? 45

The WBS Guideline encourages internal investigations to be well documented as the investigation has to be open for review. In this regard – though it is not mandatory – an employer can request the employee to sign the interview record. By bearing his/her signature, the employee can also ensure that the interview record is in line with the information he/she provided.

VII. Can the employer instruct an employee to treat the content of his/her interview as confidential? 46

Confidentiality is an important aspect in internal investigations. Particularly in terms of the whistleblower system, confidentiality is important to protect the 7 The GCG Code provides Code Provisions for Employees which stipulates that, “Employees shall have the right to report on any breach of the business ethics and code of conduct as well as any violation against laws and regulations that occurred within the company.” Similar provision is also available in Law No. 31 of 1999 on the Eradication of the Criminal Act of Corruption as lastly amended with Law No. 20 of 2001 whereby the public is entitled to search, obtain and provide information on an alleged corruption act.

Sukirno/Hirdarisvita

Reemers Publishing Services GmbH O:/Beck/Spehl_Gruetzner/3d/07_Indonesia.3d from 06.03.2013 09:28:30 3B2 9.1.580; Page size: 160.00mm  240.00mm

E. Sanctions imposed on employees

239

whistleblower as well as to prevent other employees from feeling anxious, uneasy or threatened. An employee who discusses his/her interview with other employees may cause the other employees to feel uncomfortable about the internal investigations. Subsequently, they may not be cooperative when it comes to their turn to be interviewed. The WBS Guideline even goes as far as saying that the violation of confidentiality by the whistleblower shall eliminate the employer’s obligation of guaranteeing confidentiality to the whistleblower and in certain cases it can result in the elimination of protection for the whistleblower.8

E. Sanctions imposed on employees I. What are the sanctions under employment law that can be imposed on employees refusing to cooperate in internal investigations? As discussed above, Labor Law is silent on internal investigations. Therefore, it 47 does not specifically provide sanctions that can be imposed on employees refusing to cooperate in internal investigations. If, however, the employment agreement, the company regulation or the collective labor agreement covers matters relating to internal investigation, then the refusal to cooperate can be considered as a violation of such an employment agreement or company regulation or collective labor agreement. In this regard, Labor Law states that such a violation will entitle the company to terminate the employment, but only after the respective employee is given three warning letters. The period for each warning letter shall be 6 months at the latest, unless stipulated otherwise in the employment agreement, company regulation or collective labor agreement. A noteworthy rule under Labor Law on termination is that employers must first 48 obtain a favorable decision on the termination of employment from the Industrial Relations Court (“IRC”). Exceptions to this general rule are limited to the following circumstances: – termination during probation period; – employee’s voluntary resignation (provided in writing, without duress/intimidation from the company); – expiration of a definite period/fixed term employment (provided that the definite period employment is not deemed as an indefinite period or permanent employment due to violation of the maximum allowed period of contract or types of work);

8 The Anti-Money Laundering Law, Law No. 13 of 2006 on Witness and Victim Protection and Government Regulation No. 57 of 2003 on the Procedures for Special Protection for Informer and Witness of Money Laundering Act provide legal protection for an informer with good faith. Pursuant to these laws and regulation, the protection that can be provided includes: – protection from criminal and/or civil claim; – protection on personal and/or family safety from physical and/or mental threats; – protection on assets; – concealment of identity; and/or – the right to give information without interacting face to face with the reported party, at each level of case examination.

Sukirno/Hirdarisvita

Reemers Publishing Services GmbH O:/Beck/Spehl_Gruetzner/3d/07_Indonesia.3d from 06.03.2013 09:28:30 3B2 9.1.580; Page size: 160.00mm  240.00mm

240

§ 7. Indonesia

– employee’s reaching the retirement age as provided in the employment agreement, company regulation or collective labor agreement; – employee’s death; – employee’s detention by the authorities causing his/her inability to work for 6 months; – a court decision finding the employee guilty of a crime (within the 6 month period that the employee is detained by the authorities). 49 Unless the termination of employment is due to reasons which are exempted as above, the company would need to seek approval from the IRC. 50 Under Labor Law, an employer must make efforts to avoid the termination of employment by performing supervisory measures. In practice, the employer is obligated to give an employee the opportunity to improve his/her performance by giving him/her performance evaluations, supervisory measures and warning letters before an employer terminates an employee due to non-performance. The evaluation of an employee’s performance will be based on working targets and/or the fulfillment of the employee’s obligations set out in an employment agreement or other documents (such as the employee’s annual business plan, assignment worksheet). 51 The mediator/conciliator and the IRC/Supreme Court in practice will review the factors involving an employee’s non-performance, including reviewing whether there are outside factors which affect the employee’s performance, for example, unreasonable working targets, the general economic situation, the absence of a professional development program. In addition, they may enquire whether the company has assigned the employee to another available job (which is often interpreted as “assigned to another division within the company”). The reason for this is because there is a possibility that the employee will perform better if he/she is assigned to a different area or division.

II. Is the suspicion of a criminal offence or of a severe violation of duty sufficient for an extraordinary termination? 52

As elaborated earlier, the general rule under the Labor Law is that for termination of employment, the employer must obtain an IRC decision. Suspicion of a criminal offence or severe violation of duty cannot justify an extraordinary termination. Even if an employee is suspected to have conducted a criminal offence or violated a duty, termination in this regard still has to go through the mechanism set forth under Labor Law, i. e. obtain approval from the IRC. However, a ruling of the Indonesian Constitutional Court in 2004 stated that an employer can terminate an employee for a criminal offence – but only after the employee had been convicted by a criminal court. Furthermore, the court argued that a major mistake gave excessive authority to the employer to unilaterally terminate an employee without having the prior decision of an independent and impartial court.

Sukirno/Hirdarisvita

Reemers Publishing Services GmbH O:/Beck/Spehl_Gruetzner/3d/07_Indonesia.3d from 06.03.2013 09:28:31 3B2 9.1.580; Page size: 160.00mm  240.00mm

F. Use of the obtained information

241

III. During which period of time must an extraordinary notice of termination be given to employees whose misconduct has been revealed by the internal investigations? As termination of employment must go through the IRC, except under special 53 circumstances previously listed, the issuance of extraordinary notice of termination is not applicable under Labor Law.

IV. Must an employee cooperate in internal investigations even after he/she has been given notice of termination? Labor Law is silent on this matter. Arguably, there is no legal obligation for an 54 employee to cooperate when the employee has been terminated by the company.

F. Use of the obtained information I. Is it permissible to disclose the findings and information obtained within the scope of any internal investigations to other group companies? Similar to accessing company data, disclosure of findings and information 55 obtained during internal investigations of other group companies may fall under the scope of the EIT Law. Art. 32 of the EIT Law enlists the transferring of a person’s electronic information/document as one of the prohibited acts. Art. 32 of the EIT Law: 56 “(1) Every Person who intentionally and wrongfully or unlawfully by any means alters, adds, reduces, transmits, destructs, removes, transfers, conceals other Person’s or the public’s Electronic Information and/or Document. (2) Every Person who intentionally and wrongfully or unlawfully by any means moves or transfers Electronic Information and/or Document to other Person’s Electronic System.”9

Though the findings and information may not all be in the form of electronic 57 information and/or document, the prudent course is to secure prior consent from the investigated persons on the use and transfer of any information derived from the investigation.

II. Is it permissible and advisable to forward the findings and information obtained within the scope of any internal investigations to public authorities? Currently, the prevailing laws do not require mandatory disclosure on findings and 58 information obtained from an internal investigation. However, with the growth of the GCG awareness in Indonesia, submission of the results of the internal investigations 9 The EIT Law provides penal sanctions for the acts described in this Art. 32, i. e. a maximum imprisonment of 8 years and/or maximum fine of Rp. 2,000,000,000 (approximately USD 222,000) for the act described in Art. 32 (1) and a maximum imprisonment of 9 years and/or maximum fine of Rp. 3,000,000,000 (approximately USD 333,000) for Art. 32 (2).

Sukirno/Hirdarisvita

Reemers Publishing Services GmbH O:/Beck/Spehl_Gruetzner/3d/07_Indonesia.3d from 06.03.2013 09:28:31 3B2 9.1.580; Page size: 160.00mm  240.00mm

242

§ 7. Indonesia

to public authorities such as the Police, Attorney General, the Commission for the Eradication of Corruption, and the Business Competition Supervisory Commission, would be acceptable in order to further a formal investigation or close the case if the alleged offences are not proven.10

III. Are the findings made in the scope of internal investigations subject to the attorney-client privilege? 59

Yes, the findings made are subject to the attorney-client privilege. Art. 19 of the Advocate Law states: “(1) Advocates must keep confidential anything known or acquired from their clients as a result of professional relationship, unless stipulated otherwise by the laws. (2) Advocates are entitled to the confidentiality of their relationship with the clients, including protection on the files and documents from confiscation or inspection and protection against tapping of their electronic communication.”

60

Furthermore, the Advocates Code of Ethics also stipulates the attorney-client privilege as provided in Art. 4 (h): “Advocates are obliged to hold their professional confidentiality regarding matters disclosed by the clients in trust and they are obliged to maintain such confidentiality after the relationship between the advocate and the client ends.”

61

Pursuant to this Art., therefore, attorneys engaged to conduct internal investigations shall be subject to the attorney-client privilege. However, as provided in paragraph 1 of this Art., there is an exception to the attorney-client privilege, e.g. when it is required by law. An example of this would be the Anti-Corruption Law. Art. 36 of the Anti-Corruption Law stipulates that the obligation to testify as a witness also applies to those who, due to their profession or position, are obliged to keep secrets (except religious officials who keep secrets according to their obligations). In this regard, the attorney-client privilege would not be applicable.

IV. Does the attorney-client privilege also apply to foreign attorneys? 62

Art. 24 of the Advocate Law states that foreign advocates who are employed in a law firm in Indonesia shall comply with the Advocates Code of Ethics, as well as the laws and regulations. In this regard, it can be inferred that insofar as the Advocate Law is concerned, only registered foreign attorneys in Indonesia will be subject to attorney-client privilege.

G. Following-up on internal investigations I. What is to be observed during the follow-up of internal investigations? 63

For a breach of ethics, upon obtaining sufficient evidence, the investigators should propose to the Board of Directors a sanction for the offence. The sanction proposed 10

Whistleblowing System Modul, p. 17.

Sukirno/Hirdarisvita

Reemers Publishing Services GmbH O:/Beck/Spehl_Gruetzner/3d/07_Indonesia.3d from 06.03.2013 09:28:31 3B2 9.1.580; Page size: 160.00mm  240.00mm

G. Following-up on internal investigations

243

should be in accordance with the prevailing laws and regulations, including the employment agreement, company regulation, or the collective labor agreement. For serious offences such as fraud, corruption, or money laundering, upon 64 concluding the internal investigation, the investigators should forward the case to the authorities. However, currently in Indonesia there is no amnesty program applicable for companies that turn themselves in to the authorities.

II. May an employer pay its employee’s legal fees if he/she is being prosecuted under criminal law? Labor Law does not oblige employers to pay for their employee’s legal fees. It 65 does stipulate however that in the event an employee is detained for an alleged criminal offence, the employer is obliged to provide aid for the respective employee’s family. The amount of aid varies depending on the number of dependants of the employee, as follows: – for one dependant: 25 % of the employee’s wage; – for two dependants: 35 % of the employee’s wage; – for three dependants: 45 % of the employee’s wage; – for four dependants or more: 50 % of the employee’s wage.11 This aid is to be provided for a maximum period of 6 months calculated from the 66 first day the employee is detained. With regard to an employee undergoing criminal proceedings, another noteworthy 67 rule is that an employer can only terminate an employee for a criminal offence after the employee is found guilty by the court (see the discussion on extraordinary termination in supra para. 52).12 Until such time, the employer is still obliged to pay the employee’s salary. However, Labor Law also allows an employer to terminate an employee who after 6 months is not able to carry out his/her work due to criminal proceedings. 11 12

Art. 160 (1) of the Labor Law. Decision of the Constitutional Court No. 012/PUU-I/2003.

Sukirno/Hirdarisvita

Reemers Publishing Services GmbH O:/Beck/Spehl_Gruetzner/3d/07_Indonesia.3d from 06.03.2013 09:28:31 3B2 9.1.580; Page size: 160.00mm  240.00mm

Reemers Publishing Services GmbH O:/Beck/Spehl_Gruetzner/3d/08_Italy.3d from 06.03.2013 09:29:02 3B2 9.1.580; Page size: 160.00mm  240.00mm

§ 8. Italy Para. A. Introduction . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 1 B. The 25 key questions in connection with internal investigations . . . . 9 I. Initiation of internal investigations . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 9 1. When and to what extent should internal investigations be initiated? . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 9 2. Should the internal investigations be of an open or covert nature? . . 28 3. Is it advisable to involve external investigators? . . . . . . . . . . . . . . . . . . . . 31 4. Is it permitted that foreign attorneys conduct internal investigations in Italy? . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 34 5. When should national authorities be called in? . . . . . . . . . . . . . . . . . . . . . 37 II. Admissibility and implementation of individual measures within the scope of internal investigations . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 43 1. What measures are admissible within the scope of internal investigations? . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 43 a) Employee interviews . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 50 b) Email screening . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 52 aa) Email screening if the email account is used exclusively for business purposes . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 59 bb) Email screening if the email account is used both for business and private purposes . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 60 c) Handover, review and processing of files, letters and documents of employees . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 62 d) Handover and mirroring of the computer and subsequent processing of the business-related data and electronically stored business-related documents of employees (other than emails) . . . 65 e) Inspection of the personnel files of employees . . . . . . . . . . . . . . . . . . . 68 f) Video surveillance of employees . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 70 g) Tapping of telephone conversations . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 74 h) Search of the workplace . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 78 i) Covert listening in on conversations (other than telephone conversations) on the business premises . . . . . . . . . . . . . . . . . . . . . . . . . 79 j) Investigations carried out in the surroundings of employees under suspicion . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 80 2. Must employees’ representatives such as the Works Council be involved in internal investigations? . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 81 a) The work council’s rights of co-determination and information 82 b) The Works Council’s rights regarding individual measures . . . . . 84 aa) Employee interviews . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 84 bb) Monitoring, copying and processing of documents and emails . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 85 cc) Surveillance measures . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 90 dd) Search of the workplace . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 91 ee) Investigations carried out in the surroundings of employees 92 c) Consequences if right of co-determination is not observed . . . . . . 93 III. Employee interviews . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 94 1. May an employee refuse to provide information if this information would incriminate himself/herself? . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 94 a) Duty to provide information on the tasks directly assigned to the employee or carried out by the employee . . . . . . . . . . . . . . . . . . . . . . . . 95 b) Duty to provide information in indirect connection with the scope of work . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 96

Di Garbo/Gaudino/Mancuso/Vasile

Reemers Publishing Services GmbH O:/Beck/Spehl_Gruetzner/3d/08_Italy.3d from 06.03.2013 09:29:02 3B2 9.1.580; Page size: 160.00mm  240.00mm

246

§ 8. Italy Para. c) Duty to provide information outside the scope of work . . . . . . . . . 97 d) Disclosure of information to authorities if employee is obliged to incriminate himself/herself . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 98 2. Is an employee obliged to provide information on any misconduct of or criminal offence committed by other employees? . . . . . . . . . . . . . 99 3. May an employee refuse to answer a question if he/she has already answered it within the scope of a previous interview? . . . . . . . . . . . . . . 100 4. Is an employee entitled to the presence of a member of the Works Council or an attorney during the interview? . . . . . . . . . . . . . . . . . . . . . . . 102 a) The employee’s right to the presence of a member of the Works Council . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 102 b) The employee’s right to the presence of a lawyer representing the employee’s rights . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 104 5. Is an employee entitled to read the record of his/her interview? . . . . 105 6. Is the employer entitled to request that the employee signs the record of the interview? . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 106 7. Can the employer instruct an employee to treat the content of his/ her interview as confidential? . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 107 IV. Sanctions imposed on employees . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 111 1. What are the sanctions under employment law that can be imposed on employees refusing to cooperate in internal investigations? . . . . . 111 a) Disciplinary sanctions different from termination . . . . . . . . . . . . . . . 113 b) Termination . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 115 2. Is the suspicion of a criminal offence or of a severe violation of duty sufficient for an extraordinary termination? . . . . . . . . . . . . . . . . . . . . . . . . 116 3. During which period of time must an extraordinary notice of termination be given to employees whose misconduct has been revealed by the internal investigations? . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 119 4. Must an employee cooperate in internal investigations even after he/she has been given notice of termination? . . . . . . . . . . . . . . . . . . . . . . . 120 V. Use of the obtained information . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 121 1. Is it permissible to disclose the findings and information obtained within the scope of any internal investigations to other group companies? . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 121 2. Is it permissible and advisable to forward the findings and information obtained within the scope of any internal investigations to public authorities? . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 127 a) Admissibility of disclosure of personal data . . . . . . . . . . . . . . . . . . . . . 127 b) Is it advisable to voluntarily disclose data to public authorities? . 130 3. Are the findings made in the scope of internal investigations subject to the attorney-client privilege? . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 132 a) No attorney-client privilege for in-house counsel involved in the investigations . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 139 b) Privileges in the case that external investigators are involved . . . . 140 4. Does the attorney-client privilege also apply to foreign attorneys? . 142 5. What is to be observed during the follow-up of internal investigations? . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 145 6. May an employer pay its employee’s legal fees if he/she is being prosecuted under criminal law? . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 148 C. Summary of key results . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . .

A. Introduction 1

The Italian regulatory system and the approach to corporate investigations have in recent years been subject to continuous change, also triggered by various financial scandals and corporate collapses occurred from 2002 to 2005, which involved large Di Garbo/Gaudino/Mancuso/Vasile

Reemers Publishing Services GmbH O:/Beck/Spehl_Gruetzner/3d/08_Italy.3d from 06.03.2013 09:29:02 3B2 9.1.580; Page size: 160.00mm  240.00mm

A. Introduction

247

companies such as Cirio, Parmalat, Giacomelli, Banca Popolare di Lodi and Unipol as well as other Italian corporate and financial institutions. In light of the above, legal reforms were introduced between 1998 and 2007, in particular the Legislative Decree no. 231 of July 2001 (the “Decree 231”) on the “quasi-criminal” liability of corporations and a comprehensive reform of Italian corporate law that entered into force on January 1, 2004. In parallel, Italian public prosecutors in recent years have focused their attention on white collar financial crimes, associated with insolvency cases, fraud, market abuse, investor harm and obstruction of regulators. These are all contributing to the remarkable change to the Italian legal and regulatory system, which, as underlined by a commentator “until now was something of a paradox: the (possibility unrivalled) panoply of statutory and regulatory checks and balances did not translate into a systematic enforcement of investigative powers by the various “controlling bodies”.1 A growing focus on preventive controls over corporate activities, in order to allow for better monitoring and avoidance of irregularities, has in fact resulted in several legislative changes in the areas of corporate governance, financial reports, internal auditing, minority shareholders and conflicts of interest in Italian listed companies. The combination of pre-existing and new statutory and regulatory provisions has led to a proliferation of internal and external corporate “controls” – the efficiency and effectiveness of which, however, is far from being universally recognized. In the past, the level and occurrence of the investigations and the overall climate mainly depended on the type of supervisory inquiry to which the relevant corporations were subject to. This was in turn greatly influenced by the resources available to the relevant supervisory authority or regulator. The Bank of Italy used various resources to conduct regular inspections over banks, other financial institutions and intermediaries, whereas listed companies are subject to the control of the Commissione Nazionale per la Societa` e la Borsa (“Consob”) and insurance companies to that of the Istituto di Vigilanza sulle assicurazioni private e di interesse collettivo (“ISVAP”).2 Expectations are now that the combination of new statutory and regulatory provisions, increased powers and independence recognized to various controlling bodies and regulators, as well as sensitive knowledge arising from the financial scandals, should all contribute to make the overall process of corporate control more efficient and should reinforce the strength and regularity of the investigations.3 1 Corporate Internal Investigations, An Internal Guide, Oxford University, ed. by Lomas/Kramer, 2008, p. 461. 2 The Insurance Sector Regulator. 3 Direct Investigative and sanctioning powers over supervised companies enabled Consob on February 2007 to fine Ifil, the holding company of Fiat group, and three of its directors, who were temporary suspended from their appointments, for market manipulation, in the total amount of EUR 16 million in connection with misleading communications released in August 2005. In March 2007, Consob used, for the first time, its “new” power to freeze assets of a listed company illicitly purchased, sanctioning Mr. Lonati for insider trading in addition to a fine of EUR 1.5 million. Furthermore, in the last years there has been a significant consolidation in the Italian banking industry. Such consolidation often resulted in a change in the corporate governance system of the relevant banks. They have often adopted a two-tier “dual” system of governance that is designed to ensure a clear division of responsibility between the management board and the supervisory board. The Bank of Italy’s governor has emphasized the need to pay particular attention to internal controls and improvement of risk management systems and the group level. New supervision rules will be issued in order to make similar controls over financial intermediaries and banks, avoiding inspections in favor of more frequent requests of information: Bank of Italy, Annual Report 2006, dated May 31, 2006.

Di Garbo/Gaudino/Mancuso/Vasile

2

3

4

5

6

Reemers Publishing Services GmbH O:/Beck/Spehl_Gruetzner/3d/08_Italy.3d from 06.03.2013 09:29:03 3B2 9.1.580; Page size: 160.00mm  240.00mm

248

§ 8. Italy

Some results of this new climate are already proven by the way in which banks and corporations are conducting systematic internal investigations at an unprecedented level of complexity (and indeed, some of the banks and companies involved in recent scandals have conducted their own internal investigations on past irregularities, often as a basis for subsequent damage claims against former directors and auditors). It is finally worth noting that a drastic change may arise in the legal scenario due to the possibility to use Decree 231 to assess the “quasi-criminal” liability of corporations, to sanction the torpor of Italian and foreign businesses in monitoring their internal affairs in Italy, with strong sanctions including suspension of trade. 7 In a number of cases, foreign companies (such as Siemens in a public procurement cases) and banks (such as UBS and Deutsche Bank by a Milan Court decision of June 13, 2007 in the Parmalat criminal proceedings) have been held liable under Decree 231. Courts precedents ruled that a foreign company/bank does not need to have branch offices or any permanent establishment in Italy for Decree 231 to apply. As long as the entity is doing business in Italy, the Decree will indeed apply. 8 In Italy, there is no single regulator or authority with comprehensive jurisdiction over the behavior of all corporations. The Italian regulatory system is rather based on the joint supervision of a number of independent authorities and governmental entities acting as regulators, notably in relation to specific industries (financial services being the most tightly regulated) or based on the supervision by objectives’ model (whereby regulated entities may be subject to the control of more than one authority, each authority being responsible for one objective of regulation regardless of the legal form and the activities of the regulated entity). The Italian system is generally described as a mixed model of supervision, especially with respect to financial market activities, as opposed to the centralized model adopted by other legal systems.

B. The 25 key questions in connection with internal investigations I. Initiation of internal investigations 1. When and to what extent should internal investigations be initiated? 9 a) A rather large variety of events is likely to induce a company in Italy to initiate

internal investigations. Often internal investigations can be provoked by press rumors, interest or specific requests for information by regulators. 10 In most cases such as Unipol, Banca Popolare di Lodi and Italease, internal investigations came after the enquiries of prosecutors and regulators. 11 Often, once a public prosecutor begins to investigate crimes of corruption, the companies involved have immediately activated internal investigations (with a view to minimize damage, establishing facts and punishing the responsible individuals): this, however, would not exclude the quasi-criminal liability of the company. In other cases, voluntary investigations have preceded the start of an official probe by outside forces. In both cases, there has been an overlapping and analogous conduct of the internal and external investigations. As noted, where for example individuals are under investigation by a public prosecutor in connection with possible serious crimes, it is also advisable to initiate a complete internal investigation with the view Di Garbo/Gaudino/Mancuso/Vasile

Reemers Publishing Services GmbH O:/Beck/Spehl_Gruetzner/3d/08_Italy.3d from 06.03.2013 09:29:03 3B2 9.1.580; Page size: 160.00mm  240.00mm

B. The 25 key questions in connection with internal investigations

249

to establish the truth as soon as possible in order to immediately identify an efficient defense to anticipate the beginning of criminal proceedings and/or mitigate its impact on the company. Where the underlying facts are not revealed, investigations have been initiated due to events at competitors or other businesses: “for example, sometimes the discovery within a supplier of goods and services on undisclosed, illicit payments to the buyer or procurement officer (or other members of the senior management) of a customer aimed at “facilitating” the award of contracts has given rise to an investigation and dismissals of executives both at the level of the suppliers and thereafter, following an exchange of calls between the respective CEO’s, at the level of the customer”.4 Normally, however, an internal investigation is triggered as a result of regular controls or internal audits and other institutional oversight activities (notably where a significant amount of unusual patters are detected) and/or are a natural part, or consequence, of such regular audits, especially in industries with corruption, fraud, financial irregularities and have traditionally constituted a serious risk (e.g. construction, defense and other public contractors, banking). Notwithstanding the increase of rigorous internal control systems, independent internal investigations are a recent phenomenon in Italy, which have not been adopted on a regular basis. They have been indeed quite rare outside the Italian subsidiaries of large multinational groups and have had a “cool” reception from regulators.5 In other words, until fairly recently, the Italian corporate environment was not particularly inclined to introduce the approach of voluntary investigations, whose benefit was left largely unnoticed. Accordingly, but further diminishing the perceived benefits, Italian regulators did not historically give great importance to unsolicited internal investigations, although delegated to outside counsel, but rather tended to initiate and carry out their own inspections to which, possibly the internal parallel investigation would contribute useful elements as a form of active cooperation. This is because regulators can be subject to sanctions if they refrain from performing their duties, which include investigating regulatory breaches. Through internal investigations, the company may obtain some “soft” benefits, inter alia, a reputational enhancement “which is increasingly perceived by the Italian business community as a competitive advantage over other corporate entities, thus potentially triggering (in a globalized economy) an investors’ “flight to quality” as well as a magnet for talent (recruitment and retention)”;6 hence, an increased attention on corporate governance reports and awards. Furthermore, the introducing of standards of conduct models and their effective enforcement should have a positive impact on the internal culture, thus further reducing the risk of wrongdoing while further increasing credibility of internal corporate investigations with corporate governance.

12

13

14

15

b) Internal investigations serve to identify weaknesses within the company and 16 remove them once and for all. An efficient control system is important for a 4 Corporate Internal Investigations, An Internal Guide, Oxford University, ed. by Lomas/Kramer, 2008, p. 482. 5 Other than, to a degree, the Italian Competition Authority’s attitude toward anti-trust/ competition compliance programs. 6 Corporate Internal Investigations, An Internal Guide, Oxford University, ed. by Lomas/Kramer, 2008, p. 480.

Di Garbo/Gaudino/Mancuso/Vasile

Reemers Publishing Services GmbH O:/Beck/Spehl_Gruetzner/3d/08_Italy.3d from 06.03.2013 09:29:03 3B2 9.1.580; Page size: 160.00mm  240.00mm

250

§ 8. Italy

company to avoid that employees violate any laws and moreover it is required by Decree 231. The misconduct of employees can have various and serious consequences both for the company and its management: 17 aa) Under Art. 2049 of the Civil Code, the employer is responsible for damages

caused by third parties by any illicit conduct of their employees, provided that such conduct is committed during the discharging of their duties. This article is interpreted very strictly and case law has ruled that the employer shall be responsible whenever the action of the employee has committed “in occasion” of his working activity or facilitated by it, even if the employee acted beyond his duties or violated the employer’s instructions or directives and/or when the employee committed crimes.7 18 bb) Pursuant to the provisions of Decree 231 companies are not criminally liable,

but they may incur administrative penalties whenever a crime is committed by directors, managers and persons who are subject to the direction or supervision of the management acting in the interest or to the benefit of the company. It follows that the company will not be liable if the crime was committed in the exclusive interest of its author or of third parties. 19 The company’s liability is ascertained and declared in the context of a criminal trial, by the same judge that would be competent for the trial of the individual who materially committed the crime. Indeed, as a rule, both the company and the individual who committed the offence are defendants in the same criminal trial. 20 Since its entry into force, Parliament has amended Decree 231 several times in order to extend the list of offences. As of today, the following crimes may trigger the administrative liability of the company: (1) Crimes against Administrative Authorities or against the “public faith” – Embezzlement [Criminal Code, Section 316-bis] – Collection of undue subsidies [Criminal Code, Section 316-ter] – Fraud against the State or other Administrative Authority, or for the purpose of obtaining subsidies [Criminal Code, Sections 640 § 2 no. 1 and 640-bis] – Fraud in data processing [Criminal Code, Section 640-ter] – Corruption [Criminal Code, Sections 318, 319, 319-ter, 321 and 322] – Abuse of authority [Criminal Code, Section 317] – Forgery in currency/credit cards [Criminal Code, Sections 453, 454, 455, 457, 459, 460, 461 and 464] (2) Corporate offences – False accounting and false statements in corporate records [Civil Code, Section 2621] – False accounting and false statements in corporate records to the prejudice of shareholders or creditors [Civil Code, Section 2622] – False statements in mandatory prospectuses [Civil Code, Section 2623] – False statements in auditors’ reports or notices [Civil Code, Section 2624] – Obstruction to control activities [Civil Code, Section 2625] – Fictitious formation of the corporate capital [Civil Code, Section 2632] 7

See the Italian Supreme Court (Corte di Cassazione), judgments no. 6506/1995, 12417/1998 and 2374/1999.

Di Garbo/Gaudino/Mancuso/Vasile

Reemers Publishing Services GmbH O:/Beck/Spehl_Gruetzner/3d/08_Italy.3d from 06.03.2013 09:29:04 3B2 9.1.580; Page size: 160.00mm  240.00mm

B. The 25 key questions in connection with internal investigations

(3)

(4)

(5) (6)

(7)

(8) (9)

251

– Undue reimbursement of contributions [Civil Code, Section 2626] – Illegal allocation of profits or reserves to shareholders [Civil Code, Section 2627] – Unlawful transactions on the stock of the company or its controlling company [Civil Code, Section 2628] – Transactions prejudicial to creditors [Civil Code, Section 2629] – Failure to disclose a conflict of interest [Civil Code, Section 2629 bis] – Undue distribution of corporate assets by liquidators [Civil Code, Section 2633] – Unlawful influence on shareholders’ meetings [Civil Code, Section 2636] – Market rigging [Civil Code, Section 2637] – Obstruction to the activity of regulatory authorities [Civil Code, Section 2638] Market abuse offences – Insider trading [Legislative Decree 24/2/1998 no. 58, section 184] – Market manipulation [Legislative Decree 24/2/1998 no. 58, section 185] Manslaughter and serious injury – Manslaughter [Criminal Code, Section 589] resulting from the violation of injury prevention and health and safety regulations – Serious injury [Criminal Code, Section 590 § 3] resulting from the violation of injury prevention and health and safety regulations Receiving money and stolen goods, money laundering, and use of money or goods of unlawful origin [Criminal Code, Sections 648, 648-bis and 648-ter] Terrorist and subversion activities, including those contemplated in Art. 2 of the International Convention for the Suppression of the Financing of Terrorism, executed in New York on December 9, 1999 Transnational organized crime offences (including money laundering), as defined in the United Nations Convention against Transnational Organized Crime, adopted by the U.N. General Assembly on November 15, 2000, and on May 31, 2001 Crimes relating to child pornography and prostitution, or to the trafficking of human beings Computer crimes – Falseness in a public computer document or other public document having probatory effect [Criminal Code, Section 491-bis] – Illegal access to a data processing or computer system [Criminal Code, Section 615-ter] – Illegal possession and circulation of access code to a data processing or computer system [Criminal Code, Section 615-quater] – Circulation of equipments, devices or computer programs aimed at damaging or interrupting a data processing or a computer system [Criminal Code, Section 615 quinquies] – Interception, impediment or illegal interruption of computer communications or data transmissions [Criminal Code, Section 617-quater] – Installation of equipments suited to intercept, prevent or interrupt computer communications or data transmissions [Criminal Code, Section 617quinquies] – Damaging of information, data and computer programs [Criminal Code, Section 635-bis] Di Garbo/Gaudino/Mancuso/Vasile

Reemers Publishing Services GmbH O:/Beck/Spehl_Gruetzner/3d/08_Italy.3d from 06.03.2013 09:29:04 3B2 9.1.580; Page size: 160.00mm  240.00mm

252

§ 8. Italy

– Damaging of information, data and computer programs used by the Italian State or other Public entity or, in any case, of public usefulness [Criminal Code, Section 635-ter] – Damaging of data processing or computer systems [Criminal Code, Section 635-quater] – Damaging of data processing or computer system of public usefulness [Criminal Code, Section 635-quinquies] – Computer fraud committed by the authority appointed for authentication of electronic signatures [Criminal Code, Section 640-quinquies] (10) Environmental crimes – Discharge of wastewater containing hazardous substances or other prohibited substances [Legislative Decree 3/4/2006 no. 152, Section 137] – Unauthorized collection of waste (either hazardous or not), temporary storage of hazardous medical waste at the place of production, construction and operation of unauthorized landfills (even when intended for the storage of hazardous waste), unauthorized mixing of waste [Legislative Decree 3/4/ 2006 no. 152, Section 256] – Polluting soil, subsoil, surface water or groundwater with concentrations exceeding the risk threshold (even if the pollution is caused by dangerous substances), if the company does not implement the necessary remediation activities [Legislative Decree 3/4/2006 no. 152, Section 257] – Providing false information about nature, composition, chemical and physical characteristic of the waste in order to get the certificate of analysis of waste and using a false certificate during transport, for companies operating the collection and the transport of their own non dangerous waste [Legislative Decree 3/4/2006 no. 152, Section 258] – Illicit trafficking in waste [Legislative Decree 3/4/2006 no. 152, Section 259] – Organization of activities aimed at the illicit trafficking in waste (included high-level radioactive waste) [Legislative Decree 3/4/2006 no. 152, Section 260] – Altering the functioning of the System of Control and Traceability of Waste (SISTRI) [Legislative Decree 3/4/2006 no. 152, Section 260-bis] – Exceeding the emission limit values when it results in an exceeding of the threshold values of air quality [Legislative Decree 3/4/2006 no. 152, Section 279] – Manufacturing, consuming, importing, exporting, possessing and trading certain noxious substances in violation of the provisions set forth by the Law; installation of establishments providing for the use of noxious substances; using noxious substances for the maintaining and recharging of establishments and devices traded prior to the enforcement of the Law; manufacturing, using, trading, importing and exporting the noxious substances provided by the Law [Law 28/12/1994 no. 549, Section 3] – Causing, either with malice or negligence, the pollution of sea waters by malicious or negligent dumping of polluting substances into the sea waters; causing by malicious or negligent dumping of polluting substances into the sea waters, permanent harms or serious harms to the quality of the sea waters, animal or plant species [Legislative Decree 6/11/2007 no. 206, Section 202] (11) Crimes against the administration of justice – Inducement to withhold information or make false statements to judicial authorities [Criminal Code, Section 377-bis] Di Garbo/Gaudino/Mancuso/Vasile

Reemers Publishing Services GmbH O:/Beck/Spehl_Gruetzner/3d/08_Italy.3d from 06.03.2013 09:29:04 3B2 9.1.580; Page size: 160.00mm  240.00mm

B. The 25 key questions in connection with internal investigations

253

In the near future, the list could be expanded to include criminal offences relating to the violation of legislation in other areas, such as tax legislation. The administrative penalties that could be inflicted on a company fall into two broad categories: pecuniary sanctions and disqualification penalties. Pecuniary sanctions range from a minimum of EUR 25.800,00 to a maximum of approximately EUR 1.5 million. The disqualification penalties include: – prohibition to exercise the company’s business; – suspension or revocation of any authorizations, licenses or permits related to the specific business activities involved by the criminal conduct; – prohibition to negotiate and enter into contracts with Administrative Authorities, with the only exception of those aimed at obtaining public services; – exclusion from subsidies and contributions, or revocation of any subsidies and contributions already granted to the company; – prohibition to advertise the company’s goods and/or services. Disqualification penalties can be applied to a company whenever at least one of the following conditions is satisfied: (i) the company obtained significant profit from the crime and the crime was committed by individuals belonging to the company’s top management, or by individuals subject to the direction and supervision of the top management, provided that in this latter case the crime was made possible by serious organizational faults within the company, or (ii) the company repeated the crime. As a rule, disqualification penalties are temporary, and can last between three months and two years. Such measures could, however, become definitive if the company: (i) achieved a considerable profit from the criminal conduct, and (ii) in the last seven years was already condemned to temporary disqualification penalties three times. Subject to certain concurrent conditions, the company could avoid the application of disqualification penalties. This could be achieved if the company, before the commencement of the trial, were to spontaneously (i) fully compensate the damages it caused and eliminate any detrimental consequences of the crime (or at least make serious efforts in this respect), (ii) eliminate, through the adoption of ad hoc compliance model, the organizational inefficiencies that allowed the crime to be committed, and (iii) place the profit of the crime at the disposal of the competent authority for confiscation. Pecuniary fines could be decreased by one third to two thirds if, prior to the commencement of the criminal proceeding, the following conditions were met: (i) full compensation by the company of the damages caused and elimination of the consequences of the crime; (ii) implementation of a compliance model capable of preventing the commission of crimes such as the one that was committed; (iii) delivery of the profit of the crime for confiscation.

21 22

23

24

25

26

b) The management is free to decide when and to what extent it will initiate internal 27 investigations. Internal investigations may be triggered by press rumors, a general interest or specific request of information by the regulators. An internal investigation commenced after the public prosecutors began investigating alleged crimes committed within the company would not avoid the Company’s liability to the extent that Di Garbo/Gaudino/Mancuso/Vasile

Reemers Publishing Services GmbH O:/Beck/Spehl_Gruetzner/3d/08_Italy.3d from 06.03.2013 09:29:04 3B2 9.1.580; Page size: 160.00mm  240.00mm

254

§ 8. Italy

this is provided as per Decree 231. However, if the Company adopts a proper compliance model it may avoid the restraining measure and minimize pecuniary sanctions. Under a recent judgment of the Milan Court, Directors have been held liable for damages vis-a`-vis the company because they did not implement a proper compliance model, thus exposing the company to be liable under Decree 231.8 2. Should the internal investigations be of an open or covert nature? 28 a) As voluntary investigations are still a growing field in Italy, there are few

precedents addressing communication to the public, stock exchange or customers in the event of an internal investigation and if such would be appropriate. Disclosure would only become necessary where the information of the incoming investigation is of a price-sensitive nature. However, external communication of a voluntary internal investigation can be utilized as a marketing tool or a way to reassure various stakeholders that the company or bank is taking the matter seriously by assuming a proactive stance. 29 b) If suspicions arise within a company that employees have misappropriated money

or have given or taken bribes or committed any other serious illicit act, internal investigations are obviously more effective if they are initially conducted in a covert manner. Only by means of covert investigations can the potential offenders be identified and can comprehensive information be gathered without risking that offenders cover up their actions as well as destroy evidence. Data protection laws and employment laws can be a special challenge when it comes to covert investigations as some measures within the scope of internal investigations are only admissible upon a corresponding prior notification of the affected employee. Moreover, according to a general principle stated in Art. 4 of Law 300/1970 (Workers’ Charter), the use of any device with the purpose of controlling “at a distance” the activity of employees is prohibited. More precisely the provision of law states as follows: – the use of audiovisual equipment and other devices with the purpose of controlling the activity of a worker at a distance is prohibited; – the controlling equipment which is required for organization, production or safety reasons is allowed but, if it potentially enables the control at a distance, its implementation needs the previous agreement of the Works Council or the authorization of the Labor Office. 30 Such general restrictions should always be taken into account while performing an internal investigation. In fact many devices that may be useful to conduct a thorough internal investigation enable in practice the employer to control the employee and the way in which s/he performs the working activity assigned at the distance. This includes not only tools like cameras or recorders for video surveillance or telephone tapping, but also and less apparently, instruments like hard disk, personal computer, palmtop and so on. Italian case law9 has however sometimes deemed legitimate the so called “defensive controls” made by the employer for organization, production or safety reasons or in order to ascertain illicit conducts of 8

See Milan Court, judgment no. 1774 of February 13, 2008. Among many one of the landmark cases on this topic may be considered the Italian Supreme Court’s decision back in 2002: Corte di Cassazione, April 3, 2002, no. 4746. 9

Di Garbo/Gaudino/Mancuso/Vasile

Reemers Publishing Services GmbH O:/Beck/Spehl_Gruetzner/3d/08_Italy.3d from 06.03.2013 09:29:05 3B2 9.1.580; Page size: 160.00mm  240.00mm

B. The 25 key questions in connection with internal investigations

255

the employee, hence these types of devices are not completely banned and could legitimately be used for internal investigation purposes. 3. Is it advisable to involve external investigators? Using outside counsel or detective agencies to conduct internal investigations is 31 not very common in Italy and there are no applicable rules as to when they might be engaged. The practice involving external agencies in the context of internal investigations has up to now revolved around internal audits carried out by large independent auditors, often, the big accounting firms or affiliated entities, who are instructed by the company. Even though there are just a few public examples of internal investigations to date, an increased tendency to use external counsels (including law firms) in future investigations is to be expected along with an increase in internal investigations. Independent advisers including external counsel are often used in order to design 32 and implement organizational structures for the purposes of Decree 231. Decree 231 gives the company a chance to be exempted from quasi-criminal 33 administrative liability if it gives evidence, inter alia: (i) that the company has adopted and effectively implemented “Organizational Models” (or compliance programs) capable of preventing the commission of unlawful acts; and (ii) the Supervisory Body has been granted with independent powers of initiative and controls. Therefore, companies frequently appoint outside counsel advisers as individual members of the Supervisory Body to shore expertise and independence. 4. Is it permitted that foreign attorneys conduct internal investigations in Italy? Under Italian law, there are no legal provisions that forbid the conduction of 34 internal investigations by foreign attorneys. Internal investigations would qualify as legal advice as opposed to legal representation before a Court, which would require the admission to the Italian Bar Association. From the coming into force of the EU Directive 77/249 (implemented in Italy by 35 law no. 31 of February 9, 1982), all attorneys are entitled to exercise the legal activity in any member state, using the title obtained in the state of origin, provided that such activity is occasional. Unlike the judicial activity – which requires, inter alia, that the assignment must 36 be conducted with the strict collaboration of an Italian attorney admitted to the bar and to the profession – in order to perform legal advice, no conditions are required (Art. 7 of Law no. 31 of February 9, 1982). The foreign attorney is only bound to respect the Code of Ethics, the provisions regarding professional secrecy and the duty of confidentiality. 5. When should national authorities be called in? There is no general and express obligation under Italian law for listed companies, 37 banks or other regulated entities or persons to report to national authorities any violations of law and regulations. However, corporations, banks and other entities have a system of internal 38 controls designed to prevent and discover corporate irregularities, or violation laws Di Garbo/Gaudino/Mancuso/Vasile

Reemers Publishing Services GmbH O:/Beck/Spehl_Gruetzner/3d/08_Italy.3d from 06.03.2013 09:29:05 3B2 9.1.580; Page size: 160.00mm  240.00mm

256

39

40

41

42

§ 8. Italy

and regulations, and to report on these as necessary. Certain reporting obligations insist upon the internal control bodies. Among them, it is important to remind the board of statutory auditors (“Collegio sindacale”). This internal control body – composed by independent individuals selected from certain professional categories – supervises the proper management of the company and its compliance with any applicable laws and the bylaws. In particular, they monitor the effectiveness of the administrative and accounting organization of the company and whether it is adequate to ensure full companies with the laws. For this purpose, they are entitled to demand any relevant information from directors and each statutory auditor (“sindaco”), within the board, is individually empowered to carry out internal inspections and controls. Furthermore, the board of statutory auditors has a duty to investigate any matters or suspected irregularities which are brought to its attention by minority shareholders representing at least 5 per cent of the share capital (2 per cent in listed corporations). This may lead it to report the matters to the Court or the public prosecutor. Pursuant to Art. 149 of the Legislative Decree no. 58/1998 the board of statutory auditors is under an obligation to notify Consob of any irregularities found in the context of its supervisory activity. Where there is a well-grounded suspect that the directors, in breach of their duties, have incurred serious irregularities, that may cause damage to the company, the board of statutory auditors may also report the facts to the court. At this stage, we can say that the culture of reporting to national authorities any possible irregularity is not present in Italy. However, recent developments, such as leniency in anti-trust and other areas, including de facto leniency in cases of cooperation with prosecutors/Judges and the implementation of certain statutory reforms, such as Decree 231, may reverse this trend reinforcing the reporting activity to national authorities.

II. Admissibility and implementation of individual measures within the scope of internal investigations 1. What measures are admissible within the scope of internal investigations? In principle there are no legal restrictions that would prevent an employer from performing internal investigation through meetings, interviews, analysis and copy of paper and electronic documentation, or using other means to obtain information from employees and non-employees in relation to allegations of misconduct, general compliance and internal compliance systems. 44 However, given the fact that most investigative measures may interfere with the rights of the respective employee there are specific requirements to be abided by under a labour and data protection perspective. 45 Therefore, before starting an internal investigation an employer should verify if said requirements are already in place. In case they are not in place, compliance is necessary before the internal investigation begins. 46 There are no specific rules obliging the employees to be interviewed by an auditor or other internal or external investigator. However, the cooperation in the audit 43

Di Garbo/Gaudino/Mancuso/Vasile

Reemers Publishing Services GmbH O:/Beck/Spehl_Gruetzner/3d/08_Italy.3d from 06.03.2013 09:29:05 3B2 9.1.580; Page size: 160.00mm  240.00mm

B. The 25 key questions in connection with internal investigations

257

may be considered as part of the general duty of cooperation of the employee and therefore a refusal could be sanctioned with a disciplinary measure (including possibly termination). In any case, from a disciplinary perspective, such refusal as well as all information 47 collected (in the event the investigation detects any employee’s misconduct) could not be used against the employees unless an appropriate disciplinary procedure has been carried out as follows:10 the employer issues a formal written notice to the employee as soon as possible (i. e. as soon as it discovers or has sufficient evidence of a breach of the employee’s obligations). The employee then has time to give possible justification in writing or request a meeting, possibly with the assistance of union representative. A disciplinary measure (including dismissal) may only be taken 5 (five) days after the delivery of the formal notice, or following the meeting with the employee if such an explanatory meeting has actually been requested. Personal information on employees is often collected and processed in the course 48 of the internal investigations as a result of which it must always be verified whether data protection laws are complied with within the scope of the individual measures. The employer must ensure that any personal information gathered during the internal investigation on employees and non-employees is not publicly disclosed (unless disclosure is ordered by a government authority). No notification to government authorities, Italian Data Protection Authority or 49 courts is required to perform an internal investigation. However, according to the Guidelines issued by the Italian Data Protection Authority,11 if the investigation implies also the access and checking of emails sent or received by the employees or other e-files, the prior agreement with shop council (or authorization of the labour office) is necessary also in case of agreement by the employees concerned. a) Employee interviews Employee interviews obviously constitute an essential instrument within the 50 scope of internal investigations. As a first important caveat, interviews and investigation activities cannot include questions requesting – directly or indirectly – employees’ opinions about politics, religion, union affiliation, sexual orientation and any other circumstance that is not relevant with regard to the investigation itself or their working attitude and skills, or otherwise entail the ascertainment of the same. When interviewing an employee the outcomes of the interview could not be used for disciplinary reasons against the concerned employee unless the facts are verified and the appropriate disciplinary procedure is subsequently followed, as described above under para. 10. Employee interviews within the scope of internal investigations are admissible. 51 Italian Civil Code imposes on the employee a duty of due diligence in performing his/her duties and an obligation to comply with the orders given by the employer, as long as the orders themselves are legitimate ones and are already in connection with 10 Art. 7 of the Law 300/1970 (Workers’ Charter) specifies in detail the procedure for any disciplinary action whilst the national labor collective agreement usually gives detail on the type of sanctions that an employer could impose on the employee. 11 Guidelines Applying to the Use of E-Mails and the Internet in the Employment Context – 1 March 2007, available in English at the following web address: www.garanteprivacy.it/garante/ doc.jsp?ID=1408680.

Di Garbo/Gaudino/Mancuso/Vasile

Reemers Publishing Services GmbH O:/Beck/Spehl_Gruetzner/3d/08_Italy.3d from 06.03.2013 09:29:05 3B2 9.1.580; Page size: 160.00mm  240.00mm

258

§ 8. Italy

the working activity. Upon request, an employee must provide his/her employer with information on all matters that are either directly related to his/her personal area of work and activity performed. Consequently, to the extent that the investigations concern the employee’s area of work, the employer may instruct him/her to (actively) participate in interviews within the scope of internal investigations. With regard to the employees’ participation and cooperation obligation, it is irrelevant whether the interviews are conducted by internal or external investigators. b) Email screening 52

53

54

55

56

Besides employee interviews and in preparation of the interviews, email screening i. e. the electronic monitoring and processing of the employees’ emails- is an important mean to detect weaknesses or irregularities within a company. In Italy, as highlighted above, there is a specific prohibition to use any devices which enable the employer to control “at a distance” its employees. However, defensive control, including controls made in order to determine whether criminal activity has occurred within the company, are usually considered legitimateprovided that certain precautions are complied with. With this said, an essential pre-requisite for any email screening as well as investigation of internet access and on electronic devices which were assigned to an employee (e.g. computers, palmtops, telephones, cell phones, etc.) – both in case they were used exclusively for business purposes or for both private and business purposes – is that the employer must implement a specific policy on the acceptable employee use. The said policy needs to be agreed on by the Works Council or authorized by the competent labor office, as applicable; consent of the employees may be necessary. This requirement, already stated in the Workers’ Charter with generic reference to tool enabling a control at the distance of the employees has been expressly provided by a specific regulation of the Italian Data Protection Authority on this issue that specifies also the information to be included in said policy.12 From a privacy law perspective it is further essential to always inform employees that the employer, in the course of the work relationship, may perform investigations and specify the conditions and features of the investigations and relevant monitoring activities. As applicable, the consent of employees may be necessary. Lastly, the employer always has to define and regulate the privacy role of any third party accessing the data gathered from the investigation. Thus, for example, the privacy role of investigators and also of persons within other companies of the same group (as applicable) that may have access to the data collected during the investigations. In case of transferring of data outside the European Economic Area, the issue of trans-border data flows has to be tackled in order to guarantee compliance with Italian privacy law. Lastly, the controls of the employer should always follow the principles of necessity, proportionality and adequacy, so that the employer may collect and process only the number and kind of data which is are functional and necessary for investigation purposes. Redundant, excessive and irrelevant data should always be disregarded. 12

Guidelines Applying to the Use of E-Mails and the Internet in the Employment Context – see fn. above.

Di Garbo/Gaudino/Mancuso/Vasile

Reemers Publishing Services GmbH O:/Beck/Spehl_Gruetzner/3d/08_Italy.3d from 06.03.2013 09:29:06 3B2 9.1.580; Page size: 160.00mm  240.00mm

B. The 25 key questions in connection with internal investigations

259

Finally, monitoring and controlling activities should always be gradual in the 57 sense that individual monitoring may take place only after general and no-name basis monitoring has been performed and as a result of the monitoring, it was discovered that breaches occurred. Constant, pervasive and hidden monitoring is always forbidden. The foregoing requirements apply irrespective of the nature of data source. For 58 instance it applies to data gathered through email, files, letters, documents of employees, computers, etc. aa) Email screening if the email account is used exclusively for business purposes If the email account provided by the employer is used exclusively for business 59 purposes (= email use for business purposes) and the above privacy requirements are duly in place, the employer is entitled to review and evaluate in detail the traffic data (e.g. recipient or sender, information on date and duration of a connection, utilized system services, used lines and interfaces, etc.) and the content of businessrelated emails. If, notwithstanding the employer’s prohibition, the employees used the email account for private purposes, when becoming aware of personal communications, investigators should disregard and delete them. The above referenced privacy requirements (see supra paras. 52 et seqq.) should be addressed. bb) Email screening if the email account is used both for business and private purposes (1) If the employees are allowed to use the company’s email system for private 60 purposes, neither the traffic data nor the content of the private emails may be screened without the express consent of the employee and his/her communication partner. The use of the company’s email account for both business and private purposes means that investigators are faced with the problem of having to distinguish between private and business emails in order not to commit a violation of law themselves. The email screening of an email account used for both business and private purposes is admissible if the above referenced privacy requirements (see supra paras. 52 et. seqq.) are duly in place and all of the following conditions are met: The email screening – is carried out to investigate a specific suspicion of a material breach of duty or criminal offence, – is carried out on the basis of a small number of keywords that are relevant to the material breaches of duties or criminal offences and that makes it appear unlikely that private emails will be affected, – affects only specific employees which have been selected with a view to the material breaches of duties or criminal offences, – does not constitute a permanent monitoring, – has been coordinated together with the company’s data protection officer and the Works Council, and – is carried out subject to the requirement that the internal or external investigators carrying out the email screening must immediately close private emails opened accidentally and may not print them.

Di Garbo/Gaudino/Mancuso/Vasile

Reemers Publishing Services GmbH O:/Beck/Spehl_Gruetzner/3d/08_Italy.3d from 06.03.2013 09:29:06 3B2 9.1.580; Page size: 160.00mm  240.00mm

260 61

§ 8. Italy

(2) If the investigators were able to separate private emails from business-related emails by means of respective filtering, the requirements mentioned under a) apply to the screening of business-related emails. With respect to private emails, provided always that the above referenced privacy requirements are duly in place, only measures related to the outer appearance of the emails, such as the screening of the number, time and data volume, are admissible, and always provided that the above referenced privacy requirements are duly in place. A screening of the traffic data or the content of private emails is only admissible in exceptional cases if it is suspected that individual emails contain indications of material breaches of duties or criminal offences relating to the employment relationship. c) Handover, review and processing of files, letters and documents of employees

62 aa) The employer has unrestricted access to files, letters and documents of its

employees that are produced in the course of the work relationship and that are business related. Upon request, the employee must hand them over to the employer. Internal and external investigators commissioned by the employer may inspect, review and process business-related documents of the employees without restriction. The employee who has compiled or maintains the files may not refuse inspection or even destroy the files. The above referenced privacy requirements must in any case be duly complied with (see supra paras. 52 et seqq.). 63 bb) As a general rule, the investigators may not access private files, letters or

documents within the scope of internal investigations. The employee must assist in the separation of private files, letters and documents from the documents produced in connection with the duties assigned. If the employee refuses to cooperate, the investigators may inspect the files, letters and documents in order to determine their private or business-related nature. If they are private files, letters and documents, the investigators must immediately discontinue the inspection. The above referenced privacy requirements must in any case be duly complied with (see supra paras. 52 et seqq.). 64 cc) If the business-related or private files, letters or documents contain personal

data, the provisions of the Privacy Code (Legislative Decree 196/2003 consolidated) must be complied with. Personal data means information concerning personal or material circumstances of a person and of a legal entity. This includes, for instance, the address, marital status, date of birth, nationality or characteristics of the employee. The investigators require a separate consent for the collection or processing of personal data, unless they are appointed as data processor of the employer. The collection or processing of personal data is deemed justified if it serves to clarify material breaches of duties or criminal offences relating to the employment relationship. Before the investigators may collect personal data from the files, letters or documents, they must inform the employee of the upcoming investigative measure; consent of employees may be required. If external investigators are intended to be allowed to retrieve personal data automatically, the employer must additionally agree on the following with the external investigators in writing: – reason for and purpose of the retrieval, – data recipient, Di Garbo/Gaudino/Mancuso/Vasile

Reemers Publishing Services GmbH O:/Beck/Spehl_Gruetzner/3d/08_Italy.3d from 06.03.2013 09:29:06 3B2 9.1.580; Page size: 160.00mm  240.00mm

B. The 25 key questions in connection with internal investigations

261

– type of the collected or transferred data, – technical and organizational protective measures taken. Please note that the requirements referenced under supra paras. 52 et seqq. must be complied with. d) Handover and mirroring of the computer and subsequent processing of the business-related data and electronically stored business-related documents of employees (other than emails) aa) The employer or, upon its instruction, private investigators may request from 65 the employee the handover of a company-owned computer used for business purposes and carry out a mirroring, i. e. copy the business data stored on the computer to another storage medium. The investigators may access the companyowned computer and inspect and process business-related data and electronic documents stored on this computer; the requirements referenced under supra paras. 52 et seqq. must be complied with. bb) The inspection of the employee’s private data, especially if protected by a 66 password, is inadmissible and constitutes a criminal offence. A password protection means that the individual files or a separate private drive, as applicable, are protected by passwords. If the employees are expressly prohibited from using the company-owned computer for private purposes, the inspection of private files protected by a password can be performed if there is a specific suspicion of a material breach of duties or criminal offence relating to the employment relationship, and the requirements referenced under supra paras. 52 et seqq. are complied with. cc) If the company-owned computer or the individual business-related files or 67 electronically stored documents contain personal data of the employee, the provisions of the Privacy Code must be complied with. The investigators may only collect or process any personal data contained in business-related documents if they inform the employee of the upcoming measure in advance and if the measure serves to clarify breaches of duties or criminal offences relating to the employment relationship; the requirements referenced under supra paras. 52 et seqq. must be complied with. e) Inspection of the personnel files of employees aa) The personnel files of employees constitute a further source of information for 68 the investigators. They can contain indications of previous breaches of duties on the part of employees. The employees, however, have a special interest that the information contained in the personnel file is not accessed or disclosed because the file may contain personal or intimate information. The employer is therefore obliged to keep the circle of employees who have access to personnel files as small as possible. The more sensitive the data, the larger the access obstacles. In addition to the relevant employees in the company’s human resources department or management, employees in the internal auditing department may to a certain extent inspect the personnel files within the scope of internal investigations.

Di Garbo/Gaudino/Mancuso/Vasile

Reemers Publishing Services GmbH O:/Beck/Spehl_Gruetzner/3d/08_Italy.3d from 06.03.2013 09:29:06 3B2 9.1.580; Page size: 160.00mm  240.00mm

§ 8. Italy

262 69 bb)

If the external investigators are subject to a professional confidentiality obligation, they may be granted at least partial access to the personnel files provided that the information in the personnel files is relevant to the investigations in the individual case. The requirements referenced under supra paras. 52 et seqq. must be complied with. The external investigators may under no circumstances inspect sensitive information, such as existing illnesses or similar information that is of no relevance to the internal investigations. f) Video surveillance of employees

70

The video surveillance of employees constitutes a considerable interference with the rights of the employees under surveillance and therefore, strict requirements must be met for video surveillance to be admissible. As already mentioned above, the Italian Workers’ Charter expressly forbids the employer to install tools with the aim of controlling employees at the distance. Tools able to control the employees from a distance, as the video surveillance, may be installed and used by the employer only if: the employer i) has organizational or productive reasons for its installations or the tools are required for health and safety reasons; and ii) there is the consent of the Works Council. Where no agreement with the Works Council is reached or the company doesn’t have a Works Council, an employer with a legitimate aim to use video surveillance may apply to the Labor Office for an authorization determining way and limits of the video surveillance use. Providing that the appropriate authorization on video surveillance has been obtained by the employer and that the employer itself has a prevailing legitimate interest in the video surveillance, internal or external investigators may avail themselves of such instruments and monitor employees by means of video recordings. The requirements vary depending on whether it is an open or a covert video surveillance.

71 aa) An open or visible video surveillance is admissible – if the above mentioned

authorization has been obtained within the limits provided in the agreement with the Works Council or anyway in accordance with the relevant policy approved by the Works Council or by the Labor Office. Usually, if there is a specific suspicion of a criminal offence or another serious misconduct, video surveillance may be considered legitimate. 72 bb) A covert or secret video surveillance is only admissible if there is specific

suspicion of a criminal activity or other serious misconduct and the covert surveillance constitutes the only remaining measure and is not disproportionate as a whole. Such surveillance may only be implemented so long as the appropriate procedure (Works’ Council consent or approval from the Labour office) is followed. The measure must be temporary and restricted to the area to which the suspicion extends. In any event, the employer’s intention to verify whether an employee complies with his/her duties does not constitute a sufficient justification for a covert video surveillance.

Di Garbo/Gaudino/Mancuso/Vasile

Reemers Publishing Services GmbH O:/Beck/Spehl_Gruetzner/3d/08_Italy.3d from 06.03.2013 09:29:07 3B2 9.1.580; Page size: 160.00mm  240.00mm

B. The 25 key questions in connection with internal investigations

263

For implementation of a video surveillance system, the employer should also take 73 into account the rules set forth by the Privacy Code and the regulation of the Italian Data protection Authority in video surveillance.13 g) Tapping of telephone conversations The tapping of the employee’s telephone conversations is a glaring interference 74 with the rights of the employee and generally speaking it is not permissible. As for video surveillance, tapping is a mean of controlling employees and therefore is subject to the restrictions provided by the Workers’ Charter. In principle, only the monitoring of “outer factors” is admissible, while a monitoring of the content of the conversation is only admissible in exceptional cases. aa) The superficial monitoring of telephone conversations, such as collecting and 75 checking date, time and costs, may be admissible, always provided however that employees have been duly informed and gave their consent when required by privacy requirements. Although this type of tapping sometimes includes the collection of the employee’s personal data, this compilation may be justified on grounds of the employment relationship, specifically if the monitoring is implemented for organization, production or health and safety reasons or for detecting illicit conducts of the employees (provided that the employer obtained the Works Council consent or approval from the Labor Office). In case of purely private telephone conversations; telephone numbers may not be stored. Purely private telephone conversations are only such telephone conversations that the employee pays out of his/her own pocket, e.g. on the basis of a special dial-in into the company’s telephone system. bb) Whether or not the content of telephone conversations may be monitored 76 depends on the reason for monitoring and on the circumstance that the persons taking part to the conversation are aware of the monitoring. Neither internal nor external investigators may tap private or business-related 77 telephone conversations of employees. Tapping means the monitoring of the content of a telephone conversation without the knowledge of all participants in the conversation. According to the Italian Criminal Code tapping constitutes a criminal offence. Also listening in on a telephone constitutes a criminal offence.14 The tapping of an employee’s telephone conversation can only be performed with a specific order of the competent judicial authority, i.e in the context of an investigation made by the police upon instructions of the public prosecutor. h) Search of the workplace The employer may grant internal and external investigators free access to the 78 Company’s premises. However, this does not include permission to inspect the employees’ offices. With reference to the protection of the company’s properties, the Workers’ Charter provides the possibility for the employer to use security 13 The regulation in video surveillance is available in English at the following web address: www.garanteprivacy.it/garante/doc.jsp?ID=1116810. 14 Art. 617 of the Italian Criminal Code – Knowledge, interruption or illicit impediment of communications or telegraphic or telephone conversations.

Di Garbo/Gaudino/Mancuso/Vasile

Reemers Publishing Services GmbH O:/Beck/Spehl_Gruetzner/3d/08_Italy.3d from 06.03.2013 09:29:07 3B2 9.1.580; Page size: 160.00mm  240.00mm

§ 8. Italy

264

guards. This is very limited in practice. Firstly, the employer has the right to use security guards exclusively for reasons in connection with the protection of the company’s property. Secondly, the guards may only question employees regarding actions or facts related to the protection of the property. Security guards cannot control employees nor have access to the working premises while the employees are working unless, and in exceptional circumstances, for reasons related to the protection of the company’s property itself. Given the above, it is unlikely that a search of the workplace undertaken by internal or external investigators with the permission of the employer would be deemed legitimate. i) Covert listening in on conversations (other than telephone conversations) on the business premises 79

Covert audio recordings of the covert listening in on the spoken word in the company’s business premises constitute a criminal offence.15 j) Investigations carried out in the surroundings of employees under suspicion

80

Both internal and external investigators may interview third parties related to an employee under suspicion and use the findings against the employee under suspicion within the scope of labor disputes or civil proceedings. 2. Must employees’ representatives such as the Works Council be involved in internal investigations?

81

The conducting of internal investigations does not, per se, oblige the employer to involve the Works Council but in some case, when it comes to individual measures within the scope of internal investigations, the employer may be obliged either to obtain the Works Council’s consent or inform them of the upcoming measures. a) The work council’s rights of co-determination and information

82 aa) Prior to introducing certain measures, such as the implementation of video

surveillance, the employer must obtain the Works Council’s consent or the approval of the Labor Office. 83 bb) If the Works Council has rights of co-determination and information with

reference to the measures used in the investigation, it is regardless of whether or not the internal investigations are being conducted by internal or external investigators. b) The Works Council’s rights regarding individual measures aa) Employee interviews 84

The Works Council has no right to be informed when the employer interviews an employee; this is provided that the interview is not part of a disciplinary procedure. If the meeting with the employee follows a formal notice concerning alleged breach 15

Art. 615–bis of the Italian Criminal Code – Illicit Interferences in private life.

Di Garbo/Gaudino/Mancuso/Vasile

Reemers Publishing Services GmbH O:/Beck/Spehl_Gruetzner/3d/08_Italy.3d from 06.03.2013 09:29:07 3B2 9.1.580; Page size: 160.00mm  240.00mm

B. The 25 key questions in connection with internal investigations

265

of duties of the employee, the employee has the right to be assisted by a union’s representative. bb) Monitoring, copying and processing of documents and emails (1) Business-related documents and emails of employees. (a) The Works Council’s right to be informed and consent is not triggered in the case where the employer instructs its employees to hand over business-related documents, files (in paper or electronic form), business-related letters or emails. However, should the employer monitor, copy, process files, emails or otherwise monitor the hard disk of the employee or the use the employee makes of the devices supplied for business related reasons, such monitoring activity – which enables a control “at distance” of the employee – must be approved by the Works Council or – in lack of an agreement – by the Labor Office. (b) The introduction or operation of data-processing systems enabling the employer to collect data regarding the usage of email or the internet or to access the emails of its employees are subject to consent from the Works Council’s or in their absence, to the specific approval of the Labor Office. (2) Private documents, letters or files and private emails of employees. If, due to a specific suspicion, the employer wants to request that an employee hand over documents, letters, files or emails of a private nature in order to verify whether a material breach of duty or a criminal offence has been committed, the employer does not have the obligation to inform the Works Council. In the event the employer wishes to proceed to an email screening as the monitoring process as a way of controlling the employee, the employer should agree with the Works Council on how and to what extent the screening should be performed. The Works Council does not have to be informed in advance of such screening if a relevant email usage policy – also containing provisions as to the measures the employer may take in order to monitor compliance with the policy itself – has been already agreed with them or approved by the Labor Office. In this case, the internal investigations must be conducted in accordance with the provisions laid down in the policy itself, including a possible provision which imposes an information obligation on the employer towards the Works Council as to actual screening. (3) Inspection of the personnel files of employees. When it comes to inspecting the personnel file of any employee – which is not permitted – the Works Council does not have any rights to information or of co-determination.

85

86

87

88

89

cc) Surveillance measures The Works Council has a right of approval if video surveillance or data processing 90 systems enabling the employer to collect data pertaining to the telephone usage of its employees are to be introduced or operated. Lacking the Works Council agreement to the introduction of such devices- usually with specific instructions and procedures as how to follow and to what extent the data gathered with these tools may be used – the employer might apply to the Labor Office in order to obtain in advance the approval on the use of such devices.

Di Garbo/Gaudino/Mancuso/Vasile

Reemers Publishing Services GmbH O:/Beck/Spehl_Gruetzner/3d/08_Italy.3d from 06.03.2013 09:29:07 3B2 9.1.580; Page size: 160.00mm  240.00mm

§ 8. Italy

266

dd) Search of the workplace 91

The Works Council must consent to any search conducted in any employee’s work place. If the Works Council does not agree on the search, the employer may apply to the Labor Office in order to obtain such consent. ee) Investigations carried out in the surroundings of employees

92

Investigations being carried out in the surroundings of any employees suspected of wrongdoing do not trigger the Works Council’s rights to information or of codetermination. c) Consequences if right of co-determination is not observed

93

If the employer does not observe the Works Council’s right of co-determination where such right is imposed, the Works Council may file a claim for anti-union behavior before the Labor Court in order to obtain a precautionary measure expressly prohibiting the employer to introduce the planned or impending measures. Moreover, the violation of some Workers’ Charter provision, for example the one which prohibits personal inspections on the employees (unless – in very specific cases – admissible and as long as co-determined with the Works Council or approved by the Labor Office) is a criminal offence, punishable with a fine between EUR 154 and 1.549 or arrest from 15 days to maximum one year.

III. Employee interviews 1. May an employee refuse to provide information if this information would incriminate himself/herself? 94

The questioning of employees often concerns those employees that are suspected of committing breaches of duties or criminal offences. For the employer, the question arises whether the investigators may request that the employees also provide answers to those questions concerning any misconduct on their part. Clearly an employee cannot be “obliged” to make statements incriminating him/ herself but if the questions relate to the employee’s scope of work, the refusal to reply may be construed as a violation of his duties and trigger a sanction, to be inflicted after applying the usual disciplinary procedure (see infra para. 95 and para. 98). a) Duty to provide information on the tasks directly assigned to the employee or carried out by the employee

95

If the employer requests information on matters concerning the personal scope of work – in particular the personal activities conducted at the workplace and the corresponding work results of the employee – the employee must provide this information. In this core employment relationship area, the employee must provide the requested information even if she/he had to accuse himself/herself of a criminal offence or other misconduct relevant from a disciplinary perspective. If the information request concerns the employee’s direct scope of work and if it serves Di Garbo/Gaudino/Mancuso/Vasile

Reemers Publishing Services GmbH O:/Beck/Spehl_Gruetzner/3d/08_Italy.3d from 06.03.2013 09:29:08 3B2 9.1.580; Page size: 160.00mm  240.00mm

B. The 25 key questions in connection with internal investigations

267

to investigate material breaches of duty or criminal offences in connection with the direct obligations of the employee under her/his employment contract, the possible employee’s refusal to provide information during the interview may be relevant from a disciplinary perspective. b) Duty to provide information in indirect connection with the scope of work Outside the scope of the tasks directly assigned to or carried out by an employee, 96 the employee is still obliged to provide information regarding possible criminal offences or material breaches of her/his duties in case the employee commits them whilst fulfilling the assigned duties. c) Duty to provide information outside the scope of work The employee is not obliged to answer questions on criminal offences that 97 exclusively relate to the employee’s private life. Generally speaking, the employee is not obliged to answer questions regarding the employee’s conduct outside the scope of work at all. d) Disclosure of information to authorities if employee is obliged to incriminate himself/herself Even if the information required from the authorities may lead to the employee’s 98 incrimination the employee may not withhold such information from the employer (provided that the request concerns information related to the activity performed and the duties assigned). The withholding may lead to a disciplinary sanction. In the relationship with the authorities however, it is ultimately the employer who may not withhold the requested information, irrespective of the fact that the information may lead to the employee’s incrimination. 2. Is an employee obliged to provide information on any misconduct of or criminal offence committed by other employees? An employee must inform the employer of fellow employees’ breaches of duties to 99 the extent that this concerns the employee’s scope of work (for example if the crime is committed by someone reporting to him/her or who he/she is supposed to control or supervise). Besides, knowledge of any breach of duties by fellow employees or of behavior constituting a criminal offence that an employee gains within the scope of fulfilling her/his duties must generally be disclosed if this can prevent the employer from suffering any damage. Due to their special position, employees in executive positions are at all times obliged to provide information about any misconduct or grievances within their area of responsibility. 3. May an employee refuse to answer a question if he/she has already answered it within the scope of a previous interview? In the case of extensive and time consuming internal investigations, it may 100 happen that the investigators only gradually gain knowledge of certain information. This may require that employees be interviewed more than once. Whether the Di Garbo/Gaudino/Mancuso/Vasile

Reemers Publishing Services GmbH O:/Beck/Spehl_Gruetzner/3d/08_Italy.3d from 06.03.2013 09:29:08 3B2 9.1.580; Page size: 160.00mm  240.00mm

268

§ 8. Italy

employee may rightfully assert that he/she has already answered specific questions in a previous interview depends on the subject matter the question relates to. 101 If the employer’s information request concerns the employee’s duties, part of the employee’s obligations under the employment contract is to provide the requested information and if necessary several times. In this core area, the employee may not refuse to provide the information by arguing that he/she has already provided the requested information. If the employer’s information request does not relate to the employee’s scope of work, the employee is not obliged to provide the information under any circumstances. 4. Is an employee entitled to the presence of a member of the Works Council or an attorney during the interview? a) The employee’s right to the presence of a member of the Works Council 102 aa) If internal investigators interview an employee on breaches of duties and

criminal offences within the company in the course of a disciplinary proceeding and the interview is held following a formal notice with indication of the allegations made against the employee, then the employee may involve a union representative; as the interview would in fact be a disciplinary hearing in which the employee gives her/his justifications, following where the employer may issue a disciplinary sanction against the employee her/himself. 103 bb) However, an employee may not request that a union representative be present

during an interview if the interview will be conducted by internal or external investigators within the scope of internal investigations but outside the scope of a disciplinary proceeding. It goes without saying that the results of the interview in such a case could not be used in any manner against the employee contesting any misconduct that was uncovered during the interview. b) The employee’s right to the presence of a lawyer representing the employee’s rights 104

If company-internal investigators conduct interviews within the scope of internal investigations, the employee is not entitled to the presence of his/her own lawyer during the interview. Normally, interviews within the scope of internal investigations concern the scope of work directly assigned to or performed by an employee. The employee is obliged to provide information on all matters related to her/his personal scope of work without a legal representative being present. The duty to provide information is strictly connected to her/his duties under the employment contract. 5. Is an employee entitled to read the record of his/her interview?

105

The investigators usually document the results of an interview in a record. The employee interviewed may be interested in viewing the results of this record. In such a circumstance, even if the employer is not obliged to allow the employee to read such a record, considering that the registration should be a mere record of what was said during the interview whilst additional comments being written down elsewhere, it is advisable for the employer to act in good faith permitting Di Garbo/Gaudino/Mancuso/Vasile

Reemers Publishing Services GmbH O:/Beck/Spehl_Gruetzner/3d/08_Italy.3d from 06.03.2013 09:29:08 3B2 9.1.580; Page size: 160.00mm  240.00mm

B. The 25 key questions in connection with internal investigations

269

the reading. In fact, the employer’s possible refusal would be considered unreasonable. 6. Is the employer entitled to request that the employee signs the record of the interview? The employer might have an interest in the employee signing the record of the 106 interview to ensure that no future disputes will arise regarding the determination of the facts. Therefore, the employer may ask the employee to sign the record of her/ his interview. Of course in such a case the employee must be granted the right to carefully read such a record before signing it. In case the employee refuses to sign the interview it may be possible to note such refusal on the registration 7. Can the employer instruct an employee to treat the content of his/her interview as confidential? Italian Civil and Criminal Code impose a general duty of confidentiality on the employee. Such a duty is expressly referred to the organization employment, its productive activity, and with the explicit prohibition to divulge confidential information or use them causing any actual or potential prejudice to the employer. Hence, in general, the employee must maintain secrecy on all matters s/he gains knowledge of in connection with her/his position in the company and in regard to which the employer has a justified interest to keep matters confidential. When undertaking an internal investigation, however, it might be essential that the subject matter of the investigation remains secret and sometimes, even within the company. On such occasions, the employer may unilaterally specify the duty in more detail by giving instructions and extending the scope of the facts that are to be treated as confidential. This will be done by expressly determining specific information; for example, the content of an interview conducted within the scope of the internal investigations. However, apart from giving unilateral instructions, it might be worth asking the involved employees to sign a specific confidentiality agreement on certain topics or events occurred or with reference to the fact that an internal investigation is being undertaken. The breach of the above mentioned confidentiality obligation, whether or not the employee only received oral instructions or signed a specific agreement- may be sanctioned and in most serious cases will also entail criminal liability. Even if employees are obliged to maintain secrecy vis-a`-vis colleagues and third parties on confidential information acquired in connection with the internal investigation – either following an express instruction received by the employer or because of a signed confidentiality agreement – when the internal investigations concern illegal secret (e.g. criminal offences committed by other employees), such confidentiality obligations will not be enforceable, especially when the employee is required by law to report criminal activities or otherwise to reply to questioning by public authorities.

Di Garbo/Gaudino/Mancuso/Vasile

107

108

109

110

Reemers Publishing Services GmbH O:/Beck/Spehl_Gruetzner/3d/08_Italy.3d from 06.03.2013 09:29:08 3B2 9.1.580; Page size: 160.00mm  240.00mm

270

§ 8. Italy

IV. Sanctions imposed on employees 1. What are the sanctions under employment law that can be imposed on employees refusing to cooperate in internal investigations? Employees, who in the past have acted in violation of their duties or have even committed criminal offences against their employer, will often refuse to cooperate to the internal investigations in order to not incriminate themselves or other colleagues. If the refusal to cooperate with internal investigation is persistent, the employer may impose disciplinary sanctions on the said employee, following the appropriate disciplinary procedure. 112 The employer, who wishes to contest misconduct or any other breach of an employee’s duties, should first issue a written notice specifying the breach and give the employee time to respond. The employee may reply in writing or request a meeting, including with the assistance of a union representative. The employer may then decide which, if any, is the right sanction to impose on the employee, bearing in mind that a disciplinary sanction should always be proportionate to the breach occurred. The disciplinary sanctions are usually provided by the collective agreements, which also provide a sort of table of correspondence between types of breach and the corresponding proportionate sanction. Generally speaking, the disciplinary sanctions available are the following: – Oral warning; – Written warning; – Fine (with a deduction from remuneration of maximum 4 hours); – Suspension from work and without pay (up to a maximum of 10 days); – Termination. 111

a) Disciplinary sanctions different from termination The employee’s cooperation in internal investigations is a collateral duty under his/her employment contract. If the employee refuses to cooperate in the internal investigations, the employer may decide to initiate a disciplinary action against the employee contesting the breach with a formal written notice and after having received possible justification from the employee, impose the appropriate disciplinary sanction for his/her non-participation in the internal investigation. 114 As in any other disciplinary action, the employer should carefully examine the justifications received by the employee and carefully choose the proportionate sanction to apply in each individual case. The employer must also consider that it is often the national labor collective agreement which gives indications of the proper sanction depending on the type of breach. 113

b) Termination 115

Depending on the situation, for example, if the employee repeatedly refuses to cooperate in the internal investigation or does not hand over business-related documents or emails or does not appear for an interview or violates her/his duty to maintain secrecy, the employer may also decide, after having issued a formal notice for the violation of the duty under the employment contract and after having Di Garbo/Gaudino/Mancuso/Vasile

Reemers Publishing Services GmbH O:/Beck/Spehl_Gruetzner/3d/08_Italy.3d from 06.03.2013 09:29:09 3B2 9.1.580; Page size: 160.00mm  240.00mm

B. The 25 key questions in connection with internal investigations

271

received the employee’s justification; possibly also during a meeting where the employee may be assisted by a unions’ representative, to dismiss the employee for reasons of misconduct. 2. Is the suspicion of a criminal offence or of a severe violation of duty sufficient for an extraordinary termination? The above-mentioned sanctions that are all based on the fact that the employee 116 refuses to cooperate in the internal investigations must be differentiated from such measures that are based on any misconduct of the employee. If there is sufficient evidence that a severe violation of duties or a criminal offence 117 was committed by an employees vis-a`-vis the employer, extraordinary termination would usually be justified, i. e. a termination without notice. However, case law typically only considers termination to be a proportionate action in the case where the criminal offence is somehow connected with the duties assigned to the employee or the crime is otherwise committed during working hours. In this respect, most national labor collective agreements specify that the conviction of the employee for a crime that is not business related and does not affect nor interfere with the duties that are assigned to said employee, is not a just cause of termination. In practice however, internal investigations often only give an indication that 118 employees have acted in gross violation of their duties or committed criminal offences. In such cases, the employer should carefully consider if termination would be deemed as a proportionate sanction. For example, the trust relationship between the employer and the employee, specifically with reference to higher positions may be irremediably broken. 3. During which period of time must an extraordinary notice of termination be given to employees whose misconduct has been revealed by the internal investigations? The general principle applicable to all disciplinary actions is that the formal 119 notice given to the employee regarding the breach should be sent promptly i. e. shortly after the employee’s misconduct was discovered. Once formal written notice has been issued and the employee has given her/his justifications, the employer should impose the related disciplinary sanction within a term that is usually fixed by the national collective agreements (for example the collective agreement for the commercial sector provides that the employer should send notice with the sanction within 15 days from the term given to the employee for giving her/his version of the facts). In the event the actual infringement is complex and the employer – before or once it has issued the formal notice and received justification from the employee – needs time to ascertain the exact nature of the breach and the liability of the employee, the employer itself may carry out internal investigations in order to obtain full knowledge of the underlying facts for the termination. However, national labor collective agreements usually provide a maximum term that should be complied with as well as in case of postponement; the obligation to inform the employee that the situation is still on hold, pending further investigation as to whether there is any liability and if so, the proportionate sanction that will be imposed. Di Garbo/Gaudino/Mancuso/Vasile

Reemers Publishing Services GmbH O:/Beck/Spehl_Gruetzner/3d/08_Italy.3d from 06.03.2013 09:29:09 3B2 9.1.580; Page size: 160.00mm  240.00mm

272

§ 8. Italy

4. Must an employee cooperate in internal investigations even after he/she has been given notice of termination? 120

Yes. Until the termination date, whether the employee gave notice of resignation or the employer gave notice of termination to the employee, the employee is not released from his/her duty to cooperate in internal investigations. On the contrary, once the employee has been dismissed and the employment relationship has been terminated, the employee no longer has the duty of obedience vis-a`-vis the employer and hence – apart from a general (non enforceable) duty to act in good faith – is not bound to reply to interviews or otherwise cooperate in an internal investigation anymore.

V. Use of the obtained information 1. Is it permissible to disclose the findings and information obtained within the scope of any internal investigations to other group companies? 121 a) If the company employing the employee intends to disclose personal data during

investigations to another group company, such as the domestic or foreign parent company, the same statutory provisions shall apply as in the case of any disclosure to a third party. This means that when it comes to data protection, the company may only forward the employee’s personal data if there is a legal basis for doing so and the mandatory privacy requirements are complied with (e.g. information notice has been provided to employees and, as applicable, employee consent has been obtained). 122 b) For the disclosure of the employee’s personal data to a domestic group company,

the same requirements outlined above apply. This is because in this case, from a privacy law perspective, the data disclosure represents a communication of personal data to third parties. The disclosure of personal data may be only allowed if the company’s interests cannot be satisfied in any other way. If the company’s interests are equally safeguarded by rendering the information “anonymous” or by creating an alias, it is not permissible to disclose the personal data. The employee’s right to informational self-determination, i. e. his/her right to determine who shall obtain, save, use or disclose his/her personal data must always be taken into consideration. 123 c) If the company wishes to disclose personal data of employees to foreign group

companies it must observe further requirements. The data protection law provides for different procedures depending on the destination country: 124 aa) In case personal data is disclosed to a group company situated in a Member

State of the European Union or the European Economic Area (EEA) the same requirements – stipulated in para. 122 – apply as if the data was disclosed to a domestic recipient. The same applies in the case of disclosing data to a group company situated in a third country with an adequate level of data protection. The European Commission determines whether a third country provides an adequate level of data protection. 125 bb) The disclosure of personal data to a group company in a third country that

does not provide an adequate level of data protection (these include the United Di Garbo/Gaudino/Mancuso/Vasile

Reemers Publishing Services GmbH O:/Beck/Spehl_Gruetzner/3d/08_Italy.3d from 06.03.2013 09:29:09 3B2 9.1.580; Page size: 160.00mm  240.00mm

B. The 25 key questions in connection with internal investigations

273

States) is subject to the same requirements as previously mentioned in the case of disclosure of data to a domestic recipient, as long as the recipient has undertaken to comply with the Safe-Harbor-Privacy principles or if the sender and the foreign recipient agree on the usage of unmodified standard contractual clauses approved by the European Commission and the transfer is based on these clauses. How to avoid the data protection risks described above? It much depends on 126 the specific factual circumstances. In general terms, information and consent of employees are mandatory requirements to be addressed, together with the ruling of the privacy role and liabilities of the data recipients. 2. Is it permissible and advisable to forward the findings and information obtained within the scope of any internal investigations to public authorities? a) Admissibility of disclosure of personal data aa) If a public authority, such as the public prosecutor’s office, requests the 127 disclosure of data based on its legal power, the company is permitted and in most cases obliged to disclose the data. The authority must inform the company of the legal basis. Otherwise, the authority must inform the company that disclosure will only occur on a voluntary basis. bb) If there is no legal obligation to transfer personal data to public authorities, the 128 same requirements shall apply as in the case of disclosure to third parties as previously mentioned, i. e. the disclosure of personal data to domestic authorities is permissible provided that it is required for the safeguarding of the company’s justified interests and there is no reason to assume that the employee’s legitimate interests prevail and provided the privacy requirements are in place (e.g. information to employees and as applicable consent of employees). The same applies for the transfer of personal data to authorities of an EU or an EEA Member State and for the transfer of data to authorities of a third country with an adequate level of data protection. cc) More stringent regulations apply for authorities in all other countries, including 129 the United States of America. In general, it is not permitted to disclose the personal data of an employee to a public authority in a third country which does not offer an adequate level of data protection. b) Is it advisable to voluntarily disclose data to public authorities? Internal investigations in Italy are conducted essentially by the company’s relevant 130 corporate bodies in compliance with applicable rules and are generally not passed on to the regulators. Therefore, reports are filed and kept internally to demonstrate that all “internal controls” have been duly complied with and are kept available for any judicial authority or regulatory formal investigation. This is particularly relevant as a tool to avoid quasi-criminal liability of the corporation under Decree 231. Usually companies do not disclose results of an internal voluntary investigation 131 to the public. Aside from mandatory reporting requirements (as to price-sensitive facts) under securities law and implementing regulations, Italian companies prefer to preserve the results of internal voluntary investigations rather than to report them. An exception may be represented by the “corporate governance” report, Di Garbo/Gaudino/Mancuso/Vasile

Reemers Publishing Services GmbH O:/Beck/Spehl_Gruetzner/3d/08_Italy.3d from 06.03.2013 09:29:09 3B2 9.1.580; Page size: 160.00mm  240.00mm

274

§ 8. Italy

which listed companies should disclose annually. This may lead to a debate as to where to disclose the frequency and results of the internal investigations. Where results have unveiled crimes, care should be taken to address any possible aspects of aiding and abetting, removing consequences, and addressing coordination with any criminal proceedings. 3. Are the findings made in the scope of internal investigations subject to the attorney-client privilege? 132

133

134

135 136

137

138

Under Italian law, members of certain professions, including lawyers, consultants and accountants, must keep all documents and information sent to them in the context of their professional activities confidential.16 In particular, documents handled by or given to a lawyer in the context of their professional activities are protected by professional secrecy (“segreto professionale”). A lawyer can refuse to deliver documents or any other object provided by the client, by objecting professional secrecy during investigations carried out by judicial or regulatory authorities. In such cases, a judge has the authority to verify whether there are any grounds to oppose the professional secrecy. A judge should cautiously investigate the matter prior to authorizing the seizure of the alleged “privileged/confidential” documents. Such investigation should also be aimed at assessing whether the requirements of segreto professionale exist; that is if the lawyers involved have obtained or drafted a certain document in relation to their jobs or for unrelated reasons. There would be no privilege if the documents were obtained or drafted for unrelated reasons. In practice, some judges tend to be less rigorous than they should be and often grant the prosecutors’ request to forcibly seize certain documents (e.g. contracts) in the lawyers’ possession where they appear to be critical to the criminal investigation. If professional secrecy is not involved, lawyers must hand over any documents received by or drafted for their client in original form, if so required. Producing documents covered by segreto professionale constitutes a criminal offence and damages may be sought, unless there is cause.17 In addition, it should be noted that the Codice Deontologico del Consiglio Nazionale Forense (Professional Code of Conduct) reaffirms the rule of professional secrecy and requires a lawyer to maintain absolute secrecy regarding his services and information provided by the client or which has become known to him or her in the course of the legal assistance. This duty extends to former clients and to persons who have consulted the lawyer without formal mandate. Segreto Professionale applies only to lawyers who are members of the Italian bar, most of whom are self-employed. In-house counsel lawyers who are employed by a company or a bank and who cannot therefore be members of the bar, are not subject to or protected by segreto professionale. In principle, therefore, the attorney-client privilege applies to any professional communication between the corporate client and its outside counsel, as well as to 16 The corporation itself may be even criminally liable if, for example, the Organizational Model described has not functioned in a manner as to halt certain illegal activities of which it has become aware or should have been aware. 17 Cause normally exists in extreme cases as the accrual danger of physical harm to a third party.

Di Garbo/Gaudino/Mancuso/Vasile

Reemers Publishing Services GmbH O:/Beck/Spehl_Gruetzner/3d/08_Italy.3d from 06.03.2013 09:29:10 3B2 9.1.580; Page size: 160.00mm  240.00mm

B. The 25 key questions in connection with internal investigations

275

any document produced by the outside lawyer in connection with the assistance provided to the client, and as a result, attorney work product should also be protected in the context of an investigation; including market abuse investigations. In practice, certain regulatory authorities, such as the Italian Competition Authority, and some prosecutors have shown a penchant for disregarding the privilege which should be attached to the attorney work product in the hands of the corporate client during dawn raids. In some instances, the Italian Competition Authority has simply seized the privileged document irrespective of its nature, whilst in some other cases the Italian Competition Authority and the EU Commission have not physically seized the document but nonetheless read its content during the inspection in order to get an idea of the legal opinion and possibly clarify some relevant issues/facts. In order to avoid such situations, it is common practice amongst anti-trust practitioners to have attorneys closely shadow the inspectors (from the Italian Competition Authority, the European Commission and/or the local police) during all phases of the investigation so as to be able to immediately oppose the seizure (and even their analysis if the intervention is prompt) of privileged documents. a) No attorney-client privilege for in-house counsel involved in the investigations As noted, there is no legal privilege over internal communications with the in- 139 house legal counsel or compliance department regardless of the qualification of staff. Any documents held by in-house lawyers, other than those communications from outside counsel, may have to be handed over to the regulator. In Italy, unlike other EU countries, in-house counsels’ professional activity is not recognized nor regulated by any legal provision or statute. As of today, Italian law considers legal counsels working inside a company as direct employees of the company. It results that, even if possessing all requirements to be registered with the bar, an in-house counsel cannot be admitted to it (with some limited exceptions) and is thus deprived of all rights and privileges attached to independent lawyers registered therewith. b) Privileges in the case that external investigators are involved As noted above, if investigations are conducted by external lawyers, professional 140 secrecy is applicable. External lawyers involved in carrying out internal investigations are entitled to refuse to give evidence in civil and criminal proceedings. A lawyer cannot be obliged to give evidence of any information acquired by reason of his profession, including conversations and communications with his clients (Art. 200 of the Code of Criminal Procedure), nor can he be obliged to disclose any document which is in his possession as a result of his professional activities which was declared in writing that the documents are covered by professional secrecy (Art. 256 of the Code of Criminal Procedure). It is however worth noting that if the judicial authority has reasons to doubt the 141 grounds of the lawyer’s written declaration and concludes that the investigation cannot proceed without seizure of the documents requested from the lawyer, such judicial legal authority is entitled to investigate and ascertain whether the reasons stated by the lawyer are actually existent. If the declaration of the lawyer objecting the professional secrecy is indeed unfounded, then the judicial authority can order the seizure.

Di Garbo/Gaudino/Mancuso/Vasile

Reemers Publishing Services GmbH O:/Beck/Spehl_Gruetzner/3d/08_Italy.3d from 06.03.2013 09:29:10 3B2 9.1.580; Page size: 160.00mm  240.00mm

276

§ 8. Italy

4. Does the attorney-client privilege also apply to foreign attorneys? The European Court of Justice, in determining whether documents, including legal memorandum from a company’s in-house counsel were protected by attorneyclient privilege, ruled that not only was the attorney client privilege inapplicable to in-house counsel, but it also did not extend to lawyers not licensed by a “Member State”.18 143 In response to this decision, the House of Delegates of the American Bar Association submitted a formal protest to the European Court of Justice expressing concern that the court’s finding applied not only to in-house counsel, but to all lawyers outside the European Union.19 For instance, if an American lawyer represented a client before the European Commission, client communications would not be deemed privileged because American lawyers are not subject to European Union disciplinary rules and procedures. As of today, the ruling still stands. However, “debate about whether the rules established in AM&S are outdated and should be changed” has been recently revived.20 144 The exclusion of non-European foreign attorneys (e.g. U.S. attorneys) from privilege protection in foreign countries is considered “unfair” according to some commentators due to the fact that US courts do not categorically exclude foreign attorneys from enjoying the privilege.21 142

5. What is to be observed during the follow-up of internal investigations? 145 a) After an investigation reveals any weaknesses within the company, the manage-

ment must take the necessary and specific measures to correct any misconduct and prevent any further violations of law. If the management fails to put such measures into place, its members may be held liable for damages in the case of further violations of the law and to administrative fines as per the Decree 231. 146 b) Should the findings of the internal investigations actually reveal that employees

intentionally breached their duties or committed criminal offences, as suspected, measures under labor or civil law may be taken against these employees. Any action against the employee should be taken following the appropriate disciplinary procedure provided under the applicable law and labor collective agreement. 147 c) Depending on their respective objectives, the internal investigations may reveal

claims for information or claims for damages of (or vis-a`-vis) clients, competitors, suppliers as well as information and notification obligations. In particular, when it

18 AM&S Europe Limited v. Commission of the European Communities, Case no. 155/79, [1982], E. Comm. Ct. J. Rep. 1575 19 See Goebel, Legal Practice Rights of Domestic and Foreign Lawyers in the United States, in: Daly/Goebel (eds.), Rights, Liability and Ethics in International Legal Practice 51, 76 N. 140, 2nd ed. 2004. 20 Hill, Disparate Positions on Confidentiality, at n. 52 (citing Gippini-Fournier, Legal Professional Privilege in Competition Proceedings before the European Commission: Beyond the Cursory Glance, 28 Fordham International Law Journal 967, 968 (2005)). 21 Dolmans, Attorney client privilege for In-House Counsel: A European Proposal, 4 Colum. J. Eur. L. 125, 129 (1998).

Di Garbo/Gaudino/Mancuso/Vasile

Reemers Publishing Services GmbH O:/Beck/Spehl_Gruetzner/3d/08_Italy.3d from 06.03.2013 09:29:10 3B2 9.1.580; Page size: 160.00mm  240.00mm

C. Summary of key results

277

comes to continuing business relationships, these risks must be carefully considered when following-up on the findings of the internal investigations. 6. May an employer pay its employee’s legal fees if he/she is being prosecuted under criminal law? In the case of criminal investigations or proceedings brought against an employee 148 in connection with the duties s/he carries out for the employer, most national collective labor agreements provide for certain employees, usually executives (dirigenti) and middle-managers (quadri), the right to be indemnified by their employer for any expenses incurred (including attorneys’ fees). This is until and unless individual guilt is finally established. In addition, collective agreements usually provide that the employer is to insure executives and middle managers for any risks and disbursements, including compensation for damages related to the performance of their working duties. Such reimbursement provisions also apply when the company itself is subject to a regulatory investigation. In any event, national collective labor agreements set out the employer’s right to 149 recover expenses incurred in favor of the employee in the case that s/he is definitively found guilty for gross misconduct or fraud.

C. Summary of key results I.

If companies have reason to suspect that material breaches of duties or criminal offences are being or have been committed, the management should launch internal investigations in order to avert any further damage to the company or to the members of its management and to reduce the risks connected with corporate liability as per Decree 231/2001. II. Prior to conducting individual measures within the scope of internal investigations, the employer must carefully verify or have a third party verify whether or not and to which extent these individual measures are actually permitted. Generally, limitations under criminal, labor and data protection law have to be observed. III. Under their respective employment contract, the employees are obliged to actively cooperate in internal investigations. If the employees violate this duty to cooperate, there are measures under labor law available to the employer and in most serious cases the non-cooperation may lead to a justified termination of the employment relationship. IV. If there is no legal obligation to disclose the findings made in the scope of the internal investigations, it must be carefully examined whether the disclosure of these findings to both group companies and public authorities is actually admissible; in particular when it comes to group companies and authorities in foreign jurisdictions.

Di Garbo/Gaudino/Mancuso/Vasile

Reemers Publishing Services GmbH O:/Beck/Spehl_Gruetzner/3d/08_Italy.3d from 06.03.2013 09:29:10 3B2 9.1.580; Page size: 160.00mm  240.00mm

Reemers Publishing Services GmbH O:/Beck/Spehl_Gruetzner/3d/09_Mexico.3d from 06.03.2013 09:29:32 3B2 9.1.580; Page size: 160.00mm  240.00mm

§ 9. Mexico Para. A. Introduction . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 1 B. The 25 key questions in connection with internal investigations . . . . 17 I. Initiation of internal investigations . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 17 1. When and to what extent should internal investigations be initiated? . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 17 2. Should internal investigations be of an open or covert nature? . . . . . 29 3. Is it advisable to involve external investigators? . . . . . . . . . . . . . . . . . . . . 33 4. Is it permitted that foreign attorneys conduct internal investigations in Mexico? . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 40 5. When should national authorities be called in? . . . . . . . . . . . . . . . . . . . . . 45 II. Admissibility and implementation of individual measures within the scope of internal investigations . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 50 1. What measures are admissible within the scope of internal investigations? . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 50 2. Must employees’ representatives such as the works council be involved in internal investigations? . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 65 III. Employee interviews . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 70 1. May an employee refuse to provide information if this information would incriminate himself/herself? . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 70 2. Is an employee obliged to provide information on any misconduct of or criminal offence committed by other employees? . . . . . . . . . . . . . 73 3. May an employee refuse to answer a question if he/she has already answered it within the scope of a previous interview? . . . . . . . . . . . . . . 76 4. Is an employee entitled to the presence of a member of the works council or an attorney during the interview? . . . . . . . . . . . . . . . . . . . . . . . 79 5. Is an employee entitled to read the record of his/her interviews? . . . 81 6. Is the employer entitled to request that the employee signs the record of the interview? . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 85 7. Can the employer instruct an employee to treat the content of his/ her interview as confidential? . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 86 IV. Sanctions imposed on employees . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 89 1. What are the sanctions under employment law that can be imposed on employees refusing to cooperate in internal investigations? . . . . . 89 2. Is the suspicion of a criminal offence or of a severe violation of duty sufficient for an extraordinary termination? . . . . . . . . . . . . . . . . . . . . . . . . 100 3. During which period of time must an extraordinary notice of termination be given to employees whose misconduct has been revealed by the internal investigations? . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 105 4. Must an employee cooperate in internal investigations even after he/she has been given notice of termination? . . . . . . . . . . . . . . . . . . . . . . . 108 V. Use of the obtained information . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 111 1. Is it permissible to disclose the findings and information obtained within the scope of any internal investigations to other group companies? . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 111 2. Is it permissible and advisable to forward the findings and information obtained within the scope of any internal investigations to public authorities? . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 114 3. Are the findings made in the scope of any internal investigations subject to the attorney-client privilege? . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 118 4. Does the attorney-client privilege also apply to foreign attorneys? . . . 119

Vizcarra/Ibarra/Godard

Reemers Publishing Services GmbH O:/Beck/Spehl_Gruetzner/3d/09_Mexico.3d from 06.03.2013 09:29:32 3B2 9.1.580; Page size: 160.00mm  240.00mm

280

§ 9. Mexico Para. VI. Following-up on internal investigations . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 120 1. What is to be observed during the follow-up of internal investigations? . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 120 2. May an employer pay its employee’s legal fees if he/she is being prosecuted under criminal law? . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 121

A. Introduction 1

2

3

4

5

6

7

8

As a result of past negative experiences where companies have made their way to fame based on management’s, board’s, and/or illegal and corrupt actions of employees’, companies world-wide are now taking a closer look inside. They are investing time, effort and money in corporate internal investigations, aimed at preventing situations which would negatively impact internal policy, financial statements, reputation and even the company’s existence as a whole. Globalization dictates trends for doing business worldwide and internal investigations in the corporate world are not the exception. Companies continue to struggle implementing processes which enforce better internal compliance. The development of corporate investigations however, has not been the same in every region. Latin America for example, has initiated its first attempts to implement policies and procedures addressing compliance with local legislation while at the same time, raising the bar in the way of doing business on a global scale. Mexico has faced difficult times. A complex political environment has slowed down the enactment of laws seeking to boost the country’s economy, competitiveness and democratic stability. The development of democracy in Mexico has given birth to a new phenomenon. A divided congress and partisan politics have set back the ability to pass new laws which would allow Mexico to enter into a modern democracy. The experience of Mexican legislation and institutions with internal corporate investigation has also been scarce. Perhaps the most common forum to find these types of processes is in labor matters. While Mexican politicians are still trying to agree on the national agenda, many companies are applying best practices and standards that would allow them to compete on a very aggressive level and in a constant evolving market. The challenge is therefore to balance implementing an internal compliance policy and continuing to drive business on a day-to-day basis, harmonizing them with applicable local legislation and practice to build up a world-class place to work. Companies’ best practices require them to comply with specific internal policies such as Codes of Conduct, Ethics Codes, Antitrust and Fraud Policies, Confidentiality Agreements, etc. Certainly, Mexican subsidiaries of foreign corporations and large Mexican conglomerates have devoted more time and economic resources to develop these practices than the rest of the corporations and business throughout the country. These mechanisms to avoid non-compliance of internal policy need an effective access and method to enforce specific obligations. Understanding the intricacies of local rules, formalities and timing to apply a certain action or decision will become a critical phase during the course of business. The successful existence of compliance processes will ensure a working place free of discrimination, harassment, inside trading, unequal treatment, conflicting interests and other aspects which pejoratively contribute to productivity and competitiveness. Vizcarra/Ibarra/Godard

Reemers Publishing Services GmbH O:/Beck/Spehl_Gruetzner/3d/09_Mexico.3d from 06.03.2013 09:29:32 3B2 9.1.580; Page size: 160.00mm  240.00mm

A. Introduction

281

During the course of internal investigations, companies should exercise care with respect to the individuals involved, the subject matter of the investigation, the step plan to follow, the appropriate timing based on the circumstances of the case and ultimately, the measures or disciplinary actions to apply. At all times, local regulation may create boundaries, formalities or challenges, which a company will have to overcome throughout the investigation. Ideally, misconduct, malpractice and wrongdoing properly supported, will end up with the proper corrective action. However, in a country where the long standing tradition of laws and courts has been one of protecting employees rights, corporations will encounter interesting challenges in Mexico when trying to live up to their standards and procedures. Nevertheless, globalized business and social responsibility are on a combined journey towards a more solid corporate industry; trying to shield its operations locally and abroad from financial scandals, stock market meltdown, bankruptcy, and loss of values. Accordingly, internal investigations should be an essential tool in every company or industry, either for promptly correcting deviations from the company vision and morale, or to prevent situations with potential devastating effects. Breach of restrictive covenants, non-discrimination obligations, work and sexual harassment, disclosure of confidential information, inside trading, inappropriate reporting of financial results, are only some examples of situations that will require conducting an internal investigation. The steps to follow will be crucial to a successful fact-finding exercise and the outcome of the investigation may require making difficult but necessary decisions that may include, among others, disciplinary actions, performance improvement plans, immediate termination, reporting a criminal activity to the corresponding authorities, and even the disclosure of information to the stock market to comply with regulatory obligations. As mentioned above, Mexico has not enacted specific legislation on internal investigations. There are therefore, isolated legal provisions which must be considered. Internal investigations will mainly depend on the company’s policy in effect, exercising due care during the course of the investigation and reasonable standards that should be aligned with Mexican general principles and public policy embodied in the Federal Constitution, international treaties ratified by the Mexican Senate and federal laws. During an internal investigation, there will be times where the information involved includes personal data (“Personal Data”) of certain data subjects who might be the employees, clients or any other third party (the “Data Subjects”). Please note that on July 5, 2010 Mexico published the Federal Law on Protection of Personal Data in Possession of Private Entities. It regulates the protection of Personal Data among individuals and private entities at a Federal level. Some of its provisions became effective on January, 2011 and some others on July 2011. Moreover, Art. 16 of the Mexican Constitution has been amended to include the protection of Personal Data as a constitutional right and therefore the Federal Law for the protection of Personal Data is a consequence of that constitutional amendment. In this regard, in the event of an internal investigation – from a strictly legal perspective – the written consent to manage and transfer any Personal Data of Data Subjects for the purpose of an internal investigation should be obtained from such Data Subjects. Vizcarra/Ibarra/Godard

9

10

11

12

13

14

15

16

Reemers Publishing Services GmbH O:/Beck/Spehl_Gruetzner/3d/09_Mexico.3d from 06.03.2013 09:29:33 3B2 9.1.580; Page size: 160.00mm  240.00mm

282

§ 9. Mexico

B. The 25 key questions in connection with internal investigations I. Initiation of internal investigations 1. When and to what extent should internal investigations be initiated? 17

18 19

20

21

22

23

24

In the absence of clear legal rules pertaining to internal investigations, companies should consider initiating an internal investigation in the event of any noncompliance of internal regulations or policy. The decision on whether to initiate an internal investigation can also be used as a preventive measure or as a periodical review of internal compliance. Some examples of subject matters that would require an internal investigation are the following: breach of restrictive covenants such as non-compete and nonsolicitation obligations, violation of non-discrimination obligations,1 work and/or sexual harassment claims, disclosure of confidential information, inside trading, hostile environment claims, inappropriate use of email and/or Internet tools, inaccurate reporting of financial results, possible conflict of interests, non-compliance with antitrust obligations, etc. An internal investigation would usually commence following a concern or claim made by an employee, a third party (whistleblower), or through the corporate channels of the company. In the first case, it is common to find companies with implemented mechanisms whereby employees can raise their concerns about specific matters or topics. These mechanisms or hotlines usually allow employees to make anonymous claims or report the conduct of other co-workers or management, without having to fear possible retaliation. In Mexico there is no legal provision that requires revealing the individual’s identity who initiated the report or claim and thus, this type of process is legal and considered to be good practice. Mexican Federal Labor Law (the “FLL”) does not establish a special sanction or damage for an employer who retaliates against an employee for filing a claim or raising a concern. Similarly, the FLL does not have a specific set of rules protecting “whistleblowers”. Accordingly, companies which through their internal grievance procedure provide protection to employees for filing these types of claims are definitely raising the bar in best practice and going beyond the protection of the FLL. A general rule in the FLL is that its provisions set a “minimum standard”2 of protection for employees in Mexico. Consequently, any higher or better benefit established in favor of employees will be considered valid and binding upon the employer. A claim by a third party may also trigger an internal investigation, if it relates to the company’s compliance rules. A supplier, customer, or services supplier may inform the company of a situation affecting the commercial relationship between such a third party and the company. It may include a quality/product liability issue, an employee’s conflict of interest, the request of a bribe, etc. The internal 1 2

See Art. 3 of the Federal Labor Law. See Arts. 1, 2, and 5 of the Federal Labor Law.

Vizcarra/Ibarra/Godard

Reemers Publishing Services GmbH O:/Beck/Spehl_Gruetzner/3d/09_Mexico.3d from 06.03.2013 09:29:33 3B2 9.1.580; Page size: 160.00mm  240.00mm

B. The 25 key questions in connection with internal investigations

283

investigation in this case should not only focus on the possible breach of a legal or contractual obligation by one more of its employees, but also on the company’s potential liability vis-a`-vis a third party in terms of applicable local law or specific contractual commitments. Finally, if the company through local management or corporate officers identifies a situation that requires further inquiring, an internal investigation should be conducted to gather information, obtain documents, interview employees or former employees, in order to determine whether one or more persons could be subject to certain liability. Whenever based on the company’s existing process the company becomes aware of a situation that could possibly require initiating an internal investigation, the company would be obliged to conduct an investigation. This is, once the company has established a process to investigate a situation that could potentially be subject to corrective action. This would be viewed under the FLL as part of the employee’s terms and conditions of employment,3 which the employer must comply with. Theoretically, an employee may request from the company the enforcement of its policy to ensure internal compliance, if such a situation results on the confirmation or guarantee of an employee’s right. The downside of this “direct dealing” type of programs is the abuse of a right. It is not uncommon to find in Mexico that employees raise claims for what is considered to be inappropriate conduct, when in fact this may be a personal dispute with a fellow employee or supervisor. Concern or hotlines may also be used to express a personal perception of the company’s performance, a disagreement about a salary increase, an announced reduction in force, a possible merger with a competitor, etc. An internal investigation may also be necessary if, for example an investigation conducted by a governmental authority, reveals irregularities in certain company procedures. Banking, regulatory, environmental, labor, immigration, tax and other government agencies are entitled under Mexican law to conduct periodical or random inspection visits to companies.4 In the event such procedures end up with a penalty5 or specific-performance order against the company, the latter would be required to conduct its own investigation to find out how and since when the company deviated from complying with local law.

25

26

27

28

2. Should internal investigations be of an open or covert nature? Although a healthy business practice is to keep confidential all information 29 gathered in an investigation, at a certain point in time such information and persons involved in the investigation need to be disclosed at the company level and additionally sometimes, to the appropriate government authorities. Depending of the subject matter to be investigated, the process may be of an 30 open or covert nature. In general terms, an internal investigation begins with only a small group of employees or managers. It is critical that information is not compromised when conducting an open investigation where the investigation is of general knowledge among employees or third parties. Similarly, it is advisable that 3

See Arts. 25 and 26 of the Federal Labor Law. See Arts. 540 and 541 of the Federal Labor Law. 5 See Art. 548 of the Federal Labor Law. 4

Vizcarra/Ibarra/Godard

Reemers Publishing Services GmbH O:/Beck/Spehl_Gruetzner/3d/09_Mexico.3d from 06.03.2013 09:29:33 3B2 9.1.580; Page size: 160.00mm  240.00mm

284

§ 9. Mexico

individuals who are involved in the investigation are not initially informed thereof prior to being interviewed. This is necessary in order to gather truthful and reliable information. 31 Unconcealed situations such as an employee being seriously injured at the work place or an erupted fight between employees on the company’s premises will obviously not allow the company to conduct a covert internal investigation. Other situations which would be difficult to conceal would be for example an inspection conducted by an environmental enforcement agency due to the disposal of dangerous materials in soil or into water, or police enforcement agents questioning management for an alleged fraud. 32 As mentioned before, it is advisable in any case, to keep information and facts gathered during the internal investigation confidential, until a proper assessment is made and an action plan is designed for the specific circumstances. 3. Is it advisable to involve external investigators? 33

34

35

36

37

38

39

Mexican law does not limit the involvement of external investigators. In fact, it will be the company’s decision as to which persons will undertake the internal investigation and the role that each one of them will play. In general terms, internal investigations are conducted by the appropriate department within the company’s organization. Compliance, legal, finance and human resources areas are normally involved in internal investigations. Certain departments such as legal and human resources have also dealt with similar situations in their areas of responsibility, in this recently developed area of corporate investigations in Mexico. Company’s internal compliance areas have proven to be more experienced and effective. Companies usually devote significant resources to internal investigations and although such costs may be managed with internal investigators, sometimes the matter at stake requires bringing in external investigators. Internal investigators are better informed of company policy; code of business conduct, codes of ethics, etc. The inclusion of an independent third party assisting the investigation is also generally advisable and productive. External investigators are important to involve in an internal investigation in case there is a need for high-level expertise in a particular subject. A pharmaceutical company may require a regulatory expert in a claim for failing to apply the correct labels for products. A consumer’s product company would require an antitrust expert for an anonymous claim of creating a cartel for fixing prices with other competitor. An investment bank may require an expert legal counsel on inside trading matters. Another reason for external investigators is to maintain impartiality in the process. Long-standing work or friendship relationships among employees of the same company may impair a genuine desire to conduct an impartial investigation. It is difficult to anticipate or to avoid a situation where the internal or external investigator is biased with respect to the individuals or even the particular subject under investigation (e.g. sexual harassment, child pornography, etc.). At all times the person in charge of the investigation must remain objective and open to the possibility of replacing internal or external investigators.

Vizcarra/Ibarra/Godard

Reemers Publishing Services GmbH O:/Beck/Spehl_Gruetzner/3d/09_Mexico.3d from 06.03.2013 09:29:33 3B2 9.1.580; Page size: 160.00mm  240.00mm

B. The 25 key questions in connection with internal investigations

285

4. Is it permitted that foreign attorneys conduct internal investigations in Mexico? Mexican law does not prohibit foreign individuals from conducting lawful activities in the country, provided they obtain a proper work permit or visa. A foreign individual assisting in an internal investigation must be properly advised on the type of work permit he/she should obtain prior to travelling into Mexico. Failing to obtain the appropriate visa will not render the investigation invalid, but the foreign individual may be subject to a penalty, as well as the company that benefits from the services of the foreign individual. With respect to the investigation, Mexican law does not limit the number of those who can participate in the investigation nor does it address citizenship of the investigators. A foreign investigator may add value to the investigation for having a deep knowledge of internal compliance rules, organizational structure and the overall business of the company. However, lack of knowledge of local legal standards and even cultural differences may represent a barrier for the optimum development of the investigation. There is no legal provision that would prohibit a foreign investigator conducting interviews or drafting documents in a foreign language. However, there may be a potential risk that the individual interviewed will argue that facts were misinterpreted, or information was taken out of context, etc. The use of a translator may be useful; however an investigator who is a native Spanish speaker is preferable.

40 41

42

43

44

5. When should national authorities be called in? Depending on the matters that are being investigated, Mexican authorities should be called in during the course of the investigation, or on the other hand not even be informed, if the issue has no legal effects that must be reported. There are clear examples when authorities should be immediately notified (e.g. an employee stabbed a fellow worker; a fire consumed the warehouse). However, facts and circumstances are not always clear and thus, further inquiring is required. For example, while inappropriate use of Internet can be dealt with within the company’s rules and disciplinary action, child pornography6 must be reported to the corresponding enforcement agencies. In general, conduct that can be criminally prosecuted should be reported to the criminal authorities. Sometimes disclosing this type of illegal activity will isolate the company from liability; for example, where a company may be considered to have covered up criminal activity. However, in certain circumstances, calling in national authorities would not release the company from penalties or action; like in the case of an employee who bribed a government official in order to obtain a contract to supply company products and services. When national authorities are informed of a situation that occurred inside the company, there may also be a potential exposure of the company’s reputation and even a significant impact to its financial results or value of shares in the market (e.g. inaccurate annual financial statements). It is important to keep in mind that once 6

See Arts. 209 and 209 Bis of the Mexican Federal Criminal Code.

Vizcarra/Ibarra/Godard

45

46

47

48

Reemers Publishing Services GmbH O:/Beck/Spehl_Gruetzner/3d/09_Mexico.3d from 06.03.2013 09:29:34 3B2 9.1.580; Page size: 160.00mm  240.00mm

286

§ 9. Mexico

government authorities are notified of the internal investigation, they will, in most cases, expand the investigation to other subject or areas of the company. Companies must continue to cooperate with government officials in order to avoid an action for obstruction of governmental and federal investigations under applicable Mexican law. 49 Care should be exercised in each case in order to analyze the legal or ethical obligation in reporting unlawful activities or conduct in the company, in correlation with any potential risks which would result in harming to the company’s reputation.

II. Admissibility and implementation of individual measures within the scope of internal investigations 1. What measures are admissible within the scope of internal investigations? 50

51

52

53

54

55

During internal investigations, companies may take necessary measures to obtain information, testimony, documents and data, so long as individual rights7 are not violated. Mexican law does not limit the scope of internal investigations,8 however, the company should apply reasonable measures that are not invasive of an individual’s safety, integrity or dignity.9 Likewise, companies should refrain from trying to obtain information that would breach the individual’s confidentiality obligations before third parties, or otherwise the company could be subject to the legal or contractual responsibility. As mentioned it is advisable to keep information and documents obtained from the investigation confidential. This is unless there is a legal obligation to notify national authorities. This recommendation becomes relevant where information obtained from an interview is considered to be classified or confidential. An investigator should also be careful so as to avoid threats, unsupported accusations, and excessive pressure in an interview. It is not uncommon to find in Mexico criminal complaints alleging slander, defamation, and even a hostage situation. As it will be explained in this chapter, in general terms the standard or proof required by Mexican courts is very high. Specifically, labor litigation requires an “absolute proof” standard which makes it a real challenge to gather sufficient information and evidence in order to bring an action (e.g. civil, criminal, administrative, labor, etc.) against someone. Accordingly, it is crucial to obtain solid evidence10 on the subject matter being investigated. In Mexico, electronic communications and in general, evidence stored on electronic devices is quite difficult to validate. Audio or video recording is also easily challenged in court, since it does not always prove a factual situation beyond reasonable doubt11 (i. e. person’s identity, date, time, place, motive, etc.). 7

See Arts. 1–29 of the Mexican Constitution. Isolated Court Precedent. Appeal 526/97. September 24, 1997. “Administrative Investigation. Document must include detailed facts to be investigated.”. 9 See Art. 2 of the Mexican Constitution, which forbids any type of discrimination (i. e. racial, sexual, etc.). 10 See Arts. 776 and 779 of the Federal Labor Law. 11 Isolated Court Precedent. Appeal 1766/90. May 11, 1990. “Investigation deed, total value when the employee acknowledges conduct.”. 8

Vizcarra/Ibarra/Godard

Reemers Publishing Services GmbH O:/Beck/Spehl_Gruetzner/3d/09_Mexico.3d from 06.03.2013 09:29:34 3B2 9.1.580; Page size: 160.00mm  240.00mm

B. The 25 key questions in connection with internal investigations

287

It is recommended to prepare partial reports of each task during the internal investigation, describing in detail the type of task, the participants, the persons interviewed, the information and documents obtained, as well as the date, time and place of such task. Ideally, this partial report or record should be signed by those that participated in the same. In Mexico there is no such concept as “self incrimination” that would limit the validity of this kind of document or report, or its use in court. Another measure, as explained before, is to call in external investigators or experts of a certain science. The forensic review of a computer will require an IT expert. Similarly, an accounting expert may be required to analyze whether a false reporting action has occurred; or an engineer would need to review machinery and manufacturing process to assess a possible sabotage. In each case, the person heading the internal investigation should advise those internal and external investigators and experts, the extent of their participation, the responsibility before other persons involved in the process, and their potential liability for failing to follow instructions. On July, 2010, Mexico enacted the Federal Law on Protection of Personal Data in Possession of Individuals (“FLPDI”). The Mexican government has also created the Federal Institute for Access to Information and Protection of Data, which is the authority responsible for verifying compliance with this Law. It is noteworthy that the FLPDI allows employees to consider that they have suffered damage or injury to property or rights as a result of failure to comply with the rights set forth in the FLPDI by the Company and/or the manager in charge of personal data. These rights include the right to be informed of any disclosure of personal data, correction of data and cancellation of data once the employee ceases the labor relationship. The employee may request compensation in the event that his/her rights are breached by the company. Failure to comply with this Law may even lead to criminal prosecution. In accordance with the FLPDI, when the company intends to transfer personal data to third-parties whether domestically or abroad the company must send privacy notices which must detail the purposes of the review of personal data. The data processing will be as agreed in the privacy notice, which shall contain a clause stating whether or not the employee accepts the transfer of his/her data. Note that domestic or international transfers of data may be carried out without the consent of the employee in the following cases: – If the transfer is covered by a law or treaty to which Mexico is a party; – if the transfer is necessary for the prevention or medical diagnosis, medical assistance, medical treatment or health service management; – if the transfer is made to parent companies, subsidiaries or affiliates under common control of the person or manager in charge, or a parent company or any associated company of the same group that operates under the same internal processes and policies; – if the transfer is necessary by virtue of a contract entered into to benefit the employee, between the Company and a third party; – if the transfer is necessary or legally required for the safeguarding of public interest, or administration of justice;

Vizcarra/Ibarra/Godard

56

57 58

59

60

61

62

Reemers Publishing Services GmbH O:/Beck/Spehl_Gruetzner/3d/09_Mexico.3d from 06.03.2013 09:29:34 3B2 9.1.580; Page size: 160.00mm  240.00mm

288

§ 9. Mexico

– if the transfer is required for the recognition, exercise or defense of a right in judicial proceedings, and – if the transfer is required for the maintenance or fulfillment of a legal relationship between the Company and the employee. 63 In order to avoid privacy issues regarding any possible “personal information” contained in emails or inside a computer, we suggest that all companies implement an E-mail and Computer Acceptable Use Policy, whereby the employees acknowledge at the moment of being hired that computer, internet, email and any other tools provided by the employer are solely for work purposes and therefore all information contained in the computer – including any emails – is and will always be considered property of the company. The employee therefore grants the employer any and all rights to review, manage, transfer, modify, and to handle in any other way the information contained in the computer (hardware & software), including but not limited to its email that has been provided to the employee as a work tool. Implementing the type of policies mentioned above helps prevent any misinterpretation in the event of an internal investigation. 64 Please note that Mexican laws and regulations are neither clear nor advanced regarding the regulation of these types of activities; implementing e-discovery or scanning programs in internal investigations. 2. Must employees’ representatives such as the works council be involved in internal investigations? The FLL does not contain an obligation to have an employee’s representative present at the time of an internal investigation. At the most, the FLL provides that an employee has the right to defend himself/herself before the employer, prior to imposing a disciplinary action. 66 Mexico provides sound legislation which protects an employees’ right of association and the right to form unions.12 Traditionally, unions have played an important role in Mexico’s social, political and labor activities. Unions have important and powerful rights which can be exercised against employers, and therefore, it is important to review in detail the company’s obligation before its union (if any). 67 It is common to find in collective bargaining agreements13 that unions have managed to negotiate that company decisions be first notified, consulted and negotiated with the employees’ representative. It is also common to find that a union has agreed with the employer that a union representative14 be present during an internal investigation concerning a union employee.15 Moreover, unions in Mexico have even achieved including provisions in these collective bargaining agreements, whereby they can oppose a disciplinary action or termination with cause, provided there is – according to the union – no compelling evidence. 65

12

See Arts. 357 of the Federal Labor Law. See Art. 123, A, XVI of the Mexican Constitution. See Art. 386 of the Federal Labor Law. 14 See Art. 359 of the Federal Labor Law. 15 Binding Court Precedent. Appeal 2303/81, 2760/80, 670/82, 701/82, and 4746/81. “Administrative Investigation in case of termination of employment relationship, lack. Implies a wrongful termination.”. 13

Vizcarra/Ibarra/Godard

Reemers Publishing Services GmbH O:/Beck/Spehl_Gruetzner/3d/09_Mexico.3d from 06.03.2013 09:29:34 3B2 9.1.580; Page size: 160.00mm  240.00mm

B. The 25 key questions in connection with internal investigations

289

The FLL provides that an employee can refuse to be represented by a union,16 if 68 expressly requested; regardless of whether such employee may be an affiliate of the union. This is something rarely seen in the Mexican labor market. Certainly, collective bargaining agreements and any other type of arrangements 69 with unions will not be applicable in the event of an internal investigation regarding a non-union employee.

III. Employee interviews 1. May an employee refuse to provide information if this information would incriminate himself/herself? As mentioned above, internal investigations are generally not limited under 70 Mexican law. Investigators however should be cautious of partaking in activities that may trigger a lawsuit by the employee or the person being interviewed. In addition, the Mexican legal system does not recognize “self-incrimination” as a prohibited concept. Therefore, an employee that accepts responsibility for a specific act or conduct and signs a statement to this extent would not be free from liability under applicable law or contractual obligations. A practical situation would be that the employee may refuse to provide informa- 71 tion or sign a statement if he/she knows that such information or statement will be the basis for a sanction or immediate termination. An employee cannot be forced to provide information or sign a statement. It is also a practice, that investigators have used witnesses to testify the employee’s acceptance of an act or conduct, or refusal to sign a statement. Based on the very strict standard of proof in Mexican labor procedures, this latter alternative creates the potential risk of not meeting such a standard. In case the information is not self-incriminatory, the employee or person 72 interviewed should be encouraged to cooperate and also be guaranteed that he/she will not suffer any retaliatory action. 2. Is an employee obliged to provide information on any misconduct of or criminal offence committed by other employees? According to a general principle of Mexican law, an individual who is aware of 73 conduct that may constitute criminal conduct is obliged to provide information to the company through the respective manager or to the corresponding authorities. In the first case, the company that is informed of a possible crime is also obligated to inform the corresponding enforcement agency. The above mentioned obligation may vary from state to state within the Mexican 74 Republic due to the fact criminal law is embodied in state and federal law. It is advisable to analyze the possible crime on a case-by-case basis, since a minor misdemeanor may not be reported, according to the specific circumstances (e.g. an employee who acknowledges taking out-of-pocket money from the company but has already returned the amount). A different situation may be if, according to the 16

See Art. 358 of the Federal Labor Law.

Vizcarra/Ibarra/Godard

Reemers Publishing Services GmbH O:/Beck/Spehl_Gruetzner/3d/09_Mexico.3d from 06.03.2013 09:29:35 3B2 9.1.580; Page size: 160.00mm  240.00mm

290

§ 9. Mexico

internal investigation, an employee is suspected of selling drugs inside the company, or an employee who tried to commit suicide. 75 Employees should be warned that they may also be subject to criminal liability if they refuse to provide information on a misconduct or criminal offence committed by other employees. Under Mexican criminal law, failing to report this type of activity may render the employee an accomplice, conspirator, or simply an action trying to cover up a crime.17 3. May an employee refuse to answer a question if he/she has already answered it within the scope of a previous interview? In general terms, it is difficult to obtain information, documents or answers from an employee who does not want to cooperate. Both from a practical and legal perspective, it is quite difficult (and not advisable) to force an employee to cooperate with an internal investigation. 77 Employees may be encouraged to answer questions by assuring them that the company will not hold them responsible for the information shared during the investigation. Employees may also be advised that non-retaliation rights exist only for those that cooperate with investigators. However, it will ultimately depend on the employee’s willingness to collaborate. 78 Employees may refuse to answer questions that may have already been answered in a previous investigation. Investigators may only request a confirmation that the employee’s answers to the questions would still be the same. 76

4. Is an employee entitled to the presence of a member of the works council or an attorney during the interview? As previously discussed, there is no legal right under the FLL for an employee to have union representative present at the interview. However, collective bargaining agreements18 may establish this type of prerogative for their affiliates. Unfortunately, if this is the case, the member of the union representing the employee can obstruct the line of questioning and even advise the employee not to respond to certain questions. 80 A union representative cannot be held responsible for persuading an employee not to cooperate with an internal investigation. Although not a general rule, many unions in Mexico would complicate an interview or investigation if they identify that a member of their rank may be in trouble. Some unions have a deep-rooted belief that if they defend their members, even under adverse circumstances, their representation will grow in strength. 79

5. Is an employee entitled to read the record of his/her interviews? 81 82

There is no legal provision addressing this topic in Mexico. Nevertheless, we believe it is “best practice” to allow an employee to read his/her interview. During an interview and generally during the investigation, it is recom17 18

See Art. 400 of the Mexican Federal Criminal Code. See Arts. 386 and 390 of the Federal Labor Law.

Vizcarra/Ibarra/Godard

Reemers Publishing Services GmbH O:/Beck/Spehl_Gruetzner/3d/09_Mexico.3d from 06.03.2013 09:29:35 3B2 9.1.580; Page size: 160.00mm  240.00mm

B. The 25 key questions in connection with internal investigations

291

mended to act openly with all individuals being interviewed; whether they are suspected of a particular act or misconduct, or if they are just being interviewed for general purposes. The main purpose of an investigation is to obtain valid and solid information 83 that will allow the company to make an informed decision. Accordingly, the process for obtaining such information should be as reliable as possible. It is not of much help if the investigator states wrong facts, dates or names. Allowing the employee to read the record of his or her interview may even provide better and greater details on the facts being investigated, given that sometimes after the interview the employee may remember additional facts or feel more comfortable with supplying additional information. As mentioned before, it is also advisable to allow an employee to review his or her 84 interview record in order to request the employee’s signature for the record. The advantage of having such an interview record signed by the employee is not only that such a document will be compliant with Mexican evidentiary rules, but also that such a statement cannot be subsequently changed or altered by the employees. 6. Is the employer entitled to request that the employee signs the record of the interview? The employer is entitled to request that the employee sign his/her record of the 85 interview.19 This type of signed statement is valid and can- if needed- be used in trial. It is desirable to have the employee sign each page comprising of the interview record and of course, the original record must be kept by the company. There is no legal provision in Mexico preventing an employee from keeping a photocopy of the signed record, but perhaps it is preferable to limit such copies in order to maintain the confidentiality of the investigation and the facts stated therein. 7. Can the employer instruct an employee to treat the content of his/her interview as confidential? We believe it is advisable that the employer instructs an employee to keep the 86 content of the interview confidential and refrain from disclosing any other information that may have been shared with the employee during the process (e.g. the purpose of the investigation, persons previously interviewed or to be interviewed, findings and/or information gathered thus far, etc.). The records of the investigation could be printed out in language stating that 87 such documents are protected for confidentiality purposes. Due to the importance of the issues involved in internal investigations (e.g. 88 confidentiality, harassment, discrimination, misdemeanors or criminal actions), the disclosure of investigations by the employees interviewed, and the disclosure of information given by investigators, may result in a potential liability for the company. In addition, the purpose of the investigation may even be lost along with its intention to prevent similar future conducts.

19

Isolated Court Precedent. Appeal 747/81. August 12, 1982. “Administrative record. Case in which it lacks evidentiary efficiency even if it is not challenged by the employee.”.

Vizcarra/Ibarra/Godard

Reemers Publishing Services GmbH O:/Beck/Spehl_Gruetzner/3d/09_Mexico.3d from 06.03.2013 09:29:35 3B2 9.1.580; Page size: 160.00mm  240.00mm

292

§ 9. Mexico

IV. Sanctions imposed on employees 1. What are the sanctions under employment law that can be imposed on employees refusing to cooperate in internal investigations? 89

90

91

92

93

94

95

96

The FLL does not specifically provide that an employee is obliged to cooperate in internal investigations. However, the FLL establishes that an employee is obliged to observe applicable “labor provisions”,20 which can be extended to contractual obligations or obligations under a company policy or program. We believe it can be validly included in an employee’s employment contract,21 Employee Manual, Code of Conduct, Code of Business Ethics, Internal Work Regulations, etc., that the employee is bound to comply with any internal investigation that the company may undertake and render cooperation with the investigation. Derived from the fact that the FLL does not establish a specific sanction for an employee that refuses to cooperate in an internal investigation, specific sanctions must be included in the corresponding company documentation. In terms of the FLL, an employer can only impose a disciplinary action against an employee, if the latter’s wrongdoing is clearly established in the company’s Internal Work Regulations22 and a specific penalty23 exists for such non-compliance within the regulations. The FLL provides that the Internal Work Regulations are a set of rules which are mandatory for employees and employers during the day-to-day activities of the company. The FLL specifically provides that the Internal Work Rules must include, among other things, the possible application of disciplinary actions and processes,24 where at the same time the employee must be allowed to defend himself/herself prior to the application of the corrective action. In order to be valid and binding, the Internal Work Regulations must be agreed upon by a joint committee of persons representing,25 in equal number, the employees and the employer. If employees are unionized, the Internal Work Regulations must be agreed between the union and the company. Finally, this set of rules must be filed and registered before the appropriate labor authority in Mexico.26 According to the FLL, the most severe sanction (short from termination with cause) that can be imposed on an employee who failed to comply with a specific obligation set forth in the Internal Work Regulations is a suspension of work for up to 8 days without pay.27 Normally, Internal Work Regulations provide a system which gradually applies disciplinary sanctions, starting from a verbal warning, followed by a written warning and a suspension from 1 to 8 days without pay. These regulations may also establish the effects of repeated or new offences, and how the disciplinary actions will continue to be applied, up to the termination of the employee. 20

See See 22 See 23 See 24 See 25 See 26 See 27 See 21

Art. 134, I of the Federal Labor Law. Arts. 20 and 31 of the Federal Labor Law. Art. 422 of the Federal Labor Law. Art. 423, X of the Federal Labor Law. Art. 423 of the Federal Labor Law. Art. 424, I of the Federal Labor Law. Art. 424, II of the Federal Labor Law. Art. 423, X of the Federal Labor Law.

Vizcarra/Ibarra/Godard

Reemers Publishing Services GmbH O:/Beck/Spehl_Gruetzner/3d/09_Mexico.3d from 06.03.2013 09:29:35 3B2 9.1.580; Page size: 160.00mm  240.00mm

B. The 25 key questions in connection with internal investigations

293

The FLL, as mentioned before, is protective of employees’ rights and thus, 97 embodies a general principle of “job stability”, whereby an employee can only be fired28 due to serious breach of his/her obligations. Accordingly, we believe it would be difficult to make a solid argument that refusing to cooperate with an internal investigation would be a serious breach of an employee’s obligations and consequently would merit termination with cause. The employee may be terminated with cause based on the findings of the internal investigation, but it would be complicated to support “cause” in a trial based on the mere fact of refusing to cooperate with the investigation. The FLL provides that an employee can be terminated with cause within the 98 30 calendar days29 following to the date in which the employer became aware of the wrongdoing. Federal Courts in Mexico have issued judicial precedents whereby the 30-day period starts to count from the date the internal investigation has concluded.30 Finally, an employee can also be terminated without cause by payment of the 99 statutory severance. The decision of the company may be driven by different circumstances: (i) he/she did not cooperate with the internal investigation, (ii) he/ she provided false information, (iii) the findings of the investigation are not conclusive but sufficient enough to lose confidence31 in him/her, (iv) for any other reason or (v) for no reason at all. The FLL does not oblige an employer to provide a reason for the termination without cause, but only to pay the following severance to the employee: a) 3 months of total compensation32 (base salary plus benefits in kind and in cash;33 plus b) 20 days of total compensation per each year of services rendered; plus c) 12 days of salary per each year of services rendered, with a salary cap of up to twice the minimum wage in Mexico (seniority premium34); plus d) pro-rata part of employment benefits for the last year of services and up to the date of termination. 2. Is the suspicion of a criminal offence or of a severe violation of duty sufficient for an extraordinary termination? The FLL provides that an employer can terminate an employee with cause based 100 on the specific circumstances and hypothesis described therein. In general terms, the FLL requires an employee’s wilful misconduct or gross negligence to constitute “cause”.35 However, as mentioned above, both the FLL and Mexican courts have set a very 101 high standard of proof in order to demonstrate “cause”. The standard of “absolute 28

See Art. 47 of the Federal Labor Law. See Art. 517, I of the Federal Labor Law. 30 Binding Court Precedent. Appeal 4293/70. February 19, 1971. “Dismissal, previous investigation. Statute of limitation of the employer.”. 31 See Art. 185 of the Federal Labor Law. Isolated Court Precedent. Appeal 2037/80. October 20, 1982. “Trust employees, termination of employment relationship for lack of confidence.”. 32 See Art. 50, III of the Federal Labor Law. 33 See Art. 84 of the Federal Labor Law. 34 See Art. 162, I of the Federal Labor Law. 35 See Art. 47, VI of the Federal Labor Law. 29

Vizcarra/Ibarra/Godard

Reemers Publishing Services GmbH O:/Beck/Spehl_Gruetzner/3d/09_Mexico.3d from 06.03.2013 09:29:36 3B2 9.1.580; Page size: 160.00mm  240.00mm

§ 9. Mexico

294

proof” cannot be met with a suspicion of a criminal offence or a suspicion of a severe violation of duty. The employer must have – to the extent possible – undisputed evidence that may support an employee’s termination with cause. 102 In the event the employer fails to prove “cause” in trial, the employee will be entitled to back pay throughout litigation in addition to the mandatory severance described in the preceding answer.36 Back pay under the FLL cannot be mitigated in any fashion. 103 Based on the above, it is important to keep in mind the 30-day period that the FLL grants to employers in order to terminate an employee with cause. During such period, the employer must gather as much information and evidence as possible, in order to have a better opportunity to prove “cause” in trial. 104 An employer has the alternative to terminate an employee without cause by paying him/her a salary, without having to support or justify such termination (for any reason or for no reason). Unfortunately, as the FLL has a rigid set of rules with respect to termination of an employee with cause,37 some companies have been lead to immediately terminate its employees with payment of severance, when the circumstances are so serious that they require the immediate firing of the individual. 3. During which period of time must an extraordinary notice of termination be given to employees whose misconduct has been revealed by the internal investigations? Notice of termination is an employer’s exclusive obligation and is only required when the employer terminates an employee with cause. In any other type of termination, it is not required (or recommended) to give notice. 106 As stated before, the FLL provides that an employer can terminate with cause an employee within the 30 calendar days following the date in which the employer became aware of the wrongdoing. There is no obligation under the FLL to give a prior notice of termination. Consequently, a termination with cause in Mexico will normally take place on the same date that the employee is granted the notice of termination. 107 If the company makes the decision to terminate the employee without cause and to pay the legal severance, there is no waiting or notice period to comply with and thus, the employee can be terminated immediately. 105

4. Must an employee cooperate in internal investigations even after he/she has been given notice of termination? Although difficult to enforce, this type of obligation may be included in the company’s Internal Work Regulations for employees who have been advised of their termination. 109 As referred to above, notice is only required in the event of a termination with cause and in any other case it is highly advisable to avoid giving an employee notice of termination. Based on the fact employees are seldom notified of their termination and if terminated with cause such termination is usually effective immediately, the 108

36 37

See Art. 48 of the Federal Labor Law. See Art. 47 of the Federal Labor Law.

Vizcarra/Ibarra/Godard

Reemers Publishing Services GmbH O:/Beck/Spehl_Gruetzner/3d/09_Mexico.3d from 06.03.2013 09:29:36 3B2 9.1.580; Page size: 160.00mm  240.00mm

B. The 25 key questions in connection with internal investigations

295

obligation of cooperating with the investigation after termination would be complicated to enforce. In any case, an employee that has been advised of his/her termination with cause 110 will not feel compelled in any fashion to continue cooperating with the employer.

V. Use of the obtained information 1. Is it permissible to disclose the findings and information obtained within the scope of any internal investigations to other group companies? During an internal investigation, there will be times where the information 111 involved with the internal investigation includes employee Personal Data. As it has been mentioned Mexico has recently enacted a law that regulates the protection of Personal Data among individuals and private entities at a federal level. Moreover, Art. 16 of the Mexican Constitution has been amended to include the 112 protection of Personal Data as a constitutional right. From a legal perspective, the consent38 to manage and transfer any Personal Data 113 from Data Subjects, as part of the internal investigation, should be obtained for any Data Subjects located in Mexico or when the data bases or the information containing such Personal Data is physically located or hosted in the country. From a practical perspective, and as mentioned before, it is advisable to obtain consent from each person involved in the internal investigation. 2. Is it permissible and advisable to forward the findings and information obtained within the scope of any internal investigations to public authorities? In the event that a transfer to a third party is required as a result of the internal 114 investigation, an express consent from the Data Subject will be required, unless the information and Personal Data should be transferred to an enforcement agency as a result of criminal conduct or activity. Encrypted electronic information (including Personal Data) can be stored in 115 databases as structured content, in email or instant messages as semi-structured content, and in documents or files as unstructured content. Nevertheless, employers should advise its employees about the implementation of an e-discovery system and also the use of work tools (e.g., computer, email, Internet) is being monitored and that such information may be stored. Nevertheless, employees may request the employer to destroy any private information stored as a consequence of the implementation of the e-discovery system. In order to avoid any privacy issue regarding any possible “personal information” 116 contained in the emails or inside the computer, it is advisable that companies 38 Breaching the provisions contained under the Federal Law may result, depending on the breach in a fine against the company or the data holder to whom the Data Subject provide the Personal Data that can go from approximately USD 740,000.00 to USD 1,470,000.00 plus the payment of a compensation to the Data Subject as a result of the breach to the rights set forth in the Federal Law In addition to the penalties mentioned above, the authority may impose three months to five years of imprisonment to the individual or company that is authorized to process personal data and with the purpose of making a profit, causes a security breach to the databases in his/her custody. In the case of sensitive personal data, the penalties referred to above shall be doubled.

Vizcarra/Ibarra/Godard

Reemers Publishing Services GmbH O:/Beck/Spehl_Gruetzner/3d/09_Mexico.3d from 06.03.2013 09:29:36 3B2 9.1.580; Page size: 160.00mm  240.00mm

296

§ 9. Mexico

implement an email use policy, whereby the employees are aware that computer, internet and email are solely for business purposes. Therefore, all information contained in the computer will be considered as property of the company. 117 Please note that Mexican laws and regulations are not very clear or advanced regarding the regulation of this type of activities; such as implementing e-discovery or scanning programs in internal investigations. 3. Are the findings made in the scope of any internal investigations subject to the attorney-client privilege? 118

According to Mexican provisions, all professionals are obliged to keep matters entrusted by their clients,39 strictly confidential – unless information is expressly required to be of public domain by applicable laws. In this regard, internal or external counsels acting as investigators or only assisting to the investigation must keep the information confidential until the company expressly states its permission for disclosure. 4. Does the attorney-client privilege also apply to foreign attorneys?

119

The attorney-client privilege applies to those persons having a professional relationship for legal services and/or assistance and thus, it includes foreign attorneys as well as foreign clients.

VI. Following-up on internal investigations 1. What is to be observed during the follow-up of internal investigations? 120

Following up of internal investigations will depend on the scope of such investigation and its intended purpose. If the findings of the internal investigation were not sufficient to impose a disciplinary action or to terminate an employee, the company may want to follow up on additional evidence, interviews, and fact finding that may allow continuing the investigation process. Conversely, if – following the investigation – one or more employees were sanctioned or terminated; the company may want to follow up on the enforcement and observation of internal policy with the rest of the employees, in order to avoid similar situations in the future. 2. May an employer pay its employee’s legal fees if he/she is being prosecuted under criminal law?

It is not required under Mexican law for an employer to pay the legal fees of its employees subject to criminal prosecution. In fact, this is not common practice marketing Mexico. 122 At the outset, it appears not to be advisable to establish such a policy. This is derived from the fact that the employer will be involved – at least indirectly – in criminal litigation concerning the conduct of one of its employees. There may be the unlikely case in which the company may be subject to a federal investigation 121

39

See Art. 36 of the General Professions Law.

Vizcarra/Ibarra/Godard

Reemers Publishing Services GmbH O:/Beck/Spehl_Gruetzner/3d/09_Mexico.3d from 06.03.2013 09:29:36 3B2 9.1.580; Page size: 160.00mm  240.00mm

B. The 25 key questions in connection with internal investigations

297

and that some of its local employees may be subject to criminal prosecution for following instructions from corporate offices or headquarters and the payment of employee’s legal fees may be reasonable. In any case, it is important to establish that such legal fees be under the condition of company approval and perhaps a provided cap for the fees.

Vizcarra/Ibarra/Godard

Reemers Publishing Services GmbH O:/Beck/Spehl_Gruetzner/3d/09_Mexico.3d from 06.03.2013 09:29:36 3B2 9.1.580; Page size: 160.00mm  240.00mm

Reemers Publishing Services GmbH O:/Beck/Spehl_Gruetzner/3d/10_Russia.3d from 06.03.2013 09:30:03 3B2 9.1.580; Page size: 160.00mm  240.00mm

§ 10. Russia Para. A. Introduction . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 1 B. The 25 key questions in connection with internal investigations . . . . 6 I. Initiation of internal investigations . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 6 1. When and to what extent should internal investigations be initiated? . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 6 2. Should the internal investigations be of an open or covert nature? . . 9 3. Is it advisable to involve external investigators? . . . . . . . . . . . . . . . . . . . . 13 a) External investigators . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 14 b) Internal investigators . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 22 4. Is it permitted that foreign attorneys conduct internal investigations in Russia? . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 28 5. When should national authorities be called in? . . . . . . . . . . . . . . . . . . . . . 30 II. Admissibility and implementation of individual measures within the scope of internal investigations . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 34 1. What measures are admissible within the scope of internal investigations? . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 34 a) Companies’ Data . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 34 b) Personal Data . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 39 aa) Employee interviews . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 51 bb) Email screening . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 54 cc) Handover, review and processing of files, letters and documents of employees . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 60 dd) Handover and mirroring of the computer and subsequent processing of the business-related data and electronically stored business-related documents of employees (other than emails) . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 62 ee) Video surveillance of employees . . . . . . . . . . . . . . . . . . . . . . . . . . . . 65 ff) Tapping of telephone conversations . . . . . . . . . . . . . . . . . . . . . . . . . 66 gg) Search of the workplace . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 70 hh) Covert listening in on conversations (other than telephone conversations) on the business premises . . . . . . . . . . . . . . . . . . . . 72 ii) Investigations carried out in the surroundings of employees under suspicion . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 73 jj) Amnesty programs . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 74 kk) Whistle-blowing programs . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 77 2. Works council and trade unions involvement in internal investigations . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 78 III. Employee interviews . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 82 1. May an employee refuse to provide information if this information would incriminate himself/herself? . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 82 a) Duty to provide information on the tasks directly assigned to the employee or carried out by the employee . . . . . . . . . . . . . . . . . . . . . . . . 84 b) Duty to provide information in indirect connection with the scope of work . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 86 c) Duty to provide information outside the scope of work . . . . . . . . . 87 2. Is an employee obliged to provide information on any misconduct of or criminal offence committed by other employees? . . . . . . . . . . . . . 88 3. May an employee refuse to answer a question if he/she has already answered it within the scope of a previous interview? . . . . . . . . . . . . . . 89

Kobrin

Reemers Publishing Services GmbH O:/Beck/Spehl_Gruetzner/3d/10_Russia.3d from 06.03.2013 09:30:03 3B2 9.1.580; Page size: 160.00mm  240.00mm

300

§ 10. Russia Para. 4. Is an employee entitled to the presence of a member of the works council or an attorney during the interview? . . . . . . . . . . . . . . . . . . . . . . . 90 a) The employee’s right to the presence of a member of the works council . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 90 b) The employee’s right to the presence of a lawyer representing the employee’s rights . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 91 5. Is an employee entitled to read the record of his/her interview? . . . . 92 6. Can the employer instruct an employee to treat the content of his/ her interview as confidential? . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 93 IV. Sanctions imposed on employees . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 94 1. What are the sanctions under employment law that can be imposed on employees refusing to cooperate in internal investigations? . . . . . 94 a) Reduction of the remuneration . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 97 b) Warning, reprimand and termination . . . . . . . . . . . . . . . . . . . . . . . . . . . 98 2. Is the suspicion of a criminal offence or of a severe violation of duty sufficient for an extraordinary termination? . . . . . . . . . . . . . . . . . . . . . . . . 104 3. During which period of time must an extraordinary notice of termination be given to employees whose misconduct has been revealed by the internal investigations? . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 106 4. Must an employee cooperate in internal investigations even after he/she has been given notice of termination? . . . . . . . . . . . . . . . . . . . . . . . 108 V. Use of the obtained information . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 109 1. Is it permissible to disclose the findings and information obtained within the scope of any internal investigations to other group companies? . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 2. Is it permissible and advisable to forward the findings and information obtained within the scope of any internal investigations to public authorities? . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 109 a) Admissibility of disclosure of personal data . . . . . . . . . . . . . . . . . . . . . b) Is it advisable to voluntarily disclose data to public authorities? . . 109 3. Are the findings made in the scope of internal investigations subject to the attorney-client privilege? . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 110 a) No attorney-client privilege for in-house counsel involved in the investigations . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 110 b) Privileges in the case that external investigators are involved . . . . 111 VI. Following-up on internal investigations . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 112 1. What is to be observed during the follow-up of internal investigations? . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 112 2. May an employer pay its employee’s legal fees if he/she is being prosecuted under criminal law? . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 113 C. Summary of key results . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 114 D. Table of Bibliography . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 115

A. Introduction 1

In Russia and the Commonwealth of Independent States (CIS), internal compliance investigations have not yet become a usual practice for local companies. The majority of the companies that have faced compliance investigations are local subsidiaries of US corporations and some European companies that have been inclined to carry out internal investigations within their subsidiaries internationally, including Russia. Likewise, the same segment of companies are concerned with developing internal policies, rules, whisle-blowing systems, etc. to minimize the risks of internal investigations in the future.

Kobrin

Reemers Publishing Services GmbH O:/Beck/Spehl_Gruetzner/3d/10_Russia.3d from 06.03.2013 09:30:04 3B2 9.1.580; Page size: 160.00mm  240.00mm

B. The 25 key questions in connection with internal investigations

301

Compliance investigation activities are not extremely popular with the local companies. This is explained first and foremost by the legal framework in place. Although Russia has ratified the 2003 UN Convention Against Corruption and 1999 Criminal Law Convention on Corruption, legal entities under Russian law cannot be criminally liable for any non-compliance, including for non-compliance within the anti-corruption legislation. Only physical persons guilty of crimes can be criminally liable. Legal entities can be liable (exposed to fines) for breaches of legislation of administrative offences (for the company’s corrupted activities and for improper employment of former civil servants1), but such provisions are very new to Russian law and the practice of their application just emerged. The second major point is that Russian criminal law clearly distinguishes between bribing public officials and bribing commercial partners. The term “public official” applies to the employees of state and municipal institutions and arises, above all, in the context of qualifying such crimes as bribery2 and abuse of official power.3 Under Russian law, public officials are defined as individuals discharging, whether permanently, temporarily or upon a special authorization, the functions of a representative of authority or organizational, managerial, administrative and business functions within state authorities, local self-government bodies, state and municipal institutions, state-controlled corporations, as well as the Armed Forces of the Russian Federation and other troops and military units of the Russian Federation.4 These do not per se include, for example the management team of private companies; the stock of which is held by the state, even if the state is a controlling shareholder. Like bribing public officials, bribing commercial partners is also a crime, but the practice of commercial bribery and abuse of authority are very rare in relations between private companies. However, there is an emerging practice of holding private companies liable for illegal payments on its behalf, as a matter of administrative offence, even in absence of the criminal sanctions imposed on its individual employees/representatives.

2

3

4

5

B. The 25 key questions in connection with internal investigations I. Initiation of internal investigations 1. When and to what extent should internal investigations be initiated? Russian law does not expressly require companies to conduct any specific 6 internal compliance investigations or introduce any compliance procedures. Under Russian law the so-called employment investigations, i. e. employer’s 7 obligation to investigate employees’ conduct, are required. It is not incidental that the employer’s obligation is mentioned here, since the reason for the legal norm is to make the employer follow a set procedure and properly document the employee’s conduct in order to be able to further impose disciplinary measures (see infra paras. 13 et seqq.). Given the recent changes to the legislation, whereby liability was intro1

Arts. 19.28-19.29 of the Russian Code of Administrative Offences. Arts. 290–291 of the Criminal Code of the Russian Federation. 3 Art. 285 of the Criminal Code of the Russian Federation. 4 Art. 285 of the RF Criminal Code. 2

Kobrin

Reemers Publishing Services GmbH O:/Beck/Spehl_Gruetzner/3d/10_Russia.3d from 06.03.2013 09:30:04 3B2 9.1.580; Page size: 160.00mm  240.00mm

302

§ 10. Russia

duced for undue payments on behalf of the company or for its benefit and practice of interpretation of such provisions by law enforcement and other administrative authorities of the Russian Federation, it is important to keep in mind that the administrative liability of companies arises only where the company is found guilty. The central elements of the guilt in this context include the due and reasonable efforts taken by the company to prevent the breach of law. 8 This, of course, speaks in favor of introduction of compliance procedures in Russia and ensuring that the procedures are enforced on a regular basis. And certainly a company should introduce the procedures or run investigation activities if it is obliged to do so as part of its global initiative (or obligations assumed vis-a`vis foreign governmental authorities). 2. Should the internal investigations be of an open or covert nature? Russian law does not limit any individual, company or institution in conducting any informal investigation, unless the acts of a private investigator explicitly violate applicable laws, for example privacy guaranteed by the constitution or personal data protection rules. 10 The prerogative of the covert investigation activities belongs to the Russian state authorities vested with the investigation functions. This is to ensure constitutional privacy rights. 11 Therefore, the carrying out of operational-search (criminal investigative) measures and the use of special technical means, intended (designed, adjusted, programmed) for secretly obtaining information may be legitimate only for government officers specifically authorized by the relevant laws.5 Non-compliance with this rule may actually result in administrative and criminal liability. 12 Russian laws do not provide a clear distinction between the operational-search measures of government officials and plain unrestricted research activities. Whereas some of the operational-search measures stipulated by the law are distinctly associated with restriction of constitutional rights and freedoms (e.g., control of mail, telegraph and other messages, eavesdropping which are only possible upon a court decision), some measures may appear quite usual and not expressly associated with any restriction of constitutional rights and freedoms (e.g. questioning of individuals with their consent, review of documents and objects with the consent of their proprietor). The legality test therefore lies in whether the activities interfere with constitutional rights and freedoms (privacy), especially those that are specifically mentioned by the constitution (namely, privacy of correspondence and telephone conversations). 9

3. Is it advisable to involve external investigators? 13

Depending on the purpose of an investigation and resources available to the company, an investigation may be done by way of engaging external consultants or by an internal team or a mix of both.

5

Art. 6 of the Federal Law No.144-FZ dated 12 August 1995 “On Operational Search Activities” (“Criminal Investigative Activities”).

Kobrin

Reemers Publishing Services GmbH O:/Beck/Spehl_Gruetzner/3d/10_Russia.3d from 06.03.2013 09:30:04 3B2 9.1.580; Page size: 160.00mm  240.00mm

B. The 25 key questions in connection with internal investigations

303

a) External investigators Engaging external counsels may be reasonable if the company under review does not have sufficient and qualified internal resources. It may be necessary to involve external consultants when the purposes of the investigation presuppose confidentiality and independence of investigators. Involving external investigators however may turn the investigation procedure informal from the view point of Russian employment law. The major issue that arises with the involvement of the external investigators in the course of an informal investigation is personal data treatment. A word of caution is in place here with respect to the possible use of private investigation (detectives) agencies. It is not uncommon to engage private investigators for ongoing support of internal checks of companies and of an individual employee’s compliance. However, it is necessary to keep in mind that private investigators must have a special license and must also work only within their competence as provided under the law.6 For instance, the law stipulates that a detective can search biographical and other information about persons with their consent. Unlike many jurisdictions, engaging a law firm or an audit company for conducting internal investigations does not yield any special confidentiality advantages. In Russia, legal services activities are not subject to licensing and the majority of lawyers work without admittance to the Bar or similar qualification. Only lawyers wishing to work as criminal attorneys must be admitted to the Bar. Lawyers however, admitted to the Bar cannot be employed by companies or law firms. That is why in-house counsels and the vast majority of legal consultants advising companies are not Bar members. Russian law7 provides for the protection of advocates’ secrets; however this law does not regulate the activities of lawyers other than qualified advocates (admitted to the Bar). The information shared between lawyers (other than registered advocates) and clients is considered privileged and confidential as between themselves and in relation to any third parties, but not vis-a`-vis state authorities. In addition, documents/property in possession of lawyers may be subject to seizure by the state investigative agencies. Based on the advocates’ secrets provisions, the investigation team members who are advocates admitted to the Russian Bar (if any) would not be bound to share any information made known to them in the course of their engagement for the client, nor would they be made to testify on client-attorney secrets. They would be protected against seizure of the client documents and property in their possession; therefore the documents that are held by advocates in their client files are very unlikely to come into the possession of the law-enforcement agencies. Any documents and materials in possession of advocates can be seized only pursuant to a court order, but the law restricts their use as evidence in criminal proceedings.

6 Federal Law No. 2487-I dated 11 March 1992 “On the activities of private detectives and security guards”. 7 Art. 8 of the Federal Law No. 63-FZ dated 31 May 2002 “On Advocates (Attorneys-at-Law) Activities and the Bar in the Russian Federation”.

Kobrin

14

15

16

17

18

19 20

Reemers Publishing Services GmbH O:/Beck/Spehl_Gruetzner/3d/10_Russia.3d from 06.03.2013 09:30:04 3B2 9.1.580; Page size: 160.00mm  240.00mm

304

§ 10. Russia

However, the presence of Russian-qualified advocates does not extend the same protection to the other team members. 21 Russian law8 provides for protection of auditors’ secrets where they are providing audit services to the clients (this is licensed activity in Russia). However, even the client documents kept by the auditors can be seized by the state law enforcement agencies, provided they comply with the criminal procedure (based on a statutory requirement or a court order). The laws contain no restriction to the use of the seized materials as evidence. b) Internal investigators 22 23

24

25

26

27

Russian law does not specifically provide for the form and procedure in which the employer must conduct internal compliance investigations. The law does provide however,9 that before imposing any disciplinary measures, the employer must request the employee’s explanations in writing. The request for the explanations must be also in writing; like all formal communication between the employer and employees. Usually such a request is issued in the form of an employer’s order, where the employee is requested to sign an acknowledgment of receipt. The employee’s explanations can be submitted in any form: written statement, report, etc. Such orders from an employer oblige the employee to provide the sought information. If the employee fails to submit the written explanations sought from them, such failure should be witnessed by a written employer’s statement. Non-compliance with the order to provide explanations may be treated per se as a breach of the employment obligations to comply with internal instructions and may result in disciplinary measures. Upon considering the explanations, the employer must issue a closing internal order or regulation where the result of the investigation should be specified. For instance, if the misconduct of the employee was confirmed, the employer may order some disciplinary measure imposed on the former. Because such an employer’s order is binding upon the employees and noncomplying employees risk sanctions, this formal employment law procedure can sometimes be useful. Another major advantage is that the employer is exempt from obtaining consents for processing the personal data kept in connection with employment.10 It is only the employer (or its representatives) who must carry out the formal employment procedures. Nothing in the law prohibits the employer from hiring an external service provider to consider the explanations provided by the employee. As long as the investigator is not employed or directly engaged by the employer, the issue of the personal data access arises. In practice, it happens in exceptional cases that external consultants are hired as part-time employees (into the staff) for them to be treated as employer without further authorities and consents. More usually though the external investigators are engaged by the employer and ordered to fulfill the employer’s function by way of an engagement agreement and an internal order 8

Art. 9 of the Federal Law No.119-FZ dated 7 August 2001 “On Audit Activities”. Art. 193 of Chapter 30 of the RF Labor Code. 10 Art. 6 of the Federal Law No.152-FZ dated 27 June 2006 “On Personal Data” (“Personal Data Law). 9

Kobrin

Reemers Publishing Services GmbH O:/Beck/Spehl_Gruetzner/3d/10_Russia.3d from 06.03.2013 09:30:05 3B2 9.1.580; Page size: 160.00mm  240.00mm

B. The 25 key questions in connection with internal investigations

305

of the general director (the rep office head). Depending on the data protection policies internally introduced and enforced by the company, it is often essential that the employees’ consent is obtained by the investigators to access their personal data even for the purpose of the formal employer’s investigations. For an informal investigation involving external reviewers the consent is a must in the majority of the cases. 4. Is it permitted that foreign attorneys conduct internal investigations in Russia? Foreign attorneys may conduct internal investigations in Russia in compliance 28 with Russian law. These activities are not subject to licensing, provided they do not involve actions that are only allowed to licensed private detectives. There are no requirements for foreign team members to obtain any special 29 category visas or work permits provided that they arrive for only a short-term business trip and it is not in connection with any employment in Russia; unless they are employed by a Russian company. Of course, foreign citizens will need visas to enter Russia unless there is a visa-free entrance agreement between Russia and the foreigner’s country. For the purpose of informal investigations, a normal business visa will suffice. If the decision is made to hire the foreign investigators as the investigated entity’s personnel (which happens in exceptional cases only), then the special employment visa should be obtained, individual work permit received, and the respective working place quota for a foreign employee granted to the employer. 5. When should national authorities be called in? Should investigators learn about actually committed crimes during the investigation, they are not obliged to report the crimes to the state law-enforcement agencies and there is no liability for the failure to do so. However, criminal liability is possible when assisting and concealing a crime,11 e.g. taking measures to destroy evidence of the crime. Any involvement of covert technical means of investigation would only be allowed for state investigative authorities. Therefore, if a case requires investigation by secret means, this should go into the hands of the state law-enforcement agencies. In some cases state authorities would have to be notified of the personal data collection and processing.12 The notification procedure is very simple though and can be executed in very general terms. It may be necessary to apply to the state authorities in connection with the import of strong encryption-based technologies (symmetric keys above 56 bits and asymmetric above 512 bits keys and certain asymmetric keys above 112 bits).13 Depending on the encryption technology employed, it may be necessary to obtain a special license or permit or notify the authorities.

11

Art. 316 of the RF Criminal Code. Art. 22 of the Personal Data Law. 13 Customs Union Committee Ruling dated 1 December 2009 “On the procedure for import to the customs territory of the Customs Union and export from the customs territory of the Customs Union of encryption tools”. The Customs Union includes Russia, Belarus and Kazakhstan. 12

Kobrin

30

31

32

33

Reemers Publishing Services GmbH O:/Beck/Spehl_Gruetzner/3d/10_Russia.3d from 06.03.2013 09:30:05 3B2 9.1.580; Page size: 160.00mm  240.00mm

306

§ 10. Russia

II. Admissibility and implementation of individual measures within the scope of internal investigations 1. What measures are admissible within the scope of internal investigations? a) Companies’ Data In the course of the investigation mainly the companies’ data shall be collected and analyzed, i. e. information that belongs to the companies under investigations. Belonging to the companies’ data are corporate files, contracts, job files, accountancy documents, electronic data and correspondence; as long as this information is not personal data and private correspondence of the employees (to be addressed in detail below). If external investigators are engaged, the company must consent to the processing of its data by the external investigators. In practice engagement agreement for running an investigation is sufficient for the purpose. 35 It should be kept in mind that Russian law is quite formalistic in terms of the definition of a legal entity. Thus, local subsidiaries of a global headquarters company are treated by Russian law as independent legal entities and instructions from the headquarter company are not per se a legal ground for the disclosure of the local companies’ information; each of them is entitled to its own data protection. This should be settled by consents sought from the authorized management body of each of the company for review of the information by the investigating team members. 36 Under Russian law special and very strict rules apply to data which compromises of state secrecy.14 It is not uncommon that contracts between state agencies, organizations and private companies (engaged in commercial transactions) involve state secrecy issues and impose certain restrictions upon the companies and its employees. As this category involves the necessity to maintain strict access regime, review of such data by persons who do not have permission, is impossible. We note though that state secrets are not something which is randomly stored; state secrecy regime presupposes strict segregation of this data and maintenance of storing by a responsible designated person. Russian law establishes rather formal procedures for establishing and maintaining state secrecy, classifying data as state secret, and also for granting access to state secrets. For instance, when private companies are engaged in joint work on certain projects (like public procurement orders) it might be necessary for them to have access to state secrets; in such cases the companies would be licensed to work with state secrets and enter into agreements regarding the protection of state secrets, and the individuals responsible for complying with the secrecy regime would go through admittance procedures. However, it is recommended to raise this point early on in the investigation in order to avoid occasional access to or disclosure of state secrecy. 34

14 Russian law defines a state secret as state-protected data in the spheres of the state’s military, foreign-policy, economic, intelligence, counterintelligence and criminal investigation activities, the disclosure of which may damage the security of the Russian Federation; state secret status may apply to a very extensive list of information categories specified in Art. 5 of the Russian Federation Law No. 5485–1 of July 21, 1993 “On State Secrets” and RF Presidential Decree No 1203 dated 13 November 1995 “Approving the List of Data Classed as State Secret”.

Kobrin

Reemers Publishing Services GmbH O:/Beck/Spehl_Gruetzner/3d/10_Russia.3d from 06.03.2013 09:30:05 3B2 9.1.580; Page size: 160.00mm  240.00mm

B. The 25 key questions in connection with internal investigations

307

Another category of privileged data held by the companies is commercial secrets. 37 Of course, companies can consent to processing their commercial secrets by investigators. Nonetheless, when the companies are bound by non-disclosure obligations vis-a`-vis third parties (i. e., holding third parties’ commercial secrets), individual contracts should be reviewed in order to determine if this information can be further disclosed. Quite a lot of data about companies is made publicly available in accordance with 38 disclosure laws. There is therefore no necessity to obtain anyone’s consent for collection and processing of such data. b) Personal Data Difficulties usually arise when investigators approach employee data. Employee data (the employees’ personal data, e.g. data held in HR files, including information about their previous and current employment and salary, accountancy, bank information, etc.) can be lawfully held and processed by the employer for the purpose of employment. The purpose of employment covers internal employer’s investigations aimed at supervising the employees’ fulfillment of the duties and investigation of misconducts. Thus, if an investigation is done by internal company’s resources, the issue of personal data should not be a big problem. Such employees’ data cannot be disclosed by the employer to any third parties (including external investigators involved into informal investigation) unless required by law or consented to by the employee. Unless there is a formal consent granted by each employee, the employer cannot disclose the information or consent to its review on behalf of the employees. All such data should be treated as protected personal data of the employees. In practice, provided respective internal policies have been duly introduced by the company, it may be possible to retain external advisers to review the data processed by the employer for the purpose of employment. In this case the external advisers would be acting on behalf of the employer. When it is inappropriate (e.g. when an investigation is led by a parent company and the local company is an object of it), there is no better way to secure the employees’ privacy rights than by obtaining their consent to processing of their personal data. The situation is less clear with personal documents and employee correspondence that are stored not in connection with the current employment (personal correspondence, documents, pictures that people tend to store on the firm’s workstations). On the one hand, under Russian law, one of the employee’s general obligations is due care as to the employer’s assets.15 This is in practice interpreted as prohibiting the use of the employer’s assets for personal needs, unless expressly permitted or routinely tolerated by the employer. That is, employees must use the companies’ assets for working purposes, i. e. for storing and processing their working data and exchange of correspondence in capacity of the company’s representatives. Such working documents and correspondence do not constitute private information and belong to the company; it is the company who must consent to collection and review of the information. 15

Art. 21 of the RF Labor Code.

Kobrin

39

40

41

42

Reemers Publishing Services GmbH O:/Beck/Spehl_Gruetzner/3d/10_Russia.3d from 06.03.2013 09:30:06 3B2 9.1.580; Page size: 160.00mm  240.00mm

308 43

44

45

46

47

48

49

§ 10. Russia

However, some companies allow and the vast majority of companies tolerate, use of company equipment for personal needs; including storing personal data and personal correspondence. That is why it is necessary to obtain the written consent from the individual employees for processing and transferring abroad their personal data- especially if this data is processed on purpose. Investigators should be extremely careful when reviewing personal correspondence of the custodians. This is because Russian law provides for criminal liability specifically regarding breach of the correspondence privacy.16 In practice, if personal data and correspondence can be segregated and not reviewed during investigations, investigators can proceed without obtaining consent from the personal data owners. However, if documents containing personal data and correspondence are of interest to the investigators (as the case may be with investigations aimed at establishing personal connections and contacts), then it is necessary to secure a consent for processing personal data. It is recommended to obtain consent before the investigation begins, because at a later stage, requests for consent may appear suspicious. In any case, unauthorized personal data processing or reviewing private correspondence constitutes a violation of the law (which may bear, inter alia, criminal liability) at the time when such actions are performed. It is not clear whether subsequent authorization remedies this breach or not. Russian law is silent regarding the form in which consent for processing personal data should be obtained- bar certain occasions which are outlined as follows. A special form, “qualified” consent in writing is obtained for the processing of sensitive personal data (racial, sexual data, information about health, biometric data etc) and transfer abroad to countries that do not provide adequate protection of personal data. This said, there is not yet sufficient clarity on which countries are considered as providing adequate protection. The state authorities issued its clarifications recently17 where it explained that it is the obligation of the operator to ensure that a state provides an adequate level of protection before transferring personal data to that state. As a criterion, the operators may rely on the fact of ratification by a state of the Convention for the Protection of Individuals with regard to Automatic Processing of Personal Data dated 28 January 1981 ETS N 108.18 Finally, an individual or an entity processing personal data is required to notify the relevant authorized Federal Government body of these operations.19 However, employers are exempted from the notification requirement when processing their employees’ personal data collected for the purposes of the current employment. The notification should be sent in writing and signed by the duly authorized person (or sent electronically and signed with an electronic digital signature in accordance with the legislation of the Russian Federation). The notification shall specify the following data: 1. name (family name, first name, patronymic), address of the operator; 2. the goal of personal data processing; 16

Art. 138 of the Criminal Code. Letter of the Ministry of Telecommunications and Mass Communication No. 3@->11–250–2 dated 13 May 2009. 18 Status at http://conventions.coe.int/Treaty/Commun/ChercheSig.asp?NT=108&CM=1&DF= &CL=ENG. 19 Art. 22 of the Russian Personal Data Law. 17

Kobrin

Reemers Publishing Services GmbH O:/Beck/Spehl_Gruetzner/3d/10_Russia.3d from 06.03.2013 09:30:06 3B2 9.1.580; Page size: 160.00mm  240.00mm

B. The 25 key questions in connection with internal investigations

309

3. 4. 5. 6.

categories of personal data; categories of the subjects whose personal data are processed; legal grounds for personal data processing; a list of actions involving personal data, general description of the methods of personal data processing used by the operator; 7. description of measures that the operator undertakes to take in processing personal data to ensure the security of personal data in the processing of same; 8. date of starting the processing of personal data; 9. period or condition for termination of personal data processing. There is a recommended form of the notification and recommendations for filling 50 out such a form.20 In practice, the information to be included in the notification can be in rather general terms. aa) Employee interviews Russian employment laws do not stipulate interviews as a form of interaction 51 between employee and employer. On the contrary, under Russian law, all exchanges between the employee and employer must be properly documented. As said above, when an investigation is held in the form of a formal employer’s investigation of employees’ conduct, employees might be required to cooperate and provide their written explanations in connection with the investigated matters. If employees refuse, disciplinary sanctions can be imposed on them. Nothing in the law requires employees to participate in interviews or similar activities. In such cases, if employees refuse, disciplinary and any other sanctions cannot be imposed. A written report or summary about the interview, whether signed or not by the employee, cannot replace the written explanations by the employee as required by the law. Employee interviews are nonetheless, widely used during informal investigations 52 (as opposed to the formal employment investigations) in Russia. When interviews are held as a part of such informal investigation or by independent external investigators, an employee’s desire to cooperate is crucial. If an employee refuses to be interviewed or refuses to answer any specific questions, there is no way to exert pressure on him/ her. A report or summary of the interview, whether signed or not by the employee, cannot be a legal basis for any labor transactions; including disciplinary sanctions. There is also no formal way to punish the employee for refusing to participate in the interview, review, or sign its summary or transcript. Quite in theory, it is possible to introduce an obligation for the employees to cooperate at and consent to interview by way of internal policy, but, in our view, a disciplinary sanction imposed on such basis would hardly withstand the scrutiny of the court if the employee challenges the sanction. Former employees, agents and counterparties can be interviewed provided they 53 are willing to cooperate and share information. bb) Email screening Assuming that at all the correspondence in an employee’s is not personal; 54 reviewing such should not violate the law. 20

Order of the Federal Service for Supervision in the Sphere of Telecommunication and LargeScale Communications No. 482 of July 16, 2010.

Kobrin

Reemers Publishing Services GmbH O:/Beck/Spehl_Gruetzner/3d/10_Russia.3d from 06.03.2013 09:30:06 3B2 9.1.580; Page size: 160.00mm  240.00mm

310 55

56

57

58

59

§ 10. Russia

However, as mentioned above, employees often also use their corporate workstations for personal needs, including personal correspondence. In many cases this is tolerated by the employers. Of course, using email for private correspondence can be treated (and punished) as a breach of an employee’s obligations. This is however, overweighed by the possibility of criminal liability for those who review the employee’s private correspondence. The Russian Constitution21 stipulates the privacy of correspondence and such a privacy right can be limited only by a court order. Email correspondence falls under such special protection. Violation of this rule may be treated as a criminal offence.22 We should admit that in practice this offence is very rarely incriminated. We are aware of only a very limited number of criminal investigations in this regard and all of them were related to the violation of correspondence privacy of high-level state officials. However, in order to avoid any risk of unauthorized access to private correspondence that may accidentally be received by employees in their business mailboxes, we recommend obtaining their consent. It is preferable to have written consent (for instance, having the employee sign the order to support the investigation and providing the employer with full access to mail, file, folders, removable media, granting passwords to encrypted files and partitions, etc). It is also possible to obtain consent orally, but in this situation it is recommended to have a witness which can testify that the consent was granted. If obtaining consent is not possible (e.g., refused by the employee), private correspondence should be at the very least segregated and not reviewed. cc) Handover, review and processing of files, letters and documents of employees

The employer has unrestricted access to files, letters and documents of its employees. Upon request, the employee must hand them over to the employer. The employee who has compiled or maintains the files may not refuse inspection or destroy the files (provided the document retention policy has been timely announced to the employee). 61 In addition to electronic correspondence, private correspondences in hard copies also require special treatment. It is recommended to segregate and not review them. The employee might be asked to segregate the personal documents that he or she would not allow for review in the presence of investigators. If this option is not available, the personal correspondence and other documents can be segregated during review and their content should not be analyzed. 60

dd) Handover and mirroring of the computer and subsequent processing of the business-related data and electronically stored business-related documents of employees (other than emails) 62

The employer or – upon its instruction – private investigators, may request the employee to handover company-owned computers used for business purposes in order to carry out a mirroring, i. e. copying the data stored on the computer to 21 Art. 23.2 of the RF Constitution mentions privacy of correspondence, telephone conversations, mail, telegraph and other messages. 22 Art. 138 of the RF Criminal Code

Kobrin

Reemers Publishing Services GmbH O:/Beck/Spehl_Gruetzner/3d/10_Russia.3d from 06.03.2013 09:30:06 3B2 9.1.580; Page size: 160.00mm  240.00mm

B. The 25 key questions in connection with internal investigations

311

another storage medium. The investigators may – without the employee’s knowledge – access company-owned computers, inspect and process business-related data and electronic documents stored on the computers. Restrictions pertinent to personal data apply. The review of password-protected workstations should not raise any special 63 problems if the workstations are the company’s property and are intended for the purpose of employment duties fulfillment. In this case, passwords should protect the employer’s data, to which the employer has a right. This therefore submits that the employer’s review of the workstations would not constitute an illegal access to somebody else’s data. It is not unreasonable to have the option of reseting the password by administration. Personal workstations (e.g. personal laptops left in the office) are not the 64 employer’s property and employers do not have a right to access them without the owner’s consent. ee) Video surveillance of employees Use of video monitoring of the office premises may be permitted in certain cases, 65 if stipulated by internal regulations – signed by the employees – and justified by production/working necessity. In other words, there should be a strong incentive to install cameras for reasons other than just keeping an eye on employees. For instance, cameras can be installed in shops and banks and other public spaces for security reasons. It is very difficult to justify cameras being installed in a particular employer’s office. Covert surveillance is not permitted. Existing court practice also does not admit such recording as evidence in order to prove a disciplinary breach by an employee made in the office/working environment because the employer was not entitled by law to use such special technical means for the secret monitoring of employees. ff) Tapping of telephone conversations The tapping of employee’s telephone conversations is a drastic interference with employee rights, similar to the review of personal correspondence. This type of privacy is also specifically mentioned in the Russian Constitution. In principle, the monitoring of “outer factors” (collecting and checking date, time and costs) does not require a separate consent, because the employer, as the owner of the equipment and party to the telecommunication services agreement is legally entitled to receive such information. Monitoring the content of the telephone conversations is admissible with employees’ consent. Neither internal nor external investigators may monitor the content of a telephone conversation without the participants’ knowledge, as this would constitute a criminal offence. Listening in on a telephone conversation or recording it with the consent of a participant does not constitute a criminal offence because the law23 criminalizes violation telephone conversation privacy and correspondence in the absence of consent from the affected individuals. If an individual consents, there is no breach of privacy. 23

Art. 138 of the RF Criminal Code.

Kobrin

66

67

68

69

Reemers Publishing Services GmbH O:/Beck/Spehl_Gruetzner/3d/10_Russia.3d from 06.03.2013 09:30:07 3B2 9.1.580; Page size: 160.00mm  240.00mm

312

§ 10. Russia

gg) Search of the workplace On the basis of the obligation of an employee to use the employer’s premises for the purpose of employment,24 the employer may grant internal and external investigators permission to inspect the employees’ offices irrespective of their knowledge and consent. The investigators may in any case open and inspect cabinets as well as search an employee’s desk. Nothing prohibits the investigators from making photos and copies of documents. Confidentiality of personal data and correspondence remains to be complied with. 71 It is prohibited to search private items of an employee (hand bags, coat pockets, etc) without their permission. 70

hh) Covert listening in on conversations (other than telephone conversations) on the business premises 72

Covert audio recordings of, or listening in on the spoken word on the company’s business premises is not allowed. This is a clear example of the operation-search measures allowed to state investigators only. However, there is nothing preventing the listening in or recording of conversations with the knowledge of a participant. ii) Investigations carried out in the surroundings of employees under suspicion

73

Although the law does not restrict investigators’ rights to review information about employees’ professional activities in their employment capacity, it must be born in mind that collection of personal data constitutes processing within the definition of the RF Personal Data Law and can only be done if consent is granted.25 An employer is prohibited by law26 to collect personal data about the employee, even for the purpose of employment, from any third persons other than after giving prior notice to the employee and if the employee’s written consent for the same has been obtained. Therefore, if the information sought from the surroundings can fall under the personal data categories, it is not legal to process such data without the employee’s knowledge or consent. jj) Amnesty programs

Russian law does not deal with any internal amnesty programs. However, there is no prohibition for a company to establish such programs, provided they relate to the application of employment disciplinary measures only (i. e. to the sanctions the employer is competent to apply). 75 As for criminal matters, if a person commits corruption offences (such as bribes) and assists to investigate them in the course of official criminal case, such an individual can be released from liability for participating in the crime.27 This rule however, works vis-a`-vis the person and the law-enforcement agency only, not within a company. 74

24

Art. 21 of the RF Labor Code Arts. 3, 6.1 of the RF Personal Data Law. 26 Art. 86.3 of the RF Labor Code. 27 Art. 75 of the RF Criminal Code. 25

Kobrin

Reemers Publishing Services GmbH O:/Beck/Spehl_Gruetzner/3d/10_Russia.3d from 06.03.2013 09:30:07 3B2 9.1.580; Page size: 160.00mm  240.00mm

B. The 25 key questions in connection with internal investigations

313

Naturally, no actions by the company management who have received informa- 76 tion about a crime and applied internal amnesty rules should be such as to conceal crimes. As said, criminal liability is possible for assisting to and concealment of the crimes.28 kk) Whistle-blowing programs Russian law does not prohibit companies from introducing any whistle-blowing 77 programs, such as helpdesks and green lines where the employees can submit information about alleged non-compliance. Again, only personal data processing can be an issue here. 2. Works council and trade unions involvement in internal investigations Work councils, which are regulated in many countries of the EU, do not exist in Russia. Russian law nevertheless, permits employees and employers to interact in many forms of the so called social partnership and where it is agreed between them, allows for the creation of various representation bodies, including those for negotiating and dispute resolution. Trade unions are stipulated by Russian law and can be organized at different levels.29 However nothing in the laws suggests that trade unions must be involved in any compliance procedures. In certain cases (for instance, when the employer wishes to unilaterally terminate employment or carry out a labor law transaction with a trade union member or another employee that has authorized the trade union to represent his or her interests), the motivated opinion must be sought from the trade union prior to the labor law transaction. If however collective or other agreements30 between the employer and employees provide for involvement of trade unions into the compliance procedures, then it should be necessary to accomplish the provisions of the agreement. Russian law also provides for other forms of social partnership between employer and employees which could be invoked if provided under collective or other agreements31 between the employer and employees. Most frequently it includes commissions for labor disputes resolution. Whether or not such social partnership representatives should be involved in compliance investigations depends on the collective and individual agreements between employer and employee. However, absent a specific stipulation to this effect in the agreements, no representative of the employees or employers has to be involved. It is worth mentioning here that at any point in time when employees feel that their rights in connection with the employment have been breached, they may complain to the territorial departments of the competent state authority for supervision in the sphere of compliance with the labor laws, referred to as Labor Inspections.32 Inspectors will then have to investigate the matter. This does not 28

Art. 316 of the RF Criminal Code. Chapters 4, 58 of the RF Labor Code; Federal law No. 10-FZ dated 12 January 1996 “On trade unions, their rights and guarantees”. 30 Chapter 7 of the RF Labor Code. 31 Chapter 7 of the RF Labour Code. 32 Chapter 57 of the RF Labour Code. 29

Kobrin

78

79

80

81

Reemers Publishing Services GmbH O:/Beck/Spehl_Gruetzner/3d/10_Russia.3d from 06.03.2013 09:30:07 3B2 9.1.580; Page size: 160.00mm  240.00mm

314

§ 10. Russia

directly entail involvement of the state labor inspectors in compliance investigation, but it may cause inspectors to request information, clarifications and documents related to it.

III. Employee interviews 1. May an employee refuse to provide information if this information would incriminate himself/herself? It is a basic constitutional right that a person can refuse to provide information which would incriminate him/her.33 A person can refuse to provide such information even to state law-enforcement agencies. 83 As a matter of fact, this does not hinder the labor-law obligation of the employee to provide information related to his/her working duties to the employer. However, in this case there is no way to sanction the employee who refuses to provide information that could potentially incriminate the employee. 82

a) Duty to provide information on the tasks directly assigned to the employee or carried out by the employee If the employer requests information on matters concerning the personal scope of work, in particular the personal activities conducted at the workplace and the corresponding work results of the employee, the employee must provide this information, as this is a part of the employment duty to comply with internal disciplinary rules.34 Compliance with internal rules and regulations of the labor discipline are among the basic obligations of the employees.35 The breach of these obligations is legal ground for sanctions (disciplinary measures). 85 If criminal proceedings are taking place at the same time as the internal investigations, this does not affect the employer’s request for information. 84

b) Duty to provide information in indirect connection with the scope of work 86

The obligation of employees to provide information in indirect connection with their employment, although not regulated by the laws, could be only stipulated under the collective or individual agreements between employer and employees or other internal regulations (e.g. employment agreement, job duties description, special regulatory acts of employer, etc.). It is recommended to analyze such documents on a case by case basis. c) Duty to provide information outside the scope of work

87

Generally, the employee is not obliged to answer questions regarding the employee’s conduct outside the scope of work, even in the course of a formal employer’s procedure of disciplinary investigation. However, such an obligation could be specified under collective or individual agreements between the employer and the 33

Art. 51 of the RF Constitution. Chapters 29–30 of the RF Labor Code. 35 Art. 21 of the RF Labor Code. 34

Kobrin

Reemers Publishing Services GmbH O:/Beck/Spehl_Gruetzner/3d/10_Russia.3d from 06.03.2013 09:30:08 3B2 9.1.580; Page size: 160.00mm  240.00mm

B. The 25 key questions in connection with internal investigations

315

employee or other internal regulations. It is recommended to analyze such agreements on a case by case basis. 2. Is an employee obliged to provide information on any misconduct of or criminal offence committed by other employees? No such obligation is stipulated under the Russian labour laws. Theoretically 88 however, it is possible to claim that the obligation to prevent damage to the employer exists as a part of the due care for employer’s assets.36 In practice however, it would be difficult to link it with the obligation to whistle blowing. 3. May an employee refuse to answer a question if he/she has already answered it within the scope of a previous interview? In fact Russian law does not regulate the interviews of employees. Consent of the 89 employee is crucial for the first and any subsequent interview. 4. Is an employee entitled to the presence of a member of the works council or an attorney during the interview? a) The employee’s right to the presence of a member of the works council There are no works councils in Russian law. Under Russian law, the employees 90 may only have a right to involve any representative of the trade unions and other social partnership organizations in investigations and only if such a right is stipulated under agreements with the employer. b) The employee’s right to the presence of a lawyer representing the employee’s rights Under Russian law, employees may only have a right to involve a lawyer in the 91 investigation based on agreements with the employer. Otherwise, the presence of a lawyer engaged by the employees is only possible if the employer consents to their admittance on the premises (e.g., if the employees suggest it as a condition of their consent to being interviewed by the investigators). 5. Is an employee entitled to read the record of his/her interview? Russian law only stipulates the employee’s obligation to submit written clarifica- 92 tions. As interviews are a part of the informal procedures, it is up to the interviewers whether or not to disclose their notes to the employees or ask them for a signature. The employees may refuse to sign any documents compiled by the investigators; no sanctions for that can follow.

36

Art. 21 of the RF Labor Code.

Kobrin

Reemers Publishing Services GmbH O:/Beck/Spehl_Gruetzner/3d/10_Russia.3d from 06.03.2013 09:30:08 3B2 9.1.580; Page size: 160.00mm  240.00mm

§ 10. Russia

316

6. Can the employer instruct an employee to treat the content of his/her interview as confidential? 93

Such a request would not contradict any laws per se. It is possible to issue an internal order or regulation obliging the employees to keep the matter of the investigation confidential vis-a`-vis other employees and third persons (excluding those who, by virtue of the law are entitled to receive such information). In theory, it is possible to treat this request as a binding internal disciplinary regulation and even sanction the employees for non-compliance with the employee’s obligations.37 The chances are slim however, that such sanctions would withstand scrutiny if challenged in court.

IV. Sanctions imposed on employees 1. What are the sanctions under employment law that can be imposed on employees refusing to cooperate in internal investigations? Russian law stipulates the following employment law (disciplinary) sanctions: 1. warning; 2. reprimand; 3. termination of employment based on the relevant grounds. 94 Other disciplinary measures can be stipulated by federal laws and governmental regulatory acts; there are only a very limited number of them (e.g. ‘warning about lack of qualification to the position’ provided by several laws and some labour regulations38). 95 It is impossible to expand the list of sanctions by any internal company’s regulatory documents. 96 It is necessary to distinguish between employment sanctions and employee stimulating measures.39 The latter could be regulated by internal documents (e.g. bonus systems, benefits and privileges offered by the employer, preferred vacations dates), and such documents could prescribe grounds and procedures for expropriation of such benefits from the non-complying employees. a) Reduction of the remuneration 97

It is impossible to reduce the remuneration of an employee as a sanction for an employment disciplinary breach without the employee’s consent. It is impossible to change terms and conditions of the employment agreement, including the remuneration, unless stipulated in an agreement between employer and employee or when so provided by law.40 The laws do not provide for the employer’s right to unilaterally reduce the remuneration.

37

Art. 21 of the RF Labor Code. E.g. Federal Law No. 114-FZ dated 21 July 1997 “On Customs Service in the Russian Federation”; Disciplinary Statute of the Customs Service of the Russian Federation, approved by President Decree No. 1396 dated 16 November 1998. 39 Art. 191, 192 of the RF Labor Code. 40 Art. 72 of the RF Labor Code. 38

Kobrin

Reemers Publishing Services GmbH O:/Beck/Spehl_Gruetzner/3d/10_Russia.3d from 06.03.2013 09:30:08 3B2 9.1.580; Page size: 160.00mm  240.00mm

B. The 25 key questions in connection with internal investigations

317

b) Warning, reprimand and termination Only one disciplinary sanction may be applied for each disciplinary breach. An ordinary measure for a disciplinary breach would be a warning or reprimand. Termination is only possible for breaches specified by law. The grounds relevant to compliance only are analyzed here. Those include numerous failures by employees to fulfill labor duties without justifiable reasons (if he/she has been reprimanded before)41 in other words, repeated warnings and reprimands may serve as a “numerous failures” ground for termination. We note here that in order to withstand court scrutiny in this case, if the termination is challenged in court, it should be on the grounds of more serious breaches than those that could be viewed by the court as formalities or minor breaches. This is based on the rule that when imposing a disciplinary sanction the employer must take into account the gravity of the breach and the circumstances in which it took place.42 In limited cases a single severe violation by the employee of his labor duties can result in termination of the employment. The grounds relevant to compliance include: d) committing pilferage at the place of work (including petty pilferage) of others’ property, embezzlement, willful destruction or damage to property as determined by a court ruling that has entered into legal force or the decision of a judge, body, or an official empowered to hear administrative offences cases.43 An employee directly handling money or valuables can be fired for committing culpable actions, if these actions provide grounds to lose confidence on the part of the employer.44 The manager of the organization (branch, representation office), his deputies, and the chief accountant can be fired for adoption of an unjustifiable decision that resulted in damage to the company’s property, its illegal use, or other damage to the property of the organization.45 The manager and his deputies can also lose their job for a single severe violation of their labor duties.46

98 99

100

101

102

103

2. Is the suspicion of a criminal offence or of a severe violation of duty sufficient for an extraordinary termination? A mere suspicion of a criminal offence or a severe violation sufficient for 104 termination does not give grounds for extraordinary termination. Only a proved fact of the offence or violation would create a ground for the termination of the employment as per Art. 81 of the RF Labor Code. Termination for a criminal offence is only possible after it is confirmed by the 105 governmental law-enforcement agencies, e.g. in case of the conviction judgment or case termination for non-rehabilitating reasons. An employer suspecting his em-

41

Art. 81.5 of the RF Labor Code. Art. 192 of the RF Labor Code. 43 Art. 81.6(d) of the RF Labor Code. 44 Art. 81.7 of the RF Labor Code. 45 Art. 81.9 of the RF Labor Code. 46 Art. 81.10 of the RF Labor Code. 42

Kobrin

Reemers Publishing Services GmbH O:/Beck/Spehl_Gruetzner/3d/10_Russia.3d from 06.03.2013 09:30:09 3B2 9.1.580; Page size: 160.00mm  240.00mm

§ 10. Russia

318

ployee of a criminal offence can be recommended therefore to seek investigation into the matter by governmental law-enforcement agencies. 3. During which period of time must an extraordinary notice of termination be given to employees whose misconduct has been revealed by the internal investigations? As a general rule, a disciplinary sanction can be applied no later than one month after the day of the discovery of a misdeed; not counting the period of an employee’s illness and vacation. The sanctions may not be applied later than six months after the day of the commission of a breach and, if based on the results of an inspection and examination of financial and economic activity or an audit (which is a likely case with internal investigations) later than two years after the day of its commission. These time periods shall not include a period of proceedings involving a criminal case.47 107 Before applying the sanction, written explanations should be sought from the employee as described above. The employee has 2 days to submit the explanations to the employer. 106

4. Must an employee cooperate in internal investigations even after he/she has been given notice of termination? 108

After employment has been terminated, there is no employment relationship between an employer and employee. Only contractual civil-law obligations stipulated by agreements between the employer and employee can remain in force (such as for instance confidentiality duties). Thus, a former employee’s will to cooperate will be decisive with respect to any further involvement in investigation by the employee.

V. Use of the obtained information 1. Is it permissible to disclose the findings and information obtained within the scope of any internal investigations to other group companies? a) If the company employing the employee under investigation intends to disclose personal data to another group company, such as to the domestic or foreign parent company, the same statutory provisions shall apply as in the case of any disclosure to a third party. This means that when it comes to data protection, the company may only forward the employee’s personal data if there is a legal basis for doing so or if the affected employee explicitly gives his/her consent.48 b) If the company wishes to disclose employee personal data to foreign group companies, it must observe further requirements. The data protection law provides for different procedures depending on the country of destination as outlined in supra paras. 39 et seqq.

47 48

Art. 193 of the RF Labor Code. Art. 6 of the RF Personal Data Law.

Kobrin

Reemers Publishing Services GmbH O:/Beck/Spehl_Gruetzner/3d/10_Russia.3d from 06.03.2013 09:30:09 3B2 9.1.580; Page size: 160.00mm  240.00mm

B. The 25 key questions in connection with internal investigations

319

2. Is it permissible and advisable to forward the findings and information obtained within the scope of any internal investigations to public authorities? a) Admissibility of disclosure of personal data aa) Disclosure of personal data to the public authorities acting within their competence is not restricted by law and does not require any consent. If a public authority, such as the public prosecutor’s office, requests the disclosure of data based on its legal power, the company is permitted and even obliged to disclose data available to it. Processing of such personal data shall be in compliance with and as per the procedures stipulated by the federal laws of the Russian Federation.49 It follows from this provision that only Russian authorities may be authorized by law to demand the disclosure of personal data. bb) If no legal obligation to transfer personal data to public authorities arises under federal laws, the disclosure of personal data to public authorities is permissible provided consent has been obtained. cc) It is not permitted in absence of a qualified written consent from the data subject to transfer the personal data of an employee to a third country which does not dispose of an adequate level of data protection.50 b) Is it advisable to voluntarily disclose data to public authorities? If the internal investigations have revealed any violations of the law, it may be in 109 the company’s interest to inform public investigative authorities of these violations. For instance, if the company wants to fire an employee for committing a crime, it is only possible to do so after the criminal investigation is carried out since an employer’s suspicion of crimes does not suffice. 3. Are the findings made in the scope of internal investigations subject to the attorney-client privilege? a) No attorney-client privilege for in-house counsel involved in the investigations In-house counsels conducting internal investigations are not entitled to refuse to 110 give evidence in civil or criminal proceedings. Documents held in custody of an inhouse counsel are not subject to any prohibition of seizure. b) Privileges in the case that external investigators are involved As mentioned in supra paras. 14 et seqq., only registered attorneys (advocates) 111 are covered by non-disclosure and non-attachment privileges. Other external attorneys and auditors, including foreign attorneys involved in carrying out internal investigations, are not entitled to refuse to give evidence in civil and criminal proceedings.

49 50

Art. 6.1.2 of the RF Personal Data Law. Art. 12 of the RF Personal Data Law.

Kobrin

Reemers Publishing Services GmbH O:/Beck/Spehl_Gruetzner/3d/10_Russia.3d from 06.03.2013 09:30:09 3B2 9.1.580; Page size: 160.00mm  240.00mm

320

§ 10. Russia

VI. Following-up on internal investigations 1. What is to be observed during the follow-up of internal investigations? 112

Russian law does not deal with any measures that could be introduced by the company as a follow-up to a compliance investigation. In addition, no liability exists for failing to take any preventive measures or improvement of internal policies. 2. May an employer pay its employee’s legal fees if he/she is being prosecuted under criminal law?

113

The employer may by way of an agreement with the employee(s), commit itself vis-a`-vis its employee(s) to pay the fees incurred in litigation or any other expenses. Such payments shall be considered as income earned by the employee, subject to income tax. There is no statutory duty to cover such expenses.

C. Summary of key results 114 I.

II.

III.

IV.

V.

Under Russian law there is no obligation of companies to internally investigate potential crimes within their offices. Russian law is still not very detailed on the matters pertaining to internal compliance investigations. However, there is nothing preventing companies from running such investigations as a matter of corporate policy or international/global initiative. Having duly executed and enforced compliance policies and procedures in place can serve to minimize the risks of the company’s liability for administrative offences. The main issue arising in connection with internal investigations in Russia is treatment of personal data. Most likely investigators will have to seek employee consent in order to process their personal data. Exporting of personal data to third countries may be restricted. Russian law has a formalistic approach to the notion of legal entities; treating group companies and affiliates as separate legal entities. That is why even intragroup transfer of data can raise issues with protected data treatment. Russian labor law provides very limited regulation of internal investigations. However, a formal employment investigation may be recommended where it is necessary to issue binding instruction to the employees who are not willing to cooperate in the framework of less formal investigation procedures. Furthermore, if the employer is focused on taking disciplinary measures upon the results of investigation, including termination of employments contracts, employment law procedure is a must. There is no legal obligation to disclose to governmental authorities the findings made in the scope of the internal compliance investigations. Where the decision on such disclosure is made by the company, no consent is needed for the transfer of protected data to the Russian government authorities; as they have a statutory right to review such data and are bound by the confidentiality obligations. It should be born in mind however, that for the purpose of transfer of protected

Kobrin

Reemers Publishing Services GmbH O:/Beck/Spehl_Gruetzner/3d/10_Russia.3d from 06.03.2013 09:30:09 3B2 9.1.580; Page size: 160.00mm  240.00mm

D. Table of Bibliography

321

data to foreign governmental authorities, companies are not exempt from obtaining relevant consent required under Russian law.

D. Table of Bibliography 1. Customs Union Committee Ruling dated 1 December 2009 “On the procedure 115 for import to the customs territory of the Customs Union and export from the customs territory of the Customs Union of encryption tools”. 2. Constitution of the Russian Federation. 3. Code of Administrative Offences of the Russian Federation. 4. Criminal Code of the Russian Federation. 5. Labor Code of the Russian Federation. 6. Federal Law No. 144-FZ dated 12 August 1995 “On Operational Search Activities” [“Criminal Investigative Activities”], Art. 6. 7. Federal Law No. 2487-I dated 11 March 1992 “On the activities of private detectives and security guards”. 8. Federal Law No. 63-FZ dated 31 May 2002 “On Advocates’ (Attorneys-at-Law) Activities and the Bar in the Russian Federation”, Art. 8. 9. Federal Law No. 119-FZ dated 7 August 2001 “On Audit Activities”, Art. 9. 10. Federation Law No. 5485–1 of July 21, 1993 “On State Secrets”. 11. Federal law No. 10-FZ dated 12 January 1996 “On trade unions, their rights and guarantees”. 12. Federal Law No. 114-FZ dated 21 July 1997 “On Customs Service in the Russian Federation”. 13. Federal Law No. 152-FZ dated 27 July 2006 “On Personal Data”. 14. Russian Federation Presidential Decree No. 1203 dated 13 November 1995 “Approving the List of Data Classed as State Secret”. 15. Russian Federation Presidential Decree No. 1396 dated 16 November 1998 “Approving Disciplinary Statute of the Customs Service of the Russian Federation”. 16. Letter of the Ministry of Telecommunications and Mass Communication No. 3@->11–250–2 dated 13 May 2009. 17. Order of the Federal Service for Supervision in the Sphere of Telecommunication and Large-Scale Communications No. 482 of July 16, 2010.

Kobrin

Reemers Publishing Services GmbH O:/Beck/Spehl_Gruetzner/3d/10_Russia.3d from 06.03.2013 09:30:10 3B2 9.1.580; Page size: 160.00mm  240.00mm

Reemers Publishing Services GmbH O:/Beck/Spehl_Gruetzner/3d/11_Spain.3d from 06.03.2013 09:30:37 3B2 9.1.580; Page size: 160.00mm  240.00mm

§ 11. Spain Para. Initiation of internal investigations . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 1 When and to what extent should internal investigations be initiated? . . 1 Should the internal investigations be of an open or covert nature? . . . 4 Is it advisable to involve external investigators? . . . . . . . . . . . . . . . . . . . . . . . 11 Is it permitted that foreign attorneys conduct internal investigations in Spain? . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 14 V. When should national authorities be called in? . . . . . . . . . . . . . . . . . . . . . . . 15 B. Admissibility and implementation of individual measures within the scope of internal investigations . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 27 I. What measures are admissible within the scope of internal investigations? . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 27 1. Verification of the status of illness or accident of the employee . . . . 29 2. Searches of the worker’s person, lockers or personal effects . . . . . . . . 30 3. Use of video cameras . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 32 4. Use of microphones . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 37 5. Monitoring of the use of computers (including email) . . . . . . . . . . . . . 40 6. Mail . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 45 7. Telephone . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 47 8. Company car . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 52 II. Must employees’ representatives such as the works council be involved in internal investigations? . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 55 C. Employee interviews . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 58 I. May an employee refuse to provide information if this information would incriminate himself/herself? . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 60 1. Duty to provide information directly or indirectly related to the rendering of services . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 64 2. Duty to provide information outside the scope of work . . . . . . . . . . . . 67 II. Is an employee obliged to provide information on any misconduct of or criminal offence committed by other employees? . . . . . . . . . . . . . . . . . . 68 III. May an employee refuse to answer a question if he/she has already answered it within the scope of a previous interview? . . . . . . . . . . . . . . . . . 71 IV. Is an employee entitled to the presence of a member of the works council or an attorney during the interview? . . . . . . . . . . . . . . . . . . . . . . . . . . 73 1. The employee’s right to the presence of a member of the works council . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 73 2. The employee’s right to the presence of an attorney . . . . . . . . . . . . . . . . 77 V. Is an employee entitled to read the record of his/her interview? . . . . . . 78 VI. Is the employer entitled to request that the employee signs the record of the interview? . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 83 VII. Can the employer instruct an employee to treat the content of his/her interview as confidential? . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 85 D. Sanctions imposed on employees . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 86 I. What are the sanctions under employment law that can be imposed on employees refusing to cooperate in internal investigations? . . . . . . . . 86 II. Is the suspicion of a criminal offence or of a severe violation of duty sufficient for an extraordinary termination? . . . . . . . . . . . . . . . . . . . . . . . . . . . 92 III. During which period of time must an extraordinary notice of termination be given to employees whose misconduct has been revealed by the internal investigations? . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 98 IV. Must an employee cooperate in internal investigations even after he/ she has been given notice of termination? . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 102 A. I. II. III. IV.

Diaz/Heckh/Masso´

Reemers Publishing Services GmbH O:/Beck/Spehl_Gruetzner/3d/11_Spain.3d from 06.03.2013 09:30:38 3B2 9.1.580; Page size: 160.00mm  240.00mm

324

§ 11. Spain Para. E. Use of the obtained information . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 104 I. Is it permissible to disclose the findings and information obtained within the scope of any internal investigations to other group companies? . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 104 II. Is it permissible and advisable to forward the findings and information obtained within the scope of any internal investigations to public authorities? . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 110 III. Are the findings made in the scope of internal investigations subject to the attorney-client privilege? . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 114 IV. Does the attorney-client privilege also apply to foreign attorneys? . . . . 129 F. Following-up on internal investigations . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 132 I. What is to be observed during the follow-up of internal investigations? . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 132 II. May an employer pay its employee’s legal fees if he/she is being prosecuted under criminal law? . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 134

A. Initiation of internal investigations I. When and to what extent should internal investigations be initiated? The relationship between employer and employee entails the employee’s obligation to work under the supervision of the employer (or a person appointed by the employer), under the provision of the employment contract. The employee is obliged to work in a diligent and collaborative manner as provided under the law, the Collective Labor Agreements (“CLA”), the employer’s daily orders and, if necessary, as provided by ordinary custom. Overall, the employer-employee relation must be guided by the bona fide principle.1 In accordance with this obligation, Art. 20 of the Labor Act2 establishes that “The employer may adopt the measures of supervision and control that he or she deems most fitting in order to verify compliance by the worker of his/her working obligations and duties, observing, in such adoption and application, the due consideration for his/her human dignity and bearing in mind the real capacity of handicapped workers, if applicable”. 2 Accordingly, internal investigations can only result from a suspicion of an employee’s inappropriate behavior affecting his/her work. In such cases, the employer can adopt the measures of control to verify the worker’s compliance. Consequently, these investigations must be in the legitimate interest of the company and must be proportional to this interest and the employee’s right to privacy.3 3 Moreover, CLAs may regulate additional aspects regarding how internal investigations should be conducted. It is important to review if the applicable CLA establishes any formal requirements before initiating an internal investigation. 1

1

See Art. 5 of the Labor Act. Royal Legislative Decree 1/1995 of March 24. 3 Rodrı´guez Cardo, Poder de direccio ´ n empresarial y esfera personal del trabajador, chapter II, p. 40, in: Consejo Econo´mico y Social del Principado de Asturias, 2009. 2

Diaz/Heckh/Masso´

Reemers Publishing Services GmbH O:/Beck/Spehl_Gruetzner/3d/11_Spain.3d from 06.03.2013 09:30:38 3B2 9.1.580; Page size: 160.00mm  240.00mm

A. Initiation of internal investigations

325

II. Should the internal investigations be of an open or covert nature? As a general rule, investigations should be open unless their publicity affects the purpose of such measure. Fundamental rights such as the right to privacy and to freedom from injury to reputation could be affected by the measures adopted by the employer in order to control his/her employees. For this reason, employees must be aware of the measures taken by the employer in order to establish complaints if these are disproportional to the purpose of the investigation.4 Consequently, covert investigations may only take place in exceptional situations and given the following two requirements: (i) existence of a special interest of the employer that justifies the measure and, (ii) the existence of reasonable evidence of the lack of compliance of the worker’s obligations. Jurisprudence has considered these measures to be reasonable in cases where the employee is committing serious infractions such as misappropriation of business property; non-fulfillment of the work obligations outside the work center; breach of the bona fide obligation by workers in temporary disability situations, etc.5 In consequence, the nature of the investigation (whether open or covert) will finally depend on the matter of the research and the possible consequences of an open investigation on terms of its success. Moreover, the use of inadequate measures by an employer or the disclosure of unproven accusations would be contrary to the employee’s right to privacy and to freedom from injury to reputation. Such violations of fundamental rights would declare the investigations null and void the decisions taken by the employer.6 In addition, the Social Infractions and Sanctions Act establishes that the employer’s adoption of decisions that damage the employee’s dignity7 is considered as a serious infringement. Likewise, if the measures of control that violate the employee’s right to privacy consist in video or audio recording or the disclosure of the worker’s private information, the employer could be committing a crime of discovery and disclosure of secrets.8

4 5

6

7

8

9

10

III. Is it advisable to involve external investigators? According to Art. 20.1 of the Labor Act the Employer may delegate his investiga- 11 tion faculties to other people. These people can be workers of the Company or third parties as private detectives, lawyers, certified accountants, security guards, etc. Consequently, depending on the actual subject of the investigation it would be 12 advisable to involve external investigators. Although they might fall into greater expenses, such external investigators tend to be more specialized in certain areas 4

Judgment of the Constitutional Court of 10 July 2000 (Westlaw ref. RTC 2000, 186). Judgment of the Constitutional Court of 10 July 2000 (Westlaw ref. RTC 2000, 186), Judgment of the Supreme Court of 19 July 1989 (Westlaw ref. RJ 1989, 5878) and 17 June 1996 (Westlaw ref. RJ 1996, 5166). 6 See Art. 55.5 of the Labor Act. 7 See Art. 8.11 of the Labor Infringements and Sanctions Act (R.D.Leg. 5/2000 de 4 de agosto – Ley de Infracciones y Sanciones en el Orden Social –). 8 See Art. 197 of the Criminal Code (Ley Orga ´nica 10/1995, de 23 de noviembre – Co´digo Penal –). 5

Diaz/Heckh/Masso´

Reemers Publishing Services GmbH O:/Beck/Spehl_Gruetzner/3d/11_Spain.3d from 06.03.2013 09:30:38 3B2 9.1.580; Page size: 160.00mm  240.00mm

326

§ 11. Spain

than other employees of the company. Paradigmatic examples of that would be private detectives, lawyers or certified accountants. 13 Nevertheless, jurisprudence limits the employer’s faculty to delegate to places where s/he could personally control the employees’ behavior. Namely, the Madrid Superior Court has considered that introducing a private detective as an employee into the company in order to get workers’ personal information in rest areas is contrary to the bona fide principle.9

IV. Is it permitted that foreign attorneys conduct internal investigations in Spain? 14

There is no legal provision that forbids the conduction of internal investigations by foreign attorneys. Internal investigations would qualify as legal advice as opposed to legal representation before a Court which would have as a requirement the membership of the lawyer in a Spanish Bar Association.

V. When should national authorities be called in?10 15 16

17

18

19

20

21

There are two different situations in which the national authorities should be called in the internal investigation. The first situation is if the Police or a Tribunal require a company to provide some information because it is carrying out an investigation. In this sense, Art. 118 of Spanish Constitution sets an obligation of fulfillment of every judicial resolution, order or requirement and a commitment of collaboration with the Tribunals during the course of the Proceedings. Under Art. 17.1 of the Judiciary Act11 every person, public and private entity is obliged to collaborate with the Judges and Tribunals during the course of the Proceedings, with the only exceptions recognized in the Constitution and the Law. In conclusion, if a company is required to give some information to the National Authorities, under the Spanish legislation, it is obliged, by the Constitution and Law, to collaborate. Secondly, a company could have notice of the commission of a criminal offence and, in this context, under Spanish Criminal Procedure Act there is a general obligation to report facts that could constitute a crime, however this obligation does not involve proving the facts reported. In this sense, Art. 25912 of the mentioned Act establishes that everyone who has witnessed the commitment of a public criminal offence is obliged to communicate it to the nearest public authority. Additionally, Art. 262 of the Spanish Criminal Procedure Act states that everyone who because of his/her position, profession or job has known about the commission 9

Madrid Superior Court Judgment of 20 December 2006 (Appeal no. 3688/2006). For data protection implications, please see response to question E. II. 11 Organic Law 6/1985, of 1 July. 12 A public criminal offence is any kind of offence in which the Public Prosecutor can file a complaint, initiating the legal procedure, without the knowledge or the initial complaint of the injured party. 10

Diaz/Heckh/Masso´

Reemers Publishing Services GmbH O:/Beck/Spehl_Gruetzner/3d/11_Spain.3d from 06.03.2013 09:30:38 3B2 9.1.580; Page size: 160.00mm  240.00mm

B. Admissibility and implementation of individual measures

327

of a public criminal offence is obliged to lodge a complaint with the police, the Public Prosecutor or the nearest Examining Magistrate’s Court. In both cases, the failure to comply with this general obligation is punished with a fine from 25 to 250 pesetas (from 0,15 to 1,50 E). Of course, this general obligation has some exceptions, as it does not apply for lawyers, trial attorneys, priests under secret confession, minors and mentally disabled people, amongst other. Nevertheless, it is important to highlight that this general obligation envisaged in the law, is not widely used in practice, as Judges and Courts are not used to punish people who do not report allegedly criminal facts. Only when silence converts the person in an accessory of the offence, criminal liability could arise, but it does not arise only with regards to the general obligation to accuse. Finally, under Art. 450 of the Spanish Criminal Code (i. e. offence of omission of the duties to prevent felonies or to promote their persecution) we can find two other cases in which a person that is aware of the possible commission of a criminal offence should intervene, which could be considered another type of the general obligation to report: 1. Where a person being able to directly intervene and without risk to himself or others, fails to prevent the committing of an offence endangering the life, safety or health, freedom or sexual freedom of another person, s/he shall be punished by a term of imprisonment ranging from six months to two years, should the offence endanger life, and a fine payable for six to twenty four months in all other cases, except when the unprevented offence is punishable by an equal or lesser punishment. 2. The same punishment shall apply to a person who, being able to do so, fails to notify the authorities or its officers in order to prevent the committing of an offence referred to in the previous section, when such person is aware that such offence is being committed or is to be committed in the future.

22 23

24

25

26

B. Admissibility and implementation of individual measures within the scope of internal investigations I. What measures are admissible within the scope of internal investigations? Measures of control are, in principle, legal. They can be declared unlawful when 27 analyzing them in relation to a particular case. Measures of control taken by the employer may never violate fundamental rights and have to be suitable and proportional for the particular case and objective. If the control can be done through less aggressive measures the application of the proportionality principle will lead to the implementation of the latter.13

13

Judgment of the Constitutional Court of 10 April 2000 (Westlaw ref. RTC 2000, 98), 10 July 2000 (RTC 2000, 186).

Diaz/Heckh/Masso´

Reemers Publishing Services GmbH O:/Beck/Spehl_Gruetzner/3d/11_Spain.3d from 06.03.2013 09:30:39 3B2 9.1.580; Page size: 160.00mm  240.00mm

328 28

§ 11. Spain

Control measures accepted by Law and Jurisprudence are the following: 1. Verification of the status of illness or accident of the employee

29

According to Art. 20 of the Labor Act: “The employer may verify the status of illness or accident alleged by the worker to justify his/her absences from work through check-ups by medical personnel. The worker’s refusal to undergo such check-ups may determine the suspension of any economic rights as may exist to be borne by the employer in the said circumstances”. 2. Searches of the worker’s person, lockers or personal effects

According to Art. 18 of the Labor Act: “Searches of the worker’s person, in his lockers and personal effects, where necessary to protect the assets of the company and of the other workers in the firm, may only be made inside the work centre and during working hours”. 31 In consequence, searches that are not necessary and do not comply with the aforementioned Art. will be prohibited.14 30

3. Use of video cameras There is no legal provision that specifies the procedure to install video cameras in the workplace. Thus, judges will be in charge to determine the legality of such measures from case to case.15 33 Video cameras can only be installed in work places taking into consideration the employees’ right to privacy. Namely, video cameras may not be installed in places such as toilets, changing rooms, rest areas or workers’ representatives’ rooms.16 34 In most cases, the use of video cameras is justified by the suspicion of breach of contract by the employee. The recording of videos in order to prove the incorrect behavior of the employee has been accepted by the Constitutional Court as a measure proportional to the purpose of the investigation and, thus, respectful with the employee’s right to privacy.17 35 In conclusion, the use of video cameras will be legal depending on the following factors: (i) the place where they are installed; (ii) if the installation is done in a massive and indiscriminate way; (iii) if the cameras are visible or of general public knowledge, or have been installed in a covert manner; (iv) the purpose of the installation; (v) if there are security reasons; (vi) if they are justified by the business activity of the Company; (vii) the impossibility to broadcast the videos, etc.18 32

14 Molero Manglano, Inviolabilidad de la persona del trabajador (art. 18), in: Civitas Revista ~ola de Derecho del Trabajo, number 100/1, pp. 543–554 (2000). espan 15 Judgment of the Constitutional Court of 10 April 2000 (Westlaw ref. RTC 2000, 98). 16 Judgment of the Galicia Superior Court of Justice of 21 April 1995 (Westlaw ref. AS 1995, 1514); Judgment of the Andalusia Superior Court of Justice of 17 January 1994 (Westlaw ref. AS 1994, 310); Judgment of the Madrid Superior Court of Justice of 12 April 1992 (Westlaw ref. AS 1992, 1611); Judgment of the Valladolid Supreme Court of Justice of 18 September 2006 (AS 2006, 2995). 17 Judgment of the Constitutional Court of 10 July 2000 (Westlaw ref. RTC 2000, 186); Judgment of the Basque Country Superior Court of Justice of 25 April 2006 (Westlaw ref. JUR 2006, 188532). 18 Judgment of the Constitutional Court of 10 April 2000 (Westlaw ref. RTC 2000, 98).

Diaz/Heckh/Masso´

Reemers Publishing Services GmbH O:/Beck/Spehl_Gruetzner/3d/11_Spain.3d from 06.03.2013 09:30:39 3B2 9.1.580; Page size: 160.00mm  240.00mm

B. Admissibility and implementation of individual measures

329

From a pure data protection perspective, Instruction 1/2006 on CCTV issued by 36 the Spanish Data Protection Agency19 foresees that data subjects (i. e. employees) are to be clearly informed on the processing of personal data related to them through CCTV mechanisms. In this sense, if the employer intends to install video cameras in the workplace not only for security purposes, but also to control compliance of employees with their duties, employees shall be expressly informed thereof. 4. Use of microphones The work center is not, in principle, a space where employees exercise their right 37 to privacy. In this way, the installation of microphones is accepted in certain conditions: if the measure adds security to the business activity of the company, the workers know the existence of such microphones (i. e. the works council is informed of the measure before the installation), the devices are visible and their installation is limited to certain parts of the work centre, as opposed to a general arbitrary installation all over the company.20 Nevertheless, the installation of microphones in the work place that record 38 continuously any conversation in an indiscriminate way has been declared unlawful and contrary to the workers’ right to privacy.21 Moreover, the Civil Protection of the Right to Personal and Family Privacy, to 39 Honor and to Freedom from Injury to Reputation Act establishes that any measure taken to record or listen to a person’s private matters or any other measure such as the analysis of private letters will be an unlawful interference.22 The aforementioned also applies to the use of video cameras and the listening to telephone conversations. 5. Monitoring of the use of computers (including email) There is no law that specifies the procedure for searches in computers. Compu- 40 ters had been considered a private property of the employee by jurisprudence such as the ones described under Art. 18 of the Labor Act. Nevertheless, in a recent judgment, the Supreme Court has declared that searches in computers are a manifestation of the employer’s directive power and that they do not need to follow any specific procedure. The Court argues that the computer is an asset of the Company given to the employee for professional purposes. Notwithstanding the aforementioned, the Court specifies that only in cases where 41 the employer has given notice to the employee of the possibility to control the computers and that s/he has specified that the computers are bound for professional purposes there will not be a breach of the employee’s right to privacy.23 19 Instruction 1/2006, of 8 November, of the Spanish Data Protection Agency on the processing of data through CCTV schemes. 20 Judgment of the Galicia Superior Court of Justice of 25 January 1996 (Westlaw ref. AS 1996, 12). 21 Judgment of the Constitutional Court of 10 April 2000 (Westlaw ref. RTC 2000, 98). 22 See Art. 7 of the Civil Protection of the Right to Personal and Family Privacy, to Honor and to Freedom from Injury to reputation Act (Ley Orga´nica 1/1982, de 5 de mayo – Proteccio´n Civil del Derecho al Honor, a la Intimidad Personal y Familiar y a la Propia Imagen –). 23 Judgment of the Supreme Court of 26 September 2007 (Westlaw ref. RJ 2007, 7514) and Grau Pineda, La transgresio´n de la buena fe contractual en el uso personal del ordenador de empresa: la legitimidad del control empresarial, pp. 3–4.

Diaz/Heckh/Masso´

Reemers Publishing Services GmbH O:/Beck/Spehl_Gruetzner/3d/11_Spain.3d from 06.03.2013 09:30:39 3B2 9.1.580; Page size: 160.00mm  240.00mm

330

§ 11. Spain

On the other hand, once the Company has proved the incorrect use of the computer, further searches in the specific content of this use would breach the worker’s right to privacy as described by the proportionality principle set forth by the Constitutional jurisprudence. 43 Furthermore, emails will be also protected by the Communications Secrecy right. 44 In conclusion, Employers will only be able to control computers and emails when there is a reasonable suspicion that Employees are using them incorrectly and there is no other mean to prove this fact.24 42

6. Mail The control of the employees’ mail can not only be contrary to the right to privacy, it can also be against another fundamental right: Communication Secrecy. Nevertheless, under certain circumstances the inspection of mail by the employer could be legal if respectful with the proportionality principle and the right to privacy of the employee.25 46 In this way, mail has been considered a private property of the employee such as the ones described under Art. 18 of the Labor Act. Consequently, the procedure to examine such mail will be the one described under this article.26 45

7. Telephone Control of telephone conversations can also be contrary to the Communication Secrecy right of the employees. Jurisprudence has declared that even when the screening of conversations is permitted by the work contract, a permanent recording of the telephone conversations is completely out of proportion with respect to the employee’s right to privacy.27 48 The control of telephone conversations will depend on several factors: the possibility given by the employer to the employee to use the telephone for personal reasons, the sanction imposed by the CLA for the incorrect use of the telephone – although the majority of CLAs classify it as a very serious infraction–, etc. 49 In general, Courts are tolerant with the use of the telephone for personal purposes if moderate. When the Company does not have a phone policy, judges tend to determine terminations as unfair, as opposed to companies that do have these kinds of policies. Furthermore, lack of sanction by the employer will determine the tolerance of this attitude and turn a future termination for this reason, unfair.28 50 In this regard, the Constitutional Court has admitted the possibility to record conversations when the recorder is one of the speakers as the Communications Secrecy right can only be opposed to third parties.29 47

24 Grau Pineda, La transgresio ´ n de la buena fe contractual en el uso personal del ordenador de empresa: la legitimidad del control empresarial, pp. 5–6, in: Revista Aranzadi Social, Volume 1, No. 11, pp. 111–112 (2008). 25 Agut Garcı´a/Garcı´a Ninet/Vicente Pache ´s, El control empresarial en el a´mbito laboral, p. 117 (CISS, 2005). 26 Vicente Pache ´s, El derecho del trabajador al respeto de su intimidad, p. 245, in: Consejo Econo´mico y Social, 1998. 27 Judgment of the Valencia Court of Justice of 7 December 2000 and; Garcı´a Ninet/Vicente Pache´s, El control empresarial en el a´mbito laboral, p. 119. 28 Agut Garcı´a/Garcı´a Ninet/Vicente Pache ´s (fn. 25), pp. 119–121. 29 Judgment of the Constitutional Court of 29 November 1984.

Diaz/Heckh/Masso´

Reemers Publishing Services GmbH O:/Beck/Spehl_Gruetzner/3d/11_Spain.3d from 06.03.2013 09:30:40 3B2 9.1.580; Page size: 160.00mm  240.00mm

B. Admissibility and implementation of individual measures

331

As regards the duty of information set forth by Act 15/1999 on Personal Data 51 Protection (“Act 15/1999”),30 the employer shall inform its employees that their phone conversations are being recorded. Also, depending on the characteristics and uses of such records by the employer, employees’ consent would be required. This would be the case, e.g., when the employer intends to transfer such records outside the European Economic Area, to countries not granting an equivalent level of protection to that offered within said Area. 8. Company car There are some measures of control to company cars established by law as 52 tachographs. Other recent forms of control include the use of GPS devices. The constant control of the company car’s movements by means not required by law could be understood as a violation of the employee’s fundamental rights. To a greater extent, these measures could be unconstitutional when the employee is allowed to use the car for personal reasons. Last, company cars have been considered a private property of the employee such 53 as the ones described under Art. 18 of the Labor Act. Consequently, searches in company cars will have to follow the procedure described under this article.31 In any event, from a personal data protection perspective, where such activities 54 are to take place, as already set forth under supra paras. 47 et seq., employees shall be duly informed by the employer on the processing of data resulting from such car control.

II. Must employees’ representatives such as the works council be involved in internal investigations? According to Art. 64.5 f) of the Labor Act, the works council shall “issue a report 55 prior to enforcement by the employer of the decisions s/he adopts on […] the implantation or revision of organizational and work control systems”. These reports will have to be prepared in an interval of fifteen days. Notwithstanding, the opinion of the works council will not be binding for the employer.32 Furthermore, according to Art. 18 of the Labor Act, in searches of the worker’s 56 person, in his lockers and personal effects: “maximum respect for the dignity and privacy of the worker shall be shown, and a worker’s legal representative or, in his/ her absence from the work centre of another worker from the company, shall be present, whenever this is possible”. Nevertheless, the obligation to inform the employee’s representatives is only 57 effective when the measures of control are stable. In control actions that are taken sporadically or with a specific objective, there is no obligation to inform the works council. Constitutional jurisprudence has waived the employer’s obligation in cases

30

Organic Law 15/1999, of 13 December, on the Protection of Personal Data. Agut Garcı´a/Garcı´a Ninet/Vicente Pache´s (fn. 25) pp. 123–125. 32 Agut Garcı´a/Garcı´a Ninet/Vicente Pache ´s (fn. 25) p. 56. 31

Diaz/Heckh/Masso´

Reemers Publishing Services GmbH O:/Beck/Spehl_Gruetzner/3d/11_Spain.3d from 06.03.2013 09:30:40 3B2 9.1.580; Page size: 160.00mm  240.00mm

332

§ 11. Spain

of installation of video cameras in order to discover the extraction of items by an employee33 or the hiring of private detectives to reveal the worker’s breach of contract.34

C. Employee interviews Spanish Labor framework does not establish specific provisions regarding the employee interviews during the course of internal investigations. Companies are entitled to maintain interviews with its employees by virtue of their power of direction and supervision of the employees’ rendering of services, as well as the indirect aspects of such rendering of services (e.g. workplace, work time, etc.), and employees are obliged to collaborate in such interviews, in accordance with the bona fide principle that governs the employment relationship.35 Collective Labor Agreements might establish additional considerations in this regard. 59 However, employees’ collaboration duty is limited by other employee rights which prevail over the bona fide principle as commented below. 58

I. May an employee refuse to provide information if this information would incriminate himself/herself? Spanish Constitution contains a whole set of Fundamental Rights that apply to all Spanish citizens in order to ensure the proper development of their personality, without any interference of the State and its Public Authorities. 61 All rights applicable to Spanish citizens, during a judicial procedure, are contained in Art. 24 of the Spanish Constitution. 62 Within those rights (concretely, under Art. 24.2 of Spanish Constitution) it is recognized the right to plea not guilty, to the presumption of innocence and the right to declare or not declare and, in any case, to do not declare against yourself. 63 From a labor perspective, employees may refuse to provide information even if such information does not incriminate them either, depending if the scope of the question relates to the employee’s rendering of services: 60

1. Duty to provide information directly or indirectly related to the rendering of services As commented above, due to the bona fide principle that governs the employment relationship and the duty of collaboration it may be reasonable for the employer to require employees to provide any information directly or indirectly related to the rendering of services. 65 Lack of collaboration may result in the possibility of imposing sanctions for such non-collaborative employees which may range from a written warning with no 64

33

Judgment of the Constitutional Court of 10 July 2000 (Westlaw ref. RTC 2000, 186). Judgment of the Navarra Superior Court of Justice of 29 December 2008 (Westlaw ref. JUR 2009, 159752). 35 See Art. 5 of the Labor Act. 34

Diaz/Heckh/Masso´

Reemers Publishing Services GmbH O:/Beck/Spehl_Gruetzner/3d/11_Spain.3d from 06.03.2013 09:30:40 3B2 9.1.580; Page size: 160.00mm  240.00mm

C. Employee interviews

333

other implications than requesting the employee to collaborate with the company, to the dismissal. If the company is considering sanctioning an employee who has not provided 66 information during the course of an investigation, it should bear in mind that sanctions have to be adequate and proportional to the misconduct of the employee. Therefore, even when the Spanish Labor Act states that a serious and culpable “breach of good faith” is a valid cause for terminating an employee by means of a disciplinary dismissal, lack of collaboration is highly unlikely to be considered an appropriate cause to terminate the employment relationship by a Labor Court. Sanctions to be imposed will have to be established on a case by case basis, taking into account different variables such as the scope of the investigation, the misdeed committed, if the employee has answered other questions during the interview, etc. 2. Duty to provide information outside the scope of work Outside the scope of the rendering of services, employees are not obliged to 67 provide any information to the employer, as the bona fide principle derives from the employment relationship.

II. Is an employee obliged to provide information on any misconduct of or criminal offence committed by other employees? We hereby refer to our comments under Question A.V. 68 In addition, from a labor law perspective, employees are obliged to inform 69 immediately to their manager of any situation which may result in a risk for the health and safety of other employees, which includes misconducts of the employees regarding health and safety obligations. Pursuant to section 29.3 of the Prevention of Labor Risks Act, employees may be subject to a sanction for not collaborating with the employer in this regard. However, the same considerations made in the previous section must be taken into account regarding the adequate sanction to be imposed, which, as commented, has to be proportional to the misconduct of the employee. It is more likely that the Labor Courts estimate that the sanction imposed is adequate whether the employee had any type of responsibility regarding the prevention of labor risk, being for example the coordinator of such prevention in the company. It is a recommendable practice in order to be able to sanction the employees to 70 implement a Code of Conduct which not only prohibits all acts considered wrongful, but that specifically addresses internal investigation procedures, containing provisions regarding the obligation of the employees to report wrongful acts and/or any misconducts they might witness, and the consequences of not reporting such events.

III. May an employee refuse to answer a question if he/she has already answered it within the scope of a previous interview? If the company wants the investigation to succeed, it should to prepare the 71 schedule and content of the interviews in advance, in order to avoid having an employee being interviewed many times by different people asking the same Diaz/Heckh/Masso´

Reemers Publishing Services GmbH O:/Beck/Spehl_Gruetzner/3d/11_Spain.3d from 06.03.2013 09:30:40 3B2 9.1.580; Page size: 160.00mm  240.00mm

334

§ 11. Spain

questions, as the employees might feel uncomfortable or even harassed due to an unorganized investigation. 72 There is no legal provision that prohibits questioning the same query to an employee more than once, by the same or a different person, or in the same or different interview. However, employees may refuse to answer questions already asked in a previous interview if they consider that the investigators are acting against the bona fide principle by inappropriately requesting an item of information again and again. Had the employees answered the same question before in a previous interview of the same investigation, there is no breach of their duty to collaborate, and therefore no sanction might be imposed.

IV. Is an employee entitled to the presence of a member of the works council or an attorney during the interview? 72a

Presence of a member of the works council or an attorney during the interview is not mandatory, unless established by the applicable CLA. 1. The employee’s right to the presence of a member of the works council

As commented, it is not mandatory that a member of the works council is present during the interview. 74 However, if the employee requests the presence of a member of the works council it is at best practice that the company allows such presence, in order to demonstrate that the company is acting diligently and with good faith during the investigation. 75 Moreover, it would be advisable that a member of the works council is present whether the employees request it or not for the same reasons of providing clarity to such investigations. 76 In addition, works council members have the duty of confidentiality regarding the information they manage as per their representative condition, and thus, they cannot disclose the interviews’ content. 73

2. The employee’s right to the presence of an attorney 77

As commented, employees are not entitled to the presence of an attorney during the interviews, but it is a good practice to allow the employee who requests the presence of a lawyer to do so, which in addition, will provide more credibility to the investigation.

V. Is an employee entitled to read the record of his/her interview? It is highly recommendable to keep a record in writing of each interview held with the employees. 79 There is no legal obligation that mandates that the employee should read the record of his/her interview, but it is advisable that not only the employee reads the record, but signs the record and keeps a copy signed by the company as well, in order to demonstrate that the company has acted diligently in the investigation. 78

Diaz/Heckh/Masso´

Reemers Publishing Services GmbH O:/Beck/Spehl_Gruetzner/3d/11_Spain.3d from 06.03.2013 09:30:41 3B2 9.1.580; Page size: 160.00mm  240.00mm

C. Employee interviews

335

In addition, if the company decides to take any disciplinary measures as a result 80 of the investigation, the records of the meetings would be extremely useful, if not indispensable, in providing reasons for the disciplinary action if the measure is contested, as is normally expected. As regards data protection perspective, Act 15/1999 and Instruction 1/1998 of the 81 Spanish Data Protection Agency36 grant data subjects (i. e. employees) the right to access personal data related to them. It is to be noted, however, that such access is defined as access to the following information: categories of personal data that are initially processed; data resulting from any elaboration or computer process; source of data; data recipients; uses and purposes of the processing. Therefore, it is unsure whether the right of access granted by Act 15/1999 to data subjects would cover full access to the record of interview itself, but there might be arguments that the full content of the interview is not covered by the right of access. As far as the characteristics of such right granted by Spanish data protection 82 regulations are concerned, the data controller (i. e. the employer) shall settle the relevant access request within one month as from reception thereof. The employer may deny such access to employees when the latter have already exercised their right of access during the twelve months prior to the request, unless a legitimate interest is alleged by the employee so as to be given access. Also, access may be denied where so foreseen by Spanish legislation or an EU legislative instrument of direct application, or where the later prevent data controllers to reveal data subjects the information at issue.

VI. Is the employer entitled to request that the employee signs the record of the interview? Employees are not obliged to sign the record of the interview. The Company may 83 request that two witnesses who were present during the interview sign the record of the employee in lieu, stating when and where the interview took place, who was present during the interview and that such record reproduces the answers of the employee to the queries questioned by the company. In order to provide credibility, it would be advisable that an employee represen- 84 tative and another employee of the company sign the record as witness.

VII. Can the employer instruct an employee to treat the content of his/her interview as confidential? A basic investigatory best practice is to keep the investigation records confidential 85 to safeguard the success of the investigation, and therefore, it is highly recommendable that the employer instructs the employee to treat the content of his/her interview as confidential.

36

Instruction 1/1998, of 19 January, of the Spanish Data Protection Agency on the exercise of rights of access, rectification and cancellation.

Diaz/Heckh/Masso´

Reemers Publishing Services GmbH O:/Beck/Spehl_Gruetzner/3d/11_Spain.3d from 06.03.2013 09:30:41 3B2 9.1.580; Page size: 160.00mm  240.00mm

336

§ 11. Spain

D. Sanctions imposed on employees I. What are the sanctions under employment law that can be imposed on employees refusing to cooperate in internal investigations? 86

87

88

89

90

91

As commented on the previous section, employees have a collateral good faith obligation (bona fide principle) to their employer which, in certain circumstances, may reasonably include a duty to cooperate with an internal investigation.37 If an employee refuses to cooperate in an internal investigation, the employer must first analyze if the employee’s conduct constitutes an infringement of the good faith principle and if such conduct could constitute a breach of trust. Depending on the severity of the employee’s unwillingness to cooperate, nature of the information required (within the scope of the regular rendering of services), and taking into consideration his/her level of implication in the alleged infringements, his/her conduct may be subject to the corresponding proportionate disciplinary measure. As for the type of sanctions that may be imposed, note that the disciplinary framework for ordinary employees38 is strictly regulated by collective labor agreements.39 In this regard, employee misconduct should be sanctioned in accordance to the terms established in the CLA applicable to the company. Most CLAs establish sanctions that range from verbal/written warnings and suspension of employment and pay, to a disciplinary dismissal.40 Some CLAs admit sanctions such as the restriction to apply for promotions, and compulsory transfer of work centre. In any case, it is important to bear in mind that the Labor Act prohibits employers from taking the following actions as disciplinary measures: (i) salary reduction penalty, (ii) reduction of vacations, and/or (iii) reduction of any other rights which involve the employee’s rest periods.41 Before imposing any sanction the employer should analyze if any special formal procedure is required. Generally, sanctions should be adequately communicated to employees in writing, detailing the specific misconduct and disciplinary consequence. However, there are special formal requirements that need to be met when imposing sanctions to members of the works council, employee representatives, union delegates, or union members.42 CLAs may also establish certain formal requirements to

37

See Art. 5 of the Labor Act. The disciplinary framework for executives under the scope of the RD 1382/1985, of 1 August, which establishes the legal framework of the Special Labor Relationship for Top Executive Employees, is regulated according to that specified in the employment contract; See Art. 13 RD 1382/1985. 39 As set forth in Art. 58 of the Labor Act. 40 See also Art. 54 of the Labor Act, which allows for a disciplinary dismissal in case of serious infringements which constitute a breach of contractual good faith and breach of trust. 41 See Art. 58 of the Labor Act. 42 See Art. 68 of the Labor Act, regarding the mandatory internal process to impose serious and very serious sanctions to members of the works council, employee representatives and union delegates, called “expediente contradictorio”. See Art. 10.3.3. of the Organic Law 11/1985 of 2 August, which regulates Trade Union Freedom, regarding the formal requisite of providing a mandatory hearing for union delegates, regarding the imposition of sanctions of union members. 38

Diaz/Heckh/Masso´

Reemers Publishing Services GmbH O:/Beck/Spehl_Gruetzner/3d/11_Spain.3d from 06.03.2013 09:30:41 3B2 9.1.580; Page size: 160.00mm  240.00mm

D. Sanctions imposed on employees

337

impose sanctions to ordinary employees.43 Therefore, in order to guarantee that the sanction is enforceable, previous to taking any disciplinary action, the employer should check if any formal procedures need to be followed.

II. Is the suspicion of a criminal offence or of a severe violation of duty sufficient for an extraordinary termination? A mere suspicion of a criminal offence or of a severe violation of duty may not, by itself, be sufficient to support a just cause termination. In order to support a just cause termination the employer will need to prove that (i) the employee has engaged in behavior which may be typified as sanctionable misconduct by law and/or the applicable CLA, (ii) the misconduct is severe enough and proportionally requires a disciplinary dismissal, instead of other sanctions, and (iii) in any case the dismissal is being executed within the applicable statute of limitations. If the above requirements are not met, a judge may rule that the dismissal is unfair. The declaration of unfairness of the dismissal by court will generally require the employer to choose between two alternatives: (a) reinstatement of the employee with back pay, or (b) payment of a severance compensation of 45 days of salary per year of service capped at 42 months’ salary44 until February 11, 2012 – when the 2012 Labour Reform was approved – and 33 days of salary per year of service capped at 24 months’ salary afterwards, subject in any case to additional capping limits established by the reform. Unfair dismissals of top executives45 will generally require either (a) reinstatement with back pay or (b) payment of a severance compensation of 20 days of salary per year of service, up to a maximum of 12 months’ salary. Employment agreements may establish higher severance entitlements. In order to avoid litigation, the employer may attempt to negotiate with the employee payment of a severance compensation in exchange of a full waiver and release agreement. In certain cases in which the employee has the right to choose reinstatement (e.g. employee representatives46) or in cases where the employee is protected against dismissal (e.g. dismissal during pregnancy, while enjoying a reduction of working hours for childcare, etc.), the employees may have more leverage in the negotiation such that they may request a higher severance in exchange for such waiver and release. Therefore, when pondering the decision to terminate an employee, the employer must carefully analyze all surrounding circumstances in order to determine its potential exposure in each case.

43 For example, the CLA for the Chemical Industries establishes in its Art. 62, general formal requisites to impose sanctions to employees (XV Convenio colectivo de la industria quı´mica, BOE 29 agosto 2007, nu´m. 207, [pa´g. 36075]). 44 See Art. 56 of the Labor Act and Law 3/2012 of July 6. 45 See Art. 13 of RD 1382/1985. 46 Note that the dismissal of members of the works council, employee representatives, and union delegates require the employer to exhaust an internal process called “expediente contradictorio”, previous to actually terminating the employees. In any case, if the dismissal is further declared unfair by court, the employee will have right of choice over reinstatement. See Arts. 55, 56.4 and 68 of the Labor Act.

Diaz/Heckh/Masso´

92 93

94

95

Reemers Publishing Services GmbH O:/Beck/Spehl_Gruetzner/3d/11_Spain.3d from 06.03.2013 09:30:41 3B2 9.1.580; Page size: 160.00mm  240.00mm

338

§ 11. Spain

In sum, although the mere suspicion of misconduct may not constitute just cause for dismissal, the employer may analyze the option to terminate the employee without cause by making a risk and cost assessment, which may vary depending on the specific circumstances of the affected employee. 97 Another alternative that may be suitable would be to grant the employee a garden leave as a precautionary measure until the investigation is finalized. This may be especially useful in those cases where the employer does not wish to have the employee at the workplace. In any case, it is advisable that such measure is not based on arbitrary reasons, but rather duly justified by a reasonable cause (e.g. in order to avoid the tampering of evidence which may later support the dismissal, safeguard company property, protect other employees, etc.) and that its duration is limited to that strictly necessary. 96

III. During which period of time must an extraordinary notice of termination be given to employees whose misconduct has been revealed by the internal investigations? Disciplinary dismissals do not require prior notice, thus there is no need to give a legal extraordinary notice of termination.47 Thus, upon communication of the termination, the employees’ employment with the company may be finalized.48 Employment agreements may establish prior notice entitlements, thus each employee’s circumstances should be thoroughly reviewed before taking any actions. On a separate note, if the employer grants an extraordinary notice of termination, it is important to bear in mind that there is a statute of limitations regarding the imposition of disciplinary measures. Thus, the employer must impose any disciplinary measures within the statute of limitations.49 99 The statute of limitations for minor and serious offences committed by ordinary employees is 10 days and 20 days respectively. In case of very serious offences there is a statute of limitations of 60 days. This period starts to elapse once the employer has knowledge of the employee’s misconduct. In any case, the employee shall not be sanctioned when 6 months have elapsed since the alleged misconduct has occurred.50 100 The statute of limitations for offences committed by top executives is 1 year. This period starts to count once the employer has knowledge of the top executive’s misconduct, and in any case since the alleged misconduct has occurred.51 98

47 Note that the Labor Act provides for two main types of dismissals – disciplinary dismissals and objective dismissals. Disciplinary dismissals do not require a statutory notice period prior to termination. However, objective dismissals require a 15 day prior notice of dismissal. This type of dismissal is not based on employee misconduct, but is rather based on an objective cause which makes very difficult to keep the employee in the company (e.g. redundancies). 48 Note that works council members, employee representatives, union delegates, and union members require previous exhaustion of an internal process. See Arts. 55, 56.4 and 68 of the Labor Act and Art. 10.3.3. of the Organic Law 11/1985 of August 2nd, which regulates Trade Union Freedom. 49 See Art. 60.2 of the Labor Act. 50 Id. 51 As established in Art. 13 of RD 1382/1985.

Diaz/Heckh/Masso´

Reemers Publishing Services GmbH O:/Beck/Spehl_Gruetzner/3d/11_Spain.3d from 06.03.2013 09:30:42 3B2 9.1.580; Page size: 160.00mm  240.00mm

E. Use of obtained information

339

Therefore, the employer may give an extraordinary notice of termination as long 101 as the effective date of the termination is within the statute of limitations established to sanction the alleged misconduct.

IV. Must an employee cooperate in internal investigations even after he/she has been given notice of termination? As long as the employment relationship subsists, the employee will have a general 102 good faith duty to cooperate with any matters related with his/her employment with the company.52 In practical terms it could be difficult to require cooperation from the employee 103 when he/she has been given notice of termination. In these cases, it may be arguable that the employer may impose other disciplinary sanctions before the actual dismissal (e.g. suspension of employment and pay),53 as long as the duty to cooperate is reasonably included within his/her employment duties with the company.

E. Use of the obtained information I. Is it permissible to disclose the findings and information obtained within the scope of any internal investigations to other group companies? In such cases where the employer intends to reveal information related to an 104 employee under investigation to other group companies, requirements set forth by Act 15/1999 with regard to disclosures of data and, where applicable, to transfers of data shall be observed. For instance, said requirements are applicable regardless the employer and the data recipients belong to the same corporate group. As such, disclosures/transfers of employee personal data may only take place if 105 based on any of the legitimate grounds foreseen by Act 15/1999. Otherwise, an unlawful disclosure or transfer of data, as the case may be, could be taking place, subject to administrative fines ranging from E 40,000 to E 600,000. If the company intends to reveal personal data related to its employees to another 106 group company based in Spain, such disclosure does not need to be justified before the Spanish Data Protection Agency. However, from a substantive law perspective, the disclosure may only take place if it proves to be necessary for the legitimate interests of both the company and the data recipient provided the employee has granted its prior consent to the disclosure.54 Therefore, in the event the company’s employees would have generically provided their consent55 to the disclosure of data to other Spanish group companies for management purposes, amongst which the 52

As established in Art. 5 of the Labor Act. The imposed sanction should always be proportionate to the alleged infringement, in compliance with the terms of the applicable Collective Labor Agreement. 54 Consent may be obtained either expressly or tacitly, providing data subjects with a 30 working days prior notice to oppose thereto. 55 It is to be noted, that, despite the position of other EU jurisdictions, the Spanish Data Protection Agency still accepts consent within employment relationships as a valid ground for, e.g., undertaking disclosures of data. 53

Diaz/Heckh/Masso´

Reemers Publishing Services GmbH O:/Beck/Spehl_Gruetzner/3d/11_Spain.3d from 06.03.2013 09:30:42 3B2 9.1.580; Page size: 160.00mm  240.00mm

340

§ 11. Spain

clearance of internal investigations, such consent would be sufficient to perform the intended disclosure. However, if such consent would not have been obtained beforehand by the company, given the circumstances, employees would probably refuse to provide their approval to the disclosures taking place during the investigation. 107 Alternatively, Act 15/1999 provides certain exemptions to the consent rule, which would cover, amongst others, disclosures conducted in views of the development, fulfillment and control of a legitimate relationship. As such, if the company is able to effectively justify that the disclosure to another group company in Spain takes place in views of the suitable management of the investigation itself; attending to the seriousness of the facts investigated and the possible consequences for other group companies, etc. it may eventually reveal the data without being subject to previously obtaining employees’ consent thereto. 108 Where it comes to the disclosure of data to group companies based abroad, socalled international data transfers, specific restrictions may apply determined by whether an adequate level of protection exists in the country where the recipient is based. 1. In case personal data is transferred to a group company located in a Member State belonging to the European Economic Area or to a country which is meant to provide an equivalent level of protection pursuant to a Decision of the European Commission, the same requirements set forth under paras. 104 to 107 would apply. 2. The transfer of data to a group company located outside the European Economic Area, in a country which does not provide an equivalent level of protection to that granted within said Area shall be explicitly justified before the Spanish Data Protection Agency. As a general rule, such transfers may only take place where the prior authorization of the Spanish Data Protection Agency has been obtained pursuant to: – A data transfer authorization petition filed with the Spanish Data Protection Agency based on a Data Transfer Agreement drafted in line with the European Commission’s Model Contract Clauses for the transfer of personal data to third countries56 or on Instruction 1/2000 of the Spanish Data Protection Agency.57 Under such scenario, from a formal perspective, the following documents shall accompany the transfer authorization petition (i) explanatory letter; (ii) the originally signed Data Transfer Agreement (or notarized copy thereof) plus a sworn translation in Spanish, in the event the original Agreement has not been entered into in Spanish; (iii) powers of representation, duly notarized and provided with the Apostille of the Hague Convention, where so required, of the individuals entering into the Agreement on behalf of the companies involved. – Following the so-called Binding Corporate Rules (“BCRs”).

56 Decision 2001/497/EC, of 15 June 2001, on standard contractual clauses for the transfer of personal data to third countries; Commission Decision 2010/87/EU, 5 February 2010, on standard contractual clauses for the transfer of personal data to processors established in third countries, under Directive 95/46/EC; Commission Decision 2004/5271, of 27 December 2004, amending Decision 2001/497/EC as regards the introduction of an alternative set of standard contractual clauses for the transfer of personal data to third countries. 57 Instruction of the Spanish Data Protection Agency 1/2000 of 16 December, which sets forth the rules applicable to international data transfers.

Diaz/Heckh/Masso´

Reemers Publishing Services GmbH O:/Beck/Spehl_Gruetzner/3d/11_Spain.3d from 06.03.2013 09:30:42 3B2 9.1.580; Page size: 160.00mm  240.00mm

E. Use of obtained information

341

Notwithstanding the foregoing, certain exemptions are applicable to the data 109 transfer authorization petition. Mainly, the exemptions that could eventually apply to the scenario hereby analyzed would be as follows (i) the employee has given its consent to the transfer (we hereby refer to our previous comment); (ii) the transfer takes place to a US Safe Harbor certified entity (provided that the requirements under our comment above are met); (iii) the transfer is necessary for the performance of a contract between the employee and the employer or the adoption of precontractual measures taken at the employee’s request; or (iv) the transfer is necessary for the conclusion or performance of a contract concluded, or to be concluded, in the interest of the employee, between the employer and a third party.

II. Is it permissible and advisable to forward the findings and information obtained within the scope of any internal investigations to public authorities? If a Spanish public authority (e.g., the public prosecutor, Ombudsman, Courts, etc.) would request to be provided with personal data in the exercise of its functions, or if the company would be committed to disclose data collected in the course of the internal investigation to such authorities to comply with an applicable regulation, the company would be committed to undertake such disclosure of data. Indeed, both the disclosure of data to public authorities in the exercise of their functions as well as the disclosure of data to comply with a legal obligation do generally benefit from a specific exemption to the general consent rule applicable to data disclosures described under question E.I. Where disclosure to public authorities is voluntary, the above exemptions on data protection would apply as far as the employer may rely on a general cooperation provision contained in applicable laws. As far as requests issued from authorities belonging to Member States of the European Economic Area or other countries providing an equivalent level of protection are concerned, employees’ consent would also be required. As far as the exemption applicable to the disclosure of data to public authorities is concerned, although in essence Spanish regulators were most likely thinking on the application of such exemption to Spanish public authorities, Act 15/1999 does no expressly reflect such fact, and thus it might be reasonable to extend application thereof to public authorities from other European Economic Area Member States, although legitimacy of such disclosure may be more certain if there is a previous petition from such authorities. Finally, where it comes to requests originating from authorities of other countries, there may eventually be reasonable legal grounds to justify disclosures of data thereto: 1. Data transfer authorization petition based on a Data Transfer Agreement drafted in line with the EU Model Contract Clauses. The implementation of a Data Transfer Agreement directly between the Spanish company and the foreign authority may be hardly conceivable. Alternatively, in order to cover such requests, an Agreement may be entered into between the Spanish company and the company belonging to its group, if any, which is based in the country where the request of the public authority comes from, provided such Agreement would foresee under its purposes the fulfillment of cooperation duties applicable Diaz/Heckh/Masso´

110

111

112

113

Reemers Publishing Services GmbH O:/Beck/Spehl_Gruetzner/3d/11_Spain.3d from 06.03.2013 09:30:42 3B2 9.1.580; Page size: 160.00mm  240.00mm

342

§ 11. Spain

to the data importer with the public authorities of its country of establishment. In this case, an informative notice shall be issued to employees. Nevertheless, there may be a risk that the Spanish Data Protection Agency could understand that such an Agreement aims to avoid Spanish rules on data transfers. 2. Consent. As an exemption to the transfer authorization petition, consent of employees may be used as a mean to legitimate the transfers to the foreign public authority. In this sense, we refer to our comments above under E.I. above. 3. Finally, two additional alternatives to the transfer authorization petition may be considered in the case at issue to legitimize the data transfers to a foreign authority: (i) where the transfer is linked to international judicial assistance;58 or (ii) where the transfer is required for the exercise or defense of a right in a judicial process. Under these scenarios neither the authorization of the Spanish Data Protection Agency nor the employees’ consent would be required. An important element to be considered hereby is to whom the foreign authorities’ request is addressed to and the scope thereof. Indeed, in the event the request would be specifically addressed to the group company which is based in the same country as the public authority, application of the aforementioned exemptions to the transfers of data from the Spanish company to the foreign authority would be less certain as it could not be considered that the Spanish company is directly affected by the request itself. On the other hand, in the event the foreign authority’s request would be directly addressed to the Spanish company, or even if the request was addressed to the group company which is based in the same country as the authority but extensive to its affiliates, application of these exemptions would be less uncertain. In any event, it is to be noted that in practice there is not much guidance or precedents on the implementation of the exemptions by the Spanish Data Protection Agency.

III. Are the findings made in the scope of internal investigations subject to the attorney-client privilege? Firstly, it is important to point out that what is so-called in the United States and in other common law jurisdictions as attorney-client privilege is known in Spain as professional secret. 115 There is a considerable difference between the treatments of attorney-client privilege in common law and civil law jurisdictions. While under the former, attorney-client privilege is a client right, under the latter is the right and duty of the attorney. 116 Despite these differences, both legal systems are based on a common principle: the client’s right to a defense, protection of documents that may contain any type of legal advice and/or information concerning the preparation of the defense’s case. 117 Another appreciable difference between the scope of professional secrecy in the United States and Spain is that in Spain the client’s waiver is irrelevant to an attorney’s secrecy obligation. 114

58 This exemption was probably thought by Spanish regulators as applicable to cooperation between public authorities. However, Act 15/1999 does not expressly set forth such a limitation and thus, we understand it could be applied, in practice, as explained herein.

Diaz/Heckh/Masso´

Reemers Publishing Services GmbH O:/Beck/Spehl_Gruetzner/3d/11_Spain.3d from 06.03.2013 09:30:43 3B2 9.1.580; Page size: 160.00mm  240.00mm

E. Use of obtained information

343

Therefore, the secrecy obligation incumbent upon the attorney envisages professional secrecy as a direct requirement for the defense of citizens’ rights, with two very clearly differentiated objectives: (i) to protect the interests of any person seeking the legal advice from an attorney and (ii) to guarantee fair and suitable administration of justice. It could be said that it is a duty of confidentiality that is imposed by the need for absolute trust between an attorney and the person requesting his/her services and that continues existing even after services have been rendered. Unlike other countries, in Spain the attorney-client privilege obligation only applies to attorneys that are members of a Bar Association. In-house counsels are also bound by attorney-client privilege, since they are members of the Bar Association and can appear in Court to defend the interests of their employers and third parties. It should be mentioned that in Spain the attorney-client privilege is relative, as it is up to the attorney to determine what information should be kept confidential. The attorney has an obligation to his/her client, as established in professional and deontological standards, which provide for punishment if the obligation is breached. Art. 199.2 of the Spanish Criminal Code thus establishes that “any professional who, by breaching his obligation of secrecy and non-disclosure, divulges the secrets of another person shall be sentenced to 1–4 years’ prison, a fine payable for 12–24 months and professional disqualification for 2–6 years”. Professional secrecy covers all the information disclosed by the client and all the circumstances associated therewith, in addition to any information shared on a confidential basis with other attorneys. More specifically, legal privilege is regulated pursuant to the Spanish Bar Association Code of Ethics, Art. 5 of which contains the following provisions: 1. Legal privilege must be observed not only with respect to a client’s information, but also to information pertaining to the other party or any third party, insofar as such information is known as a result of the professional practice of the lawyer. 2. A client’s waiver may not be sufficient to release the lawyer from the obligation and therefore, professional secret must necessarily be observed with respect to the other or third party information, despite the waiver the client may have granted. 3. Face-to-face or telephone conversation that lawyers may have with clients, other parties or their counsel shall not be recorded without the prior express consent of all parties involved. Lawyers cannot bring before Courts as evidence any letter sent by adverse parties and addressed to the said lawyer without the prior consent of such party. 4. Legal privilege is a duty of the lawyer as an individual and must be kept even in relation to partners of the same legal firm. 5. Exceptionally, in the event of blatant injustice caused by legal privilege, lawyers can request advice from the Chairman of the Local Bar Association to determine what means can be used to prevent injustice without breaching legal privilege, whenever possible. This advice has proven to be extremely flexible. Occasionally, Local Bar Associations has released lawyers from their duty of secret, even without the client’s consent.

Diaz/Heckh/Masso´

118

119

120

121

122

123

Reemers Publishing Services GmbH O:/Beck/Spehl_Gruetzner/3d/11_Spain.3d from 06.03.2013 09:30:43 3B2 9.1.580; Page size: 160.00mm  240.00mm

344 124

125

126

127

128

§ 11. Spain

Notwithstanding these rules, the current situation in Spain is quite different. There are certain acts of misconduct that are widespread amongst lawyers that, in fact, limit the scope of legal privilege, as explained above. Some examples of minor misconduct are: the use of client information for promotional purposes, recording of conversations and the misuse of written conversations received from other parties, which is common practice. Spanish authorities apply two criteria to determine whether a given document is protected by legal privilege: 1. The nature and intended use of the document, in other words, whether it refers to data solely pertaining to the company or is related to the need of organize the company’s defense in legal proceedings, and 2. Persons participating in the preparation of such document, in other words, whether it has been prepared by corporate employees or with the cooperation of external counsels. Notwithstanding the above, Spanish Law provides for certain exceptions regarding legal privilege: special measures against terrorism and illegal drug trafficking and the prevention of money laundering. Finally, it should be mentioned that the attorney has an obligation to disclose information when aware that the client plans to commit a crime in the future. In such case, the attorney-client privilege gives way and there is nothing to prevent the attorney from being called to testify as a witness with regard to such future events. The reason behind the duty to disclose is that if the information were kept secret, the attorney could be accused of committing a crime regulated in Art. 405 of the Spanish Criminal Code, which consists of the failure to comply with one’s obligation to prevent certain crimes from being committed or to report them to the authorities.

IV. Does the attorney-client privilege also apply to foreign attorneys? The attorney-client privilege or the professional secrecy applies to those attorneys, who are members of Spanish Bar Associations and thus, admitted to practice law in Spain. When such attorneys practice abroad,59 they must respect not only the provisions of the Spanish Bar Association Code of Ethics but also the ethics regulation provided by the Bar Association of the State where the lawyer was practicing. 130 Foreign lawyers are not governed by the provisions of the Spanish Bar Association Code of Ethics but they are subject to the provisions of the European Bar Associations Advisory Council Code of Ethics, on which the provisions of the Spanish Code of Ethics are based.60 131 Finally, pursuant to Art. 12.12 of the Spanish Bar Association Code of Ethics, any communication exchanged with a foreign lawyer shall be deemed confidential, but it is advisable to request its acceptance of such confidential nature from the foreign attorney. 129

59 60

Arts. 1.2 of the Spanish Bar Associations Code of Ethics. Preamble and Art. 1.1 of the Spanish Bar Associations Code of Ethics.

Diaz/Heckh/Masso´

Reemers Publishing Services GmbH O:/Beck/Spehl_Gruetzner/3d/11_Spain.3d from 06.03.2013 09:30:43 3B2 9.1.580; Page size: 160.00mm  240.00mm

F. Following-up on internal investigations

345

F. Following-up on internal investigations I. What is to be observed during the follow-up of internal investigations? After the investigation concludes, the employer should take the necessary actions 132 to correct any misconduct. It is especially important to be aware of the statute of limitations regarding the imposition of disciplinary sanctions, in order to secure that disciplinary measures are enforceable. On the other hand, if the results of the investigation show that the safety of other 133 employees is at risk (e.g. due to harassment), it is important for the employer to take immediate action to prevent and mitigate the risk and/or further damages. Lack of undertaking necessary precautionary measures may constitute a breach of the employer’s duty of care in the workplace which, depending on the circumstances, may result in high administrative fines.61

II. May an employer pay its employee’s legal fees if he/she is being prosecuted under criminal law? Under Spanish Constitution and Spanish Criminal Procedure Act, there is the 134 obligation (which is also considered a right) of being represented during the criminal proceedings by a lawyer and a trial attorney. Under Art. 24.2 of the Spanish Constitution it is recognized the right of being 135 represented by a lawyer in order to exercise the right of defense and under Art. 118 of the Spanish Criminal Procedure Act62 it is said that, in order to exercise the rights derived from the condition of defendant or accuser, both parties to a proceeding should be represented by a lawyer and a trial attorney. Taking both articles into account, lawyers and trial attorneys do not make a 136 commitment to the person who is paying them, instead, they should make a commitment to the person who is being represented by them. This means that Judges do not investigate who is paying the lawyer’s legal fees but rather who is being represented by whom, so to pay legal fees of a person prosecuted under criminal law could never be detrimental or harmful to the person or entity that is paying them. 61 See generally: Arts. 8.11, 8.13, 11.4, 12.16, 13.10 of the Labor Infringements and Sanctions Act (R.D.Leg. 5/2000 de 4 de agosto – Ley de Infracciones y Sanciones en el Orden Social –); Art. 14 of the Labor Risk Prevention Act (Ley 31/1995 de 8 de noviembre – Ley de Prevencio´n de Riesgos Laborales). The Labor Inspection has determined that fines related to workplace harassment may constitute an infringement to the employees’ dignity, harassment, and infringement in labor risk prevention measures, criteria which increases the employer’s exposure to high administrative fines that in extreme circumstances may amount to 819.780 EUR. (Criterio Te´cnico 69/2009 sobre las actuaciones de la Inspeccio´n de Trabajo y Seguridad Social en material de acoso y violencia en el trabajo). Fines for minor infringements to general labor obligations may range from 60 EUR to 625 EUR; serious infringements, from 626 EUR to 6.250 EUR; very serious infringements, from 6.251 EUR to 187.515 EUR. Fines for minor infringements related to the risk prevention duty may range from 40 EUR to 2.045 EUR; serious infringements 2.046 EUR to 40.985 EUR; very serious infringements, 40.986 EUR to 819.780 EUR (Labor Infringements and Sanctions Act). 62 Royal Decree of 14 September 1882, as amended.

Diaz/Heckh/Masso´

Reemers Publishing Services GmbH O:/Beck/Spehl_Gruetzner/3d/11_Spain.3d from 06.03.2013 09:30:44 3B2 9.1.580; Page size: 160.00mm  240.00mm

§ 11. Spain

346

Besides, in the case that an employee becomes defendant in a criminal proceeding, depending on the criminal offence he/she is being accused of, the company can be considered responsible at civil law63 or even prosecuted as criminal liable. 138 In that case, the company would also have obligation/right of being represented by a lawyer and a trial attorney in order to exercise its rights and be party to the proceedings. 139 As it has been said before, the Court does not know who pays the lawyer in a criminal procedure, only who is representing whom, so it is not harmful for the company to pay the employee’s legal fees. 140 If the company decides to defray the legal fees for the employee’s lawyer and it becomes party to the proceedings, the relevant decision for the company is to choose being represented by the same lawyer or, if it is more advisable regarding the facts, designate a different one. 137

63

Either directly or vicariously.

Diaz/Heckh/Masso´

Reemers Publishing Services GmbH O:/Beck/Spehl_Gruetzner/3d/12_Switzerland.3d from 06.03.2013 09:31:32 3B2 9.1.580; Page size: 160.00mm  240.00mm

§ 12. Switzerland Para. A. Initiation of internal investigations . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 1 I. When should internal investigations be initiated and to what extent? . . 1 1. Duties to investigate . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 2 a) Duty of senior management to initiate investigations . . . . . . . . . . . 2 b) Duty of a company to initiate investigations . . . . . . . . . . . . . . . . . . . . . 5 2. Extent of investigations . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 8 a) Depth of investigations . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 9 b) Scope of investigations . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 15 II. Should the internal investigation be of an open or covert nature? . . . . 16 III. Is it advisable to involve external investigators? . . . . . . . . . . . . . . . . . . . . . . . 18 IV. Is it permitted for foreign attorneys to conduct internal investigations in Switzerland? . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 20 1. Ban to investigate for foreign states . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 21 2. Ban to divulge Swiss business secrets to foreign entities and states . . 28 V. When should national authorities be called in? . . . . . . . . . . . . . . . . . . . . . . . 35 B. Admissibility and implementation of individual measures within the scope of internal investigations . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 39 I. What measures are admissible within the scope of internal investigations? . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 39 1. In general . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 39 2. Evidence preservation from email accounts, computers etc. . . . . . . . . 45 3. Search term screening of data . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 47 4. Handover and processing of physical employee documents . . . . . . . . 55 5. Employee interviews . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 58 6. Monitoring of ongoing email exchange . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 60 7. Video monitoring of employees . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 63 8. Telephone tapping . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 65 9. Covert listening to, or registering of, private conversations of others . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 67 10. Inspection of personnel files . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 68 11. Investigations carried out in the surroundings of employees under suspicion . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 71 12. Searching of workplace . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 74 13. Amnesty programs . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 75 II. Must employees’ representatives such as the works council be involved in internal investigations? . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 76 C. Employee interviews . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 78 I. May an employee refuse to provide information if this information would incriminate himself/herself? . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 78 II. Is an employee obliged to provide information on any misconduct of, or criminal offences committed by, other employees? . . . . . . . . . . . . . . . . . 79 III. May an employee refuse to answer a question if he/she has already answered it within the scope of a previous interview? . . . . . . . . . . . . . . . . . 81 IV. Is an employee entitled to the presence of a member of the works council or an attorney during the interview? . . . . . . . . . . . . . . . . . . . . . . . . . . 83 V. Is an employee entitled to read a record of his/her interview? . . . . . . . . 86 VI. Is the employer entitled to request that the employee signs the record of the interview? . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 89 VII. Can the employer instruct an employee to treat the content of his/her interview as confidential? . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 92

Livschitz

Reemers Publishing Services GmbH O:/Beck/Spehl_Gruetzner/3d/12_Switzerland.3d from 06.03.2013 09:31:33 3B2 9.1.580; Page size: 160.00mm  240.00mm

348

§ 12. Switzerland Para. D. Sanctions imposed on employees . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 94 I. What are the sanctions under employment law that can be imposed on employees refusing to cooperate in internal investigations? . . . . . . . . 94 II. Is the suspicion of a criminal offence or a severe violation of duty sufficient for an extraordinary termination? . . . . . . . . . . . . . . . . . . . . . . . . . . . 96 III. During which period of time must an extraordinary notice of termination be given to employees whose misconduct has been revealed by the internal investigation? . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 99 IV. Must an employee cooperate in internal investigations even after he/ she has been given notice of termination? . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 100 E. Use of the obtained information . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 101 I. Is it permissible to disclose the findings and information obtained within the scope of any internal investigations to other group companies? . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 101 II. Is it permissible and advisable to forward the findings obtained within the scope of any internal investigations to public authorities? . . . . . . . . . 102 III. Are the findings made in the scope of internal investigations subject to the attorney-client privilege? . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 104 IV. Does the attorney-client privilege also apply to foreign attorneys? . . . . 107 F. Following-up on internal investigations . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 110 I. What is to be observed during the follow-up on internal investigations? . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 110 II. May an employer pay its employee’s legal fees if he/she is being prosecuted under criminal law? . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 112 G. Summary of key results . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 114 H. Appendix . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 115

Bibliography: Berni/Livschitz, Rechtsfolgen mangelhaften Compliance Managements, in: Internationales Handelsrecht III (2009); Bo¨ckli, Schweizer Aktienrecht, 4th ed. (2009); Bru¨hwiler, Kommentar zum Einzelarbeitsvertrag, Art. 319 – 343 OR, 2nd ed. (1996); Cassani, Grenzu¨berschreitende Korruption – Internationale Zusta¨ndigkeit der schweizerischen Strafjustiz, in: Ackermann/ Wohlers (ed.), Korruption in Staat und Wirtschaft, 2010, p. 17 et seqq.; Daeniker, Kann eine Publikumsgesellschaft ihre Organe von Verantwortlichkeitsanspru¨chen schadlos halten?, in: GesKR 3/2009, p. 278 et seqq.; Donatsch (ed.), Schweizerisches Strafgesetzbuch, 18th ed. (2010); Egli, Die Verdachtsku¨ndigung nach schweizerischem und deutschem Recht (2000); Forster, Die strafrechtliche Verantwortlichkeit des Unternehmens nach Art. 102 StGB (2006); Geiser, Die Treuepflicht des Arbeitnehmers und ihre Schranken (1983); Godenzi, Private Beweisbeschaffung im Strafprozess, Diss. (2008); Hauser/Schweri/Hartmann, Schweizerisches Strafprozessrecht, 6th ed. (2005); Honsell/ Vogt/Wiegand (eds.), Basler Kommentar – Obligationenrecht I, Art. 1 – 529 OR, 5th ed. (2011); Livschitz, Strafrechtliche Risiken fu¨r international ta¨tige Schweizer Unternehmen und deren Leitung – Unternehmensstrafbarkeit, Gescha¨ftsherrenhaftung, Geldwa¨scherei, in: EIZ Vol. 84, (2006), 57 et seqq.; Livschitz, Liability of Legal Persons for Corruption – a Swiss Perspective, in: OSCE et al., Criminalisation of Corruption, Paris 2007, p. 9 et seqq.; Maurer-Lambrou/Vogt (eds.), Basler Kommentar – Datenschutzgesetz, 2nd ed. (2006); Mu¨ller, Whistleblowing – ein Ku¨ndigungsgrund?, NZA (2002), 424 et seqq.; Niggli/Wipra¨chtiger (eds.), Basler Kommentar – Strafrecht I, Art. 1-110 StGB; Strafrecht II, Art. 111 – 392 StGB, 2nd ed. (2007); Niggli/Heer/Wipra¨chtiger (eds.), Basler Kommentar – Schweizerische Strafprozessordnung. Jugenstrafprozessordnung (2010); Portmann/ Sto¨ckli, Schweizerisches Arbeitsrecht, 2nd ed. (2007); Rehbinder, Schweizerisches Arbeitsrecht, 15th ed. (2002); Rosenthal/Jo¨hri, Handkommentar zum Datenschutzgesetz sowie weiteren, ausgewa¨hlten Bestimmungen (2008); Schmid, Handbuch des schweizerischen Strafprozessrechts (2009); Schwenzer, Schweizerisches Obligationenrecht, Allgemeiner Teil, 5th ed. (2009); Streiff/von Kaenel, Arbeitsvertrag, Praxiskommentar zu Art. 319 – 362 OR, 6th ed. (2006); Swiss Data Protection and Information Commissioner, Guideline on the Monitoring of Internet and Computers at the Work Place (SDPIC Guideline, available at www.edoeb.admin.ch/dokumentation/00445/00472/00532/ index.html, last visited on 11 February 2010); Wipra¨chtiger, Strafbarkeit des Unternehmens, AJP/ PJA 2002, 754 et seqq.; Zulauf, Kooperationen mit dem Ausland: Verrat an der Schweiz?, Festschrift Peter Nobel (2004).

Livschitz

Reemers Publishing Services GmbH O:/Beck/Spehl_Gruetzner/3d/12_Switzerland.3d from 06.03.2013 09:31:33 3B2 9.1.580; Page size: 160.00mm  240.00mm

A. Initiation of internal investigations

349

A. Initiation of internal investigations I. When should internal investigations be initiated and to what extent? The answer to this question can be split into two parts: the first deals with the 1 duty of either the company or its management or Board of Directors to initiate an internal investigation; the other deals with the extent of such investigation, both in terms of its depth and scope. 1. Duties to investigate Under Swiss law, a number of duties to initiate internal investigations can be identified, either for senior management – or as the case may be – the Board of Directors, and for the company itself. While these duties can not be enforced in forma specifica, violation thereof might entail either criminal or civil liability: a) Duty of senior management to initiate investigations First, under the concept of Officers’ and Directors’ Liability in Swiss criminal law, 2 each member of senior management is responsible for preventing criminal conduct within his or her ambit of responsibilities, provided the conduct in question is anticipated as a typical business risk for the company. This entails, besides putting in place and maintaining those compliance structures which are appropriate and necessary to prevent business-related criminal conduct, the relevant manager’s duty to intervene against specific criminal conduct which he becomes aware of or at least deems possible based on circumstantial indications.1 Under the case law of the Swiss Federal Supreme Court,2 the duty to intervene against specific criminal conduct encompasses the duty to investigate. Once a suspicion or even a reasonable doubt of possible non-compliance with penal laws relating to the company’s business arises, senior management must stop the activity in question and investigate relevant facts until sufficient clarity is obtained so as to judge conclusively whether or not there is a violation.3 A duty to investigate also results from senior management’s duty to put in place and maintain sufficient compliance structures;4 those structures encompass amongst other things, reasonable and appropriate spot checks and audits. If as a result, a suspicion of criminal violations arises, the relevant pattern of facts must be investigated in depth in order to demonstrate within the company that wrongdoing is not tolerated and potential criminal perpetrators will not be left unpunished. In other words, the concept of officers’ and directors’ liability in criminal law entails the duty to investigate, both in order

1

BSK-Seelmann, Art. 11 PC N 51 et seqq. with references; see particularly BGE 122 IV 103. BGE 122 IV 103, consideration VI.2.a. 3 BGE 122 IV 103 ibidem. 4 (Amongst others) BSK-Seelmann, Art. 11 PC N 52 with references; see also Swiss Federal Penal Court, ruling no. SK.2007.21 of 16 May 2008, considerations 5.1.2 and 5.3.3. 2

Livschitz

Reemers Publishing Services GmbH O:/Beck/Spehl_Gruetzner/3d/12_Switzerland.3d from 06.03.2013 09:31:33 3B2 9.1.580; Page size: 160.00mm  240.00mm

350

§ 12. Switzerland

to prevent as well as to deter criminal wrongdoing connected with the company’s business.5 3 Second, the above holds equally true not only for senior management but also for executive Directors (since under Swiss company law, membership in a Board of Directors does not conflict with executive tasks within the company). Nonexecutive Board members however, do not generally fall under the concept of officers’ and directors’ criminal liability pursuant to the case law of the Swiss Federal Supreme Court.6 Nevertheless, in a relatively recent ruling, the Swiss Federal Penal Court held that also non-executive Board members must ensure the existence of all structures and policies appropriate and necessary for the company to be compliant with criminal law relevant to its business.7 Therefore, nonexecutive Directors are well advised to ensure, amongst other things, the existence of corporate policies which define along the lines mentioned above, under what circumstances the company has to commence internal audits or spot checks or where necessary, full-fledged investigations. 4 Third, each Board member holds a fiduciary duty towards the company and its shareholders consisting of, amongst other things, a duty to protect the company’s assets from damage.8 Under this fiduciary duty, the Board of Directors is to put in place and maintain appropriate systems of internal controls and risk management. In supervising these systems for proper functioning, the Board has a duty of “enhanced alertness whenever suspicions of misconduct or damaging activities arise”.9 Logically, this means that the Board is well-advised in such cases to investigate the pattern of facts in question in order to gain sufficient clarity and to prevent damage to the company.10 Finally, the Swiss Code of Best Practices, a soft law code enacted by the Swiss business federation “Economiesuisse” and an important practical source of guidance when interpreting the Board of Directors’ fiduciary duty towards the company – especially in cases of large corporations – not only provides for the Board’s duty to put in place and maintain an appropriate system of internal controls and risk management, but also entails the explicit duty of the Board to have an effective compliance function within the company. The Board shall review “proper compliance” within the company at least once a year.11 Logically, there cannot be any fundamental difference between ensuring “proper compliance” with relevant laws under the corporate fiduciary duty (as interpreted by the Swiss Code 5 Similar: Wipra ¨ chtiger, 756; Livschitz, Strafrechtliche Risiken, 69. Under the case law of the Swiss Federal Supreme Court, it is conceivable to impose such duty not only on senior management but in addition also on lower-ranking management within the scope and possibilities of their corporate responsabilities and powers, see BGE 6S. 447/2003; 120 IV 300. 6 BGE 105 IV 172. 7 Swiss Federal Penal Court, ruling no. SK.2007.21 of 16 May 2008, consideration 5.3.3. 8 See for instance Art. 717 of the Swiss Code of Obligations relating to share corporations, the most popular corporate form under Swiss law. Similar provisions exist relating to other corporate forms, see e.g. articles 538 para. 1, 812 and 902 para. 1 Swiss Code of Obligations. 9 Swiss Federal Supreme Court decision no. 4C.358/2005 of 12 February 2007, consideration 5.2.1. 10 Apparently dissenting in the sense that the Board of Directors should refrain from its own investigation and simply involve prosecutorial authorities: SDPIC Guideline, section 9; this opinion is, however, neither based on relevant authority nor does it otherwise reflect a reasonable approach in line with the Board’s overall duties under company law. 11 Swiss Code of Best Practices, ed. 2008, Sections 19 & 20.

Livschitz

Reemers Publishing Services GmbH O:/Beck/Spehl_Gruetzner/3d/12_Switzerland.3d from 06.03.2013 09:31:34 3B2 9.1.580; Page size: 160.00mm  240.00mm

A. Initiation of internal investigations

351

of Best Practices) on the one hand, and that of officers’ and directors’ liability under criminal law on the other. It can thus be referred to what was elaborated upon under the duty to investigate under criminal law. b) Duty of a company to initiate investigations Under Swiss corporate criminal liability rules, a company can be held liable for 5 active corrupt practices, money laundering, terrorism financing and furtherance of, or participation in, a criminal organization, provided an organizational flaw within the company was conducive to the criminal conduct in question.12 The organizational flaw referred to in this rule is nothing but the lack of necessary and appropriate compliance structures within the company in order to prevent the said criminal offences from occurring within the enterprise, provided that those offences form a part of the business risk which a particular company must reasonably anticipate.13 Similar to the relevant rules under the concept of officers’ and directors’ liability in criminal law (see supra paras. 2 et seqq. “Duty of senior management to initiate investigations”), the company will have to investigate internally – as a part of its appropriate compliance system – whenever a suspicion of criminal wrongdoing arises, be it as a consequence of a spot check or internal audit, be it due to a whistleblowing report or any other indication the company may receive. In analogy to the concept of officers’ and directors’ criminal liability, the company’s duty to investigate serves the purpose of both intervening against specific misconduct and deterring others from violating the law by getting the message across that no perpetrator gets away. It must be pointed out that no relevant case law exists relating to the company’s 6 duty to investigate under the rules of corporate criminal liability. However, given that those rules were developed based on the concept of officers and directors’ criminal liability in essence by replicating the same principles for the company,14 it must be assumed that the case law cited above (see supra paras. 2 et seqq. “Duty of senior management to initiate investigations”) with regard to officers’ and directors’ liability will apply mutatis mutandis to the company. Finally, a duty to investigate may arise from relevant regulation for companies in 7 the regulated financial sector, i. e. for banks, insurance companies, stock exchanges, casinos, companies administrating collective investment schemes as well as financial intermediaries outside the banking business which, instead of joining self-regulatory organizations, opted for direct supervision by FINMA (the Swiss financial market regulator). All those companies might be ordered by FINMA to have an internal investigation conducted by an external audit firm (“Pru¨fgesellschaft”) appointed and paid by the company.15 The external audit firm then reports both to the Board of Directors and, in parallel, to FINMA.16 Furthermore, FINMA may request from any company in the regulated sector any information or data it requires in order to

12 Art. 102 para. 2 Swiss Penal Code in connection with articles 322ter et seqq., 305bis, 260ter, and 260quinquies Swiss Penal Code, as well as with articles 4a and 23 Swiss Act on Unfair Competition. 13 BSK-Niggli/Gfeller, Art. 102 PC N 246 et seqq.; Livschitz, Liability of Legal Persons, 18 et seq. 14 For an in-depth analysis of the underlying concept of liability: Forster, 74 et seqq. 15 Art. 24 Swiss Financial Market Supervision Act (FINMASA). 16 Art. 27 para. 1 FINMASA.

Livschitz

Reemers Publishing Services GmbH O:/Beck/Spehl_Gruetzner/3d/12_Switzerland.3d from 06.03.2013 09:31:34 3B2 9.1.580; Page size: 160.00mm  240.00mm

352

§ 12. Switzerland

meet its duties under the Swiss Federal Act on Financial Market Supervision.17 Logically, this duty to respond to information requests will entail an internal investigation in the company if the requested information cannot be retrieved otherwise. The companies in the regulated sector must then also spontaneously report to FINMA all occurrences that are of relevance for FINMA’s supervision such as significant legal violations, occurrences that would likely require adjustments in the company’s risk mapping, etc.18 A regulated company is well-advised to properly verify and document relevant indications before reporting them to FINMA, which logically results in relevant (albeit initially perhaps limited) internal investigations. Finally, for each regulated industry, more detailed rules relating to their duty to investigate internally may exist under FINMA’s regulations, such as under e.g. a regulation dated December 8, 2010, on the countering of money laundering and terrorism financing in the banking, securities dealing and collective investment businesses19 (providing for, amongst others, the duty to investigate and evaluate in detail transactions with increased risk under Articles 14 and 19). 2. Extent of investigations 8

The extent to which a company must conduct an investigation can be defined both by subject matter (depth) and geographically (scope): a) Depth of investigations

In terms of subject matter, it is important to limit the same to what is necessary and appropriate under the circumstances because, as will be shown below at B. “Admissability and implementation of individual measures within the scope of internal investigations”, limiting the investigation to the necessary and appropriate is a crucial element allowing the company to justify, as the case may be, intrusions into personality and data protection rights of its staff. 10 Limiting to what is necessary and appropriate varies in changing circumstances: If for instance, the investigation is triggered by a specific suspicion of non-compliant conduct, then the conduct in question should be investigated thoroughly, so as to be in a position to prove the wrongdoing in court; be it e.g. in proceedings where the company attempts to recover damages caused by the conduct or, in a labor dispute where the staff in question challenges disciplinary punishment. In these cases, the company will bear the burden of proof for its cause of action or, as the case may be, defense. To this end, the company should not only gather documentary evidence but also talk to potential witnesses about their observations so as to identify who might be offered to the court as a witness in case of litigation, and to be able to better contextualize retrieved documentary evidence, etc.20 If indications of additional wrongdoing arise during these fact gatherings, such additional wrongdoing should 9

17

Art. 29 para. 1 FINMASA. Art. 29 para. 2 FINMASA. 19 SR no. 955.033.0. 20 Such contact with potential witness is permissible for lawyers even in the context of criminal proceedings, provided the witness is not unduly influenced, see e.g. BSK-Ruckstuhl, art. 128 PPC N9. It is advisable to such extent to talk to the witness with another lawyer or paralegal present, and to invite the witness in writing or by email to attend the conversation which ideally should take place on the lawyer’s premises, see BGE 136 II 551, 555 et seq. 18

Livschitz

Reemers Publishing Services GmbH O:/Beck/Spehl_Gruetzner/3d/12_Switzerland.3d from 06.03.2013 09:31:34 3B2 9.1.580; Page size: 160.00mm  240.00mm

A. Initiation of internal investigations

353

be investigated as well based on the duties explained above at 1. “Duties to investigate”. If, on the other hand, the company investigates not based on a specific suspicion but rather in order conduct a routine spot check, then the extent of the same is simply driven by the risk management methodology the company applies, etc. In the latter case it is, of course, important to be able to demonstrate that the risk management methodology is a consistent one and thus, spot checks etc. conducted under that methodology are not just arbitrary but rather a necessity in order to adequately manage the company’s client-, country- and transaction-related risks. However, what the company should not do generally and what is not required to be done as a rule under Swiss law, is to fish for non-compliant conduct without any indication and beyond what is necessary under risk management rules within the framework of spot checks or internal audits. The reason being that besides disrupting effects such “fishing expeditions” might have for the business, they will often entail non-justifiable intrusions into legally protected (data) privacy spheres of the company’s staff. How does one avoid “fishing expeditions”? For instance, if non-compliant conduct occurs in a specific place within the company, it does not necessarily mean that the company or even its division in question is under general suspicion of non-compliance. Such general suspicion is in principle contrary to the presumption of innocence that both the company and its staff enjoy under Swiss law. Largescale screening of data, emails, documents etc. for indications of wrongdoing beyond the specific division in question is then unnecessary and legally not warranted. However, if certain parts of the company are exposed to high risk of a certain type of wrongdoing according to its bona fide risk assessment, then it might be defensible for the company to also screen the remainder of the company division or affiliate in question for analogous wrongdoing other than the specific suspected one, as the high risk exposure might per se indicate additional violations. Also, the company might need to engage in broad screening of data and documents throughout a plurality of divisions or countries without any suspicion or indication of non-compliance whatsoever (and hence, in a “fishing expedition”) because it is pressured into doing so by a foreign authority. Even though such pressurizing is in conflict with Swiss legal principles, agreeing to the fishing exercise sought by the foreign authority might in some instances be simply the cheapest and least burdensome way out of serious legal risk exposure the company might face in the particular country and thus, the exorbitant investigation will not only ultimately be in the shareholders’ interest but it will also likely be warranted by the Board’s and managements fiduciary duty. Further, the subject matter extent of investigations might of course be different if in the regulated sector, the investigation is a result of a FINMA enquiry. In such instance, the subject matter extent is driven in the first place by FINMA’s request for information, and might also be extended if indications of additional wrongdoing emerge in the course of the investigation. Finally, subject matter-wise, the investigation might extend to third party suppliers used by the company such as sales agents, distributors and other suppliers of services and goods if a suspicion arises that those third parties, or individuals employed by them, were involved in non-compliant conduct. This is particularly true where the conduct of such third parties may be imputed to the company such

Livschitz

11

12

13

14

Reemers Publishing Services GmbH O:/Beck/Spehl_Gruetzner/3d/12_Switzerland.3d from 06.03.2013 09:31:34 3B2 9.1.580; Page size: 160.00mm  240.00mm

354

§ 12. Switzerland

as for instance, in case of indirect bribery through an agent or distributor.21 Needless to say, extending the investigation into the ambit of third parties requires their consent. The company should seek to obtain such consent already in advance when negotiating the cooperation agreement, e.g. by agreeing on the third party supplier’s duty to grant the company access to its premises for reasonable spot checks, audits and, where necessary and justified by specific suspicions, further reaching investigative measures regarding the business relationship in question. Where such audit and investigation rights have not been agreed in advance then the company should at least use its bona fide best endeavors to get ad hoc permission.22 b) Scope of investigations 15

Geographically, the extent of investigations is driven by the Board’s and management’s fiduciary duty to preserve company assets and by the geographical extent of the company’s and its management’s ambit of responsibility under criminal law: – As a consequence of the duty to protect the company’s assets, management must extend the investigation to each location where the value of the assets is jeopardized by non-compliant conduct; i. e. if non-compliant conduct occurs within a foreign subsidiary of the company, the Board’s and management’s fiduciary duty owed to the company and its shareholders mandates that such foreign subsidiary also be investigated, provided, of course, the company’s level of control over such subsidiary enables the Board and management to investigate. When it comes to protecting the company and its assets from damages, corrupt practices and money laundering are among the things included. The reason being that first, the use of the company’s money for such activities is not covered by the corporate goal and thus may represent simultaneously a criminal offence of a theft-like nature (under Swiss law: possibly disloyal management according to art. 158 Swiss Penal Code). Second, revenues earned from such conduct cannot be retained by the company because they are subject to criminal forfeiture and money laundering and thus, must be depreciated accounting-wise.23 Third, under Swiss law, jeopardising assets to the extent that the risk incurred must be reflected by booking a provision in the company’s books, is equivalent to damaging these assets. Swiss statutory accounting rules mandate that provisions be booked where the risk in question is at least 25%.24 Such risk level will often be reached in the scenarious of interest here. Consequently, management’s fiduciary duty mandates that internal investigations 21 Art. 2 OSCE Convention on Combating Bribery of Foreign Public Officials in International Business Transactions. See also the rules on instigation or, as the case may be, aiding and abetting in art. 24 and 25 Swiss Penal Code. Needless to say, the duty to extend a proper investigation to third parties (other than, of course, the company’s employees) must be differentiated from precontractual third party Due Diligence, which can likewise be legally mandated. The latter is not covered by the present analysis. 22 Note that a company’s duty to extend compliance efforts to third parties such as suppliers, agents etc. is disputed under Swiss law (against: BSK-Niggli/Gfeller, Art. 102 PC N 66 et seq.; in favor: Berni/Livschitz, 131). In the view advocated here, anti-corruption compliance is hardly possible to manage effectively without involving agents etc., and thus attempting to extend relevant inquiries to third parties can well be mandated under art. 102 Swiss Penal Code; the same might hold true under specific circumstances relating to effective interests protection under management’s fiduciary duty. 23 Berni/Livschitz, 138 et seqq. 24 BGE 116 II 441; ZR 87 no. 79.

Livschitz

Reemers Publishing Services GmbH O:/Beck/Spehl_Gruetzner/3d/12_Switzerland.3d from 06.03.2013 09:31:34 3B2 9.1.580; Page size: 160.00mm  240.00mm

A. Initiation of internal investigations

355

be extended not only where violations target the company’s assets directly (such as theft and fraud) but also, where such assets are jeopardized indirectly through corrupt practices and money laundering. – The duty of the company and its top management to investigate under criminal law reaches geographically wherever relevant criminal conduct can be imputed to the company, its senior management, or Board of Directors. As a general rule, criminal conduct within foreign subsidiaries will be imputed to top management and the parent company to the extent such conduct occurs within the latter’s ambit of organizational control and the manager or parent company in question is a de facto body corporate of the subsidiary.25 Thus, the duty to investigate extends geographically to all parts of the group of companies where top management and the parent company have decisive organizational and factual control e.g. through the possibility to give corporate instructions and enforce corporate policies, through membership in affiliates’ Boards of Directors, etc. – Finally, Swiss companies in the regulated financial sector must ensure compliance with Swiss financial market regulation, including anti-money laundering rules globally throughout their group of companies, to the extent the same is controlled from within Switzerland. FINMA may order the company to conduct, or have an external audit firm (“Pru¨fgesellschaft”) conduct an internal investigation in any of its foreign permanent establishments or affiliates, provided of course such investigations are legally permissible at destination.26

II. Should the internal investigation be of an open or covert nature? Aside from strategic considerations on how best to preserve the evidence 16 required to achieve the goal of the investigation, the following legal rules will be driving a com-pany’s decision on whether to conduct the internal investigation openly or covertly: – According to a number of rules aimed at protecting the employees’ personality and privacy,27 an employer may in principle only process personal data and information relating to the employee insofar as such processing is necessary to evaluate the employee’s fitness for employment or to routinely implement the employment agreement. Any other processing of personal data (including, amongst others, gathering and assessing of evidence relating to the employee in the course of internal investigations) must be either possible to anticipate by the concerned employee under the circumstances, or covered by the employee’s consent or (where the investigation is covert and thus, no consent can be obtained), must be adequate and necessary in order to achieve a goal in the company’s bona fide interest which outweighs the employee’s interests (in particular that of being asked for consent and more generally, not being investigated). The more important the company interests that need to be protected through its investigation and the more 25 BSK-Niggli/Gfeller, Art. 102 PC N 73 and 405 with references; Berni/Livschitz, 132 et seqq. Cassani, 32–36 with references. Dissenting in the reasoning but apparently coming to a similar result: BSK-Pieth Art. 322septies PC N 7 a. 26 Art. 43 Swiss Financial Market Supervision Act. 27 Art. 28 Swiss Civil Code, Art. 328 and 328 b Swiss Code of Obligations, Art. 12 Swiss Data Protection Act etc.

Livschitz

Reemers Publishing Services GmbH O:/Beck/Spehl_Gruetzner/3d/12_Switzerland.3d from 06.03.2013 09:31:35 3B2 9.1.580; Page size: 160.00mm  240.00mm

356

§ 12. Switzerland

prominent the employees’ suspected involvement in the wrongdoing or suspected possession of important evidence, the easier will it be for the company to justify covert investigative measures. For instance, when investigating a serious offence such as fraud, theft of company assets, or corrupt practices, and where the company has reasons to believe the employee might conceal evidence if it investigates overtly, even drastic measures such as covert videotaping might be defensible. In a relatively recent precedent, the Swiss Federal Supreme Court decided that, even in the absence of a specific suspicion relating to historic or ongoing violations, preventive covert videotaping of teller counters without the employee’s knowledge was permissible due to the employer’s outweighing interest to protect large amounts of cash from theft and because the employees were taped only sporadically, thus limiting the intrusion into their personality rights proportionally.28 In consequence the company may as a general rule, choose covert investigative means wherever they can be defended as proportionate under the circumstances, except for some very drastic covert measures (telephone tapping; registering of private conversations, hacking password-protected private computers, etc.) which represent criminal offences that can only be justified in cases of necessity or self-defense (see in more detail below at “B. Admissability and implementation of individual measures within the scope of internal investigations”).29 – The other set of rules that might influence the company’s choice between open or covert investigative means is usability of the evidence obtained for judicial proceedings. However, here too, the general rule is that even evidence obtained illegally (e.g. through phone tapping without the employee’s consent) may still be used by a court if as a result of a balance of interests, the interests of finding out the truth outweighs the employee’s interest of being protected in his privacy and personality.30 The interest of finding out the truth will likely outweigh the employee’s privacy protection interest when the misconduct in question is a serious one. This rule is in line with that discussed above relating to the legality or illegality of the evidence gathering itself, except that even in some drastic cases where criminal provisions prevent the evidence gathering from being legal (such as phone tapping etc.), illegal evidence might still be of use for the company in judicial proceedings. In other words: there is no “fruit of the poisonous tree” doctrine in Swiss law. Thus, also from the point of view of usability of evidence at court, the company may in principle flexibly choose between overt and covert investigative means so long as its choice appears appropriate and necessary in order to find out the truth about a sufficiently serious violation of pertinent law. The rule is: The further-reaching the covert investigative means in breach of the employee’s privacy protection are, the more serious must the investigated violation be to still maintain usability of evidence at court. 17 Against this background, the company is generally (notwithstanding some drastic exceptions) quite flexible in choosing between overt or covert investigative ap28

Swiss Federal Supreme Court decision no. 6B.536/2009 of 12 November 2009, consideration 3.7. As defined in Art. 15 and 17 of the Swiss Penal Code. 30 BGE 109 Ia, 244, 247 = Pra 72 (1983) no. 275, confirmed by the European Court on Human Rights (Schenk vs. Switzerland) in: EuGRZ 1988, 390 et seqq.; Swiss Federal Supreme Court decision no. 1P.51/2007 of 24 September 2007; dissenting (to the effect of usability in general of evidence gathered by a private person and handed over to an authority): Godenzi, 332 et seq. 29

Livschitz

Reemers Publishing Services GmbH O:/Beck/Spehl_Gruetzner/3d/12_Switzerland.3d from 06.03.2013 09:31:35 3B2 9.1.580; Page size: 160.00mm  240.00mm

A. Initiation of internal investigations

357

proaches so long as its choice is proportionate under the circumstances. Typically, the internal investigation will combine an array of both covert and overt investigative means. In most cases, the company will preserve certain evidence covertly such as emails and physical documents, which will be imaged and collected secretly in order to prevent concealment by the data custodians. Such covert evidence preservation is always permissible for the company relating to evidence under its control.31 On the other hand, the company will in many cases also choose to circulate a data preservation notice suspending the company’s usual data destruction policy and asking all employees within the investigated divisions to preserve all data until further notice. Such general instruction does not normally place employees in a position to identify the exact scope and subject matter of the investigation and thus possibly collude (although it could be used to inform the investigated employees about the exact scope of the investigation and the investigative means used, as in principle mandated under data protection rules32); simultaneously, such data retention notice might be necessary in order to avoid directors’ and officers’ criminal liability for concealment of evidence (“Urkundenunterdru¨ckung”) under art. 254 Swiss Penal Code. In addition, the company might well choose to screen and assess emails preserved from certain employees after asking them overtly for consent because according to general experience, in many cases, the employees do not refuse permission, and obtaining the same is more comfortable than having to justify (through discretionary and thus, hard-to-predict balancing of interests) the data screening after the fact. As a matter of practice, most of these tactical combinations of overt and covert means can be justified by the principle of proportionality mentioned above without running into significant problems.

III. Is it advisable to involve external investigators? In addition to factual and tactical reasons relating to special investigative 18 expertise, the need to avoid conflicts of interest, the fact that according to general experience, individuals not involved with the company and thus emotionally unaffected by the investigated facts might be less exposed to investigative errors and misassumptions, etc., there might also be legal reasons to involve external investigators: – The main reason is secrecy. Depending on the specific circumstances, the company might wish to conduct a privileged investigation, the findings of which will not be subject to seizure by the judiciary without the company’s consent. Under Swiss law, legal privilege is a rather narrow concept under which on the one hand, only information and materials that the company leaves with an external attorney (who is a member of a Swiss or foreign bar) in order for him to give the company legal advice will be privileged.33 On the other hand, and in addition to the information the company hands over to its external counsel, any correspondence between the company and external counsel relating to the provision of legal advice will be privileged; regardless of where the correspon31

Rosenthal/Jo¨hri, Art. 328 b CO N 106. See infra para. 45 et seq. Evidence preservation from email accounts, computers etc. 33 See e.g. (as a result) the Swiss Federal Supreme Court decision no. 1B_101/2008 of 28 October 2008. 32

Livschitz

Reemers Publishing Services GmbH O:/Beck/Spehl_Gruetzner/3d/12_Switzerland.3d from 06.03.2013 09:31:35 3B2 9.1.580; Page size: 160.00mm  240.00mm

358

§ 12. Switzerland

dence is located.34 Until January 2011, legal privilege was even narrower, but equally required the involvement of external counsel. Hence, whenever the investigation ought to be privileged under Swiss law, it must be conducted or at least overseen by external counsel. It should be noted, that a draft bill relating to legal privilege of in-house counsels35 was ultimately given up on. – Another legal reason is data privacy. When it comes to investigating covertly and thus, touching upon data universes protected by data protection and personality rights without the concerned employee’s consent, the company needs to prove that data access was a necessity and justified under the circumstances by its own outweighing bona fide interest (see supra paras. 16 et seq. and infra paras. 39 et seqq.). The involvement of external investigators who neither personally know the data subject (employee) under investigation, nor are personally involved with the investigated business, will likely be less intrusive for the employee and thus, the company’s position will be easier to defend under the above-mentioned proportionality test.36 – In the regulated sector, FINMA may ask the company to appoint (and pay for) an external audit firm (“Pru¨fgesellschaft”) admitted by FINMA in order to conduct an investigation it requests.37 However, these external investigators themselves need to submit to FINMA supervision38 and will thus likely be forensic advisory service providers rather than law firms. The above considerations relating to legal privilege do not apply in such instance and in fact, FINMA is, in these cases, entitled to access the information gathered in the investigation.39 19 Beyond the above considerations, involving external lawyers as investigators might be tactically advisable for obvious reasons if the internal investigation is conducted in order to prepare for, or support the company’s defense in criminal or civil proceedings where the lawyers in question represent the company.

IV. Is it permitted for foreign attorneys to conduct internal investigations in Switzerland? 20

Two so-called “blocking statutes” limit foreign attorneys from participating in investigative activities in Switzerland although in principle, investigating on behalf of companies is not prohibited for foreign lawyers under Swiss law: 1. Ban to investigate for foreign states

21

The first rule of interest is the ban to investigate for the benefit of foreign authorities, unless the Swiss federal government (or, if no high profile case is in 34 According to a revision of the law which will become effective in the course of 2013 (exact date is not yet known), correspondence outside the premises of a lawyer will only be privileged if the attorney is admitted to practise in Switzerland, see rev. Art. 264 para. 1 letter d PPC; Art. 51a BZP and Art. 13 para. 1bis VwVG. 35 Thus, for now, there is no in-house counsel privilege in Switzerland as a matter of statutory law in Switzerland. 36 Rosenthal/Jo ¨ hri, Art. 328 b CO N 75. 37 Art. 24 FINMASA. 38 Art. 28 FINMASA. 39 Art. 29 FINMASA.

Livschitz

Reemers Publishing Services GmbH O:/Beck/Spehl_Gruetzner/3d/12_Switzerland.3d from 06.03.2013 09:31:35 3B2 9.1.580; Page size: 160.00mm  240.00mm

A. Initiation of internal investigations

359

question, the competent federal ministry) gives permission to do so (which permission is discretionary, often hard to acquire and thus, will not be elaborated upon here).40 Under this first rule, it is forbidden to gather evidence on Swiss soil which will 22 subsequently be introduced in foreign proceedings, regardless of whether or not such proceedings are already pending at the time of the evidence-gathering or rather, might only be initiated subsequently. However, an exception applies to a party to foreign proceedings who, in order to improve its position, chooses to voluntarily file evidence gathered in Switzerland in these foreign proceedings. This exception applies only to evidence under the direct control of the party in question; whenever a party must collect evidence from third parties, such evidence-gathering will be considered an investigation, and investigations for the benefit of foreign authorities, will always fall under the rule discussed here.41 Further, even where the evidence in question is under the relevant party’s direct control, filing of the evidence in foreign proceedings will be prohibited without permission of the Swiss federal government (or competent ministry) where the involved foreign court or authority seeks production of the evidence through the exercise of coercive power: for instance, by means of a subpoena, a violation of which may entail fines, a conviction for contempt of court, or similarly intrusive sanctions. Conversely, where a production order (or implicit expectation that evidence be produced) is directed at a litigant and non-compliance does entail only sanctions of civil nature, such as assessment of evidence to the relevant litigant’s detriment or so-called terminating sanctions in civil proceedings (i. e. the non-compliant litigant loses), production of the evidence in question will be considered voluntary and not an act for the benefit of the foreign state in question. Gathering of such evidence in Switzerland by the litigant will not fall under the ban to investigate for the benefit of foreign states, so long as the evidence is under the litigant’s direct control. Where a third party (who is not a litigant) is required or expected to file evidence in foreign court or prosecutorial or administrative proceedings, the ban to investigate applies irrespective of the nature of sanction (if any) threatened against that third party.42 In summary, wherever coercive power threatened by a foreign authority or court 23 is involved, or a non-litigant collects evidence for the benefit of foreign proceedings, or relevant information is collected from third parties, one runs the risk of running afoul of Swiss penal law. Hence, whenever foreign attorneys come to Switzerland in order to interview employees, image electronic data from servers, and/or gather physical files in order to, for instance, use this evidence on behalf of a foreign parent company and the parent company plans to file, or might possibly file that evidence in full or in part or even in summarized form in foreign proceedings (criminal, administrative or civil, pending or future), the foreign attorney’s conduct will often fall under the ban to investigate for the benefit of a foreign state. If, however, these foreign attorneys (and their client) strictly refrain from any 24 (present of future) use – directly or indirectly in summarized or processed form – of the materials gathered on Swiss soil in non-Swiss administrative or judicial proceedings, contentious or non-contentious, present or future, then they may 40

Art. 271 Swiss Penal Code. BSK-Hopt, Art. 271 SPC N 15. 42 Guideline of the Swiss Federal Office of Justice, 2005 (currently in revision), p. 23. 41

Livschitz

Reemers Publishing Services GmbH O:/Beck/Spehl_Gruetzner/3d/12_Switzerland.3d from 06.03.2013 09:31:36 3B2 9.1.580; Page size: 160.00mm  240.00mm

360

§ 12. Switzerland

certainly come to Switzerland and conduct their investigation. The same holds true if the evidence in question will be introduced in possible foreign proceedings through mutual legal assistance or administrative exchange of information; in these cases, the ban to investigate for foreign authorities does not apply because a Swiss authority (the one extending mutual legal or administrative assistance) and not a foreign one will receive the data in question. 25 For the sake of completeness, it should be noted that the ban to investigate for the benefit of a foreign authority equally applies to Swiss attorneys; it does not depend on the attorney’s nationality, place of admission or usual place of business. The reason why the relevant rule is mentioned in relation to foreign attorneys is that quite often, foreign attorneys travel to Switzerland exactly for the purpose of investigating internally with a view to non-Swiss judicial or administrative proceedings or even reporting obligations of their client, as a result of which the evidence they gather will likely be introduced in foreign proceedings in violation of the rule discussed here. Non-Swiss attorneys investigating on Swiss soil should thus simply be aware of Swiss blocking statutes and where appropriate or necessary, be prepared to seek advice on what is still permissible under these rules.43 26 Sometimes, the question is being asked whether accessing information e.g. on a Swiss server remotely (via a VPN protocol or through similar means) would bypass the ban to investigate for the benefit of foreign state on Swiss soil. The question has not been tested by courts to date. There are doctrinal opinions who are inclined to allow such remote access if the remote access is being used in the course of ordinary business, rather than installing the same purposely for the investigation in question.44 Although these opinions are more than reasonable, as a practical matter, in the absence of guidance from courts one would simply take a risk allowing such remote access. 27 Finally, the question often arises on how likely a prosecution for violation of the ban to investigate for the benefit of foreign states is. Every prosecution under that rule requires permission by the Swiss federal government (who may delegate the matter for decision to a competent ministry).45 Permission can be denied in the national interest of Switzerland. As a matter of practice, the requirement to seek permission to prosecute represents a certain psychological hurdle for prosecutors to initiate relevant matters. Indeed, prosecutions of, or court convictions for, violations of the ban to investigate for the benefit of foreign states are rarely publicly known. However, needless to say, it is impossible to jump to general conclusions as to the risk of being sanctioned, and one should act with utmost caution in view of the rule discussed here when investigating on Swiss soil internal matters with cross-border impact. 2. Ban to divulge Swiss business secrets to foreign entities and states 28

The second rule of interest is the prohibition to divulge so-called Swiss business secrets to non-Swiss legal entities or organizations or governmental bodies or courts.46 Now, foreign attorneys who investigate in Switzerland will be acting not 43 Especially in the regulated financial sector, Swiss regulation allows for exceptions to the above restrictions for purposes of consolidated supervision, see e.g. Art. 43 para. 2 FINMASA. 44 E.g. Rosenthal, Art. 271 N 35. 45 Art. 66 OCA. 46 Art. 273 SPC.

Livschitz

Reemers Publishing Services GmbH O:/Beck/Spehl_Gruetzner/3d/12_Switzerland.3d from 06.03.2013 09:31:36 3B2 9.1.580; Page size: 160.00mm  240.00mm

A. Initiation of internal investigations

361

only on behalf of (as a rule) a foreign client but also, a foreign law firm: hence, in either case as agents of a non-Swiss legal entity. However, the view advocated here, one cannot consider a Swiss party’s foreign law firm (as opposed to a foreign party’s law firm) a non-Swiss entity in the sense of Art. 273 SPC; such approach would be evidently unreasonable and not in line with the legislator’s intent relating to Art. 273 SPC. But non-Swiss based entities or their lawyers should not, in principle, be given insight into Swiss business secrets. The question now is what counts as a Swiss business secret: A Swiss business secret is any information of commercial value that is not in the 29 public domain outside Switzerland and that typically relates to a business domiciled in Switzerland or a branch or permanent establishment of a foreign business on Swiss soil. In theory, a Swiss business secret can even relate to economically significant information touching upon an employee, such as e.g. an employee’s salary statement.47 But in most cases, only third party businesses with a presence on Swiss soil will be touched upon as a matter of practice, because the investigated parties will normally waive secrecy. A Swiss business secret would for instance be a contract, contractual negotiations, enforcement of a contract or even the breach of the same, etc., all of which is not (yet) in the public domain outside Switzerland. In addition, some doctrinal opinions hold that the (mostly third party) secret’s owner(s) must have a valid reason to expect confidentiality of the relevant information, which depends on the nature of the legal relationship in question. For instance, where the information of interest has been entrusted by the secret’s owner to the party who now wishes to disclose the same, under an agency agreement, a brokerage mandate or another legal relationship involving similar confidentiality duties of the agent, all non-public information which the secret’s owner has entrusted will be considered a Swiss business secret. Conversely, where for example, the party in question is bound by a simple sales agreement with the purported secret’s owner, one may argue that there is no Swiss business secrecy of the latter.48 However, this opinion – although it is more than only reasonable – has not, so far, been tested by courts. Thus, as a matter of practice, looking at the nature of the legal relationship governing the transfer of non-public information from its owner to the party who now wishes to disclose it is of only limited use unless one is already in a defence situation or is prepared to take risks. The ban to divulge such information to a foreign legal entity is also valid intra- 30 group. Hence, a non-Swiss parent company is treated as if it were totally unrelated to the Swiss entity in question when it comes to cross-border disclosure of commercially relevant information from Switzerland. In principle, commercially relevant information relating to a Swiss business etc. may even be deemed a Swiss business secret if it relates to criminal or otherwise illegal activity. Only if the activity in question is also illegal from a Swiss perspective (and thus, relevant information would qualify for mutual legal assistance in criminal matters or administrative exchange of information), can the facts be disclosed abroad without violating the blocking statute discussed here. However, the problem is that often, when the investigation is still ongoing and the completion of the full picture still outstanding, one cannot yet assess whether or not the facts under scrutiny are 47 48

See e.g. BGE 65 I 47. Zulauf, p. 1089.

Livschitz

Reemers Publishing Services GmbH O:/Beck/Spehl_Gruetzner/3d/12_Switzerland.3d from 06.03.2013 09:31:36 3B2 9.1.580; Page size: 160.00mm  240.00mm

362

31

32

33

34

§ 12. Switzerland

indeed illegal. In such a situation, cross-border disclosure of the facts (or even disclosing these facts to foreign lawyers) may mean taking into account a violation of Swiss business secrecy, should the facts ultimately prove to relate to legal conduct. On the other hand, Swiss business secrets may be disclosed abroad to the extent the secret’s owner(s) consents. Such consent does not have to be express; it can well be implied and for instance, result from a contract which needs to anyway be disclosed to a parent company in the course of its implementation, etc. That having been said, a Swiss affiliate of a foreign parent can consent to the disclosure of its own business secrets to the foreign parent company but, if the same secrets also involve third parties with a presence on Swiss soil, then those third parties must also consent, unless their consent results at least implicitly from the circumstances. In view of the above, it is problematic for foreign attorneys to review Swiss business-related information because they might in fact, come across third parties’ Swiss business secrets where not even an implicit waiver exists. Such a situation might well be deemed a forbidden divulgation of Swiss business secrets to a foreign entity (on whose behalf the attorneys are investigating). In order to avoid relevant risks, it is advisable to have the investigation conducted by (Swiss or – in the opinion advocated here but not tested by courts – even non-Swiss) investigators retained by the Swiss entity who is to produce relevant information. These investigators may pre-screen all information gathered for Swiss third party business secrets and either obtain secrecy waivers (where feasible) or alternatively, simply redact all information which might lead to the identification of the Swiss third parties (names, addresses, etc.) before the evidence is transmitted outside Switzerland. In most cases, such redacting will resolve the problem under the Swiss business secrecy rule (although hypothetically, even redacted information might be considered a Swiss business secret where the Swiss economy might have an interest to keep secret not only identities, but also facts such as e.g. a secret fabrication method. Such a hypothetical, however, is rather unlikely to be pertinent in the scenarios of interest here). In cases where it can be conclusively excluded that Swiss business secrets of third parties are touched upon, it is of course not a problem to have the internal investigation conducted by foreign attorneys (provided of course that they are not done for the benefit of a foreign authority, see supra paras. 21 et seqq. “Ban to investigate for foreign states”). The same holds true in the view advocated here where the existence of third parties’ business secrets cannot be conclusively excluded but is not reasonably likely. In such a case, it will be hard for a court to assume that whoever processed the data took into account a possible cross-border divulgation of Swiss business secrets and thus, acted willfully blindly. Willful blindness is the minimum mens rea requirement for being sentenced for breach of Swiss business secrecy. Procedurally, here too, permission to prosecute from the Swiss government (who may delegate the matter to a ministry for decision) is necessary in order for a prosecutor to take action (except for initial protective measures). Like in case of the ban to investigate for the benefit of a foreign state (see supra paras. 21 et seqq.), such permission may be denied in the national Swiss interest and, likely represents a psychological hurdle for prosecutors. Publicly known prosecutions are thus rare in that ambit as well. Also, sometimes, where divulgation of Swiss business secrets e.g. to a foreign court can only be avoided at the cost of being imposed a terminating sanction and losing a significant lawsuit involving a high amount in dispute, it may Livschitz

Reemers Publishing Services GmbH O:/Beck/Spehl_Gruetzner/3d/12_Switzerland.3d from 06.03.2013 09:31:36 3B2 9.1.580; Page size: 160.00mm  240.00mm

A. Initiation of internal investigations

363

be possible to recourse to the defence of necessity. Needless to say, relying on this way out or speculating on the likelihood for the prosecutor to refrain from seeking permission to prosecute, involves great risks and is not generally advisable. Finally, the ban to divulge Swiss business secrets is extraterritorial from a Swiss perspective: in theory, a Swiss prosecutor in principle must take action irrespective of the place of disclosure.49

V. When should national authorities be called in? First, companies within the regulated financial sector have a duty to report any 35 suspicion of money laundering in relation to a client’s assets to the Swiss Money Laundering Reporting Office and in general, whenever there is a reasonable suspicion or knowledge that those assets derive from a serious crime and are subject to the control of a criminal organization or serve the purpose of terrorism financing.50 On the other hand, even for companies in the regulated sector, there is never a reporting obligation and consequently, no national authorities need to be involved in cases where such reporting would self-incriminate the company.51 Beyond anti-money laundering-related reporting obligations, companies in the regulated sector have to report findings of their internal investigations to FINMA whenever such internal investigation was commissioned by FINMA according to Art. 24 and 27 Swiss Financial Market Supervision Act. Furthermore, regardless of whether an investigation by an external audit firm (“Pru¨fgesellschaft”) was mandated by FINMA, companies from the regulated sector have to sua sponte report occurrences that are significant for FINMA’s supervision,52 such as serious violations of laws that touch upon the company’s risk assessment, or serious organizational or compliance problems, or difficulties with foreign authorities, etc.53 For companies outside the regulated sector, a duty to involve national authorities 36 is for example, conceivable in the absence of other (internal) means to prevent damage to company assets. In these cases, a basis for the duty to call in national authorities is the Board’s and/or management’s fiduciary duty towards the company and its shareholders.54 For instance, one could think of a situation where internal investigations revealed a theft of significant assets which- without the help of prosecutorial authorities cannot be traced. Additionally, a fiduciary duty of management or the Board to involve national authorities might arise in order to prevent harm to the company’s reputation and goodwill, for instance when rumors of serious malfeasance within the company leak out to the market, important investors, the financial press, or other significant players, and subsequently lead to a situation where the authorities have to be involved in order to meet bona fide expectations of important stakeholders, etc. Furthermore, involving authorities might be necessary in order to gather certain types of evidence required which the 49 Art. 4 SPC in connection with Art. 273 SPC. On the possibility to raise the defense of necessity see e.g. unpublished judgement of the Police Court of Zug of 25 January 1990, in the matter of R.M. 50 Art. 9 Swiss Anti-Money Laundering Act. 51 BSK-Niggli/Fiolka, art. 102 PC N 83. 52 Art. 29 para. 2 Swiss Financial Market Supervision Act. 53 Message of the Swiss Federal Governmental relating to the FINMASA draft bill, p. 2880. 54 Art. 717 Swiss Code of Obligations and analogous provisions for companies other than the share corporation.

Livschitz

Reemers Publishing Services GmbH O:/Beck/Spehl_Gruetzner/3d/12_Switzerland.3d from 06.03.2013 09:31:36 3B2 9.1.580; Page size: 160.00mm  240.00mm

364

§ 12. Switzerland

company is not allowed to collect privately in the circumstances such as e.g. tapping of phone conversations.55 Moreover, it might be adequate and even required under management’s fiduciary duty to report individual perpetrators to prosecutorial authorities in order to ensure the message gets through internally that perpetrators of serious violations do not get away just with disciplinary sanctions under labor law, or to sue these perpetrators in court to recover damages. However, these scenarios will, as a rule, be rather drastic situations of serious delinquency. Further, in instances where employees use their private IT assets, private email IDs (gmail, yahoo, etc.) or social media accounts (facebook etc.) to commit violations, the company has rarely any legal means to access relevant data in the absence of the employee’s agreement (given ad hoc or in advance contractually, including by agreeing to relevant IT policies), other than calling in prosecutorial authorities.56 Finally, it may be advisable to report e.g. questionable payments to the tax authorities in order to benefit from the amnesty granted for first time voluntary disclosure under Art. 175 para. 3 SDTC and Art. 56 para 1bis STHC; Art. 13 SAPC. 37 On the other hand, there is never a legal duty to call in authorities when such involvement would expose the company to the danger of self-incrimination (which is always the case where active corruption, money laundering, terrorism financing or participation in or furtherance of criminal organizations on behalf of the company is involved). Similarly, individual members of management or the Board cannot be expected to incriminate themselves in order to fulfill their fiduciary duties. 38 In the absence of a duty to involve public authorities, the company should be aware that public authorities are often not very helpful to the company because they usually pursue a completely different agenda and also, because under Swiss law, the results of an internal investigation – even if the same may have been finalized already – do not in principle release the public authorities from conducting their own investigations. The public authorities are, as a general rule, free to consider the evidence offered by the company but will typically want to double-check and complement the same with their own additional evidence and investigative steps; the reason being that investigations by public authorities in Switzerland are governed by the principle of inquisitiveness which provides for the authorities to take the lead.57 Likewise, certain evidence such as in particular, employees’ interviews, will not be usable in court as witness depositions unless repeated in a formal witness deposition under the controlling procedural rules. This having been said, the involvement of public authorities will as a rule be disruptive to the business and 55 See in more detail below at B. Admissability and implementation of individual measures within the scope of internal investigations; the opinion advocated by the Swiss Data Protection and Information Commissioner according to which public authorities must be involved whenever evidence for suspected criminal conduct within the company needs to be collected (SDPIC Guideline, section 9) goes too far, as it is neither legally warranted or reasonable. 56 Alternatively, seeking a civil court injunction under art. 158 Swiss Civil Procedure Code (on “preliminary taking of evidence”) might work, depending on the circumstances and the suspected violation, the rank and position of the employee, his/her purported involvement, the scope of his/ her fiduciary duties and the information the company already has on his data. To date, the matter, however, appears to be untested under art. 158 Swiss Civil Procedure Code. 57 Hauser/Schweri/Hartmann, § 53 N 8. This principle is, however, put into perspective by the possibility for the company to apply for so-called abbreviated proceedings, giving the prosecution some discretion to rely on the company’s own gathered evidence and resolve the case through plea bargaining: see Art. 358 et seqq. PPC.

Livschitz

Reemers Publishing Services GmbH O:/Beck/Spehl_Gruetzner/3d/12_Switzerland.3d from 06.03.2013 09:31:37 3B2 9.1.580; Page size: 160.00mm  240.00mm

B. Admissibility and implementation of individual measures

365

entail significant additional costs for the company without providing added benefit. In the absence of the above scenarios where involvement of public authorities might be necessary particularly as a consequence of the Board’s and/or management’s fiduciary duty, the company will perhaps prefer to conduct its own investigation discreetly and solve the problem without involving public authorities.

B. Admissibility and implementation of individual measures within the scope of internal investigations I. What measures are admissible within the scope of internal investigations? 1. In general Typically, an internal investigation will start with preservation of evidence through 39 the imaging of electronic data (particularly emails) and gathering of physical documents; in the following, both types of evidence shall be referred to as “documentary evidence”. The subsequent steps are, as a rule, a preliminary analysis of documentary evidence (through search term screening of emails and other data) and thereafter, interviews with employees who can deliver explanatory or, as the case may be, additional information relating to the documentary evidence. Possibly, other investigative means such as monitoring of ongoing email exchanges, video surveillance of employees, tapping of telephone conversations, or an array of other covert investigative steps might become necessary and adequate in order to fully investigate the pattern of facts. Most of these investigative measures likely interfere in principle with a number of 40 legal protections for the employee’s benefit. First, in general the protection of his/ her privacy sphere and personality;58 second and in particular, the protection of the employee’s personal data privacy;59 third, the ban under criminal law of tapping or intercepting non-public telephone conversations, or of recording non-public conversations;60 fourth, the ban under criminal law to hack password-protected automated data processing devices of others;61 fifth, the ban of unauthorized remote data processing on computing devices of others;62 and lastly, the ban under criminal law of unauthorized gathering of sensitive personal data or personality profiles from data collections of others.63 In principle, these protections can be validly waived (even implicitly) by the (duly 41 informed) employees concerned, and to the extent waivers are refused or cannot be obtained for other reasons (such as absence, sickness, etc.); the protections (except for those under criminal law) can be set aside based on an interest-balancing test (also known as “proportionality test”): That is, investigative measures are permissible whenever they represent appropriate and necessary means (i. e. no milder 58 Art. 13 Swiss Federal Constitution, Art. 28 Swiss Civil Code, Art. 328 b Swiss Code of Obligations and Art. 26 Ordinance no. 3 under the Swiss Labor Act. 59 Art. 328 b Swiss Code of Obligations, art. 4 set seqq. Swiss Data Protection Act. 60 Art. 179bis, 179ter and 179quater Swiss Penal Code; Art. 50 Swiss Telecommunication Act. 61 Art. 143bis Swiss Penal Code. 62 Art. 45 c Swiss Telecommunication Act. 63 Art. 179novies Swiss Penal Code.

Livschitz

Reemers Publishing Services GmbH O:/Beck/Spehl_Gruetzner/3d/12_Switzerland.3d from 06.03.2013 09:31:37 3B2 9.1.580; Page size: 160.00mm  240.00mm

366

§ 12. Switzerland

measures would be effective) to achieve a bona fide goal for the company that outweighs the employee’s interest not to process his personal data.64 Where investigative means are banned under criminal law (i. e. in cases of hacking, phone tapping, and other drastic and rather exceptional investigative steps),65 exceptions are only permissible in scenarios of self-defense or necessity (i. e. where an attack against the company’s legally-protected, outweighing interests is imminent and additionally, the investigative means in question are the only effective possibility to defend the said interests).66 42 On the other hand, where data privacy rules are violated (because the data processing is justified neither by an informed waiver nor by the proportionality test), except for the said violations of criminal law, the legal risk exposure is as a rule relatively mild for a company: Other than possible claims for injunctive relief,67 the company will in most cases be faced with in essence just damage claims; “just” damage claims because the employee would have to prove his or her economic damage, which as a rule will be quite limited – if at all provable – in the scenarios discussed here, and because moral damages never reach significant amounts in Swiss law.68 In addition, mild fines (up to CHF 10,000) could be imposed upon the individuals involved in cases where so-called “sensitive” personal data (about illnesses, religious orientations, etc.) or “personality profiles” (i. e. data universes permitting conclusions about the employees’ essential personality traits) are being processed illegally, or where a company omits to notify the Swiss Data Protection and Information Commissioner about its group-wide binding corporate rules (BCRs) relating to cross-border data transfers.69 These latter violations, however, occur rather rarely in the context of internal investigations. 43 Although as a result, most potential data privacy violations by the company that might occur during an internal investigation only result in exposure to, in essence, (hard-to-prove) civil damage claims, a company who for whatever reason seeks to avoid even those will be well advised to put in place and ask its staff to sign off on a corporate policy providing as much information as possible on investigative data processing, and seeking as much employee consent as possible in advance: Such policy should preventively address the company’s reasonable needs (and as the case may be, routines) to access personal employee data from time to time and to the extent feasible, anticipate not only routine spot checks and audits but also, the company’s measures possibly used in the course of investigations of suspected wrongful conduct (including monitoring of emails, potential video taping etc.). Since the main rule is that any investigative step covered by the employee’s informed 64 Rosenthal/Jo ¨ hri, Art. 328 b CO N 71 et seqq. and N 92 et seqq.; BGE 130 II 425 = Pra 94 (2005) no. 71, consideration 4.2. with references. 65 Entailing punishment with jail terms up to 3 years or fines, along with an entry in the criminal register. 66 Art. 15 and 17 Swiss Penal Code. 67 Which in cases of systemic flaws and a bearing on a large number of individuals, may also be sued for by the Swiss Data Protection and Information Commissioner (Art. 29 Swiss Data Protection Act); however, where the company involves outside counsel and as a consequence, the investigation is privileged, the Commissioner has no access to the relevant data and his investigative and remedial powers become, as a consequence, unenforceable. 68 E.g. Schwenzer, N 17.12 et seqq. 69 Art. 34 in connection with Art. 6 para. 3, 14 or 11 a Swiss Data Protection Act as well as Art. 106 para. 1 and 333 para. 1 Swiss Penal Code.

Livschitz

Reemers Publishing Services GmbH O:/Beck/Spehl_Gruetzner/3d/12_Switzerland.3d from 06.03.2013 09:31:37 3B2 9.1.580; Page size: 160.00mm  240.00mm

B. Admissibility and implementation of individual measures

367

consent is permissible, seeking informed permission in advance is the simplest and cheapest approach for a company, and once an employee has signed-off on a wellworded policy, it will in many cases likely be hard for him or her to argue after the fact that the waiver did not cover (because he or she did not reasonably anticipate) the investigative situation in question.70 In the absence of (or as the case may be, in addition to) such advisable policy, the 44 following rules apply to the investigative steps mentioned below: 2. Evidence preservation from email accounts, computers etc. Preservation of evidence is normally the very first measure adopted in internal 45 investigations. It usually consists of a combination of covert data imaging (preponderantly emails from archives and live servers), overt data imaging (particularly from desktops, laptops and other mobile computing devices), and a data retention notice circulated within the company divisions under investigation. A data retention notice offers a good opportunity to inform the employees concerned on the extent and purpose of processing of their personal data during the investigation, as is in principle required under Swiss data protection rules.71 But circulating a data retention notice does not yet qualify as data processing so that informing the employees about the scope and purpose of processing may be postponed or even omitted entirely, if this is likely to jeopardize the investigation and the omission is warranted under the “proportionality test”.72 However, it is in principle advisable to inform the affected data subjects as soon as viable, in order for the company to reduce its risk exposure under data protection law. None of these measures represents a problem in practice: even covert evidence 46 preservation (which as a rule, is done routinely by automatic backup systems anyway) is something the employer is entitled to at all times,73 and if in case of overt data imaging (e.g. from an individual’s company laptop) an employee does not cooperate voluntarily, the company may demand that the employee grant access to his (company-owned) computing device for the purpose of data preservation. The company may also access the said computer without the assistance of or in the absence of the employee even if it is password-protected, for the purpose of evidence preservation. In doing so, the company will not be committing the criminal offence of hacking password-protected data processing systems of others,74 simply because the company computer in question is not one “of others” but belongs to, and may be legally accessed by, the company,75 unless the computer is used for private purposes only (which in the scenarios of interest here, will hardly be the case).

70 Indeed, data processing is legal where it could be anticipated by the affected data subject in the circumstances, see Art. 4 para. 4 DPA. 71 Art. 4 para. 4 Swiss Data Protection Act. Note that mere recognizeability (as opposed to express and detailed information) in the circumstances suffices under that rule. 72 See supra paras. 39 et seqq. 73 Rosenthal/Jo ¨ hri, Art. 328 b CO N 103 and 106; Swiss Data Protection and Information Commissioner, cited above at Fn. 10, section 8.5.2. 74 Art. 143bis Swiss Penal Code. 75 Mutatis mutandis also: ROSENTHAL/JO ¨ HRI, Art. 45 c TCA N 22.

Livschitz

Reemers Publishing Services GmbH O:/Beck/Spehl_Gruetzner/3d/12_Switzerland.3d from 06.03.2013 09:31:37 3B2 9.1.580; Page size: 160.00mm  240.00mm

368

§ 12. Switzerland

3. Search term screening of data Typically, the next step will consist of screening email accounts for data that responds to a set of search terms. Such screening represents processing of personal data of employees falling under Swiss data protection rules, to the extent the computers or email accounts in question are personalized (e.g. because the email address reads “[email protected]” as opposed to “[email protected]”, or through the assignment of company laptops or PCs for the personal use of a particular employee). The screening in question will be deemed processing of personal data regardless of whether or not private use of company email accounts or computer devices is prohibited. Even in cases where email and other electronic data are used for business purposes only, personalization of email accounts or computer devices suffices for the data to be considered personal data and for the search term screening to be regarded as personal data processing.76 Under personal data processing rules, the data processing must either be permitted by the data subject (the employee) or in the absence of informed permission (including recognisability in the circumstances), justified under the “proportionality test”.77 48 In view of the above, it is in principle advisable to conduct search term screening overtly wherever this option is tactically viable. This is because, if the employee gives informed permission, a (discretionary and thus, hard-to-predict) proportionality test will not be necessary. In addition, experience shows that the data subjects quite often, consent to screening, even in cases where they are involved in wrongdoing (since they either believe they will be able to “explain” the facts under investigation or, they sense the truth will come to light anyway and refusing consent would not ultimately benefit their cause). If seeking an employee’s consent is not a viable option then the proportionality test needs to be conducted and in case of sufficiently serious wrongdoing under suspicion, the company as a rule will be able to claim its prevailing interest in processing the data where its custodian is under suspicion of a significant violation or even, of only possessing relevant evidence without being implicated.78 The situation may look different under the proportionality test if for instance, the data screening relates to just petty non-compliance or is not triggered by a specific suspected violation but rather, part of a mere spot check within the framework of the company’s risk management or compliance policies. Then e.g. covert spot checks in the company’s non-personalized accounting entries or screening of anonymous or pseudonymous server protocols etc. might suffice. In view of the foregoing, it is advisable for the company to document the scope of data screening, the search terms used and the investigated suspicion in a written investigative plan. The company will then be in a better position to prove proportionality of data processing. 49 The above limitations to the company’s data processing rights apply regardless of whether or not private email use is permitted for the employees under investigation, which means: – First, it does not make a lot of sense from a Swiss perspective to rely on a distinction between permitted and prohibited private email use because even where private email use is prohibited, it is unavoidable anyway as a matter of 47

76

Rosenthal/Jo¨hri, Art. 328 b CO N 103. See supra paras. 39 et seqq. 78 Rosenthal/Jo ¨ hri, Art. 328 CO N 72. 77

Livschitz

Reemers Publishing Services GmbH O:/Beck/Spehl_Gruetzner/3d/12_Switzerland.3d from 06.03.2013 09:31:38 3B2 9.1.580; Page size: 160.00mm  240.00mm

B. Admissibility and implementation of individual measures

369

practice and in most enterprises, tolerated within reasonable limits.79 An employer cannot prohibit with legal effect what it tolerates daily. – Second, it results from the above that an employer must in most cases expect to come across private emails even where private emailing is forbidden, and the prohibition to use company email accounts for private purposes does not alter the nature of a private email- it remains private if it is indeed private. On the other hand, where private email use is generally not allowed the company can benefit from the presumption of all emails being business-related until proof of the contrary.80 The same presumption applies where private use is restricted to folders, accounts etc. that are labeled accordingly and the employer screens folders or files without privacy labels. – Third, the question whether or not the employer may process for the purposes of its internal investigation private emails he comes across in business email accounts, must be answered in function of the proportionality test, exactly as for business emails: Would such processing be a necessary and appropriate means to find out the truth about the subject-matter of the investigation, and does the goal pursued in the investigation outweigh the employee’s interest in privacy? As a rule, the answer will be no for private emails, and the company will have no interest whatsoever (let alone an outweighing one) to even look at them.81 Private emails should thus simply be excluded from the universe of data responsive to the search term screening. Two exceptions to this rule are, however, conceivable: First, where emails have both private and business-related content (which is often the case where over time, employees develop personal friendships in addition to their working relationships), the emails may be processed nonetheless but processing must be a priori limited to business content; all content of private nature should be disregarded and for the purposes of follow-up processing, redacted.82 Second, if a reasonable suspicion arises that an employee under investigation has likely hidden responsive relevant information in private emails then these emails may be processed to the extent necessary provided, of course, the proportionality test warrants covert processing (because e.g. a suspicion of a serious offence such as bribery is under investigation).83 In the absence of either a specific suspicion of wrongdoing or a compliance- 50 driven necessity for a spot check (in both cases outweighing the employee’s interest in data privacy), the company’s right to process personal employee data is in principle limited to monitoring the employee’s professional performance and to what is necessary to routinely implement the employment contract (such as processing social security numbers, names, birthdates etc.). The company must not solely (and not even preponderantly) monitor the employee’s general behavior at work.84 As a rule, the company will not be able to reasonably assert an outweighing 79

Rosenthal/Jo¨hri, Art. 328 b CO N 77 and 103. Rosenthal/Jo¨hri, Art. 328 b CO N 77. 81 Rosenthal/Jo ¨ hri, Art. 328 b CO N 78. 82 Rosentahl/Jo ¨ hri, ibidem. 83 According to a part of doctrinal literature, data that is marked “private” can only be accessed based on a court ruling (BSK-Winterberger-Yang, Art. 328b/362 CO N 22 [in the BSK on the DPA]). This opinion is neither backed by case law, nor is it in line with art. 4 Swiss Data Protection Act allowing data processing unconditionally to the extent justified under the proportionality test, unless criminal law kicks in. 84 Art. 59 para. 1 letter a Swiss Labor Act; art. 26 ordinance no. 3 under the Swiss Labor Act. 80

Livschitz

Reemers Publishing Services GmbH O:/Beck/Spehl_Gruetzner/3d/12_Switzerland.3d from 06.03.2013 09:31:38 3B2 9.1.580; Page size: 160.00mm  240.00mm

370

§ 12. Switzerland

necessity to screen (without the employee’s permission) employee emails and other personal data just in order to assess professional performance. This absence of outweighing interest of the company is also the reason why accessing personal employee email accounts or files within the framework of a mere “fishing expedition”85 will likely not be permissible under data and personality protection rules. 51 The limitations outlined above as a rule do not apply to non-personalized email accounts (e.g. [email protected]) regardless of whether individual employees of the company may be identified as dealing with the emails in question.86 The reason being that employees who use non-personalized company accounts cannot reasonably expect the same level of data privacy as in personalized accounts: i. e. data retrieved from non-personalized email accounts in principle may be processed at the company’s discretion. As a practical matter, non-personalized email accounts are rarely of interest for internal investigations anyway. 52 Further, it should be mentioned for the sake of completeness that search word screening by the company of emails retrieved from (even password-protected) personalized company email accounts does not fall, in the view advocated here, under the “hacking” offence under criminal law (i. e. the ban of unauthorized access to password-protected data processing systems of others).87 The simple reason being that for the company, company accounts are not data processing systems “of others” but rather, its own data processing systems: At least where a computer or account is not used exclusively for the employee’s private purposes, the company must be regarded as in principle authorized to access the data processing system. However, this question has never been conclusively ruled upon by a court88 but a more stringent interpretation than that suggested here – namely one prohibiting the company from accessing its own business emails on personal employee accounts – would appear quite unreasonable and ultimately not practicable. 53 The analysis with regard to “hacking” is, of course, a different one if the company accesses an employee’s private email account hosted outside the company’s infrastructure. In such a case, the company would indeed expose itself to the risk of punishment under the “hacking” offence if the email account is password-protected.89 Situations where the company can reasonably assert self-defense or necessity (i. e. preventing an imminent attack against the company’s prevailing interests90) would be quite unlikely. Against this background, the company as a rule should call in prosecutorial authorities in order to have private employee data outside the company’s own infrastructure screened, and the authorities will have to arm themselves with a relevant court warrant to be able to conduct the screening legally.91

85

See supra paras. 8 et seqq. Rosenthal/Jo¨hri, Art. 328 b N 103. 87 Art. 143bis Swiss Penal Code. 88 In BGE 130 III 28, consideration 4.2 = Pra 2003 Nr. 115, the Swiss Federal Supreme Court held that unauthorized accessing by an employee of a password-protected email account of his superior used preponderantly privately, would be considered hacking. This case is obviously not comparable with the situation discussed here. However, it can be argued e contrario that accessing a company computer preponderantly used for business purposes does not constitute hacking. 89 Here, BGE 130 III 28 (see above at Fn. 77) would well be comparable and pertinent. 90 See Art. 15 and 17 Swiss Penal Code. 91 Art. 269 et seqq. Swiss Penal Procedure Code. 86

Livschitz

Reemers Publishing Services GmbH O:/Beck/Spehl_Gruetzner/3d/12_Switzerland.3d from 06.03.2013 09:31:38 3B2 9.1.580; Page size: 160.00mm  240.00mm

B. Admissibility and implementation of individual measures

371

Finally, it should also be pointed out that emails do not fall under mail secrecy 54 (violation of which is criminally punishable92). Mail secrecy is limited to physical, postal mails in sealed envelopes. In the opinion advocated here, emails do not fall under mail secrecy, not even if they are encrypted.93 4. Handover and processing of physical employee documents The rules outlined above in relation to emails and other electronic data apply 55 mutatis mutandis to physical documents: First ask for informed consent. If no consent is obtained or asking is not viable, process only if warranted under the proportionality test, i. e. as far as necessary and appropriate in order to reach a bona fide goal that outweighs the employee’s interests (such as possibly the investigation of suspected serious wrongdoing, etc.); no processing for general behavior monitoring; processing allowed insofar as necessary for performance monitoring (which, however, will not as a rule be the case). Each individual case must be assessed separately; predicting the outcome of the proportionality test in court is generally difficult. In practice, processing of physical documents might be slightly more permissible than that of emails because, for example, within the framework of a general routine spot check covered by the company’s risk management policy, it may indeed be necessary for instance, to check on the correct entry in the accounting system of an invoice directly addressed to an employee even in the absence of the employee’s permission, etc. Additionally, given that the data universes in question will likely be significantly narrower than in the case of electronic data, it might be fair and appropriate for the company to ask the concerned employee to personally assist in the selection of responsive documents, exclusion of strictly private documents, etc. Moreover, it must be noted that mail secrecy (violation of which is a criminal 56 offence94) applies to physical letters in sealed (not just closed but, actually sealed or glued) envelopes addressed to employees personally. If, however, the envelope is addressed to the employer and marked to the attention of the relevant employee (and not labeled “confidential” or “private” or something similar), then the envelope may be opened by the company without breaching mail secrecy.95 If a company feels it needs to open sealed personal letters belonging to employees (and addressed to them privately) then as a rule, it must call-in prosecutorial authorities unless opening is necessary to prevent an imminent danger to the company’s prevailing interests (i. e. in cases of self-defense or necessity96). As a matter of practice, processing physical files is usually not of utmost 57 importance for internal investigations. Most proof will be found in email accounts and other electronic data, and even letters exchanged physically are often additionally circulated electronically. Physical document processing is thus often 92

Art. 179 Swiss Penal Code. Likewise: Donatsch, 285; Rosenthal/Jo¨hri, Art. 328 b CO N 87; BSK-von Ins/Wyder, Art. 179 PC N 20 et seqq. Also, contrary to certain foreign legislations, a company allowing for private use of its infrastructure does not become a telecommunications services provider and thus, is not subject to telecommunications secrecy under Art. 43 TCA. 94 Art. 179 Swiss Penal Code. 95 BGE 114 IV 16. 96 Art. 15 or 17 Swiss Penal Code. 93

Livschitz

Reemers Publishing Services GmbH O:/Beck/Spehl_Gruetzner/3d/12_Switzerland.3d from 06.03.2013 09:31:38 3B2 9.1.580; Page size: 160.00mm  240.00mm

372

§ 12. Switzerland

limited to the screening of corporate documents such as Board minutes etc; these documents will be made available, as a rule, by the company and the involved individuals voluntarily so that generally, processing of physical documents does not pose practical problems. 5. Employee interviews Employee interviews are permissible based on the company’s right under labor law to ask the employee for any information and documentation relating to his or her tasks or ambit of responsibility.97 In principle, an employee must cooperate and provide the company with the information sought under the fiduciary duty towards his or her employer.98 However, the employee’s duty to cooperate ceases where he/ she would risk incriminating himself/herself.99 In the opinion advocated here, the same holds true whenever the employee is asked to “testify” against close relatives, i. e. the classic right to refuse testimony known under procedural rules should be granted also in employee interviews; this results from an interpretation of the employee’s right to personality protection under Art. 28 of the Swiss Civil Code which (in the sense of horizontal effect) also takes into account civil rights granted under the Federal Constitution including procedural rights derived from such civil rights. 59 Should an employee refuse cooperation at an interview without being protected under the privilege against self-incrimination (including the privilege not to provide information on close relatives), the employer may adopt appropriate disciplinary measures under labor law. The appropriateness of a measure must be assessed based on all circumstances, including the seriousness of the allegations being investigated, the importance of the investigation for the company, the significance of the refused cooperation for the investigation, the employee’s rank and position, etc. In drastic cases a company might even be in a position to terminate the employee in question without exposing itself to the consequences of abusive termination (which consequences are incidentally limited to a damage compensation capped at six months’ salary100 and if the unjustified termination is a summary one, additionally paying the salary for the duration of the notice period). 58

6. Monitoring of ongoing email exchange 60

The rules outlined in relation to email screening apply here by analogy. It is hard to imagine that live email monitoring is necessary in order to monitor professional performance or for any other routine task as a compliance spot check.101 Often, live monitoring is likewise unnecessary in order to prevent for example, internet policy violations because in such cases, it will usually suffice to simply block relevant sites, email accounts etc. or to conduct the screening on a no-name basis. In most 97

Portmann/Sto¨ckli, N 369. Godenzi, 55 with further references. 99 Godenzi, 56 with further references. 100 See Art. 337 c para. 3 Swiss Code of Obligations. 101 However, permanent monitoring through anonymous or pseudonymous email protocol screening (without content screening of the proper mails) is permissible at all times in order to prevent email and internet abuses etc.; SDPIC Guideline, section 6. 98

Livschitz

Reemers Publishing Services GmbH O:/Beck/Spehl_Gruetzner/3d/12_Switzerland.3d from 06.03.2013 09:31:39 3B2 9.1.580; Page size: 160.00mm  240.00mm

B. Admissibility and implementation of individual measures

373

scenarios, live email monitoring will be a rather drastic measure where screening of saved emails and/or employee interviews have revealed e.g. ongoing or – even worse: repeat – delinquency. Seeking consent from the employee will not be tactically advisable in such a situation and the question will then boil down to the proportionality test:102 is the monitoring really necessary and adequate to find out the truth about the suspicion in question, also taking into account the concerned employee’s interest? If the suspicion and the underlying violation are serious enough, monitoring will often be permissible even in the absence of a waiver from the employee.103 Here too, the pertinent general rules elaborated on above must be kept in mind: no monitoring of (preponderantly) general behavior at work,104 no “fishing expeditions” as a rule, redacting of private (as opposed to just personal) information, keep monitoring strictly to the absolute necessary minimum in terms of time and scope. Further, the employees concerned need to be informed about the goal and scope of monitoring and the means used as early as possible, and must be given an opportunity to make observations.105 If however, an employer wishes to use live email monitoring in order to monitor (preponderantly) general behavior at work, the employees always need to give an informed consent in advance.106 Often, companies wish to covertly monitor live email exchange in order to gather 61 evidence for an employee’s breach of contractual duties such as non-compete obligations and the like. In such situations, monitoring live email traffic is delicate; although the conduct in question might be quite detrimental to the company, it could still be regarded as a borderline case under the proportionality test as long as no criminal offence (such as divulgations of commercial secrets etc.) is reasonably suspected. If nonetheless the company opts for monitoring it is especially critical to restrict it to what is really necessary, in particular, not to capture the full email traffic but rather, use appropriate search term-based filtering. Otherwise, beyond having to defend against civil claims under data protection law, the company risks not being able to use the evidence gathered in civil court. It is advisable to document the scope of monitoring and the exact rationale underlying the same in a written investigative plan. It should be mentioned that live email monitoring does not fall under the criminal 62 offence of wrongful interception of ongoing telecommunication107 to the extent the email traffic in question is hosted on the company’s own servers or on servers of a service provider appointed by the company. The reason being that in these cases 102

As was quintessentially confirmed by the Swiss Federal Supreme Court in regard of video monitoring (and thus, relating to an analogous problem): BGE 130 II 425 et seqq. = Pra. 94 (2005) no. 71; consideration 4.2 with further references. 103 Rosenthal/Jo ¨ hri, Art. 328 b CO N 96 et seqq. with references; In essence also Swiss Data Protection and Information Commissioner, cited above at Fn. 10, sections 6 and 7; the Swiss Data Protection and Information Commissioner requires, however, that the company previously put in place monitoring guidelines where the employees are informed about the abstract possibility of monitoring in case of abuses (Swiss Data Protection and Information Commissioner, cited above at Fn. 10, section 7). Although such guidelines are advisable they are not an absolute requirement for email monitoring; the same can be permissible also in the absence of monitoring guidelines if monitoring is justified under the proportionality test. 104 See also Art. 26 Ordinance no. 3 under the Swiss Labor Act. 105 Art. 5 et seq. Ordinance no. 3 under the Swiss Labor Act. 106 Art. 26 of Ordinance no. 3 under the Swiss Labor Act. 107 Art. 50 Swiss Telecommunication Act.

Livschitz

Reemers Publishing Services GmbH O:/Beck/Spehl_Gruetzner/3d/12_Switzerland.3d from 06.03.2013 09:31:39 3B2 9.1.580; Page size: 160.00mm  240.00mm

374

§ 12. Switzerland

(i) the company was meant to receive the email traffic on its – or its provider’s – server (otherwise the employee in question a priori could not receive it) and (ii) interception in the sense of the criminal offence can only be committed by a party who should not have received the communication; it is irrelevant for whom the content was intended, the offence relies on the intended receipt only, not on the addressee of the content. The analysis is, of course, a different one if the company captures live email traffic from an employee’s account hosted outside the company’s IT infrastructure. Then the emails are received by an unintended recipient and diverting the email traffic might well fall under wrongful interception of ongoing telecommunication. 7. Video monitoring of employees Video monitoring of employees is governed by the same principles as monitoring of live email traffic: no monitoring of just (preponderantly) general behavior at work unless previously permitted by the employee on an informed basis; permissible to the extent warranted under the proportionality test.108 Under this test, the necessity for video monitoring must be pressing (i. e. absence of milder measures to uncover the facts under investigation is required) and the violation at hand a serious one for the measure to be deemed legal, because video monitoring is a rather drastic intrusion into the employee’s rights. The monitoring must be restricted in time and scope to what is really necessary, i. e. for instance, to just certain areas in the company, to certain times of the day or certain tasks the employee usually performs, etc. It will unlikely be permissible over lengthy periods and the employees concerned must be informed about the purpose and scope of monitoring and the means used as soon as possible. Here too, documenting the relevant scope and rationale in a written investigative plan is highly advisable. 64 For instance, in a relatively recent precedent, the Swiss Federal Supreme Court confirmed that video monitoring of teller counters to prevent theft of cash was permissible because on the one hand, the employees in question were not permanently subjected to the taping and on the other hand, the company’s interest to protect its cash outweighed the employee’s interest in not being taped even sporadically.109 Thus, the Swiss Federal Supreme Court held that even in the absence of a specific suspicion of past or ongoing violations, videotaping can be permissible in situations where a permanent danger of criminal conduct against important assets of the employer is imminent. It can be inferred from such reasoning, that it holds even more true where the company investigates a suspicion of serious criminal conduct against its interests, such as repeat bribery and videotaping is necessary and appropriate to prove the crime. In perusing the precedent it still remains questionable however, whether covert video monitoring may be used to prove just contractual violations. In principle, the same considerations apply as with live email monitoring (see supra paras. 60 et seqq.). In performing the proportionality test it must be taken into account that video monitoring is a drastic intrusion and thus, only very seriously damaging civil violations could (if at all) possibly justify the use of covert video taping. 63

108

See supra paras. 60 et seqq. See Swiss Federal Supreme Court decision no. 6B.536/2009 of 12 November 2009, consideration 3.7. 109

Livschitz

Reemers Publishing Services GmbH O:/Beck/Spehl_Gruetzner/3d/12_Switzerland.3d from 06.03.2013 09:31:39 3B2 9.1.580; Page size: 160.00mm  240.00mm

B. Admissibility and implementation of individual measures

375

8. Telephone tapping Telephone tapping is a criminal offence, unless the conversation regards orders, 65 reservations, and similar business by phone, or emergency calls.110 If a telephone conversation falling under these categories contains additional private or nonreservations etc.-related content, then whatever content prevails defines the nature of the conversation and controls whether or not the said exception to punishment applies. Thus, other than routine registration of these calls about reservations, emergen- 66 cies etc. for quality control or documentation purposes, the company should not engage in telephone tapping even if it would appear warranted under the proportionality test. The reason for this is, that unlike violations of data protection rules, non-compliance with criminal law is only permissible when a justification provided for under the Swiss Penal Code is available; namely self-defense against an imminent attack from the participants of the tapped conversation or, necessity (i. e. when the company’s interests outweighing those of the telephone users in question are imminently endangered and the tapping is the only available means to prevent the danger).111 These situations arise rarely in the course of internal investigations, and only competent authorities in possession of a relevant court warrant will as a rule, be able to legally tap phones.112 9. Covert listening to, or registering of, private conversations of others Listening by means of a technical device (a “bug”, a microphone, a stethoscope, a 67 wireless transmitter, etc.) to non-public oral conversations or recording such conversations on tape, a CD, a hard drive, etc. is a criminal offence.113 Only in case of necessity or self-defense (i. e. of imminent attacks against the company’s prevailing interest and the listening being the only available protection) can such conduct be permissible. This will rarely be the case in the scenarios of interest here. Listening to non-private oral conversations simply by ear and taking notes is not a criminal offence and is permissible. 10. Inspection of personnel files Personnel files often contain sensitive data such as information relating to medical 68 conditions, religious orientations, and the like. Furthermore, they might contain personality profiles (i. e. information about essential aspects of an employee’s personality) especially if over a longer period of time, work appraisals and other information on the employee’s general conduct etc. are accumulated. When a company enters sensitive data and/or personality profiles pulled together from personnel files into a database in the course of an internal investigation, the employees concerned in principle must be informed actively (not just upon demand) about (i) the new database controller’s identity, (ii) the purpose of processing of that new database, and (iii) the categories of third party data recipients in case transmission of the data 110

Art. 179quinquies Swiss Penal Code. See Art. 15 and 17 Swiss Penal Code. 112 Art. 269 et seqq. PPC. 113 Art. 179bis Swiss Penal Code. 111

Livschitz

Reemers Publishing Services GmbH O:/Beck/Spehl_Gruetzner/3d/12_Switzerland.3d from 06.03.2013 09:31:39 3B2 9.1.580; Page size: 160.00mm  240.00mm

376

§ 12. Switzerland

to third parties (incl. affiliates of the same group of companies) is intended.114 Intentional violation of the duty to inform is a criminal misdemeanor punished with a fine up to CHF 10,000.115 69 However, according to an opinion in doctrinal literature, only repeat gathering of sensitive data or personality profiles entails the duty to inform the data subject.116 This opinion, although indeed reasonable, has not been confirmed by case law thus far. To be on the safe side, putting together sensitive data or personality profiles from personnel files in a new database in the course of internal investigations should always be regarded as entailing in principle the duty to actively inform the concerned employees, as mentioned above. 70 On the other hand, the duty to inform can be set aside if informing the data subject would entail disproportionate efforts on the company’s part, or where saving and disclosing the data is provided for under a Swiss statute or international treaty.117 Further, the duty to inform can be set aside where the data is transmitted to a third party and setting aside the duty to inform is warranted by that third party’s outweighing interests.118 Finally the duty to inform can be set aside where covert gathering of sensitive data from personnel files is a necessity under the proportionality test, and, in addition, appropriate in order to achieve the goals of the investigation; provided these goals outweigh the employee’s interest to be informed overtly. Given that a violation of the duty to inform can entail (albeit mild) consequences under criminal law, the proportionality test should be performed with special care and for instance, the question should be posed whether certain information contained in the personnel file can be separated or as the case may be, redacted before the file is processed for the purposes of the investigation, etc. Also, as a rule it is not necessary to inspect personnel files covertly during an investigation in order to discover the truth about the facts under scrutiny. However, it might become a necessity to process personnel files when it comes to imposing disciplinary sanctions on non-compliant employees. Needless to say, the company is free to consult its personnel files in order to assess disciplinary sanctions; this is one of the very reasons under labor law why a company maintains personnel files119 and thus a statutory defence provided for under Art. 14 para. 4 DPA. 11. Investigations carried out in the surroundings of employees under suspicion 71

Investigations carried out in the surroundings of employees under suspicion could technically consist of an array of means: gathering oral and documentary information from friends and acquaintances, taking covert pictures or covert video taping on public or even private premises, etc. These means should be assessed as follows: – Video taping and photographing on private premises without the permission of those who are taped/photographed is a criminal offence;120 except in cases of selfdefense or necessity (i. e. if an attack against the company’s prevailing interests is 114

Art. 14 para. 1 and 2 Swiss Data Protection Act. Art. 14 and 34 Swiss Data Protection Act. 116 Rosenthal/Jo ¨ hri, Art. 7 a (as of Dec. 1, 2010: Art. 14) DPA N 6. 117 Art. 14 para. 4 Swiss Data Protection Act. 118 Art. 14 para. 5 and Art. 9 para. 1 Swiss Data Protection Act. 119 Portmann/Sto ¨ ckli, N 472. 120 Art. 179quater Swiss Penal Code. 115

Livschitz

Reemers Publishing Services GmbH O:/Beck/Spehl_Gruetzner/3d/12_Switzerland.3d from 06.03.2013 09:31:40 3B2 9.1.580; Page size: 160.00mm  240.00mm

B. Admissibility and implementation of individual measures

377

imminent and the taping/photographing in question is the only possible and adequate means to fight off the attack). – Gathering information from private sources, as sometimes done e.g. by private investigators, is in principle a serious intrusion into the data subject’s personality and privacy and requires permission. In the absence of the same, the Swiss Federal Supreme Court considers such “spying” to be in principle against good faith121 but nonetheless, covert “spying” can be justified under the proportionality test.122 In view of the serious nature of the privacy intrusion discussed here, the company’s interest that justifies covert private investigations amongst the employee’s friends etc. should be a pressing and serious one. This will be the case when e.g. the employee is imminently suspected of a serious crime such as fraud (not about a petty amount but rather, significant money), corruption, or similar abuse and the investigative means in question are indeed necessary and appropriate to uncover the suspicion under investigation. For instance, the Swiss Federal Supreme Court held that an insurer may legally commission private investigations against an insured party under reasonable suspicion of insurance fraud.123 In contrast, private investigations uncovering just contractual violations as a rule are unlikely to be justified under the proportionality test. Incidentally, investigations carried out by external investigators will likely be regarded as less intrusive than those conducted by investigators permanently employed by the company, who perhaps know the investigated employee personally etc. – Taking pictures of, or video taping the employee on public premises requires in principle, the same legal treatment as covert “spying” amongst private parties discussed above. If however, covert video taping encompasses private conversations, the taping is a criminal offence124 and in the absence of permission from all taped parties, is only permissible in cases of self-defense or necessity. In any event, the investigated employee should be informed about the investiga- 72 tion, its scope and content as soon as feasibly possible. Also, it should be noted that the investigative findings discussed here might result in the creation of a personality profile relating to the investigated employee. When entered into a database or compiled in an investigative report, the information gathered is subject to the information duties discussed above at 10. “Inspection of personnel files”, violation of which may be punished with a criminal fine up to CHF 10,000. Informing the employee may be postponed or abandoned to the extent justified under the proportionality test which, given the rather drastic intrusion into the employee’s privacy and the possible criminal impact of non-information, will require an imminent suspicion of a serious violation in order to justify a delay or giving up the duty to inform. In addition, if processed repeatedly, a report or database on private investiga- 73 tions that contains personality profiles and/or sensitive data, must in principle be registered with the Swiss Data Protection and Information Commissioner; violation of the duty to register may equally be punished with a criminal fine up to CHF 10,000.125 That duty may likewise be put aside under the proportionality test 121

See e.g. the ruling of the Swiss Federal Supreme Court no. 5A.78/2007 of 27 August 2007. Rosenthal/Jo¨hri, Art. 12 DPA N 20; BSK-Maurer-Lambrou/Steiner, Art. 4 DPA N 17. 123 BGE 135 I 169, consideration 5. 124 Art. 179quater Swiss Penal Code. 125 Art. 11 a Swiss Data Protection Act. 122

Livschitz

Reemers Publishing Services GmbH O:/Beck/Spehl_Gruetzner/3d/12_Switzerland.3d from 06.03.2013 09:31:40 3B2 9.1.580; Page size: 160.00mm  240.00mm

378

§ 12. Switzerland

against the background that once registered, the contents of the registration (and thus certain information about the contents and purpose of the database or report in question) will be publicly accessible, which usually does not make a lot of sense if the information concerned relates to private investigations. In the view advocated here, even repeated use of a private investigator’s report or database during one and the same internal investigation is not repeat processing in the sense of the law that triggers the duty to register. The reason for this is that the rationale behind the duty to register aims at databases on personality profiles that are used not only repeatedly within one project, but also systematically beyond a specific investigation.126 Notwithstanding the above, registration with the Swiss Data Protection and Information Commissioner is not due anyway if the company appoints an internal data protection officer and registers the report or database with the same, or if the company is data protection-certified and registers the certificate with the Swiss Data Protection and Information Commissioner, or if the company has good reasons to state that it was legally required to create the data collection or report in question.127 12. Searching of workplace 74

The principles developed above relating to the preservation of evidence and the screening of electronic and physical data also apply to the searching of workplaces: – The company is entitled to preserve evidence at all times through physical copies and imaging of electronic data found at the workplace. To that effect, the company may ask the employee to hand over documents and computers etc. The company can thereby in principle assume that all documents and data which are not evidently private in nature are business-related, unless computers, lockers, drawers etc. were assigned to the employee for his exclusive and solely private use. Unless solely used by the employee privately, based on a relevant permission, instruction, policy etc, the company may request that the employee grant access to the lockers etc. The company may also access the employee’s PC and other computer devices at his workplace without committing the criminal offence of hacking, even if the computerized devices are password-protected, unless the computers are – and are allowed or tolerated to be – undisputedly used for private purposes only or at least preponderantly. – In principle, these measures should be carried out overtly and with the employee’s permission. If the employee refuses permission or cannot be asked for the same because for instance, he is absent, the above measures can be performed nonetheless if warranted under the proportionality test. The same holds true where a priori, the company decides to apply these investigative means covertly. – Personal briefcases, pockets, etc. belonging to the employee do not as a rule fall under the presumption of being business-related. On the contrary, it must be reasonably presumed that they are private and used for private purposes only. Their contents may only be searched against the employee’s volition if there is a

126

Like here: Rosenthal/Jo¨hri, Art. 11 a DPA N 50. Art. 11 a para. 5 letters a, e and f Swiss Data Protection Act. Usually, the company will have such reason, e.g. its duty owed to the shareholders to protect its assets. 127

Livschitz

Reemers Publishing Services GmbH O:/Beck/Spehl_Gruetzner/3d/12_Switzerland.3d from 06.03.2013 09:31:40 3B2 9.1.580; Page size: 160.00mm  240.00mm

B. Admissibility and implementation of individual measures

379

pressing suspicion of a serious criminal violation and the search appears necessary and adequate under the proportionality test. – Sealed letter envelopes addressed to the employee personally (as opposed to letters addressed to the company but marked to the employee’s attention) must not be opened except in cases of necessity or self-defense; otherwise the opening of such envelopes constitutes a criminal offence.128 13. Amnesty programs Amnesty programs, i. e. the promise of giving up on disciplinary sanctions 75 against non-compliant employees in return for their cooperation in the internal investigation, are in principle permissible, if the amnesty appears as reasonable and adequate in order to best achieve the goal of the investigation. The interests against which amnesty programs must be balanced are (i) the necessity for each compliance and internal controls system to apply disciplinary sanctions consistently and thereby grant equal treatment so as to effectively deter and prevent and in order to comply with the employer’s duty of equal treatment owed to the employees, and (ii) management’s and the Board’s fiduciary duty towards the company and its shareholders to protect the company’s assets from damage. An amnesty program must not conflict with either of these two requirements in order to be permissible. To such end, it is advisable to design consistent amnesty programs that for instance, define a clear order of leniencies extended or credits; for instance, full leniency for the first cooperator in the door, a certain decreased maximum punishment for the second in the door, another, more stringent (but still decreased) maximum sanction for the third one etc., without allowing too many employees to benefit from the program. This is because as a rule, amnesty programs work best when they incentivize a run for the best possible credit, which requires reasonable limitation of the pool of eligible employees. If these requirements are met then the amnesty program is unlikely to conflict with the consistency requirement under compliance and employment rules or with the Board’s or management’s duty to preserve the company’s interests.

II. Must employees’ representatives such as the works council be involved in internal investigations? Under Swiss law, an employees’ representation must be put in place only if a 76 company has 50 employees or more and a certain number of employees vote in favor thereof.129 Where indeed an employees’ representation was elected, the representation body 77 has certain mandatory information rights towards the company such as in matters relating to work safety, mass layoffs, a sale of the company in full or in part, pension plans as well as, in general, all matters the representation body must know in order to duly fulfill its tasks.130 Finally, the employees’ representation must be informed at 128

Art. 179 Swiss Penal Code. Art. 3 and 5 Swiss Employees Participation Act. 130 Art. 9 and 10 Swiss Employees Participation Act. 129

Livschitz

Reemers Publishing Services GmbH O:/Beck/Spehl_Gruetzner/3d/12_Switzerland.3d from 06.03.2013 09:31:40 3B2 9.1.580; Page size: 160.00mm  240.00mm

380

§ 12. Switzerland

least once a year on the effects the company’s course of business is likely to have on the employees. Beyond the above-mentioned rights to be informed, the employees’ representatives have only those rights that have been agreed upon between the representation body and the employer. Thus, in the absence of an agreement on the employees’ representation’s right to be involved in internal investigations, there is no relevant entitlement based on statutory or case law.

C. Employee interviews I. May an employee refuse to provide information if this information would incriminate himself/herself? 78

Absolutely. Nobody must incriminate himself/herself, regardless of whether or not such self incrimination would occur in judicial proceedings or in internal investigations of a company.131 In addition, in the opinion advocated here, an employee has no duty to incriminate, or even generally provide information about close relatives.132

II. Is an employee obliged to provide information on any misconduct of, or criminal offences committed by, other employees? 79

An employee’s duty to report violations committed by peers or superiors or, in case of superiors, by anyone within the ambit of their responsibility, may be inferred in principle from the employee’s fiduciary duty towards their employer.133 However, in the opinion advocated here, such a duty is not absolute and depends on the specific circumstances of each single case: On the one hand, the higher the employee’s rank, the more enhanced his fiduciary duty and consequently, his duty to report misconduct. On the other hand, it must also be taken into account that reporting misconduct of peers or superiors might equally expose the reporting employee (particularly a low-ranking one) to mobbing or similar hostile conduct at work and thus, would indirectly also be detrimental to his or her personality.134 The problem hence boils down to the question where the limits to an employee’s fiduciary duty are and how serious a disadvantage for himself/herself an employee is expected to suffer in order to benefit his or her employer’s interests. This having been said, whether or not in a given situation for instance, a rather low-ranking employee has a duty to report violations committed by peers or superiors is not a clear-cut assessment: It might depend on the suspected perpetrator’s position within the company and his relationship with the employee in question, how serious the violation in question is, how pressing the suspicion is and how well it can be documented, and finally, what protection the employer has put in place for 131

Godenzi, 68; see also supra paras. 35 et seqq. See supra paras. 58 et seq. 133 BGE 113 IV 68, 63 et seq.; Cantonal Court of the Canton Vaud, in: JAR 1986, 154 et seqq.; Bru¨hwiler, Art. 321 a CO N 2; BSK-Portmann, Art. 321 a CO N 12; Rehbinder, N 126; Streiff/von Kaenel, Art. 321 a CO N 7; Mu¨ller, 424. 134 Like here: Rehbinder, N127; in essence also: Geiser, 177. 132

Livschitz

Reemers Publishing Services GmbH O:/Beck/Spehl_Gruetzner/3d/12_Switzerland.3d from 06.03.2013 09:31:41 3B2 9.1.580; Page size: 160.00mm  240.00mm

C. Employee interviews

381

the benefit of whistleblowers. For instance, it would appear odd if a low-ranking employee happened to find written proof of large-scale corrupt payments and omitted to turn this evidence over to the company’s compliance organization or the whistleblowing hotline although he is reasonably well-protected. Beyond such rather drastic cases however, there is in principle no clear legal basis for a lowranking employee’s duty to report misconduct. In contrast, a high-ranking employee’s fiduciary duty to report misconduct of lower-ranking staff within his ambit of responsibility is well defensible. Whatever the answer to the question of whether or not, and under what 80 circumstances, an employee must report misconduct; as a practical matter that answer is only relevant if the company plans to dismiss or otherwise discipline the employee for his omission to report. In view of the above-mentioned difficulties to give a clear-cut assessment on whether or not an omission to report is a violation of fiduciary duties, the company risks being reproached for abusive dismissal or, in case of other sanctions imposed, a breach of its contractual duties towards the employee when opting for disciplinary punishment. Consequently, as a matter of practice, it would make sense to restrict disciplinary punishment for non-reporting a priori to rather high-ranking staff and perhaps in addition to even lower-ranking employees whose obligations to report certain occurrences are part of their job description (such as internal auditors, internal controllers, etc.). Going after low-ranking staff for non-reporting does not, as a rule, necessarily benefit the company’s cause; although exceptions in cases of very serious wrongdoing are conceivable under a possible necessity for the company to act consistently and stringently in a given situation. Needless to say, an employee must refrain from actively sabotaging an internal investigation by destroying information or evidence, etc. It is quite clear that such conduct would as a rule justify even a summary dismissal.135

III. May an employee refuse to answer a question if he/she has already answered it within the scope of a previous interview? To the extent the employee would not incriminate himself or herself and – in the 81 view advocated here – the subject matter does not have anything to do with close relatives, the employee has a duty to cooperate with the company’s investigation based on his fiduciary obligations. That being said, the employee must in principle answer questions that have been previously asked provided of course that the questions relate to his employment and to the scope of the investigation. It is in the company’s discretion whether or not, for tactical or other reasons, it opts for repeat, identical, or similar questioning in various situations or at different stages in the course of the investigation. These discretionary rights are, however, limited by the company’s duty to protect the employee’s personality.136 Thus, in circumstances where repeating of identical or similar questions would result in outright harassment of the employee (e.g. because there is no reasonable interest in repeating the questions), the repeated interrogation should cease. In other words, repeat questions

135 136

Godenzi, 54 et seq. with references. Art. 328 Swiss Code of Obligations.

Livschitz

Reemers Publishing Services GmbH O:/Beck/Spehl_Gruetzner/3d/12_Switzerland.3d from 06.03.2013 09:31:41 3B2 9.1.580; Page size: 160.00mm  240.00mm

382

§ 12. Switzerland

are not a problem as long as they are reasonable and appropriate in view of bona fide investigative needs under the circumstances. 82 Generally, repeat questions do not usually pose a problem. Cooperative employees are usually not bothered by repeat questions whereas non-cooperative employees might choose not to answer questions even if posed only once. An employee’s refusal to answer questions posed repeatedly is only legally relevant when it comes to deciding whether or not disciplinary sanctions are justified or rather, would be abusive and thus illegal. Ultimately, the problem boils down to the question whether or not the employee’s overall conduct was cooperative as can be reasonably expected in the circumstances based on the employee’s fiduciary duty towards the company. So long as the employee’s conduct does not actively sabotage the investigation or otherwise present a significant obstacle to the company’s efforts to uncover the truth, it would be rather difficult for the company to discipline an employee only on the grounds that he or she refused in a few instances to answer questions that had already been previously posed.

IV. Is an employee entitled to the presence of a member of the works council or an attorney during the interview? There is no basis in statutory or case law for an employee’s entitlement to either an attorney paid for by the company, or a works council member to be present at the interview. As regards the latter, reference is made to supra paras. 76 et seq., where it was discussed that in the absence of a relevant agreement between the company and an employees’ representation (if any), there is no entitlement of the same to participate in the investigation. On the other hand, there are no legal grounds to prevent the employee from involving legal counsel at his own expense; since the employee’s counsel is under a secrecy duty, confidential information that might be discussed during the interview is not jeopardized. Also, one cannot generally assume that an employee who engages private counsel to assist him/her in speaking with the company in possibly difficult and tense situations would represent a breach of fiduciary duties towards the company. 84 However, where an employee is interviewed because overall he appears as a suspect rather than someone who can provide information as a “witness,” the employee may refuse to cooperate based on his self-incrimination privilege. In such a case the employee can of course make his cooperation contingent upon the presence of an attorney paid for by the company because where an employee does not have any duty to cooperate at all, he or she can of course set conditions for cooperating. It is then a matter of negotiation whether or not and to what extent any conditions are ultimately agreed to. The only limit to the employer’s ability to agree is the Board’s and management’s fiduciary duty vis-a`-vis the company and its shareholders and thus, the company’s best interests. Where it is not in the company’s interests to pay for legal representation of an employee who is under serious suspicion of having damaged the company, and paying for private counsel (to further the employee’s cooperation) would unlikely benefit the overall outcome of the investigation, the company will refuse to pay and rather, will take into account the relevant employee’s non-cooperation. 83

Livschitz

Reemers Publishing Services GmbH O:/Beck/Spehl_Gruetzner/3d/12_Switzerland.3d from 06.03.2013 09:31:41 3B2 9.1.580; Page size: 160.00mm  240.00mm

C. Employee interviews

383

Notwithstanding the above, it is advisable and represents best practices for a 85 company to allow and pay for so-called “pool counsel”. A pool counsel is an attorney paid for and appointed by the company but, whose task consists of accompanying employees at interviews and advising them on for instance, their rights and obligations, the impact of certain answers they might wish or refuse to give, the impact of their refusing or agreeing to cooperate, etc. According to general experience, pool counsel significantly eases the task for all parties involved. Cooperation with employees where it is unclear as to what extent they might be suspects or rather, mere “witnesses”, is usually smoothened. Possible mistrust and nervousness that often arise in such situations can be overcome more easily with pool counsel present. Also, it is advisable that where tactically defensible, the company shares the subject matter and at least the rough structure of the interview with pool counsel preliminarily, so as to allow pool counsel to reasonably prepare the interviewees. Where employees act bona fide and cooperate, they will be able to provide more accurate information at the interview. Where however, employees are non-cooperative, they will very often not cooperate either way, i. e. with or without preliminary information-sharing with pool counsel. Finally, pool counsel can be helpful when it comes to finalizing interview notes and for instance, checking their accuracy: Pool counsel usually reads the interview notes more attentively and detachedly, and will usually ensure more accurate recording of the contents discussed than an employee who is not assisted by pool counsel.

V. Is an employee entitled to read a record of his/her interview? As a rule, it is in the employer’s very interest to have the employee or, as the case 86 may be, pool counsel read the interview notes. First, because an employer is under the duty of truthful data processing;137 reading the interview notes by the employee and confirming, or where necessary, correcting their content helps ensure correctness of the processed information. Second, only truthful interview records are of use for the company, for obvious reasons. Third, if for instance the investigation entails litigation against the employee, the company’s position at court will be stronger if the employee has read and confirmed the content of the interview notes than in the opposite case, for equally obvious reasons. Finally, under a recent precedent of the Swiss Federal Supreme Court, the employee would even be entitled to receive a copy of the interview notes; however, the Swiss Federal Supreme Court did not examine whether e.g. jeopardy to legal privilege would place the company in a position to refuse handing out the notes.138 If the company chooses not to have the employee read and confirm the interview 87 notes, then under Swiss procedural rules, those notes will represent mere party allegations at court. In civil proceedings, the court will not always be in a position to assess the interview in favor of the company. Possibly, the contents of the interview records would have to be proven by additional evidence. Similarly, in criminal proceedings, interview notes that were not reviewed and confirmed by the interviewee are party allegations that are subject to discretionary assessment by the 137 138

Art. 5 para. 1 Swiss Data Protection Act. BGE 138 III 425.

Livschitz

Reemers Publishing Services GmbH O:/Beck/Spehl_Gruetzner/3d/12_Switzerland.3d from 06.03.2013 09:31:41 3B2 9.1.580; Page size: 160.00mm  240.00mm

384

§ 12. Switzerland

prosecution and as the case may be, the court.139 In the absence of additional proof (such as for instance, credible depositions from the interviewers in the witness stand), a court might not accept the interview notes as sufficient proof to the employee’s detriment. 88 Notwithstanding the above, an employee has a right to review the interview notes based on his or her personality protection rights and the principle of good faith. Additionally, under Art. 5 para. 2 of the Swiss Data Protection Act, each employee has the right to correct any of his personal data and hence the interview notes too, which logically requires that the employee can review them. On the other hand, a company may legally withhold the interview notes from the employee if justified under the proportionality test. If, for instance, the company is reasonably concerned about the danger of collusion amongst various suspects in an investigation of significant misconduct, then it has valid reasons to delay the employee’s review of the interview notes until the danger of collusion is over. In case the interview notes are used abroad and the controlling foreign legislation mandates that the interview notes be withheld from the employee in order for the company to effectively protect its rights and defend its position, the company may validly do so under the proportionality test. The recent Swiss Federal Supreme Court precedent mentioned supra at para. 26 did not deal with such exceptions.

VI. Is the employer entitled to request that the employee signs the record of the interview? Based on its instruction powers, an employer may certainly ask the employee to sign interview notes provided of course that the employee agrees with the content, failing which the employee obviously has no duty to sign, unless his disagreement with the contents is ill-founded. The employer may, however, request that the employee sign the interview record only to the extent that he agrees with the contents. The signing of interview notes once the content is agreed upon is in the interest of both parties for the reasons discussed above.140 90 The question of interest is whether or not an employee can be disciplined for refusal to sign interview notes despite the company’s instruction to do so. First, an employee can certainly not be disciplined if his refusal to sign is based on bona fide grounds such as a reasonably-founded disagreement with the contents. Second, if the refusal to sign the interview notes is the only lack of cooperation with the investigation and the employee has otherwise cooperated, it will be very difficult for the company to regard the employee’s refusal to sign as sufficient basis for disciplinary sanctions. If, however, the refusal to sign is one of many non-cooperative acts by the employee (who has no legal basis to refuse cooperation such as the privilege from selfincrimination) then it might weigh-in to give an overall picture. Finally, the company may theoretically have the employee enjoined by a court to sign the interview notes if indeed in the circumstances, there is such a duty. Initiating such proceedings however, would in most circumstances make absolutely no sense for the company; rather, if the company needs the employee’s statements against another party, the employee will 89

139 140

Godenzi, 74 et seqq, with further references; Hauser/Schweri/Hartmann, § 53 N 8. See supra paras. 86 et seqq.

Livschitz

Reemers Publishing Services GmbH O:/Beck/Spehl_Gruetzner/3d/12_Switzerland.3d from 06.03.2013 09:31:42 3B2 9.1.580; Page size: 160.00mm  240.00mm

D. Sanctions imposed on employees

385

ultimately need to be called to the witness stand in court. If the employee’s statement is self-incriminating he/she has no duty to cooperate and thus, no duty to sign notes. As a matter of practice, the question of whether or not the employee has to sign 91 interview notes upon the company’s instructions is not of great relevance on a stand-alone basis. Either the employee cooperates anyway in which case signing the interview notes is not a problem; or the employee does not cooperate and his refusal to sign interview notes is not as a rule decisive, since the contents of the interview will in any case hardly be of added value for the company.

VII. Can the employer instruct an employee to treat the content of his/her interview as confidential? The employee owes the company a duty of confidentiality and secrecy under 92 labor law,141 and if the company has a bona fide interest, it can validly instruct an employee to keep certain facts and matters secret also from other employees. On the other hand, experience shows that in internal investigations in Switzer- 93 land, it is hardly ever possible to successfully enforce a duty amongst employees to treat interview contents confidentially. As a matter of fact, employees will in most cases exchange relevant information anyway and it will never be possible for the company to prove which of them violated the instruction to maintain silence. In consequence, the question discussed here is unfortunately in many cases rather of academic interest from a Swiss perspective, and in planning its investigation, the company should be aware thereof.

D. Sanctions imposed on employees I. What are the sanctions under employment law that can be imposed on employees refusing to cooperate in internal investigations? First, it must be reminded that under the privilege against self-incrimination, an 94 employee has no duty to cooperate when he or she is under suspicion of criminal violation. When the suspicion relates to “just” a contractual breach, a minority opinion in Swiss legal doctrine holds that an employee is expected to contribute to clarifying the situation and unveiling the truth by virtue of his or her fiduciary duty towards the employer.142 However, in the view advocated here, an employee has no duty to cooperate in such a situation either, because nobody can be expected to actively contribute to proving its own breach of contract or more generally, proving facts that give rise to claims against oneself. This is a fundamental principle of the Swiss legal system reflected inter alia in Art. 8 of the Swiss Civil Code under which whoever wishes to prove a fact upon which he or she bases a claim or other exercise of rights, bears the burden of proof. This principle can be regarded as reflecting the more general principle of fundamental fairness and good faith, too. Consequently, only disciplinary sanctions against employees who refuse to cooperate without 141 142

Art. 321 a para. 4 Swiss Code of Obligations. Egli, 59.

Livschitz

Reemers Publishing Services GmbH O:/Beck/Spehl_Gruetzner/3d/12_Switzerland.3d from 06.03.2013 09:31:42 3B2 9.1.580; Page size: 160.00mm  240.00mm

386

§ 12. Switzerland

being charged of wrongdoing are defensible in the opinion advocated here, unless the employee actively sabotages the investigation by e.g. destroying evidence. In that latter case, a summary dismissal due to serious breach of trust is defensible also against an employee under suspicion143 (which is quite in line with criminal liability of a suspect in judicial proceedings for active destruction of evidence144). 95 Second, in cases where non-suspicious employees violate their duty to cooperate with the investigation (but do not actively sabotage the same), the sanction a company may impose depends on the circumstances and must be proportionate taking into account all relevant aspects such as the seriousness of the investigated violation and thus, the seriousness of the danger for, or attack against, the company’s interests, the employee’s rank and thus, the intensity of his or her fiduciary duty, the investigators’ conduct (e.g. whether or not they harassed the employee etc.), whether non-cooperation was only sporadic or rather systematic, whether cooperation would have likely been crucial to the overall result of the investigation, etc. The answer whether or not a disciplinary punishment is appropriate under these principles, is always discretionary and thus, a court decision in case of litigation might be hard to predict. In theory, the following sanctions are conceivable: – Dismissal by giving contractual notice: Although generally permissible under Swiss law (except for certain “barred periods” such as sickness, military service etc.), such dismissal could be regarded as abusive in certain circumstances, in which case the company would have to pay the employee a compensation capped at the amount of six months’ salary.145 A dismissal with contractual notice for non-cooperation would certainly not be abusive if the employee’s refusal to cooperate represents a serious violation of fiduciary duties in the circumstances, e.g. if a high-ranking officer with enhanced fiduciary duties refuses to participate in an interview although he would incriminate neither himself nor close relatives, and his participation would be important for the overall result of the investigation. – Demotion: Under Swiss law, a demotion is a combination of a dismissal with contractual notice and an offer for a new (lower) position.146 A demotion is thus only permissible in cases where also a dismissal with contractual notice would not be abusive. It should be pointed out that a transfer to another position without deterioration in employment conditions and within the profession of the employee in question, is in principle permissible based on a simple instruction from the company, provided such instruction does not contradict specific agreements between the parties, or cannot be reasonably expected from the employee in the circumstances.147 – Forfeiture of voluntary remuneration elements such as discretionary bonuses, etc. in cases of similarly serious violations: It must be noted that often, under Swiss labor law it is difficult to distinguish between discretionary and non-discretionary remuneration elements, such as variable pay. Non-discretionary salary elements are owed to the employee unconditionally during the employment and can never be denied.148 143

Godenzi, 54 with further references. Art. 254 Swiss Penal Code. 145 Art. 337 c para. 3 Swiss Code of Obligations. 146 E.g. decision of the Federal Supreme Court no. 4C.177/2003 of 21 October 2003, consideration 3. 147 Portmann/Sto ¨ ckli, N 184 et seqq. 148 Portmann/Sto ¨ ckli, N 292 et seqq. and 297 et seqq. 144

Livschitz

Reemers Publishing Services GmbH O:/Beck/Spehl_Gruetzner/3d/12_Switzerland.3d from 06.03.2013 09:31:42 3B2 9.1.580; Page size: 160.00mm  240.00mm

D. Sanctions imposed on employees

387

– A company may issue a formal warning letter to the employee pinpointing the lack of cooperation and announcing that in case of further lack of cooperation, the employee will be dismissed with contractual notice (or where necessary, in rather drastic cases, in theory even summarily). In such a case, the employee would no longer be able to assert abusive dismissal if indeed, he or she refuses to cooperate yet again in circumstances equivalent to those giving rise to, and described in, the warning letter.149 In order to be effective, the formal warning must – besides specifying the circumstances and conduct in question – clearly announce the disciplinary action to be taken in case of repeat misconduct.

II. Is the suspicion of a criminal offence or a severe violation of duty sufficient for an extraordinary termination? An employee’s misconduct which is serious enough to severely compromise the 96 trust and confidence the company places in him, such as a criminal offence against the company’s interests or an otherwise very serious, non-criminal malfeasance against the company, may justify a summary dismissal. Usually, criminal offences such as fraud, corrupt practices, embezzlement and other theft–like conduct represent sufficient grounds for the company to summarily dismiss an employee. The same holds true in principle for instance, in cases of a breach of non-compete obligations or divulgation of business and fabrication secrets, etc.150 However, whether or not a summary dismissal is justified, is ultimately a discretionary decision of the court. In order for a company to summarily terminate an employee on the grounds 97 mentioned above, the violation in question does not have to be conclusively proven at the time of termination. Rather, the company may validly terminate the employee summarily based even on a relevant serious suspicion. However, if challenged in court, the company bears the full burden of proof for the actual violation, not just the suspicion.151 The company’s legal risk exposure for unjustified summary dismissal is first, payment of the salary during the full contractual notice period and second, a compensation payable to the employee for unjustified summary dismissal, capped at six months’ salary.152 In cases that are not 100 % clear-cut, many Swiss companies prefer, as a matter of 98 practice, to grant the employee in question an immediate garden leave, dismiss the employee with contractual notice and pay his salary during the notice period rather than facing an out of court dispute or perhaps even litigation for unjustified summary dismissal. Granting garden leave and paying the remainder of salary is in many cases simply cheaper for the company than litigating the case or engaging in lengthy negotiations and discussions with opposing counsel.

149

BGE 127 III 310, consideration 3, with further references. Portmann/Sto¨ckli, N 365 et seq. 151 Portmann/Sto ¨ ckli, ibidem. 152 Art. 337 c para. 1 and 3 Swiss Code of Obligations. 150

Livschitz

Reemers Publishing Services GmbH O:/Beck/Spehl_Gruetzner/3d/12_Switzerland.3d from 06.03.2013 09:31:42 3B2 9.1.580; Page size: 160.00mm  240.00mm

§ 12. Switzerland

388

III. During which period of time must an extraordinary notice of termination be given to employees whose misconduct has been revealed by the internal investigation? 99

Summary dismissal must be communicated to the concerned employee immediately; that is, as a rule of thumb, Swiss courts will tolerate a reaction period of no more than two to three days.153 In cases where the termination for cause must be approved by a corporate body or committee, reaction periods of up to one week may still be acceptable.154 Also, the employer may grant the employee a possibility to reinstate confidence for instance, by providing an explanation for his or her conduct; however, such possibility must be granted forthwith, i. e. within the timelines mentioned. Lapsing of these deadlines will lead to the company’s forfeiture of the right to terminate the employee summarily for the conduct in question.

IV. Must an employee cooperate in internal investigations even after he/she has been given notice of termination? 100

In theory, an employee who resigned or received termination continues to have the same fiduciary duties towards the company for the remainder of the notice period as any non-terminated employee. Consequently, all duties to cooperate in the investigation discussed above remain in place. However, once the employment has been terminated, the company loses its main leverage against the employee to enforce his duty to cooperate, namely the possibility to terminate the employment. Naturally, in drastic cases such as active sabotaging of the investigation, the company could still terminate the employee for cause even though the employment has already been terminated with contractual notice. Also, in similarly drastic cases, the company could for instance cut back discretionary salary elements which it planned to pay out during or at the end of the termination notice period. But except for these rather rare scenarios, the company has no realistic means to pressurize an employee, nor does an employee have any significant incentive to cooperate unless such cooperation is a priori absolutely non-detrimental for the employee and thus, his or her decision to cooperate is an indifferent one. Consequently, as a matter of practice, the company should carefully plan who it terminates in the course of an investigation particularly if employees’ cooperation is still required. In the event of doubt, it is advisable for the company to grant gardening leave without terminating at all, if e.g. it would like to avoid collusive conduct of the employee in question pending the investigation.

153 154

Portmann/Sto¨ckli, N 770. E.g. BGE 93 II 18.

Livschitz

Reemers Publishing Services GmbH O:/Beck/Spehl_Gruetzner/3d/12_Switzerland.3d from 06.03.2013 09:31:43 3B2 9.1.580; Page size: 160.00mm  240.00mm

E. Use of obtained information

389

E. Use of the obtained information I. Is it permissible to disclose the findings and information obtained within the scope of any internal investigations to other group companies? Other group companies are treated no differently than completely unrelated 101 companies. That having been said, the following rules apply: – First, a distinction must be made between domestic disclosure within Switzerland on the one hand and cross-border disclosure on the other. In cases of domestic disclosure, transfer of information to an affiliate or parent company touches upon data privacy rights of the employees and other individuals affected by the investigation. These transfers must either be covered by an informed permission from the data subjects or must be justified under the proportionality test, i. e. in the absence of permission from the data subjects, disclosure to an affiliate or parent company must be appropriate and necessary in order to achieve a bona fide goal of the company that outweighs the employee’s interest not to disclose.155 The informed consent from the involved data subjects may in principle be an implicit one and can also result from the circumstances.156 Where sensitive data or personality profiles are being disclosed, permission must be obtained explicitly,157 unless under the proportionality test, delaying or giving up of the permission can be justified. – Second, where results obtained in the course of the investigation are disclosed across borders, Swiss blocking statutes (Art. 271 and 273 Swiss Penal Code) relating to the ban of data gathering for the benefit of foreign states and the prohibition to divulge Swiss business secrets abroad must be complied with.158 It should be reminded that the protection of Swiss business secrets (Art. 273 Swiss Penal Code) also applies intra-group. This blocking statute is best complied with if the data in question is screened for Swiss business secrets by the Swiss entity or its appointees (lawyers, forensic services providers) prior to the data transfer and where necessary, Swiss business secrets are redacted, unless the third party owners of the secret waive secrecy. – Third, in cases of cross-border intra-group data transfer, disclosure of investigative results outside Switzerland is always permissible when all parties concerned (i. e. all data subjects) give informed permission (unless the data is to be subsequently used for the benefit of a foreign authority, in which case the Swiss government must also consent or mutual legal or administrative assistance must be requested159). In the absence of voluntary, informed consent by the data subjects and, also, of governmental use of the data outside Switzerland, cross-border data disclosure is nonetheless permissible where additional precautions are taken to ensure an appropriate level of data protection at destination:

155

Rosenthal/Jo¨hri, Art. 4 DPA N 42, Art. 13 DPA N 6. Art. 4 para. 3 and 4 Swiss Data Protection Act. 157 Art. 4 para. 5 Swiss Data Protection Act. 158 See supra paras. 20 et seqq. 159 See supra paras. 21 et seqq. 156

Livschitz

Reemers Publishing Services GmbH O:/Beck/Spehl_Gruetzner/3d/12_Switzerland.3d from 06.03.2013 09:31:43 3B2 9.1.580; Page size: 160.00mm  240.00mm

390

§ 12. Switzerland

– The Swiss Data Protection and Information Commissioner maintain a list of jurisdictions where it can be reasonably assumed that an appropriate data protection level is being adhered to. A data protection level is appropriate if complying with the STE 108 Convention or the Directive 95/46/EC and is enforced in practice and not just theoretically. In essence, EU member states will be deemed as having an appropriate data protection level (with perhaps certain reservations relating to legal entities which under Swiss law, but not necessarily in the EU, are protected under data protection rules as well; however, in the context discussed here this is usually not a problem). Data transfer to these countries does not pose legal problems other than those already discussed at the domestic level. The assessment is different relating to e.g. the United States, where no data protection rules which are deemed appropriate from a Swiss perspective, exist. In principle, if data is disclosed to e.g. a US entity, data transfer and/or data processing agreements should be made with the recipients to ensure appropriate data protection at destination, even if the recipient is EU or Swiss Safe Harbor certified (in which case appropriate data protection level, but not the data controller’s control of the data, is ensured. Appropriate data protection levels can also be ensured intra-group through binding corporate rules – BCRs – which need to be enforced in reality and not just on paper).160 The contents of such BCRs must be equivalent to those of e.g. the data processing agreements mentioned, and the BCRs must be notified to the Swiss Data Protection and Information Commissioner.161 However, it must be reminded that EU or Swiss Harbor certificates or other means ensuring proper data protection level cannot substitute data processing agreements; a data processing agreement is always necessary between the company in question (the data controller) and the data processer (e.g. an outside forensic services provider) so as to ensure compliance of the latter with instructions from the former, even in domestic setups. Where a data controller transfers data to another data controller, data transfer (and not data processing) agreements are advisable. They serve analogous purposes as data processing agreements. – In the absence of an appropriate data protection level at destination or informed waivers from the parties concerned, the company may only disclose the data abroad if justified under the proportionality test or in order to defend or assert its legal position in foreign court proceedings.162 In the view advocated here, the same holds true relating to defense of the company’s interests in administrative or prosecutorial proceedings, as is warranted under the proportionality test. Furthermore, the proportionality test may for instance justify cross-border disclosure within the framework of pre-trial-discovery not only where the same has been mandated by a foreign court but also in case it occurs on a voluntary basis. In such case, the reasoning is that the disclosure allows the company to settle a significant legal dispute that may seriously impair its important interests.163 It must be reminded once more, that even where the proportionality test justifies cross-border disclosure of investigative results under data protection law, 160 Art. 6 para. 2 letter g Swiss Data Protection Act. In such case too, additional data processing and/or data transfer agreements are advisable. 161 Art. 6 para. 3 Swiss Data Protection Act. 162 Art. 6 para. 2 letter d Swiss Data Protection Act, provided, however, that also the internal data gathering (pre-transfer abroad) was equally proportionate. 163 Similar: Rosenthal/Jo ¨ hri, Art. 6 DPA N 69.

Livschitz

Reemers Publishing Services GmbH O:/Beck/Spehl_Gruetzner/3d/12_Switzerland.3d from 06.03.2013 09:31:43 3B2 9.1.580; Page size: 160.00mm  240.00mm

E. Use of obtained information

391

blocking statutes (Art. 271 or 273 Swiss Penal Code) might prevent the company from the envisaged data transfer, and to such effect a process of mutual legal or administrative assistance might have to be initiated.

II. Is it permissible and advisable to forward the findings obtained within the scope of any internal investigations to public authorities? First, it should be reminded that a company might have duties to disclose certain 102 investigative results to authorities: generally, if an authority with subpoena powers (i. e. a court, or prosecutorial or regulatory authority) so demands, in accordance with applicable procedural rules or, for regulated companies, various disclosure duties towards its regulator may exist, both upon request and sua sponte.164 In those cases, no problems arise under data protection law because where the company complies with legally valid orders from Swiss authorities or courts it cannot logically be in breach of other Swiss laws.165 Second, where disclosure duties exist towards foreign authorities, Swiss blocking 103 statutes (Art. 271 and 273 Swiss Penal Code) must be complied with. With regard to protection of personal data, disclosure must be covered either by an informed consent from all data subjects concerned or by the proportionality test. As a rule, fulfilling a legal disclosure duty (be it upon demand or voluntarily) may justify disclosing personal data under the proportionality test but will not per se justify investigating or gathering of evidence generally for the benefit of the foreign authority in question in compliance with Art. 271 Swiss Penal Code. That provision might be complied with in case of just civil disadvantages for non-disclosure before the foreign court or authority in question, such as a shift of burden of proof; not, however, if the sanction for non-disclosure will be penal in nature such as punishment for contempt of court, or a fine (criminal or regulatory).166 Similarly, compliance with the protection of Swiss business secrets under Art. 273 Swiss Penal Code is not set aside by a legal duty to disclose abroad. While the company can waive secrecy, third party owners of a secret should either be asked for their waiver too, or their identity should be redacted prior to disclosure (unless not just identities but beyond that, also anonymous patterns of facts are protected as a Swiss business secret such as e.g. know-how that has commercial value even if not referable to any specific party).167 Third, if in the absence of a legal duty a company wishes to disclose findings of internal investigations to authorities, a number of legal considerations should be made: – First, personal information relating to employees or other parties (emails etc., even if business-related) is protected under the Data Protection Act and may only be disclosed if either the data subject gives an informed waiver or, if disclosure is justified under the proportionality test. Under this test, only if the company’s interests outweigh that of the data subject’s interest not to be disclosed and 164

See supra paras. 5 et seqq. and supra paras. 35 et seqq. Even in criminal law, a duty to disclose imposed by a court or authority that is not evidently null and void would either give rise to the defense of acting in accordance with a legal duty (Art. 14 Swiss Penal Code) or of mistake of law (Art. 21 Swiss Penal Code). 166 Rosenthal/Jo ¨ hri, Art. 271 PC N 24. 167 Rosenthal/Jo ¨ hri, Art. 273 PC N 12. 165

Livschitz

Reemers Publishing Services GmbH O:/Beck/Spehl_Gruetzner/3d/12_Switzerland.3d from 06.03.2013 09:31:43 3B2 9.1.580; Page size: 160.00mm  240.00mm

392

–

–

–

–

§ 12. Switzerland

disclosure is necessary and appropriate to promote the said company’s interest, can the data be disclosed to the authority in question. In case of only voluntary disclosure, the proportionality test could be a delicate matter and depending on the circumstances, its outcome may be literally impossible to assess in case of litigation. Second, authorities as a rule pursue different agendas than companies and thus, disclosing confidential or even delicate facts to an authority beyond a legal duty to do so may contrast with management’s and the Board’s fiduciary duties. If for example, results of an internal investigation of corrupt business practices are disclosed to a prosecutor even though the company has no indication that the prosecutor might have been tipped off about the incriminating facts (and thus, criminal proceedings are not imminent), involving the prosecutor might well be more damaging to the company than keeping the investigative results confidential and resolving the problem discreetly. On the other hand, where an official investigation has already started or is about to start, offering the company’s cooperation through disclosure of its own, internal investigative results might provide – depending on the circumstances – a basis for penalty reductions and it might be advisable also for the Board and management to best comply with their fiduciary duties. Ultimately, whether or not and if so, to what extent voluntary disclosure of internal investigations is advisable in the absence of relevant duties is a judgment call and general guidelines in the absence of specific circumstances are hardly possible. Conversely, voluntary disclosure of e.g. corrupt payments to the tax authorities is as a rule advisable in order to profit from amnesty relating to tax fines etc. Third, the company should also keep in mind that certain evidence gathered internally such as employee interviews, will likely have only limited value before Swiss courts and authorities so that the evidence in question will have to be taken again by the authorities (e.g., interviewees will have to depose as witnesses, imaged data might have to be double-checked using spot checks, etc.). Especially in criminal cases, it is in principle the prosecutor, who has the lead under Swiss procedural rules and thus, it is he who will decide quite discretionarily based on all relevant circumstances what evidence he accepts and where he conducts the investigation. Hence, an internal investigation might only partly relieve the company from the disruptive effects of official investigations, if the internal investigation is disclosed to the authorities. Fourth, where a company has significant business interests abroad, other considerations might apply. This is because relevant foreign authorities might on the one hand, in principle accept the results of internal investigations in lieu of official ones and also, because foreign authorities might have different means as well a different reach, and therefore the ability to perhaps be more aggressive than authorities in Switzerland. Whether or not voluntary disclosure is then advisable, is driven primarily by considerations to be made against the background of the foreign legal system concerned. Finally, findings from an internal investigation might be of great interest for e.g. shareholders or competitors with a view to possible damage claims (of shareholders against management for breach of fiduciary duties etc.; of competitors against the company for having committed unfair competition or having engaged in a cartel, etc.). Thus, before voluntarily disclosing results from its investigation Livschitz

Reemers Publishing Services GmbH O:/Beck/Spehl_Gruetzner/3d/12_Switzerland.3d from 06.03.2013 09:31:43 3B2 9.1.580; Page size: 160.00mm  240.00mm

E. Use of obtained information

393

to authorities, a company should carefully analyze with whom and to what extent the authority in question might share the information. Particularly, foreign authorities might be governed by the principle of freedom of information as opposed to official secrecy (the latter would apply for most Swiss authorities of interest here). Where no possibilities exist under the applicable rules to limit third parties from accessing the disclosed information, perhaps free availability of the information for potential civil opponents bears greater risks for the company than omitting to disclose voluntarily. Once again, to disclose or not is then a judgment call for management and the Board.

III. Are the findings made in the scope of internal investigations subject to the attorney-client privilege? As mentioned above,168 given the absence of legal privilege for in-house lawyers, 104 only information provided to external counsel (or his/her auxiliary) for the purposes of legal advice, and correspondence with counsel serving the same purpose, will be privileged. This means as a matter of practice, that without involving external counsel in 105 order to oversee and coordinate the investigation for the purpose of giving legal advice based on the results of the same, no legal privilege will apply. The investigation will be privileged to the extent the information gathered is on the lawyer’s or his/her auxiliary’s premises and also to the extent the lawyer and/or his/her auxiliaries correspond with the company about the investigation for purposes of legal advice – regardless of whether this correspondence is found with the client or rather, the lawyer. Evidence underlying the correspondence – for example, business emails and other company data – which the company has handed over to external counsel – but kept copies of, does not become privileged on the company’s premises only because outside counsel now has copies too. The situation is different for work products (e.g. interview notes, investigative plans and reports, etc.) which external counsel has prepared based on information received or gathered from the company: this information is treated like lawyer’s correspondence and is privileged regardless of its location.169 Finally, draft legislation relating to legal privilege for in-house counsel170 has not 106 passed parliament. It is not known if and when it might be re-submitted.

IV. Does the attorney-client privilege also apply to foreign attorneys? Yes, it does in principle, with the same limitations as for Swiss attorneys (see 107 supra paras. 104 et seq.) The only requirement for non-Swiss attorneys is that they

168

See supra paras. 18 et seq. Art. 264 para. 1 lit. c Swiss Penal Procedure Code; Schmid, 501; see also the decision of the Federal Supreme Court no. 1B_101/2008 of 28 October 2008, consideration 4.4, referring to the practice of the Federal Supreme Court under which attorney-client privilege only applied to documents of which the attorney had physical possession. This practice will become obsolete at the end of 2010. 170 See e.g. the press release of the Federal Department of Justice and Police of 22 April 2009. 169

Livschitz

Reemers Publishing Services GmbH O:/Beck/Spehl_Gruetzner/3d/12_Switzerland.3d from 06.03.2013 09:31:44 3B2 9.1.580; Page size: 160.00mm  240.00mm

394

§ 12. Switzerland

must be admitted to a bar (anywhere in the world).171 However, for correspondence with outside counsel and his work products found on the company’s premises, legal privilege is granted only to attorneys admitted to practise in Switzerland (see supra para. 18). 108 It should be noted that the scope of Swiss legal privilege rules is in principle strictly territorial: When a Swiss authority accesses e.g. correspondence between a foreign attorney and his Swiss client which is found or seized on Swiss soil, Swiss rules on legal privilege will apply, because Swiss authorities only apply their own procedural laws, except in mutual legal or administrative assistance proceedings, where application of foreign laws is provided for under relevant treaties. In cases where a Swiss authority asks a foreign authority to gather evidence through mutual legal or administrative assistance, the requested authority will as a rule apply its own rules on legal privilege, unless there is room to apply Swiss rules under the applicable treaty. 109 Having said the above, multinational companies should be careful when passing on delicate and confidential correspondence e.g. through their Swiss in-house counsel: Even though the latter might mark the correspondence as “privileged and confidential,” it will not be privileged if seized by Swiss authorities who will apply Swiss rules, which do not recognize in-house counsel’s privileges.172

F. Following-up on internal investigations I. What is to be observed during the follow-up on internal investigations? 110

The investigative findings form the factual basis for the Board and management to fulfill their legal duties resulting from corporate law, criminal law and regulatory rules, that is: – Under their fiduciary duty, the Board and management must protect the company’s assets, goodwill and profitability. To the extent the investigative findings reveal occurrences that jeopardize what management and the Board must protect, these dangers must be eliminated. For instance, if corrupt practices were uncovered in the division under investigation, and those responsible are unlikely to behave compliantly in future, tolerating them in the enterprise puts the company’s money at risk of being used also in future transactions in violation of its corporate goal and code of conduct. Hence, the employees in question should be demoted or if necessary, terminated. Also, if the weaknesses detected are not only personal but rather, structural in nature, the Board’s and management’s fiduciary duties mandate that structures, policies, and whatever else is necessary and appropriate in the circumstances be improved and that the improvements be subjected to reasonable spot checks and audits to ensure their effectiveness. Fiduciary duties might also speak in favour of making voluntary tax disclosures, where appropriate (e.g. in corruption cases), in order to protect the company from high tax fines. Finally, to minimize damages (if any) incurred by the company, a careful analysis of the odds to claim damages from perpetrators of serious violations might be 171

BSK-Oberholzer, Art. 321 CP N 5. See e.g. the decision of the Federal Supreme Court no. 1B_101/2008 of 28 October 2008, consideration 4.4, with further references. 172

Livschitz

Reemers Publishing Services GmbH O:/Beck/Spehl_Gruetzner/3d/12_Switzerland.3d from 06.03.2013 09:31:44 3B2 9.1.580; Page size: 160.00mm  240.00mm

F. Following-up on internal investigations

395

necessary; in this regard it must be noted that criminal fines imposed on a company as a rule do not qualify as damages eligible for compensation under Swiss law.173 – Similarly, also under directors’ and officers’ criminal culpability rules, to prevent crimes within their ambits of responsibilities and to such end, to ensure all necessary and appropriate organizational measures,174 senior management and, as the case may be, the involved Board members must eliminate organizational shortcomings detected, carry out all structural and personnel changes to that effect, and spot check/audit these changes at reasonable intervals in the future. – For regulated companies, the result of internal investigations might in addition, trigger reporting obligations or other follow-up, as provided for under the relevant regulation.175 Similarly, for listed companies, certain findings might entail the duty to publish an ad hoc-notice, or as the case may be, the company will have to instate a black-out period for trading in the company’s own shares pending follow-up on certain findings, etc. – Investigative reports and possible follow-up should be kept confidential from all those who were not involved in the investigation, stretching to company staff and officers. This is because negligent divulgation of relevant information might represent a violation of personality rights of those personally concerned by the investigation, and also to avoid use of the information against the company, e.g. in shareholders’ suits. In other words, the company must ensure a sufficient level of data safety through access controls, state-of-the-art technical treatment etc.176 – The data generated by the investigation must be destroyed as soon as possible to the extent it relates to employees and other third parties, i. e. as soon as there is no legal necessity for the company to hold on to the data. The latter depends on the circumstances of each individual case such as, amongst others, relevant statutes of limitations (under both Swiss and applicable foreign laws). For instance, where an investigation relates to active bribery of public officials, the statute of limitations under Swiss law is 15 years from the commission of the act. Consequently, it makes sense for the company to keep the data for 15 years even where it chooses not to report the incident to prosecutorial authorities, because during the subsequent 15 years, the company might, in theory, be implicated in relevant proceedings unwillingly. The investigative data might then become crucial for the company’s defense. Beyond the above, the company should also be aware of possible duties (e.g. under pertinent regulations – Swiss or foreign) to archive the data for certain minimum periods because destroying the data prior to the lapsing of these periods might expose the individuals in charge to sanctions for unlawful destruction of records.177 Notwithstanding the above, findings from an internal investigation might be of 111 great interest for shareholders or competitors with a view to possible damage claims (of shareholders against management for breach of fiduciary duties etc.; of competitors against the company for having committed unfair competition or having engaged 173

BGE 134 III 59, consideration 2. See supra paras. 2 et seqq. 175 See supra paras. 5 et seqq. 176 Art. 7 para. 1 Swiss Data Protection Act. 177 In Switzerland: Art. 254 Swiss Penal Code. 174

Livschitz

Reemers Publishing Services GmbH O:/Beck/Spehl_Gruetzner/3d/12_Switzerland.3d from 06.03.2013 09:31:44 3B2 9.1.580; Page size: 160.00mm  240.00mm

§ 12. Switzerland

396

in a cartel, etc.). Therefore, a company should be careful with whom and to what extent findings from the investigation are shared in the course of the follow-up.

II. May an employer pay its employee’s legal fees if he/she is being prosecuted under criminal law? It depends on what the employee is being prosecuted for and whether the prosecution in question is founded on a bona fide suspicion: – In cases where an employee has (purportedly) violated the company’s interests e.g. because he or she is accused of bribery (and thus, of having misappropriated the company’s money in violation of its corporate goal and code of conduct, in order to buy revenue that may be criminally forfeited), then the company is, in principle, the victim of the offence in question. Paying for that suspected perpetrator’s defense would be like catching a thief and giving him money to flee in a taxi. In principle, such conduct would be hard to defend for the company’s Board and management under their fiduciary duties.178 – In cases where an employee is suspected of an offence against the company’s interests but his prosecution reasonably appears ill-founded – or at least reasonable doubts arise as to the prosecution’s odds to prevail – it is acceptable for a company to advance the costs for the defense but, in case the employee’s guilt is proven, ask the employee for a refund. Otherwise the Board or, as the case may be, management are likely to be in a problematic position under their fiduciary duties.179 In addition, paying for the defense costs in question must be justified along the lines summarized below: 113 Where an employee is charged with wrongdoing that is not directed against the company’s interest, then the company may pay for that employee’s defense, provided that assuming the cost is beneficial for the company in the circumstances. For example, where the employee is a “rain maker” or otherwise very valuable to the company and needs to be sheltered in order to ensure continuing performance (which is higher than the defense costs in question). In other words, where the company is not a victim of the offence, payment for legal fees must be carefully considered and, although not excluded, is a matter of balancing all interests in question. 112

G. Summary of key results 114 I.

There are duties for companies and their management to initiate internal investigations under corporate, criminal and regulatory law. In essence, these duties arise in scenarios where either criminal wrongdoing within the company’s typical scope of business, or conduct that jeopardizes the company’s assets and goodwill is suspected of being or having been committed. Furthermore, it may be appropriate to take limited investigative measures within the

178 179

Similar: Bo¨ckli, § 13 N 858 et seqq.; Daeniker, 384 with references. Daeniker ibidem with references.

Livschitz

Reemers Publishing Services GmbH O:/Beck/Spehl_Gruetzner/3d/12_Switzerland.3d from 06.03.2013 09:31:44 3B2 9.1.580; Page size: 160.00mm  240.00mm

G. Summary of key results

II.

III.

IV.

V.

397

framework of routine audit and spot checks, as mandated under regulatory rules or the need under corporate and criminal law to ensure compliance. In conducting internal investigations, the company is mostly quite flexible with regard to the investigative means chosen, ranging from email screening and employee interviews, to drastic measures such as covert video monitoring of employees – provided the measures chosen are either covered by informed consent of those concerned, or are appropriate and necessary in the circumstances in order to further a bona fide interest of the company that outweighs the interests of the individuals whose data and personality are touched upon. In addition, limitations under criminal law (relating to phone tapping, spying, cross-border use of gathered information, etc.) apply. Although in principle, employees have a fiduciary duty towards the company to cooperate in internal investigations, such a duty is not absolute and may be limited by outweighing interests of the employees concerned. An employee is not expected to incriminate himself or his close relatives, and a low-ranking employee’s duty to report wrongdoing of peers and superiors is as a rule hard to justify. Involving external investigators is advisable particularly where relatively serious intrusions into the employee’s privacy might become necessary in the course of the investigation. Also, where a company wishes to maintain legal privilege in an investigation, external counsel needs to be involved. There might be legal duties for companies in the regulated financial sector to disclose results of the internal investigation to the regulator. Beyond such duties, Swiss law does not in principle mandate disclosure of investigative results unless a court or authority subpoenas specific relevant information. Where information from an internal investigation is shared voluntarily with authorities or in general, third parties, limitations under data protection rules for the benefit of employees and other individuals concerned, as well as (in case of cross-border information sharing) blocking statutes in penal law must be considered. Moreover, it must be carefully considered to what extent the information subsequently becomes publicly accessible. This is especially in view of potentially hostile interests third parties might have in perusing the information.

Livschitz

Reemers Publishing Services GmbH O:/Beck/Spehl_Gruetzner/3d/12_Switzerland.3d from 06.03.2013 09:31:45 3B2 9.1.580; Page size: 160.00mm  240.00mm

398

§ 12. Switzerland

H. Appendix Table of Statutes

115

Name

Original Title

SR no.

Swiss Federal Constitution

Bundesverfassung der Schweizerischen Eidgenossenschaft vom 18. April 1998 (BV)

101

Swiss Civil Code (“CC”)

Zivilgesetzbuch vom 10. Dezember 1907 (ZGB)

210

Swiss Code of Obligations (“CO”)

Obligationenrecht vom 30. Ma¨rz 1911 (OR)

220

Swiss Data Protection Act (“DPA”)

Bundesgesetz vom 19. Juni 1992 u¨ber den Datenschutz (DSG)

235.1

Swiss Act against Unfair Competition

Bundesgesetz vom 19. Dezember 1986 gegen den unlauteren Wettbewerb (UWG)

241

Swiss Penal Code (“PC”)

Schweizerisches Strafgesetzbuch vom 21. Dezember 1937 (StGB)

311.0

Swiss Act on the Monitoring of Telecommunications

Bundesgesetz vom 6. Oktober 2000 betref¨ berwachung des Post- und Fernfend die U ¨ PF) meldeverkehrs (BU

780.1

Swiss Telecommunication Act (“TCA”)

Fernmeldegesetz vom 30. April 1997 (FMG)

784.10

Swiss Labor Act

Bundesgesetz vom 13. Ma¨rz 1964 u¨ber die Arbeit in Industrie, Gewerbe und Handel (Arbeitsgesetz, ArG)

822.11

Ordinance no. 3 under the Swiss Labor Act

Verordnung 3 vom 18. August 1993 zum Arbeitsgesetz (Gesundheitsvorsorge, ArGV 3)

822.113

Swiss Employees Participation Act

Bundesgesetz vom 17. Dezember 1993 u¨ber die Information und Mitsprache der Arbeitnehmerinnen und Arbeitnehmer in den Betrieben (Mitwirkungsgesetz, MitwG)

822.14

Swiss Anti-Money Laundering Act

Bundesgesetz u¨ber die Beka¨mpfung der Geldwa¨scherei und der Terrorismusfinanzierung im Finanzsektor (Geldwa¨schereigesetz, GwG)

955.0

Livschitz

Reemers Publishing Services GmbH O:/Beck/Spehl_Gruetzner/3d/12_Switzerland.3d from 06.03.2013 09:31:46 3B2 9.1.580; Page size: 160.00mm  240.00mm

399

H. Appendix

Name

Original Title

SR no.

Swiss Financial Market Supervision Act (“FINMASA”)

Bundesgesetz vom 22. Juni 2007 u¨ber die Eidgeno¨ssische Finanzmarktaufsicht (FINMAG)

956.1

Swiss Penal Procedure Code (“PPC”)

Schweizerische Strafprozessordnung vom 5. Oktober 2007 (StPO)

312

Swiss Civil Procedure Code (“CPC”)

Schweizerische Zivilprozessordnung vom 19. Dezember 2008 (ZPO)

272

Swiss Administrative Penal Code (“SAPC”)

Bundesgesetz vom 22. Ma¨rz 1974 u¨ber das Verwaltungsstrafrecht (VStrR)

313.0

Swiss Act on the Organisation of Federal Criminal Authorities (“OCA”)

Bundesgesetz vom 19. Ma¨rz 2010 u¨ber die Organisation der Strafbeho¨rden des Bundes (StBOG)

173.71

Swiss Act on Direct Taxes (“SDTC”)

Bundesgesetz vom 14. Dezember 1990 u¨ber die direkte Bundessteuer (DBG)

642.11

Swiss Act on Harmonisation of Direct Cantonal and Municipal Taxes (“STHC”)

Bundesgesetz vom 14. Dezember 1990 u¨ber die Harmonisierung der direkten Steuern der Kantone und Gemeinden (StHG)

642.14

Swiss Act on Administrative Procedure (“VwVG”)

Bundesgesetz vom 20. Dezember 1968 u¨ber das Verwaltungsverfahren (Verwaltungsverfahrensgesetz, VwVG)

172.021

Swiss Act on Federal Civil Proceedings (“BZP”)

Bundesgesetz vom 4. Dezember 1947 u¨ber den Bundeszivilprozess (BZP)

273

Livschitz

Reemers Publishing Services GmbH O:/Beck/Spehl_Gruetzner/3d/12_Switzerland.3d from 06.03.2013 09:31:46 3B2 9.1.580; Page size: 160.00mm  240.00mm

Reemers Publishing Services GmbH O:/Beck/Spehl_Gruetzner/3d/13_USA.3d from 06.03.2013 09:32:25 3B2 9.1.580; Page size: 160.00mm  240.00mm

§ 13. United States of America1 Para. A. Introduction . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 1 B. Initiation of internal investigations . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 2 I. When and to what extent should internal investigations be conducted? . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 2 1. Notions of corporate governance – the role of a company’s board of directors in compliance and investigations . . . . . . . . . . . . . . . . . . . . . . . . . 7 2. Obtaining credit under the U.S. Sentencing Guidelines, the Principles of Federal Prosecution of Business Organizations and the SEC Enforcement Manual . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 11 a) US Sentencing Guidelines . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 11 aa) Policies and procedures . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 13 bb) Board and management responsibility . . . . . . . . . . . . . . . . . . . . . . 14 cc) Appropriate assignment of responsibility . . . . . . . . . . . . . . . . . . . 15 dd) Communication and training . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 16 ee) Steps to ensure compliance . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 17 ff) Enforcement of compliance program . . . . . . . . . . . . . . . . . . . . . . . 19 gg) Response to illegal conduct . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 20 b) The Principles of Federal Prosecution of Business Organizations 23 c) SEC Enforcement Manual . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 26 3. Auditor’s detection of potential illegal act – Securities Exchange Act Section 10A . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 28 4. Whistleblower issues under Dodd-Frank whistleblower bounty rules and section 10(A) whistleblower program requirement . . . . . . . 32 II. Should the internal investigation be of an open or covert nature? . . . . 37 1. Attorney-client privilege . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 41 2. Work product doctrine . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 48 C. Admissibility and implementation of individual measures within the scope of the internal Investigation . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 56 I. What measures are admissible within the scope of an internal investigation? . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 56 1. Document hold notices . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 57 2. Document collection . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 58 3. Review of personnel files . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 59 4. Document and email review . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 60 5. Interviews . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 61 6. Interview memoranda . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 63 7. Telephone conversation recording . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 64 8. Video surveillance . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 69 a) Video only . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 70 b) Not in private areas . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 71 c) Bargain with the union . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 72 9. Workplace searches . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 73 II. Must employees’ representatives such as the works council be involved in internal investigations? . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 74 1 We would like to extend our heartfelt gratitude to several of our colleagues who expended a considerable amount of time and energy on this Chapter, including Ying Deng, Natalia MacWilliam, Melinda Laine and Kyle Olson, all associates in Baker & McKenzie’s Dispute Resolution practice group, and Robert Mignin and Ryan Vann of Baker & McKenzie’s Compensation and Employment practice group.

Kent/Tomas

Reemers Publishing Services GmbH O:/Beck/Spehl_Gruetzner/3d/13_USA.3d from 06.03.2013 09:32:25 3B2 9.1.580; Page size: 160.00mm  240.00mm

402

§ 13. United States of America Para. D. Employee interviews . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 75 I. May an employee refuse to provide information if this information would incriminate himself/herself? . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 77 II. Duty to provide information on the tasks directly assigned to the employee or carried out by the employee . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 79 III. Duty to provide information in indirect connection with the scope of work . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 81 IV. Duty to provide information outside the scope of work . . . . . . . . . . . . . . . 82 V. Disclosure of information to authorities if employee is obliged to incriminate himself/herself . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 83 VI. Is an employee obliged to provide information on any misconduct of a criminal offense committed by other employees? . . . . . . . . . . . . . . . . . . . 84 VII. May an employee refuse to answer a question if he/she has already answered it within the scope of a previous interview? . . . . . . . . . . . . . . . . . 85 VIII. Is an employee entitled to the presence of a member of the labor union or an attorney during the interview? . . . . . . . . . . . . . . . . . . . . . . . . . . . 86 1. Union representation . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 86 2. Attorney representation . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 88 IX. Is an employee entitled to read the record of his/her interview? . . . . . . 92 X. Is the employer entitled to request that the employee signs the record of the interview? . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 93 XI. Can the employer instruct an employee to treat the content of his/her interview as confidential? . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 94 E. Sanctions imposed on employees . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 96 I. What are the sanctions under employment law that can be imposed on employees refusing to cooperate in an internal investigation? . . . . . 96 II. Is the suspicion of a criminal offense or of a severe violation of duty sufficient for termination? . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 102 III. Must an employee cooperate in internal investigations even after he/ she has been terminated? . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 104 F. Use of obtained information . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 105 I. Is it permissible to disclose the findings and information obtained within the scope of any internal investigation to other group companies? . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 105 II. Is it permissible to disclose the findings and information obtained as a result of an internal investigation to the authorities? . . . . . . . . . . . . . . . . . . 106 G. Following-up on internal investigations . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 113 I. What is to be observed during the follow-up of internal investigations? . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 113 II. May an employer pay its employee’s legal fees if he/she is being prosecuted under criminal law? . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 116

A. Introduction 1

The decision to initiate an internal investigation is a significant event to a corporation. The question inevitably arises in the context of allegations of misconduct by agents of the corporation, which if serious raise the specter of a government investigation. When serious allegations arise, the need for an internal investigation is clear. If the allegations are not initially serious or credible, the necessity of initiating an investigation is less apparent. The consequences of initiating an investigation can include disruption to business, operations and morale, loss of business, reputational damage, significant legal, forensic advisory and electronic data storage and review costs. In addition, although investigation counsel or the investigation team conKent/Tomas

Reemers Publishing Services GmbH O:/Beck/Spehl_Gruetzner/3d/13_USA.3d from 06.03.2013 09:32:25 3B2 9.1.580; Page size: 160.00mm  240.00mm

B. Initiation of internal investigations

403

ducting the investigation generally go to great lengths to clarify that the investigation is a fact finding process and that in many cases no determinations have been made, business organizations are run by, and act through their corporate agents. As a result, virtually any investigation into potential wrongdoing at a business organization will involve the specter that an employee or group of employees may have done something wrong. On the other hand, a failure to investigate allegations of misconduct also can have substantial consequences, including the perception that the corporation does not take such allegations seriously. For all of these reasons, companies often deliberate carefully, and rightfully so, over whether to commence an internal investigation. The first section of this chapter “Initiation of internal investigations” contains a discussion of the common reasons why companies in the US chose to initiate an investigation and a description of certain key legal and product doctrines in the US which are relevant to companies, their Board of Directors and management in deciding whether to initiate an internal investigation.

B. Initiation of internal investigations I. When and to what extent should internal investigations be conducted? The primary purpose of an internal investigation is to gather facts regarding 2 allegations of misconduct so that management and directors can make informed decisions, including remedial action, concerning the allegations. In some cases, the decision to commence an internal investigation is a fairly easy decision. For example, when a company has received a grand jury subpoena or it is otherwise notified that it is the subject of an investigation by US criminal or regulatory bodies (such as the United States Department of Justice (“DOJ”), the U.S. Securities and Exchange Commission (“SEC”) or the U.S. Commodities Futures Trading Commission (“CFTC”)), the company is likely to commence an internal investigation, for several reasons. Many companies faced with such an investigation decide that it is better for the company to be perceived as cooperative and seriously engaged in rooting out potential wrongdoing at the company. A company that undertakes an internal investigation under these circumstances generally hopes to recover “cooperation credit” in the form of a reduced fine or penalty, a reduction from a fraud or intent-based charge to a charge viewed as less serious, or possibly even a deferral of the prosecution or even a decision not to prosecute. U.S. enforcement attorneys, and defense counsel representing the parties under 3 investigation, are guided by official guidelines or agency pronouncements which over the years have taken on a quasi-legislative effect in the white collar crime arena. Depending upon the nature of the possible violations and the government agencies involved, the following documents or pronouncements could play a significant role in determining whether, and to what extent, a company receives cooperation credit in a government investigation. – U.S. Federal Sentencing Guidelines Manual § 8 B2.1. Effective Compliance and Ethics Program2 2

2011 U.S. Federal Sentencing Guidelines Manual (“U.S.S.G. Manual”), available at www.ussc. gov/Guidelines/2011_Guidelines/Manual_HTML/8b2_1.htm.

Kent/Tomas

Reemers Publishing Services GmbH O:/Beck/Spehl_Gruetzner/3d/13_USA.3d from 06.03.2013 09:32:25 3B2 9.1.580; Page size: 160.00mm  240.00mm

404

§ 13. United States of America

– United States Attorney’s Manual – Principles of Federal Prosecution of Business Organizations3 – SEC Enforcement Manual4 – CFTC – Cooperation Factors in Enforcement Division Sanction Recommendations.5 4 These sources provide guidance to companies regarding the circumstances under which credit or leniency may be afforded to companies that elect to proactively address compliance with laws issues, including instituting an internal investigation and implementing remedial measures based on that investigation. 5 In other cases, the necessity of instituting an internal investigation is less clear. For example, a company may have received a complaint alleging wrongdoing by the company’s executives, sales, or financial department staff. Or, the company’s board of directors or audit committee may be alerted to alleged misconduct during the course of an internal or external audit of the company’s operations.6 In many instances, the company will not yet have been contacted by a government agency, and not every wrongful act warrants law enforcement or regulatory, particularly federal, action. In these cases, a company’s management, board of directors and legal department are faced with a vexing question. There are many factors weighing in favor of the company not initiating an investigation. If a company decides to undertake an investigation, there likely will be significant cost involved. If the investigation uncovers no evidence of wrongdoing, some may question the wisdom of expending corporate resources and distracting employees from their jobs. It is also natural for companies and their representatives to fear that an investigation into a single transaction or event will snowball into a significant corporate investigation, potentially resulting in a prosecution. 6 Notwithstanding these concerns, a company may chose to initiate some type of internal review for other reasons. First, the company must determine whether it is at risk of criminal or regulatory investigation. Practically speaking, companies that operate in a more regulated industry, such as the securities, defense or healthcare industries, are more likely to be at risk of regulatory investigation. Second and similarly, a company’s exposure to regulatory fines and sanction is also a consideration when determining whether to initiate an inquiry. For example, if a company is publicly traded in the US and subject to SEC registration and reporting obligations, or if it sells into particular countries through foreign subsidiaries, there 3 U.S. Attorneys’ Manual §§ 9-28.000 et seq., available at www.justice.gov/opa/documents/corpcharging-guidelines.pdf. 4 SEC Enforcement Manual (2011), available at www.sec.gov/divisions/enforce/enforcementmanual. pdf. 5 CFTC Enforcement Advisory, Cooperation Factors in Enforcement Division Sanction Recommendations, August 11, 2004, available at www.cftc.gov/ucm/groups/public/@cpdisciplinaryhistory/ documents/file/enfcooperation-advisory.pdf. 6 Section 10(A)(b) of the Securities Exchange Act of 1934 (“Exchange Act”) (discussed in greater detail below) provides that if, during the course of an audit, a company’s external auditor uncovers evidence of an “illegal Act” (a defense term) and it has determined that it is likely that the illegal act has in fact occurred, it must inform management or the audit committee or Board of Directors of the evidence or illegal act. 15 U.S.C. § 78j–1(b). Section 10(A)(b) report generally sets in motion a chain of events that requires management or the audit committee to investigate the matter. Failure to engage in appropriate remedial action may result in the failure to obtain the auditor’s sign-off on a company’s “financial statements” or the resignation of the external auditor.

Kent/Tomas

Reemers Publishing Services GmbH O:/Beck/Spehl_Gruetzner/3d/13_USA.3d from 06.03.2013 09:32:26 3B2 9.1.580; Page size: 160.00mm  240.00mm

B. Initiation of internal investigations

405

is a greater risk that questionable corporate conduct may result in a regulatory investigation, than there is a for a private company that does not sell internationally. In these cases, companies often elect to conduct a review of the alleged misconduct in order to assess the extent, if any, of the misconduct, and to possibly report it to the regulatory authorities in the hope of avoiding significant fines and sanctions. US regulatory agencies often cite the existence of a pre-existing compliance program, including conducting an appropriate investigation into the allegations, as a significant factor in determining whether to take enforcement action.7 Third, results of the internal investigation and review will serve to put the company in a better position to respond to any potential criminal, regulatory and civil action. Fourth, to the extent that the investigation relates in any way to a company’s financial statements and financial reporting requirements, the company’s auditor may very well, pursuant to Section 10(A)(b) of the Exchange Act, require adequate assurances that the matter has been investigated and that it is not likely to have a “material effect on the financial statements of the company.8 Fifth, a company may elect to investigate in order to ensure that corporate assets are being safeguarded and not stolen, embezzled, misappropriated or misused, an objective of particular concern for public companies subject to the US federal securities laws, including the accounting provisions of the Foreign Corrupt Practices Act (“FCPA”). A company may also chose to investigate because it feels that it has been a victim and is seeking to gather evidence for use against the employee or the third party that has victimized the company. Finally, a company may wish to identify employees who have engaged in wrongdoing, and sanction them appropriately. An investigation also will help to determine whether the company’s compliance policies, procedures or programs need to be enhanced. These monitoring and remedial actions are key elements of the Sentencing Guidelines’ assessment of an effective compliance program and will impact a federal prosecutor’s decision to prosecute under the Principles of Federal Prosecution of Business Organizations. They are also essential elements of a publicly traded company’s system of internal accounting controls under the FCPA and internal controls over financial reporting under the Sarbanes Oxley Act, both of which are incorporated into the Securities Exchange Act of 1934 and govern US public companies and, in many instances, their domestic and foreign subsidiaries. In the summary, although there are possibly numerable reasons why a company may elect to initiate an internal investigation, this determination in most cases will be driven by one or more of the following factors: – Traditional US notions of corporate governance. – The potential for obtaining cooperation credit or leniency from US law enforcement agencies.

7 See SEC Enforcement Manual (2011); OFAC Guidance on Opening Securities and Futures Accounts, available at www.treasury.gov/resource-center/international/standards-codes/Documents/ securities_future_accounts_11052008.pdf 8 The auditor will require these assurances before attesting to the company’s financial statements. Failure to obtain the auditor’s attestation or the resignation of the auditor can result in several unintended consequences, including to timely file SEC quarterly and annual reports, delisting from a steady exchange, deregistration of a company’s securities with the SEC, and possibly a criminal or regulatory investigation. 15 U.S.C. § 18j-1(b).

Kent/Tomas

Reemers Publishing Services GmbH O:/Beck/Spehl_Gruetzner/3d/13_USA.3d from 06.03.2013 09:32:26 3B2 9.1.580; Page size: 160.00mm  240.00mm

406

§ 13. United States of America

– Responding to issues that arise in connection with an audit of the company’s financial statements. – Responding to whistleblower allegations. 1. Notions of corporate governance – the role of a company’s board of directors in compliance and investigations Traditionally, in the US, the question of a director’s obligation to monitor the company and to ensure compliance with the law has been a question of state law, driven by the state business codes establishing a director’s duties to the company and shareholders, and the interpretative cases. There is, however, an increasing “federalization” of corporate conduct and compliance. This trend is most pronounced in two areas: (i) when a company is publicly traded in the United States; or (ii) when a company is otherwise subject to a broad web of federal regulation, such as in the healthcare, securities and financial services industries. Moreover, any US company, or non-US company that operates in the US directly or through subsidiaries, is subject to applicable US civil or criminal laws, including antitrust, the FCPA and other criminal laws, which create strong incentives for establishing a robust compliance program. The DOJ’s Principles of Federal Prosecution of Business Entities and the Federal Sentencing Guidelines’ definition of an effective compliance program provide significant benefits to all companies, domestic or foreign, who maintain a strong compliance program and who appropriately investigate and remediate alleged wrongdoing.9 These pronouncements make it clear that a company’s board of directors is responsible for setting an appropriate “tone at the top” and staying abreast of the compliance initiatives of the Company.10 8 The precise scope of a director’s obligation under US state law to monitor the company for legal compliance and to ensure that the company maintains an effective compliance program is a developing body of law. By way of background, in the US, a company’s board of directors is generally bound by three main sets of fiduciary duties and obligations: (i) the duty of care; (ii) the duty of loyalty; and (iii) the duty of obedience.11 In the US, under the Revised Model Business Corporation Act, which has been adopted in some form in at least 24 states, a director will be viewed as having discharged his or her duty of care where the director: (i) acts in good faith; (ii) with the duty of care an ordinary prudent person in a like position would exercise under similar circumstances; and (iii) in a manner the director reasonably believes to be in the best interests of the company.12 A director’s duty of care is generally broken down into two subcomponents: (i) the duty to make informed decisions and (ii) the duty of oversight.13 Where a disinterested director reasonably investigates the facts and, based upon that reasonable investigation, in good faith determines to undertake an action they believe are in the best interests of the company, the director will be protected from “second 7

See U.S. Attorneys’ Manual § 9-28.300(A); U.S.S.G. Manual § 8C2.5(f)(1). See U.S. Attorneys’ Manual § 9-28.500(B); U.S.S.G. Manual § 8B2.1(b)(2). 11 Webb/Tarun/Molo, Corporate Internal Investigations, § 3.01, 3–4 (1993). 12 Model Business Corporation Act, § 8.30(a)-(b) (2002) 13 Smith v. Van Gorkam, 488 A.2 d 858 (Del. 1985); In re Caremark International Inc. Derivative Litigation, 698 A 2 d 959 (Del. Ch. 1996). 9

10

Kent/Tomas

Reemers Publishing Services GmbH O:/Beck/Spehl_Gruetzner/3d/13_USA.3d from 06.03.2013 09:32:26 3B2 9.1.580; Page size: 160.00mm  240.00mm

B. Initiation of internal investigations

407

guessing” of that decision under the business judgment rule.14 Accordingly, where a director undertakes reasonable efforts to ascertain all information relevant to the investigation, and based on that action takes measures reasonably designed to terminate the conduct, the director’s decisions, even if determined in hindsight to have been wrong, will be protected under the business judgment rule.15 However, this decision must be an informed decision based on all reasonably available information. A director’s uniformed decision will not be protected by the business judgment rule.16 Nevertheless, certain courts indicate that a director’s failure to implement an 9 adequate compliance program may result in liability for a director.17 In cases where a director has not made a “business decision”, but rather has failed to exercise his or duty of oversight over the company’s affairs (such as by failing to adequately monitor the company’s operations),18 a developing modern trend in U.S. case law is that the business judgment rule will generally not be available.19 The “duty to monitor” a company’s affairs, as evidenced below in the landmark decision in 14 Block/Barton/Radin, The Business Judgment Rule: Fiduciary Duties of Corporate Directors, Vol. 1, Ch. 1 § C (2009). 15 Aronson v. Lewis, 473 A.2 d 806, 812 (Del. 1984); Joy v. North, 692 F. 2 d 880, 886 (2 d Cir. 1982), cert denied 460 U.S. 1051 (1983). 16 See Sporkin, SEC Enforcement and the Corporate Board Room, 61 N.C. L. Rev. 455 (1983): The business judgment rule provides that directors can rely on their best professional judgment when filling the duties of their office. But what is the key to the business judgment rule? First, the directors must be acting in good faith. But even under the good faith standard, they must make the requisite investigation and inquiry. Otherwise they cannot really be acting in good faith. Id. at 45657. Thus, the Corporate Director’s Guidebook counsels that: [a] director is entitled to rely on reports, opinions, information, and statements (including financial statements and other financial data) presented by (i) the corporation’s officers or employees whom the director reasonably believes to be reliable and competent in the matters presented, (ii) legal counsel, public accountants, or other persons as to matters that the director reasonably believes to be within their professional or expert competence, and (iii) duly authorized committees of the board on which the director does not serve, unless in any such cases the director has knowledge that would make such reliance unwarranted. However, a director relying on others has a responsibility to keep informed of the efforts of those to whom the word has been delegated. The extent of this review function will vary depending upon the nature and importance of the matter in question. ABA Committee on Corporate Laws, Corporate Director’s Guidebook (6th ed., ABA Section of Business Law, 2011). 17 Stone v. Ritter, 911 A.2 d 362, 370 (Del. 2006) (approving the standard set forth In re Caremark Int’l Inc. Deriv. Litig., 698 A.2 d 959 (Del. Ch. 1996)) [T]he necessary conditions predicate for director oversight liability [are]: (a) the directors utterly failed to implement any reporting or information system or controls; or (b) having implemented such a system or controls, consciously failed to monitor or oversee its operations thus disabling themselves from being informed of risks or problems requiring their attention. Id. at 370. 18 For example, the Corporate Director’s Guidebook identifies the following functions of the board as part of its oversight responsibility: [A]pproving fundamental operating, financial, and other corporate plans, strategies and objectives; evaluating the performance of the corporation and its senior management and taking appropriate action, including removal, when warranted; selecting, regularly evaluating, and fixing the compensation of senior executives; requiring, approving, and implementing senior executive succession plans; adopting policies of corporate conduct, including compliance with applicable laws and regulations, and maintenance of accounting, financial and other controls; reviewing the process of providing appropriate financial and operational information to decision makers (including board members); and evaluating the overall effectiveness of the board. Supra note 15. 19 Brown, The Corporate Director’s Compliance Oversight Responsibility in the Post-Caremark Era, 26 Del. J. Corp. L. 1, 13 (2001); Griffith, Jr., Director Oversight Liability: Twenty First Century Standards and Legislative Controls on Liability, 20 Del. J. Corp. L. 653, 656 (1995).

Kent/Tomas

Reemers Publishing Services GmbH O:/Beck/Spehl_Gruetzner/3d/13_USA.3d from 06.03.2013 09:32:26 3B2 9.1.580; Page size: 160.00mm  240.00mm

408

§ 13. United States of America

Caremark, fits hand-in-glove with the expectation that the board of directors be involved in the company’s compliance program. 10 With respect to a director’s duty of care and oversight, generally reserved as state law issues, and the emergence of the then-emerging federal criminalization of corporate misconduct, demonstrated by the U.S. federal sentencing guidelines, Chancellor Allen in In re Caremark stated “[a]ny rational person attempting in good faith to meet an organizational governance responsibility would be bound to take into account [the Guidelines] and the enhanced penalties and the opportunities for reduced sanctions [they] offer.”20 Chancellor Allen went on to hold that a company’s directors are required to “exercise a good faith judgment that the corporation’s information and reporting system is in concept and design adequately to assure the board that appropriate information will come to its attention in a timely manner as a matter of ordinary operations.”21 Thus, any director must be familiar with the mandates of the US sentencing guidelines, as well as the subsequent federal laws that further defined a director’s duty to ensure that his or her company has a robust compliance program. 2. Obtaining credit under the U.S. Sentencing Guidelines, the Principles of Federal Prosecution of Business Organizations and the SEC Enforcement Manual a) US Sentencing Guidelines The US Sentencing Guidelines provide that when making sentencing recommendations and decisions, a prosecutor and judge, respectively, may consider the existence of an effective compliance program as a mitigating factor. United States Attorney’s Manual, Principles of Federal Prosecution of Business Organizations (commonly referred to as the “Filip Memo”) at p. 11, available at www.justice.gov/ opa/documents/corp-charging-guidelines.pdf. Therefore, companies often look to mitigate or reduce any potential sanction by establishing processes consistent with the Guidelines. One key element to the Guidelines’ definition of an effective compliance program is monitoring, detecting and responding to potential criminal conduct – of which investigations and internal corporate inquiries are an essential component.22 12 Under the Guidelines, the Board of Directors has overall responsibility for a company’s compliance program.23 In order for a company’s compliance program to be deemed effective, the company must exercise diligence in detecting and preventing criminal conduct and promote a culture of compliance. Importantly, the Guidelines recognize that the failure to prevent or detect a single instance of wrongdoing does not necessarily render a company’s compliance program ineffective.24 However, a company should conduct risk assessments and tailor its compliance program to the findings of that assessment. To this end, the Guidelines 11

20 Elson/Gyves, In Re Caremark: Good Intentions, Unintended Consequences, 39 Wake Forest L. Rev. 691, 701 (2004). 21 Caremark, 698 A. at 970. 22 U.S.S.G. Manual § 8B2.1. 23 Id., § 8B2.1(b)(2). 24 Id., § 8B2.1(a).

Kent/Tomas

Reemers Publishing Services GmbH O:/Beck/Spehl_Gruetzner/3d/13_USA.3d from 06.03.2013 09:32:27 3B2 9.1.580; Page size: 160.00mm  240.00mm

B. Initiation of internal investigations

409

clearly state that a company must periodically assess the risk of criminal conduct at the company and take appropriate steps to design, implement and modify the company’s compliance program with respect to each of the following elements in view of the findings of this risk assessment.25 The Guidelines provide that in order for a company’s compliance program to be deemed effective, it must meet the criteria set forth below.26 aa) Policies and procedures The company shall establish standards and procedures (i. e., policies, procedures, 13 processes) designed to prevent and detect criminal conduct. bb) Board and management responsibility The company’s governing authority (e.g., the Board of Directors) must be know- 14 ledgeable about the content and operation of the compliance and ethics program and must exercise reasonable oversight with respect to the implementation and effectiveness of the compliance program. – High-level personnel of the organization shall ensure that the organization has an effective compliance and ethics program and specific individuals within highlevel personnel shall be assigned overall responsibility for the compliance program. – Specific individuals within the company must be delegated day-to-day operational responsibility for the compliance program. This person or persons shall report periodically to high-level personnel and, as appropriate, to the governing authority (or an appropriate subgroup of the governing authority, such as the audit committee) on the effectiveness of the compliance program. This person must be given adequate resources, appropriate authority, and direct access to the governing authority/appropriate subgroup. cc) Appropriate assignment of responsibility The company must use reasonable efforts not to include within the substantial 15 authority personnel of the company any person whom the organization knew, or through the exercise of due diligence would be expected to know, engaged in illegal activities or other conduct inconsistent with an effective compliance program. dd) Communication and training The company must take reasonable steps to communicate periodically its policies 16 and procedures, and other aspects of the compliance program, to the Board of Directors, high-level personnel, substantial authority personnel, employees and, as appropriate, the organization’s agents, through training programs and otherwise disseminating information.

25 26

Id. Id., § 8B2.1(b).

Kent/Tomas

Reemers Publishing Services GmbH O:/Beck/Spehl_Gruetzner/3d/13_USA.3d from 06.03.2013 09:32:27 3B2 9.1.580; Page size: 160.00mm  240.00mm

410

§ 13. United States of America

ee) Steps to ensure compliance The company must take reasonable steps to ensure that the organization’s compliance program is followed, including monitoring and auditing to detect criminal conduct, as well take reasonable steps to evaluate periodically the effectiveness of the company’s compliance program. 18 The company must also take reasonable steps to have and publicize a system for reporting misconduct, which may include mechanisms that allow for anonymity or confidentiality under which the company’s employees may report or seek guidance regarding potential or actual criminal misconduct without fear of retaliation. 17

ff) Enforcement of compliance program 19

The company’s compliance program must be promoted and enforced consistently throughout the company. These efforts must include incentives for employees to act legally and in accordance with the company’s compliance program and appropriate disciplinary measures with respect to employees that have engaged in criminal conduct or failed to take reasonable steps to prevent or detect criminal conduct. gg) Response to illegal conduct

After criminal conduct has been detected, the company shall take reasonable steps to respond appropriately to the criminal conduct and to prevent further similar criminal conduct, including making any necessary modifications to the organization’s compliance program. 21 Importantly, the Guidelines recognize that there is no “one-size-fits-all” approach to a company’s compliance structure.27 Rather, factors such as the size of the organization, compliance with governmental regulations and the industry in which the company operates will impact the Government’s expectations as to the formality of, and the resources devoted to, a company’s compliance program.28 Another key factor in determining whether a company’s compliance program is effective is how the company’s compliance program compares to those of other companies in the same industry.29 22 Particularly important in the context of investigations, Application Note 6 to the Guidelines details what steps companies should take in order to ensure that they have responded appropriately to criminal conduct.30 These measures include, in addition to commencing an investigation, taking steps to ensure that the harm resulting from the criminal conduct is remedied (including paying restitution) and self-reporting and cooperating with authorities. In addition, in view of the findings of the investigation, the Application Note provides that the company should seek to modify its compliance program in order to address potential deficiencies. 20

Id., § 8B2.1, cmt. n.2. Id. 29 Id. 30 Id., § 8B2.1, cmt. n.6. 27 28

Kent/Tomas

Reemers Publishing Services GmbH O:/Beck/Spehl_Gruetzner/3d/13_USA.3d from 06.03.2013 09:32:27 3B2 9.1.580; Page size: 160.00mm  240.00mm

B. Initiation of internal investigations

411

b) The Principles of Federal Prosecution of Business Organizations The Principles of Federal Prosecution of Business Organizations set forth in the 23 United States Attorney’s Manual (“USAM”), is the DOJ policy instructing prosecutors under what circumstances they should initiate a prosecution against a business entity. The USAM requires prosecutors to consider the following factors when making a charging decision relating to business entities. 1. the nature and seriousness of the offense, including the risk of harm to the public and applicable policies and priorities, if any, governing the prosecution of corporations for particular categories of crime; 2. the pervasiveness of the wrongdoing within the corporation, including the complicity in, or the condoning of, the wrongdoing by corporate management; 3. the corporation’s history of similar misconduct, including prior criminal, civil, and regulatory enforcement actions against it; 4. the corporation’s timely and voluntary disclosure of wrongdoing and its willingness to cooperate in the investigation of its agents; 5. the existence and effectiveness of the corporation’s pre-existing compliance program; 6. the corporation’s remedial actions, including any efforts to implement an effective corporate compliance program or to improve an existing one, to replace responsible management, to discipline or terminate wrongdoers, to pay restitution, and to cooperate with the relevant government agencies; 7. collateral consequences, including whether there is disproportionate harm to shareholders, pension holders, employees, and others not proven personally culpable, as well as impact on the public arising from the prosecution; 8. the adequacy of the prosecution of individuals responsible for the corporation’s malfeasance; and 9.31 the adequacy of remedies such as civil or regulatory enforcement actions.32 Thus, among the factors federal prosecutors are required to consider is whether the company maintained an effective corporate compliance program. The Department has no formulaic requirements regarding corporate compliance 24 programs and companies are afforded great latitude in designing and implementing their compliance program. The fundamental questions a prosecutor is directed to ask are: Is the corporation’s compliance program well designed? Is the program being applied earnestly and in good faith? Does the corporation’s compliance program work?33 In answering these questions, the prosecutors are instructed to consider the comprehensiveness of the compliance program; the extent and pervasiveness of the criminal misconduct; the number and level of the corporate employees involved; the seriousness, duration, and frequency of the misconduct; and any remedial actions taken by the corporation, including, for example, disciplinary action against past violators uncovered by the prior compliance program, and revisions to corporate compliance programs in light of lessons learned. Prosecutors are also instructed to consider the promptness of any disclosure of wrongdoing to the government. In evaluating compliance programs, prosecutors may consider whether the corporation has established corporate governance mechanisms that are designed to effectively detect and prevent misconduct. For example, do the corporation’s directors exercise independent review of proposed corporate actions rather than unquestioningly ratify officers’ recommendations; are internal audit functions conducted at a level sufficient to ensure their independence and accuracy; U.S. Attorneys’ Manual § 9-28.300(A). Id. 33 Id., § 9-28.800, cmt. 31 32

Kent/Tomas

Reemers Publishing Services GmbH O:/Beck/Spehl_Gruetzner/3d/13_USA.3d from 06.03.2013 09:32:28 3B2 9.1.580; Page size: 160.00mm  240.00mm

412

§ 13. United States of America

and have the directors established an information and reporting system in the organization reasonably designed to provide management and directors with timely and accurate information sufficient to allow them to reach an informed decision regarding the organization’s compliance with the law.34 A Prosecutor will look to determine whether a compliance program is a “living” program that develops along with the company, or whether it is a “paper program[,]” whether these are adequate staff or resources to audit, document and implement to company’s compliance program, and whether the company’s employees are informed about the program.35 25 A common theme that runs throughout these pronouncements is the duty that the board of directors has in the stewardship of the compliance program.36 As a general matter, a company’s board of directors, as well as management, may not completely disregard serious allegations of wrongdoing.37 Rather, the directors and management are expected to ensure that the allegations are, under the circumstances, reasonably investigated.38 In cases where the allegation may affect the company’s financial statements or reporting obligations, a company’s audit or other similar committee may also be involved in the investigation.39 c) SEC Enforcement Manual 26

The SEC also provides similar guidance to individuals and entities subject to SEC enforcement authority (including publicly traded companies, their subsidiaries and employees, and persons and entities in the securities industry) publicly traded companies relating to the circumstances under which the SEC will consider providing cooperation credit to a company. This guidance, which is set forth in the SEC Enforcement Manual, refers companies to what is commonly referred to as the Seaboard Report for specific guidance on the circumstances under which the SEC will consider leniency for companies that cooperate with SEC investigations.40 These factors include, but are not limited to, the nature of the misconduct, the length of the misconduct, the corporate positions (senior officers v. low-level employees) involved in the wrong doing, whether shareholders were harmed by the misconduct, how the misconduct was discovered, the company’s response and remediation upon learning of the misconduct and whether the company’s board of directors or audit committee was involved in the investigation and fashioning a response.41 Nevertheless, the SEC manual sets forth “four broad measures of a company’s cooperation.”42 These include: – The nature and the extent of a company’s self-policing before the incident (including an effective compliance program and tone at the top); 34

Id. Id. 36 Webb/Tarun/Molo, supra note 11, § 3.01. 37 Id. 38 Id. 39 Id., § 3.02. 40 2011 SEC Enforcement Manual § 6.1.2. 41 Id., § 6.1.2 (Reference to Report of Investigation Pursuant to Section 21(a) of the Securities Exchange Act of 1934 and Commission Statement on the Relationship of Cooperation to Agency Enforcement Decisions, U.S. Sec. and Exch. Comm’n, Exchange Act Release No. 44,969 (Oct. 23, 2001)(“Seaboard Report”), www.sec.gov/litigation/investreport/34-44969.htm.). 42 Id. 35

Kent/Tomas

Reemers Publishing Services GmbH O:/Beck/Spehl_Gruetzner/3d/13_USA.3d from 06.03.2013 09:32:28 3B2 9.1.580; Page size: 160.00mm  240.00mm

B. Initiation of internal investigations

413

– Self reporting of the matter to the authorities, including conducting an investigation of the matter and the consequences of the misconduct; – Remedial measures implemented in light of the investigation, including discipline, modifying internal controls and recompensing victims; – Cooperation with law enforcement agencies.43 The SEC Manual states that the level of cooperation credit provided to compa- 27 nies can range from a non-prosecution to reduced sanctions or charges.44 In any event, the SEC Manual and our experience make it clear that a key factor employed by the SEC staff in its charging assessment is the nature and the extent of a company’s investigation and remedial efforts. 3. Auditor’s detection of potential illegal act – Securities Exchange Act Section 10A In the context of public companies, the independent auditing process can also give 28 rise to investigations. Section 10A of the Securities Exchange Act of 1934 (Section 10A) imposes obligations upon registered public accounting firms (“auditors”), and by implication companies with stock traded in the US public markets (including foreign private issuers and companies with ADSs listed on US exchanges), where an auditor detects a potentially illegal act.45 Section 10A, among other things, requires auditors to take certain actions if, during the course of an audit, the auditor becomes aware of information indicating that an illegal act has or may have occurred. Importantly, it does not matter whether the potential illegal act would have a material effect on the issuer’s financial statements. As a general matter, upon learning of a potentially illegal act, the auditor must 29 take the following steps: – determine whether it is likely that an illegal act has occurred (auditors generally defer to legal counsel in making this determination). If it is determined that an illegal act has occurred, the auditor must determine and consider the possible effect of the illegal act on the financial statements of the issuer. This includes contingent monetary effects, such as fines, penalties, and damages; – inform the appropriate level of the management of the issuer and ensure that the audit committee of the issuer is adequately informed with respect to the potential illegal act, unless the potential illegal act is clearly inconsequential. In relevant part, Section 10A provides that if, once the audit committee (or a 30 Board of Directors in the absence of an audit committee) is informed of the potentially illegal act, the auditor concludes that: (i) the illegal act has a material effect on the financial statements of the issuer; (ii) senior management has not taken, and the board of directors has not caused senior management to take, timely and appropriate remedial actions with respect to the illegal act; and (iii) the failure to take remedial action is reasonably expected to warrant departure from a standard report of the auditor or warrant resignation from the audit engagement, the auditor is required to directly report its conclusions to the company’s board of directors. Significantly, if a company’s Board of Directors receives such a report from its 43

Id. Id. 45 15 U.S.C. § 78j-1. 44

Kent/Tomas

Reemers Publishing Services GmbH O:/Beck/Spehl_Gruetzner/3d/13_USA.3d from 06.03.2013 09:32:28 3B2 9.1.580; Page size: 160.00mm  240.00mm

414

§ 13. United States of America

auditor, it must notify the SEC that it has received such a report. Upon receiving this notification, the SEC will be in a position to investigate the matter, including making informal requests or subpoenaing information. 31 In practice, the discovery of a potential illegal act by an auditor often results in the issuer conducting an inquiry/investigation to determine whether the potentially illegal conduct has in fact occurred or is supported by evidence. Under Section 10A, an illegal act is broadly defined to include “any act or omission that violates any law, or any rule or regulation having the force of law.” 4. Whistleblower issues under Dodd-Frank whistleblower bounty rules and section 10(A) whistleblower program requirement On May 25, 2011, the SEC adopted final rules implementing a whistleblower program pursuant the Dodd-Frank Wall Street Reform and Consumer Protection Act (“Dodd-Frank”).46 Under the SEC’s whistleblower program, persons who voluntarily provide the SEC with original information regarding a violation of the US federal securities laws or the FCPA may be eligible to receive a bounty if the information leads to a successful SEC action exceeding and overall monetary remedies that exceed $1,000,000.47 Provided the remedies reach $1,000,000, then the total bounty available to an eligible whistleblower is between a minimum of 10 % and a maximum of 30 % of the total aggregate penalties generated through all enforcement proceedings arising from the same nucleus of facts.48 33 The final rules define who qualifies as a whistleblower, exempts or limits the ability of certain individuals, such as in-house counsel or compliance personnel, and provides that the statute’s anti-retaliation provisions apply to all whistleblowers.49 34 Although the final whistleblower rules do not require internal reporting through a company’s compliance helpline, they do provide an incentive to encourage individuals to utilize internal compliance processes. Under the final rules, voluntary participation in internal compliance can increase award amounts. The rules provide that voluntary participation in a company’s compliance and reporting system is a factor that can increase the amount of the bounty.50 Furthermore, if a whistleblower submits a tip internally, and either simultaneously or within 120 days makes a submission to the SEC, the whistleblower increases the probability of an award because he or she now has two paths to a recovery – monetary sanctions that result from: (1) the SEC’s investigation of the information provided by the whistleblower; and/or (2) the self-disclosure by the company to the SEC of the results of an internal investigation prompted by the whistleblower.51 35 These whistleblower rules under the Dodd-Frank Act built upon the whistleblower provisions that the US Congress enacted after the last wave of corporate scandals in 32

46 Implementation of the Whistleblower Provisions of Section 21F of the Securities Exchange Act of 1934, SEC Release No. 34–64545, 17 C.F.R. Pts. 240, 249 (May 25, 2011), available at www.sec.gov/rules/final/2011/34-64545.pdf. 47 17 C.F.R. § 240.21F-3. The CFTC, which has responsibilities for regulating the US commodities markets, has also implemented a similar whistleblower regime. 48 Id., § 240.21F-5. 49 Id., § 240.21F-2. 50 Id., § 240.21F-6. 51 Id. § 240.21F-6, § 240.21F-4(b)(7).

Kent/Tomas

Reemers Publishing Services GmbH O:/Beck/Spehl_Gruetzner/3d/13_USA.3d from 06.03.2013 09:32:28 3B2 9.1.580; Page size: 160.00mm  240.00mm

B. Initiation of internal investigations

415

2001 and 2002 in the form of the Sarbanes-Oxley Act of 2002 (“Sarbanes-Oxley”). Under Rule 10A-3 of the Exchange Act,52 which was adopted pursuant to Section 301 of Sarbanes-Oxley, the audit committee of a public company’s board of directors is required to, among other measures, establish procedures for the receipt, retention and treatment of complaints regarding accounting, internal accounting controls or auditing matters, as well as the confidential, anonymous submission by the company’s employees of concerns regarding auditing or accounting matters. This rule has served to further solidify the board of directors, and specifically the audit committee, as the component of the company that most often finds itself at the forefront of an investigation or allegation of corporate wrongdoing, as such matters within the audit committee’s mandatory purview include allegations of, for example, accounting fraud, financial statement fraud, embezzlement, misappropriation, self-dealing, corruption, and securities fraud. In order to assist the audit committee in carrying out these functions, Sarbanes Oxley provides the audit committee with the authority to retain outside advisors to assist it when carrying out its functions.53 Furthermore, boards of directors will often delegate the audit committee the responsibility of handling investigations relating to fraud or other potential significant litigation, as well as responsibilities for helping to ensure compliance by the company and its employees with applicable laws, rules and regulations.54 In the wake of Sarbanes-Oxley, management compliance and internal controls 36 obligations have also increased. Under Section 302 of Sarbanes Oxley, “significant deficiencies” and “material weaknesses” existing in the internal controls or that could lead to fraud must be reported by the certifying officer.55 In addition, Section 404, “Management Assessment of Internal Controls,” requires the company to file a report with the SEC addressing the company’s internal controls. Id. Similarly, Section 906 “requires each periodic financial statement filed by an issuer to be accompanied by a written statement by the chief executive officer and the chief financial officer (or equivalent thereof) of the issuer.”56

II. Should the internal investigation be of an open or covert nature? Although it is best to seek to retain the confidentiality of a corporate internal 37 investigation as long as possible, in many cases it is inevitable that the existence of the investigation will become known within the organization as documents are collected, computers are imaged and employees are interviewed. Notwithstanding this, there are several reasons why it is beneficial for an internal corporate investigation to remain confidential for as long as possible, as well as that the information learned during the scope of the investigation be shared with a limited group of corporate employees. At the outset of the investigation, retaining the confidentiality of the investigation 38 will allow for unfettered establishment of an investigation plan, the staffing of the investigation team and perhaps most importantly, the immediate gathering of documents and emails. The investigation plan serves to frame many of the legal Id., § 240.10A-3. Pub. L. 107–204, July 30, 2002, 116 Stat. 745. 54 Webb/Tarun/Molo, supra note 11, § 3.02[2]. 55 Id., § 3.02[3]. 56 Id., § 3.02[5]. 52 53

Kent/Tomas

Reemers Publishing Services GmbH O:/Beck/Spehl_Gruetzner/3d/13_USA.3d from 06.03.2013 09:32:29 3B2 9.1.580; Page size: 160.00mm  240.00mm

416

§ 13. United States of America

and factual issues to be resolved in the investigation. The investigation plan also helps the investigation team to identify potential interviewees and sources of documents and emails. While some employees may be identified early on as potential sources of information, other employees likely to have information may not be so obvious. The exercise of preparing the investigation plan assists in fleshing out a fuller scope of employees who are likely to have relevant information. Maintaining the confidentiality of an investigation, at least in its early stages, also helps to ensure that investigation counsel is able to obtain all relevant documentation, including before potential bad actors can delete emails or hard drives or destroy documentation. Furthermore, US law enforcement and regulatory bodies often request information on what steps a company has done to secure evidence and ensure that no evidence has been altered or destroyed. Maintaining the confidentiality of an investigation until evidence has been gathered is often helpful in demonstrating the legitimacy and robustness of a company’s evidence gathering process. 39 If there is a potential for corporate criminal liability or regulatory exposure, investigation counsel may wish to meet with the criminal and regulatory authorities and disclose the matter at the outset of the investigation. Doing so gives the authorities the opportunity to implement a highly confidential investigation, which may be in the company’s interest. Even if the company decides to not engage upon a highly confidential investigation, meeting with the criminal authorities or regulators before the investigation is far along allows investigation counsel to ascertain whether these authorities have any concerns over the focus of the investigation, and to shape the investigation appropriately, without prejudicing their ability to gather information. 40 (i) Related to the issue of investigation confidentiality is the issue of the twin doctrines of the attorney-client privilege and the work product doctrine. (ii) Taking steps to minimize communications about the investigation and limiting the group of persons that have knowledge of key facts regarding the investigation minimizes the risk of a waiver of the attorney-client privilege or work product doctrine protection that might attach to the investigation materials, the interview memorandum, and the investigation report. 1. Attorney-client privilege 41

In general, the attorney-client privilege protects: (i) communications; (ii) made between an attorney and the client; (iii) in confidence; and (iv) for the purpose of obtaining or providing legal assistance for the client.57 Some courts in the US have held that the attorney-client privilege protects only those communications from a client to a lawyer, not to communications from a lawyer to a client attendant to rendering legal advice.58 However, other US courts have adopted a broader rule, under which a communication from a lawyer to the client for the purpose of rendering legal advice is also protected by the attorney-client privilege.59 In the US, 57 Koehnen/Russenberger/Cowling (eds.), Privilege and Confidentiality: An International Handbook, 350–1, International Bar Association (2006). 58 Webb/Tarun/Molo, supra note 11, § 6.04[1], 6-8(note 3). 59 Id., at § 6.04[1], 6–9 (note 5).

Kent/Tomas

Reemers Publishing Services GmbH O:/Beck/Spehl_Gruetzner/3d/13_USA.3d from 06.03.2013 09:32:29 3B2 9.1.580; Page size: 160.00mm  240.00mm

B. Initiation of internal investigations

417

the attorney-client privilege extends to both individuals and corporations.60 Furthermore, the attorney-client privilege extends to communications between external counsel and in-house counsel as well as in certain cases, in-house counsel and company employees, provided the purpose of the conversation was to obtain facts or information necessary to provide legal advice.61 In the US, the client is the holder of the attorney-client privilege and only the client has the ability to waive the privilege.62 When a corporation is the client, the corporation’s management is vested with the authority to assert or waive the attorneyclient privilege.63 As addressed in greater detail below, investigation counsel conducting employee interviews, in order to maximize the protection of the attorney-client privilege, should inform all current and former corporate employees who are interviewed that the company – and not the individuals – are the client and that only the company can assert or waive the attorney-client privilege arising out of the interview. Another key component to preserving the attorney-client privilege is that the communication be made, and expect to be retained, in confidence. Communications made in the presence of a non-privileged third party could result in a loss of confidentiality and possibly result in a waiver of the privilege.64 In Upjohn Co. v. United States, the US Supreme Court ruled that, in the corporate context, the attorney-client privilege extends not only to communications between corporate counsel and persons in the “control group” (e.g., high level management), but also to communications between corporate counsel and any employee who communicates with the lawyer about matters within the scope of that employee’s duties and at the direction of his or her supervisor.65 As a result, investigation counsel is generally free to communicate with lower level corporate employees about matters within the scope of their duties which have a bearing on the investigation. This is not necessarily an absolute privilege, however, as communications with corporate employees about matters outside of the scope of their duties could be deemed to fall outside of the scope of the attorney-client privilege. This is particularly true under the laws of certain US states, which provide that the attorney-client privilege extends out to communications between counsel and these employees in the “control group” of the corporation. In order to reduce the risk of a waiver of the corporate attorney-client privilege with respect to the communications between the employee and corporate counsel, investigation counsel conducting interviews and meetings with current and former employees should provide the interviewee with an Upjohn notification. Typically, the Upjohn notification advises the interviewee that the interviewer is an attorney who represents the company, that the communications during the interview are protected by the attorney-client privilege, that the company holds the privilege and that the company, in its discretion, may waive it and disclose the matters discussed during the interview with third parties, including law enforcement authorities. The Upjohn notification also involves the attorney explaining that only the company can Id., § 6.02, 6–3. Id. 62 Id., § 6.05, 6-31. 63 See Commodity Futures Trading Com. v. Weintraub, 471 U.S. 343, 348 (1985). 64 United States v. Evans, 113 F.3 d 1457 (7th Cir. 1997). 65 Upjohn v. United States, 449 U.S. 383, 389 (1981); Freedman, Internal Company Investigations and the Employment Relationship 84 (1994). 60 61

Kent/Tomas

42

43

44

45

Reemers Publishing Services GmbH O:/Beck/Spehl_Gruetzner/3d/13_USA.3d from 06.03.2013 09:32:29 3B2 9.1.580; Page size: 160.00mm  240.00mm

418

§ 13. United States of America

waive the privilege, and directing the interviewee to retain their discussions in confidence. The Upjohn notifications are counsel’s attempts to strike a balance between protecting the attorney-client privileged nature of the interview and the practical reality of most all internal investigations – that the facts most likely reside outside of a small “control” group and that in order to adequately develop these facts, investigation counsel needs to speak with mid-to-lower level employees who might not otherwise fall within the “control” group. 46 Notwithstanding the protection offered on federal privilege law and the Upjohn warnings, companies conducting investigations in the US should limit the dissemination of facts and legal advice obtained during the investigation to only those people who need to know the information. This is particular to the case where state law issues lie at the core of an investigation, which makes it more likely that state privilege law (as opposed to the federal law which extends the attorney client privilege beyond the “control group”) can be applied. Disseminating investigation documents and communications to persons not essential to the investigation may impact the company’s ability to retain investigation materials in confidence and increase the risk of inadvertent waiver of the attorney-client privilege. 47 Another common privilege issue arises when investigation counsel retains forensic accountants, private investigators or other third parties to assist in the investigation. These professionals often provide essential expertise and guidance to counsel conducting the investigation. Communications between the attorney and these experts and agents have been held to be privileged as long as they were made “in confidence for the purpose of obtaining legal advice from the lawyer.”66 However, in order to best protect a claim of privilege over these communications, the expert should be retained on outside counsel or, at the very least, the in-house legal department in the US. 2. Work product doctrine In the U.S., courts will also shield from compelled disclosure (including civil discovery) materials that qualify for protection under the “work product doctrine.” The work product doctrine provides protection for certain materials prepared in anticipation of litigation because, as the United States Supreme Court noted, “[i]n performing his various duties … it is essential that a lawyer work with a certain degree of privacy, free from unnecessary intrusion by opposing parties and their counsel.”67 If all the elements of this doctrine are met, the scope of the protection that the court will provide depends on the nature of the material for which protection is being sought. Although the material may qualify for protection under the work product doctrine, that protection can be waived by the party seeking the protection. Furthermore, a court may order, upon a proper showing by the party seeking production, that certain types of work product be disclosed. 49 The work product doctrine has been codified in the US Federal Rules of Civil Procedure. Under the US Rules of Civil Procedure, work product protection applies to 1) materials that are 2) prepared in anticipation of litigation or trial 3) by or for 48

66 See United States v. Kovel, 296 F.2 d 918, 922 (2d Cir. 1961); United States v. Davis, 131 F.R.D. 391, 397–98 (S.D.N.Y. 1990), modified on other grounds, 19 F.3 d 770 (2 d Cir. 1994). 67 Hickman v. Taylor, 329 U.S. 495, 511 (1947).

Kent/Tomas

Reemers Publishing Services GmbH O:/Beck/Spehl_Gruetzner/3d/13_USA.3d from 06.03.2013 09:32:29 3B2 9.1.580; Page size: 160.00mm  240.00mm

B. Initiation of internal investigations

419

the party to the litigation or his representative.68 This analysis is fact-specific and, therefore, requires explanation. For purposes of this doctrine, “materials” include “documents and tangible things”69 as well as certain types of investigative reports.70 The United States Supreme Court recognized the important role that investigative reports play in client representation and extended the work product protection to those reports explaining that “attorneys often must rely on the assistance of investigators and other agents in the compilation of materials in preparation for trial. It is therefore necessary that the doctrine protects material prepared by agents for the attorney as well as those prepared by the attorney himself.”71 The second element, which requires that the material be prepared in anticipation of litigation, does not require that a lawsuit already be filed, but does require more than “a remote prospect of future litigation…”72 Nevertheless, courts uphold work product claims over material prepared in connection with internal investigations. In the context of an internal investigation, a court is more likely to find that this element has been fulfilled if the investigation is commenced and directed by counsel, rather than non-attorney corporate leadership.73 The closer the parties are to actual litigation, the more likely it is that the court will find that this element has been satisfied. The final element, which requires that the materials be prepared either by the party to the litigation or the party’s representative, includes material prepared by the party’s attorney as well as material prepared for the party’s attorney.74 It is important to note that courts have, at times, found that analyses conducted by corporate employees, even when directed by counsel, did not qualify for protection under this doctrine.75 Thus, it is better practice to obtain outside experts for preparation of materials created in anticipation of litigation. Even if all three elements of the work product doctrine are met, those materials may become discoverable if a court finds that there is substantial need for the materials in question and there is an inability to obtain substantially equivalent information without undue hardship.76 However, depending on the nature of the work product, the court will afford the material differing levels of protection. Material that reflects the attorney’s “mental impressions” is afforded near complete protection. The burden to discover this material is “a far stronger showing of 68

Fed. R. Civ. Proc. 26(b)(3)(A). Id. 70 United States v. Nobles, 422 U.S. 225, 238–39 (1975). 71 Id. 72 In re Special September 1978 Grand Jury (II), 640 F.2 d 49, 65 (7th Cir. 1980). 73 “The results of internal corporate reviews, whether undertaken at the direction of in-house counsel or outside counsel, may be protected from disclosure under the attorney-client privilege and/or the work-product doctrine.” In re Grand Jury Proceedings, 2001 U.S. Dist. LEXIS 15646, No. M-11-189, at *96-97 (S.D.N.Y. Oct. 3, 2001) (citing United States v. Davis, 131 F.R.D. 391, 405). 74 Nobles, 422 U.S. 225 at 239 (discussing that after Hickman, courts disagreed about whether the work product doctrine also applied to “materials prepared on [an attorney’s] behalf [,]” and clarified that “[n]ecessarily, it must []”). 75 See In re Six Grand Jury Witnesses, 979 F.2 d 939, 945 (2 d Cir. N.Y. 1992)(refusing to apply the protection of the work product doctrine to analyses conducted by corporate employees where it was unclear to the court whether the analyses involved mental impressions or whether they were simply “straightforward calculations from raw data”). 76 Fed. R. Civ. Proc. 26(b)(3)(A)(ii). 69

Kent/Tomas

50

51

52

53

Reemers Publishing Services GmbH O:/Beck/Spehl_Gruetzner/3d/13_USA.3d from 06.03.2013 09:32:30 3B2 9.1.580; Page size: 160.00mm  240.00mm

420

§ 13. United States of America

necessity and unavailability by other means…” than is required for work product containing only relevant and non-privileged facts.77 54 The Federal Rules of Civil Procedure and courts applying the work product doctrine distinguish between pure fact work product and work product containing an attorney’s “mental impression” – often referred to as “core” or “opinion” work product. The federal work product doctrine provides that a litigant may not discover documents or tangible things that are prepared in anticipation of litigation or for trial by or for another party or its representative.78 “Fact” work product may be discovered by a party who can show that it “has substantial need for the materials to prepare its case and cannot, without undue hardship, obtain their substantial equivalent by other means”.79 Usually, “core” or “opinion” work product – work product containing the attorney’s mental impressions – is not discoverable even upon such a showing.80 55 Likewise, work product can become discoverable, even if it is entitled to protection, if that protection is waived. Waiver can occur in a wide variety of situations, such as if a party puts the protected work product at issue81 or if the party or their counsel provide work product to witnesses or any other third party that does not share “common interests in developing legal theories and analyses of documents.”82 The majority rule is that if someone waives the protection provided under the work product doctrine to one opponent, such as the government, that person or company also waives that protection against all other opponents.83 The minority rule is that disclosure to the government only constitutes a limited waiver and does not waive the privilege with respect to all other opponents.84

C. Admissibility and implementation of individual measures within the scope of the internal Investigation I. What measures are admissible within the scope of an internal investigation? 56

Companies looking to conduct internal investigations in the U.S. are generally afforded wide latitude in conducting internal investigations. Below are investigative 77

Upjohn, 449 U.S. at 401-402. Fed. R. Civ. P. 26(b)(3). 79 Id. 80 Id. 81 Nobles, 422 U.S. at 239 (“Here respondent sought to adduce the testimony of the investigator and contrast his recollection of the contested statements with that of the prosecution’s witnesses. Respondent, by electing to present the investigator as a witness, waived the privilege with respect to matters covered in his testimony[]”). 82 Berkey Photo, Inc. v. Eastman Kodak Co., 74 F.R.D. 613, 616 (S.D.N.Y. 1977), aff’d in part, rev’d in part 603 F.2 d 263 (2d. Cir. 1979), cert. denied 444 U.S. 1093 (1980) (discussing that “the decision to give the work product to the witness could well be deemed a waiver of the privilege[]). 83 Salomon Bros. Treasury Litig. v. Steinhardt Partners, L.P. (In re Steinhardt Partners, L.P.), 9 F.3 d 230, 235 (2 d Cir. N.Y. 1993)(“The waiver doctrine provides that voluntary disclosure of work product to an adversary waives the privilege as to other parties[]” but declining to adopt a per se rule that “all voluntary disclosures to the government waive work product protection” and deciding, instead, to make privilege decisions on a case-by-case basis). 84 Diversified Indus. v. Meredith, 572 F.2 d 596, 611 (8th Cir. 1977). 78

Kent/Tomas

Reemers Publishing Services GmbH O:/Beck/Spehl_Gruetzner/3d/13_USA.3d from 06.03.2013 09:32:30 3B2 9.1.580; Page size: 160.00mm  240.00mm

C. Admissibility and implementation of individual measures

421

steps that often are considered in the context of an internal investigation, and an explanation as to any limits on their use. 1. Document hold notices Companies routinely issue document hold notices to effected employees at the 57 beginning of an internal investigation.85 In fact, if the US governmental authorities conduct an investigation of the matter, they usually will expect that a document hold letter will have been issued. The failure to issue a document hold notice could result in significant reputational and legal consequences if employees destroy or discard relevant documents. This is particularly the case if a law enforcement or regulation agency has issued a subpoena or a request, and such documents are destroyed or discarded after the issuance of the subpoena.86 Furthermore, the creation or alteration of documents either during an investigation or specifically after the initiation of the US government investigation can result in corporate or individual criminal liability for obstruction of justice87 or false statements,88 In all cases, a company must suspend its routine document retention/destruction policy and issue a “litigation hold” to ensure the preservation of relevant documents as soon as it reasonably anticipates litigation.89 Failure to do so may result in the imposition of penalties and an adverse jury instruction.90 Additional steps to preserve evidence may be warranted, depending on the circumstances. 2. Document collection The collection of information from employees is one of the most essential 58 components of an internal investigation. Companies usually seek to gather information in an employee’s office, desk and files, which can be relevant to the investigation.91 Companies will also seek to image employee computer hard drives and a company’s email and data servers.92 Employees often have personal information stored on their work computer or send personal emails though their corporate email account. While the prevailing view in the US is that employees who store personal information on their work computers do not have an expectation of privacy with respect to such information, at least one court has held that such an expectation exists, and that it may limit an employer’s right to review certain emails and other Webb/Tarun/Molo, supra note 11, § 8.04[4]. See e.g., United States v. Lench, 805 F.2 d 1443 (9th Cir. 1986) (affirming defendant’s sentence for obstruction of justice where vice-president instructed employees to destroy materials responsive to federal grand jury subpoena). 87 18 U.S.C. § 1505 (Obstruction of proceedings before departments, agencies, and committees); 18 U.S.C. § 1510 (Obstruction of criminal investigations); 18 U.S.C. § 1516 (Obstruction of Federal audit); 18 U.S.C. § 1517 (Obstructing examination of financial institution); 18 U.S.C. § 1518 (Obstruction of criminal investigations of health care offenses); 18 U.S.C. § 1519 (Destruction, alteration, or falsification of records in Federal investigations and bankruptcy); 18 U.S.C. § 1520 (Destruction of corporate audit records). 88 18 U.S.C. § 1001. 89 Zubulake v. UBS Warburg LLC, 220 F.R.D. 212, 218 (S.D.N.Y. 2003). 90 Merck Eprova AG v. Gnosis S.p.A. et al., 07 Civ. 5898 (S.D.N.Y. Apr. 20, 2010). 91 Webb/Tarun/Molo, supra note 11, § 8.04[2]. 92 Id. 85 86

Kent/Tomas

Reemers Publishing Services GmbH O:/Beck/Spehl_Gruetzner/3d/13_USA.3d from 06.03.2013 09:32:30 3B2 9.1.580; Page size: 160.00mm  240.00mm

422

§ 13. United States of America

electronic information.93 Companies should review their employment policies to ensure that employees are given explicit notice of the company’s authority to review all such emails. 3. Review of personnel files 59

Investigation counsel or members of the investigation team will typically request copies of the personnel files of certain employees whose conduct is at issue in the investigation. Information in the personnel files may help to provide clues about an employee’s propensity for misconduct, or conversely, the employee’s relatively clean record. The employee’s personnel file will also likely include his or her job application, which may contain statements or representations, particularly about legal or employment-related disciplinary problems, that may be relevant to the current investigation. Although it is advisable to seek guidance from employment counsel prior to requesting and reviewing personnel files, generally speaking there is no prohibition on reviewing such files. 4. Document and email review

60

The next step in an investigation will usually involve the review of hard copy and electronic documents.94 Although there is no general prohibition on reviewing all relevant hard and electronic documents within the possession of the company, investigation counsel will usually target their review of hard copy documents to documents found in files that are likely to contain documents relevant to the investigation. Hard copy document review is usually limited to the most relevant types of files due to the voluminous nature of hard copy documents and because they are not easily searchable like computer documents. However, hard copy documents can be essential to an investigation, particularly where these hard copy documents show evidence of forgery or alteration; as such evidence of forgery or alteration can be significant in establishing wrongdoing and wrongful intent. More so each passing year, document review in the context of an internal investigation is focused on electronic documents. This is for good reason, as email is now the preferred method of communicating among co-workers and third parties. Documents, such as invoices, spreadsheets and ledgers, are often created in a computer file at which point they are printed out and signed or otherwise modified manually. Because of the clear relevance of these documents, and the fact that they are searchable, investigation teams tend to focus efforts on e-document review. This review is usually accomplished by uploading all of the electronic media onto a server, running a deduplication process, and then applying selected keywords against these documents in an attempt to identify the most potentially relevant subset of documents.95 This potentially relevant subset of documents is usually reviewed by a legal professional and tagged as “hot”, “relevant”, “not relevant” or “privileged.”96 From these tagged documents and the attendant determinations, investigation counsel will make deci93

Stengart v. Loving Care Agency, Inc., A-16-09, 2010 WL 118945 at *2 (N.J., Mar. 30, 2010). Webb/Tarun/Molo, supra note 11, § 8.04[4][b]. 95 Id., § 8.10[2]. 96 Id., § 8.11. 94

Kent/Tomas

Reemers Publishing Services GmbH O:/Beck/Spehl_Gruetzner/3d/13_USA.3d from 06.03.2013 09:32:30 3B2 9.1.580; Page size: 160.00mm  240.00mm

C. Admissibility and implementation of individual measures

423

sions about the investigation scope and interview strategy. These documents may also lead to additional evidence or potentially relevant employees; whose computer hard drive and documents may also need to be copied. 5. Interviews Employee interviews are a typical, and in most cases, expected step in an 61 investigation.97 The investigation planning and document review will often assist to identify those individuals that investigation counsel wishes to interview. If the matter came to the attention of a company through a complaint or whistleblower call, both the complainant and the subject(s) of that complaint should be interviewed. As a general matter, there is no legal limitation as to who investigation counsel may interview in the context of an investigation. Investigation counsel may interview current and former company employees, employees of vendors and other business partners, as well as any other person who may have knowledge about the matters at issue in the investigation.98 With respect to interviews of current employees of the company, in most cases the company may reasonably assert that the statements made by the employee to investigation counsel in that interview are protected by the attorney-client privilege, to the extent the communication is intended to assist investigation counsel to provide legal advice to the company (e.g., advise the company as to potential legal violations and disclosure obligations).99 The corresponding notes and memoranda of those interviewed are protected under the work product doctrine.100 Where investigation counsel wishes to interview a third party who is not employed by the company, however, there is some question as to whether the statements made during that interview are protected under the attorney-client privilege.101 Even if the parties agree that the interview and the matters discussed in the interview will remain confidential, fact that the interviewee is an outsider to the confidential relationship between counsel and client may thwart an assertion of the attorney-client privilege with respect to that interview. Courts in the US have extended the protection of the attorney-client privilege to 62 communications with former employees where the communications related to that employee’s actions or observations about matters while employed by the company.102 These communications also must satisfy all of the elements of a valid attorney-client privileged communication.103

Id., § 9.02. Id., § 9.03. 99 Id.; Upjohn, 449 U.S. at 394–395 (Extending the privilege to case involving communications with a corporation’s employees when the employees are acting at the direction of the corporation’s officers and attorneys). 100 Lerman v. Turner, 2011 U.S. Dist. LEXIS 715 (N.D. Ill. Jan. 5, 2011) (“When an attorney prepares a memorandum of a witness interview with an eye toward litigation, the memorandum qualifies as work product even if the lawyer functioned primarily as an investigator.”). 101 Webb/Tarun/Molo, supra note 11, § 9.03. 102 Id., § 6.04[3], 6-20.1 103 Id. 97 98

Kent/Tomas

Reemers Publishing Services GmbH O:/Beck/Spehl_Gruetzner/3d/13_USA.3d from 06.03.2013 09:32:31 3B2 9.1.580; Page size: 160.00mm  240.00mm

424

§ 13. United States of America

6. Interview memoranda 63

Interview memoranda should be prepared by counsel conducting or participating in the interview.104 The interview memoranda should reflect the relevant facts of the interview.105 However, in order to maximize the work-product and attorney-client privilege, the memoranda should not be a verbatim transcription of the interview and the memoranda should contain attorney mental impressions and views as the credibility of the witness, the believability of the responses, and views on how the statements in the interview affect the investigation strategy.106 These interview memoranda should be prepared shortly after the interview, reflect that the Upjohn warnings were provided, and state that the memorandum is not a verbatim transcript and reflects attorney mental impressions. Finally, the interview memoranda should include the time, date and participants in the interview. 7. Telephone conversation recording

The Federal Wiretap Act (“Act”), 18 U.S.C. §§ 2510 et seq., generally prohibits the interception, disclosure or intentional use of oral, wire and electronic communications, including those that occur in the workplace. An “oral communication” occurs when the individual uttering the communication expected it would be a private conversation.107 A “wire communication” is one that carries a person’s oral communication over a wire, such as a phone call, and includes the “electronic storage of such information.”108 An “electronic communication” is the transfer of information (writing, images, signals, sounds, data, etc.) transmitted by electronic means including radio waves.109 Email and pagers are examples of “electronic communications.” 65 “Interception” is the aural or other acquisition of the contents of any oral, wire or electronic communication, through the use of any electronic or mechanical device.110 For example, recording a call with a tape recorder connected to a switchboard without an employee’s knowledge is an interception that constitutes a violation of the Act. Merely listening to an allegedly illegally-obtained audiotape of a private telephone conversation, however, is not a violation of the Act, as the interception occurred when the conversation was recorded. 66 The Act does not apply if the employer has the consent of one party to the communication, unless the communication is intercepted for the purpose of committing a criminal or tortious act. Consent may be either express or implied.111 67 The Act provides a civil cause of action to anyone whose communications are unlawfully intercepted. Successful plaintiffs may recover actual or statutory damages ($10,000 or $100 per day for each day of violation, whichever is greater), punitive damages and attorneys’ fees.112 The Act also makes the unlawful interception, or the 64

Id., § 9.07. Id. 106 Id. 107 18 U.S.C. § 2510(2). 108 Id., § 2510(1). 109 Id., § 2510(12). 110 Id., § 2510(4). 111 Id., § 2511(2)(d). 112 Id., § 2520(c)(2)(B). 104 105

Kent/Tomas

Reemers Publishing Services GmbH O:/Beck/Spehl_Gruetzner/3d/13_USA.3d from 06.03.2013 09:32:31 3B2 9.1.580; Page size: 160.00mm  240.00mm

C. Admissibility and implementation of individual measures

425

attempted interception, of an oral, wire, or electronic communication a felony punishable by fine and/or imprisonment.113 In addition to the Act, there are state laws that govern telephone recording/ 68 recording discussions. These states are divided into two groups – states that permit recording based on consent of one party and states that require the consent of all parties to the conversation.114 Companies should be mindful to comply with all applicable wiretapping laws. 8. Video surveillance Companies often conduct video surveillance of corporate premises in order to 69 protect corporate assets from theft or misappropriation. The right of an employer to conduct video recording is generally recognized. Nonetheless, the use of a video camera to monitor employees during working time may constitute a violation of certain employee privacy rights if not performed correctly. Below are three guidelines to ensure that video surveillance does not run afoul of the law. a) Video only Employers should limit their recording to video only, unless they have analyzed 70 the relevant federal and state wiretap laws, which are likely to apply to any videotape that includes an audio component. b) Not in private areas An employer should exercise caution if the area being recorded is one in which 71 employees have a reasonable right of privacy. For example, an employer should almost never record activity in a bathroom, locker room, changing room, nursing mother’s room, or any other area where an employee would have a reasonable expectation of privacy. c) Bargain with the union An employer should exercise caution if the employees are represented by a union 72 and the cameras have not previously been in operation. The National Labor Relations Board has held that an employer has a duty to bargain regarding the installation and continued use of surveillance cameras, the circumstances in which the cameras will be activated, the discipline resulting from improper conduct captured on camera and the general areas in which the cameras should be placed.115 9. Workplace searches Employers should exercise caution in executing workplace searches. While an 73 employer is generally free to search all employer-owned property (desks, lockers, computers, vehicles, etc.) if it has a reasonable basis for doing so, employees often Id., § 2511(4). See, e.g., N.Y. Penal Law §§ 250.00, 250.05 (one party), and Cal. Penal Code §§ 631, 632 (all parties). 115 Anheuser Busch, Inc., 342 NLRB No. 49 (July 22, 2004). 113 114

Kent/Tomas

Reemers Publishing Services GmbH O:/Beck/Spehl_Gruetzner/3d/13_USA.3d from 06.03.2013 09:32:31 3B2 9.1.580; Page size: 160.00mm  240.00mm

§ 13. United States of America

426

have certain privacy rights that counter-balance the employer’s need for conducting the search. Essentially, courts will weigh the employer’s interest in conducting the search versus the employee’s privacy right. To that end, employers are advised to exercise extreme caution in searching an employee’s personal property (purse, briefcase, vehicle, clothing, etc.) or if the search involves opening a lock, as an employee often has a very high expectation of privacy in those situations.

II. Must employees’ representatives such as the works council be involved in internal investigations? 74

See infra paras. 85 et seq.

D. Employee interviews Questioning employees, both those suspected of wrongdoing and those who are not, is a key component of any internal investigation. It is important that interviews be conducted in a way that best protects the company and the investigator, is in compliance with the relevant attorney ethics rules, and also honors the legal rights of the interviewee. In this section we analyze more deeply the legal and ethical issues arising in the context of such interviews. 76 This is an area in which the law varies substantially by jurisdiction. The rules may be quite different depending on which country’s laws apply, and within the US, which state’s laws apply. Thus, the investigator must be cognizant not only of the location of the interview, but also which country’s court system – and within the US, which state’s court system – is likely to be adjudicating any dispute. 75

I. May an employee refuse to provide information if this information would incriminate himself/herself? 77

Employee interviews often involve asking questions of employees who are suspected of committing criminal offenses. For the employer, the question arises whether the employee has a legal right to refuse to answer if the answer would incriminate the employee. In the vast majority of internal investigations – i. e., those conducted in private with no government agency direction involved – an employee has no legal right to refuse. Specifically, in the US, absent a special right created by employment contract or collective bargaining agreement, an employee has a legal privilege against self-incrimination only if there is sufficient government involvement in connection with the investigation such that the questioner’s actions may be “fairly attributable” to the government.116 This is so because the privilege is the product of the rights created by the Fifth Amendment to the US Constitution, which focus on creating rights of individuals vis-a`-vis the government. An internal investigator’s actions are “fairly attributable” to the government if the government is directing a cooperating company’s internal investigation, or is threatening or otherwise compelling the company such that the company’s investigators are 116

United States. v. Stein, 440 F. Supp. 2 d 315 (S.D.N.Y. 2006).

Kent/Tomas

Reemers Publishing Services GmbH O:/Beck/Spehl_Gruetzner/3d/13_USA.3d from 06.03.2013 09:32:32 3B2 9.1.580; Page size: 160.00mm  240.00mm

D. Employee interviews

427

considered to be representatives of the government.117 If the privilege attaches, the government may not use its invocation against the employee in a criminal proceeding.118 Even without a legal right against self incrimination, the employee nonetheless 78 may refuse to answer, of course, but that refusal may be deemed by the company to be a failure to cooperate. We discuss below the sanctions that a company may impose on an employee who refuses to cooperate with an internal investigation.

II. Duty to provide information on the tasks directly assigned to the employee or carried out by the employee In the US, absent a properly-invoked privilege against self-incrimination, an 79 employee has a duty to cooperate with his employer’s internal investigation. Most US states have statutes that define the scope of this duty. For example, the California statute states: An employee shall substantially comply with all the directions of his employer concerning the service on which he is engaged, except where such obedience is impossible or unlawful, or would impose new and unreasonable burdens on the employee.119

In states where the duty to cooperate is not codified, the courts have created a 80 common law duty.120 In the context of an internal investigation, this duty to cooperate means that an employee must comply with all reasonable requests of the employer, including submitting to an interview regarding tasks directly assigned to, or carried out by, the employee.121 If the employee chooses to refuse to answer incriminating questions, an employer may sanction the employee.

III. Duty to provide information in indirect connection with the scope of work In the US, an employee’s duty to provide information regarding matters indi- 81 rectly connected to the scope of work is the same as the duty regarding matters directly connected to the scope of work: the employee must comply with all reasonable requests. Reasonableness depends on the job and duties of the employee. Questions that may be appropriate for one employee may not be appropriate for another.122 So long as the questioning relates in some way to the employee’s scope of work and the matters under investigation, the employee will likely have a duty to answer.

117 Id. Several business executives at companies have been prosecuted for obstruction of justice based on false statements to internal investigators when they knew that the statements would be passed on to the government. See, e.g., United States v. Kumar, CR-04-0846 (E.D.N.Y. 2006). 118 Erwin v. Price, 778 F.2 d 668 (11th Cir. 1985). 119 Cal. Labor Code § 2856 (West 1989). 120 See, e.g., Thomas Blaney v. Commonwealth of Pennsylvania, Unemployment Comp. Bd. of Review, 58 Pa. Comwlth. 260, 427 A.2 d 1242 (1981). 121 Brian/McNeil (eds.), Internal Corporate Investigations, 171 (ABA 2nd ed. 2003) 122 Id.

Kent/Tomas

Reemers Publishing Services GmbH O:/Beck/Spehl_Gruetzner/3d/13_USA.3d from 06.03.2013 09:32:32 3B2 9.1.580; Page size: 160.00mm  240.00mm

428

§ 13. United States of America

IV. Duty to provide information outside the scope of work 82

If questioning during an employee interview strays too far from the workplace and delves into the employee’s personal life, then the questioning may be deemed unreasonable, thus releasing the employee from his duty to cooperate. In addition, the employee’s right to privacy may be violated. Most US courts recognize that a right to privacy exists that may be protected by the victim filing a tortious claim for invasion of that right. The right to privacy is invaded when one “intentionally intrudes, physically or otherwise, upon the solitude or seclusion of another or his private affairs or concerns, if the intrusion would be highly offensive to a reasonable person.”123 Several courts have awarded damages to an employee whose privacy was invaded by questions asked by an internal investigator.124

V. Disclosure of information to authorities if employee is obliged to incriminate himself/herself 83

In some European jurisdictions, an employer may not disclose to the authorities an employee’s self-incriminating statement made during the course of an internal investigation, and if the authorities obtain evidence of the statement, they may not use the statement against the employee in a criminal case. Absent a claim that the internal investigators were agents of the government who had unlawfully coerced the statement, there is no such principle in the US. Companies routinely disclose to the authorities incriminating statements made by the company’s employees in the course of an internal investigation, and the authorities lawfully use evidence of these statements to prosecute the wrongdoer who made the admission.125 This occurs because the company has the lawful right to disclose to the government whatever it learns in the course of an internal investigation, and has a strong incentive to do so in order to earn cooperation credit that may enable it to avoid prosecution, or to receive a more lenient punishment.126

VI. Is an employee obliged to provide information on any misconduct of a criminal offense committed by other employees? 84

In the US, an employee’s duty with regard to providing information about misconduct committed by others is the same as that which applies to him. His rights not to provide information are less broad because if the issue is misconduct by others, then the employee’s privilege against self incrimination and right to privacy are less likely to be implicated. 123

Restatement 2 d of Torts, Section 652B. See, e.g., O’Brien v. Papa Gino’s of America, Inc., 780 F.2 d 1067 (1st Cir. 1986) (employee’s right of privacy was violated by investigator’s inquiry into drug use because inquiry was unrelated to employee’s job); Hall v. May Department Stores Co., 637 P.2 d 126 (Ore. 1981) (employee’s right of privacy was invaded by investigator’s false statement that he had evidence that the employee committed a crime). 125 U.S. Attorneys’ Manual § 9-28.700. 126 Id. 124

Kent/Tomas

Reemers Publishing Services GmbH O:/Beck/Spehl_Gruetzner/3d/13_USA.3d from 06.03.2013 09:32:32 3B2 9.1.580; Page size: 160.00mm  240.00mm

D. Employee interviews

429

VII. May an employee refuse to answer a question if he/she has already answered it within the scope of a previous interview? There is no US law which addresses an employee’s right to refuse to answer a 85 question on the ground that it was already answered in an earlier interview. In fact, it is quite common for internal investigators to conduct multiple interviews of key employees, and to ask the same or similar questions on multiple occasions. If a question is repeated over and over to the point that it becomes harassing, the employee could bring a claim for invasion of privacy or intentional infliction of emotional distress.127

VIII. Is an employee entitled to the presence of a member of the labor union or an attorney during the interview? 1. Union representation When a union-represented employee is asked to attend a meeting to investigate 86 a violation of a company rule in which the employee can reasonably expect that discipline might occur, the employee has the right to request the presence of another employee (known as “Weingarten” rights).128 The right does not mean that the employee’s request must be granted. It merely means that, if the request has been made, the employer may not force the employee to go through the interview without the representative. The employer may, however, decline to conduct the interview and simply proceed to investigate the incident without interviewing the employee involved. The right to a witness is triggered only when an interview for purposes of investigation or questioning is scheduled. It is not triggered when a meeting with an employee is called merely to communicate or administer discipline already decided upon. Additionally, where an employee is represented by a union, the employer must 87 comply with the established disciplinary and grievance procedures and may be required to bargain with the union over the discipline imposed. 2. Attorney representation Under US law, absent a special provision in an employment contract or collective 88 bargaining agreement, an employee does not have the right to have his attorney present during an internal investigation interview.129 That being said, it is not uncommon for an employee to be represented by counsel during an internal 127 Intentional infliction of emotional distress is a common law tort governed by state law and was first recognized in Wilkinson v. Downton, 2 Q.B. 57 (1897), which recognized that the elements of such a claim are (1) outrageous conduct by the defendant; (2) defendant’s intention of causing, or reckless disregard of the probability of causing, emotional distress; (3) plaintiff suffering actual harm, i. e. emotional distress; and (4) actual and proximate causation between the defendant’s conduct and the plaintiff’s emotional distress. See also State Rubbish v. Siliznoff, 38 Cal. 2 d 330. 336–37 (1952). 128 NLRB v. J. Weingarten, Inc., 420 U.S. 251 (1975). 129 See TRW, Inc. v. Superior Court, 25 Cal. App. 4th 1834 (1994).

Kent/Tomas

Reemers Publishing Services GmbH O:/Beck/Spehl_Gruetzner/3d/13_USA.3d from 06.03.2013 09:32:32 3B2 9.1.580; Page size: 160.00mm  240.00mm

430

§ 13. United States of America

investigation interview. This may occur either because the employee asked to have counsel present and the company agreed, or the company decided to recommend that the employee retain counsel. Although most investigators, in most situations, would prefer to conduct an interview without the presence of an attorney for the witness, companies often will agree to an employee’s request for counsel to be present out of a desire to be fair to its employees. A company may recommend that an employee retain counsel for purposes of the internal investigation if the company believes that an attorney will help the employee refresh his recollection and to provide truthful information. 89 A related question is whether the company must, or should, pay the attorney’s fees of the employee’s counsel. There are two related concepts: indemnification and advancement of fees. Indemnification refers to reimbursing an employee for attorney’s fees already incurred. Advancement refers to the company’s payment of fees at the time the attorney’s invoice is tendered.130 The relevant state statutes – based on the company’s state of incorporation – and the company’s authorizing documents may mandate or allow either or both.131 90 Many companies choose to pay the legal fees of their employees for strategic reasons. If advancement occurs, a company has the right to require an employee to sign an Undertaking, by which the employee promises to repay the amount expended under certain circumstances, such as the defendant’s conviction.132 91 DOJ policy expressly states that a company’s decision to pay the legal fees of its employees is not a factor in determining whether a company should receive credit for cooperating with a government investigation.133

IX. Is an employee entitled to read the record of his/her interview? 92

Investigators usually memorialize the results of an interview in an interview summary. Occasionally, the employee interviewed may desire to review the results, but the employer is not obliged to permit the employee to read the record of the interview. The interview summary, having been created by an agent of the company, is the company’s property, and it may disclose, or not disclose, the summary as it sees fit.

X. Is the employer entitled to request that the employee signs the record of the interview? 93

Under certain circumstances, especially if an employee makes incriminatory admissions, the company may want the employee to sign a factual statement, thereby attesting that the facts contained in the statement are true. Based on the employee’s duty to comply with the reasonable requests of his employer, the employer may require the employee to review and sign such a statement if the employer so chooses.134 130

United States v. Stein, 435 F. Supp. 2 d 330, 354–55 (S.D.N.Y. 2006). Id.; see also 8 Del. C. § 145. 132 See 8 Del. C. § 145. 133 U.S. Attorneys’ Manual § 9-28.730. 134 See generally Brian/McNeil, supra note 113, at 170-72. 131

Kent/Tomas

Reemers Publishing Services GmbH O:/Beck/Spehl_Gruetzner/3d/13_USA.3d from 06.03.2013 09:32:33 3B2 9.1.580; Page size: 160.00mm  240.00mm

E. Sanctions imposed on employees

431

XI. Can the employer instruct an employee to treat the content of his/her interview as confidential? If the internal investigation interview is cloaked with the confidentiality protections 94 of the attorney-client privilege, then the company is the holder of the privilege and the company, not the employee, has the sole right to decide when to disclose the contents of the interview. This means that the company’s investigators may advise the employee that they are obligated to treat the interview as confidential, with regard to both co-workers and to third parties.135 The investigator should emphasize to the employee that the confidentiality obligations apply only to what was said by the participants to the interviewer, and not to the underlying facts. If the employee is subsequently interviewed by the government and withholds underlying facts based on the confidentiality directives received during the internal investigation interview, the company could be at risk for being prosecuted for obstruction of justice.136 In addition to privilege concerns, a duty to maintain the confidentiality of an 95 interview may arise if trade secret or other confidential information is discussed that is the subject to confidentiality obligations imposed by law or by agreement between the company and the employee.

E. Sanctions imposed on employees I. What are the sanctions under employment law that can be imposed on employees refusing to cooperate in an internal investigation? Employees sometimes violate their duty to cooperate with an internal investiga- 96 tion, often because cooperation would disclose their wrongdoing. At that point, the employer has a range of sanctions available to it, including a suspension (with or without pay), a reduction in salary or bonus, and termination. The legality of these sanctions depends on the law of the state governing the employment relationship, the facts regarding the employee’s conduct and failure to cooperate, and the extent of the company’s investigation. It is always unlawful for an employer to sanction an employee for a reason that is 97 prohibited by law. US law prohibits employers from sanctioning an employee on the basis of, among other things, the employee’s race, age, sex, national origin or whistleblowing activities.137 In the US, an employer’s right to sanction an employee depends on whether the 98 state whose law governs the relationship is an “at-will” state or a “just-cause” state. Assuming that the sanction is not expressly prohibited by law, an employer in an “at-will” state may lawfully impose whatever sanction it deems appropriate, including termination, unless such action is restricted by employment agreement, collective bargaining agreement, or some other promise by the employer in the company

Webb/Tarun/Molo, supra note 11, § 6.04. See 18 U.S.C. § 1512(b). 137 See Brian/McNeil, supra note 113, Ch. 6, § 3. 135 136

Kent/Tomas

Reemers Publishing Services GmbH O:/Beck/Spehl_Gruetzner/3d/13_USA.3d from 06.03.2013 09:32:33 3B2 9.1.580; Page size: 160.00mm  240.00mm

432

§ 13. United States of America

personnel manual or elsewhere.138 If there is an applicable collective bargaining agreement or employment agreement, then the terms of that agreement govern. 99 Some “at-will” states allow an employee to contest a termination if the termination violates public policy. To succeed, an employee would have to prove that a public policy exists and that the sanction violated that policy. If the evidence shows that the termination was based on the employee’s failure to cooperate with an internal investigation or provable significant misconduct, the public policy argument will fail.139 100 Some states always require the employer to have “good cause” before sanctioning an employee.140 Other states imply a “good cause” requirement from the circumstances, such as personnel policies, handbooks, longevity and promotions.141 “Good cause” is an elusive concept, not easily described. One court defined it as “a fair and honest cause or reason, regulated by good faith on behalf of the one exercising the power.”142 101 In deciding whether an employee’s failure to cooperate with an internal investigation constitutes “good cause” for termination, a court may consider several factors, including the seriousness of the alleged misconduct, the importance of the employee’s information to the investigation, other alternative means of discovering the information, the corporation’s intent in questioning the employee, the employee’s position in the company, the employee’s reason for withholding the information, and the company’s treatment of similarly situated employees. Before terminating the reluctant witness, the company should give him written notice of his duty to cooperate and the possible sanctions.143

II. Is the suspicion of a criminal offense or of a severe violation of duty sufficient for termination? The foregoing discussion focused on the sanctions available to an employer if an employee refuses to cooperate in the internal investigation. Another question is whether the sanction of termination is appropriate if based on proof, or even mere suspicion, that the employee engaged in the underlying misconduct. 103 In pure “at-will” jurisdictions, an employer may terminate an employee for any reason, at any time. Therefore, in these states, both proof and suspicion of wrongdoing are sufficient to justify termination.144 If some level of cause is required for termination, a court will consider several factors to determine if there was sufficient cause for an employee’s termination. These include: – Did the employee know that his misconduct would subject him to discipline? – Was the rule that was violated reasonably related to the safe and proper operation of the business? 102

138

Id. Johnson v. Arkansas State Hospital, No. 07–1810, 2008 U.S. App. LEXIS 13633 (8th Cir. June 27, 2008). 140 See Brian/McNeil supra note 113, at 186. 141 Id. 142 Id. 143 Id. 144 See e.g. Tex. Workforce Commission v. BL II Logistics, L.L.C., 237 S.W.3 d 875, 881 (Tex. App. 2007). 139

Kent/Tomas

Reemers Publishing Services GmbH O:/Beck/Spehl_Gruetzner/3d/13_USA.3d from 06.03.2013 09:32:33 3B2 9.1.580; Page size: 160.00mm  240.00mm

F. Use of obtained information

– – – – –

433

Did the company investigate? Was the investigation fair and objective? How strong was the evidence of the violation? Is there reason to believe that the company is discriminating against the employee? Is termination as a sanction an appropriate response to the seriousness of the offense?145

III. Must an employee cooperate in internal investigations even after he/she has been terminated? Under US law, an employee’s duty to cooperate with an employer, including in 104 connection with internal investigations, is extinguished upon termination.146 The only exception is if the employee’s employment agreement or severance agreement requires such ongoing cooperation. For this reason, companies conducting internal investigations often delay terminations of employees involved in alleged misconduct. A common practice is to place the employee on paid suspension or leave. That way, he is removed from the workplace and cannot engage in any further misconduct, but is available for further interviews. The company may terminate the employee when the investigation is concluded. Furthermore, companies that terminate an employee but provide a severance package to the term of employee sometimes include cooperation with the company in its investigation as a condition to payment of the severance amounts.

F. Use of obtained information I. Is it permissible to disclose the findings and information obtained within the scope of any internal investigation to other group companies? A company may disclose internal investigation findings to other companies in 105 the corporate group, although the company should be mindful of privilege issues. As discussed above, provided that the investigation is properly conducted by legal counsel in order to provide the company with legal advice, communication of the investigation findings to lawyers or management within the company will not generally result in a waiver of the attorney-client privilege. Furthermore, even though the parent company and its subsidiary are separate corporate entities, the sharing of investigation findings between a subsidiary and the parent company does not present a significant risk of a waiver of the attorney client privilege.147

Tobias, Litigating wrongful discharge claims, § 9.09 note 55 (1987). V.I.M. Recyclers, L.P. v. Magner, 271 F. Supp.2 d 1072 (N.D. Ill. 2003). 147 Webb/Tarun/Molo, supra note 11, 6.04[2], note 25. 145 146

Kent/Tomas

Reemers Publishing Services GmbH O:/Beck/Spehl_Gruetzner/3d/13_USA.3d from 06.03.2013 09:32:34 3B2 9.1.580; Page size: 160.00mm  240.00mm

434

§ 13. United States of America

II. Is it permissible to disclose the findings and information obtained as a result of an internal investigation to the authorities? 106

107

108

109

110

Companies are free to disclose the findings of their internal investigations with public authorities including federal and state law enforcement and regulatory bodies. In fact, US companies and companies conducting business in the US often chose to disclose the findings of an internal investigation to law enforcement authorities or regulators with a view to receiving cooperation credit, including reduced fines or sanctions or possibly a decision to not prosecute.148 In considering whether to make this disclosure decision, however, special care must be paid to data privacy concerns; specifically, those arising under EU law. As part of the investigation process, companies often elect to produce emails and other non-privileged documents obtained during the course of the investigation. If these documents are transmitted to the US from non-US jurisdictions, particularly those that monitor robust data privacy laws, the transmission of these records may give rise to concerns under the local data privacy laws. In addition to being allowed in all circumstances, disclosure to the authorities is required when the investigation results in the discovery of certain specified violations, such as bribery in the context US government contracts.149 If disclosure to the authorities is not mandatory, the company should analyze whether disclosure is in its strategic interests. The issues that bear on this decision are: (1) whether the investigation uncovered evidence of unlawful conduct; (2) if unlawful conduct occurred, is the company liable, or is it a victim; and (3) if the company is liable, what is the likelihood that the government will learn of the misconduct if no disclosure occurs, and what is the likely sanction in the two contexts – voluntary disclosure v. discovery by the government if no disclosure is made.150 If the financial statements do not need to be revised, the company should consider whether to disclose anything to its corporate stakeholders regarding the findings of the investigation. Such interested stakeholders may include the company’s lenders, stockholders, employees, suppliers, customers and the general public. The company also may consider whether to make restitution to victims if it is legally responsible for the misconduct. In the voluntary disclosure context, US DOJ regulations provide that a company’s voluntary disclosure of wrongdoing, including information generated through the investigation, is relevant to a prosecutor’s decision whether to initiate changes against the company. Specifically, DOJ regulations state: “In gauging the extent of the corporation’s cooperation, the prosecutor may consider, among other things, whether the corporation made a voluntary and timely disclosure, and the corporation’s willingness to provide relevant information and evidence and identify relevant actors within and outside the corporation, including senior executives.”151 U.S. Attorneys’ Manual § 9-28.700. See 41 U.S.C. § 57(c). 150 Tarun/Tomczak, A Proposal For A United States Department of Justice Foreign Corrupt Practices Act Leniency Policy, 47 Am. Crim. L, Rev. 153 (2010). 151 U.S. Attorneys’ Manual § 9-28.700. 148 149

Kent/Tomas

Reemers Publishing Services GmbH O:/Beck/Spehl_Gruetzner/3d/13_USA.3d from 06.03.2013 09:32:34 3B2 9.1.580; Page size: 160.00mm  240.00mm

G. Following-up on internal investigations

435

DOJ regulations state that to obtain credit for voluntary disclosure and coopera- 111 tion, a company need not waive the privileges – attorney-client and work that attach to the investigation.152 Indeed, federal prosecutors are directed not to ask for a privilege waiver.153 Rather, the required disclosure is of the underlying facts of the conduct under investigation.154 This means that a company may choose to disclose its investigation report to the 112 authorities, as well as other materials protected by privilege, but it need not do so in order to obtain cooperation credit. If a company chooses to waive its privileges by disclosing privileged investigation materials to the government, then according to most courts in the US, the company has waived its privileges as to all third parties.155 In fact, among the Courts of Appeals, only that for the Eighth Circuit has found that an attorney-client privileged communication can be selectively waived.156 The Diversified court reasoned that protecting such materials even after their disclosure to the government would encourage corporations to retain outside counsel to investigate corporate wrongdoing and would facilitate disclosures to the government.157 However, the majority rule is that a disclosure of attorney-client privileged communications to the government in the context of an investigation by the government of the disclosing party waives the privilege as to all other parties.

G. Following-up on internal investigations I. What is to be observed during the follow-up of internal investigations? If the company is a public company and the investigation determined that the 113 company’s prior financial statements were materially incorrect, then revised financial statements must be prepared and submitted to the SEC. Indeed, liability for securities fraud can attach if a material error is discovered but not corrected.158 If the investigation determined that the company’s prior income tax returns were 114 incorrect (because, for example, the company had improperly deducted certain expenses that in fact were bribes and thus non-deductible), then the company must either prepare amended returns and submit them to the Internal Revenue Service or, if amended returns are not filed, explain to the company’s external auditors the nature of inaccuracies on the prior returns.159 Id., § 9-28.710. Id. 154 Id., § 9-28.720. 155 See, e.g., Permian Corp. v. United States, 665 F.2 d 1214 (D.C. Cir. 1981); In re Subpoenas Duces Tecum, 738 F.2 d 1367, 1371–75 (D.C. Cir. 1984); United States v. Mass. Inst. of Tech., 129 F.3d. 681, 686 (1st Cir. 1997); In re Martin Marietta Corp., 856 F2 d 619, 623–4 (4th Cir. 1988), cert. den’d, 490 U.S. 1011 (1989); see also In re Steinhardt Partners L.P., 9 F.3 d 230, 235 (2 d Cir. 1993). 156 Diversified Indus. v. Meredith, 572 F.2 d 596 (8th Cir. 1977) (holding that corporation’s disclosure to SEC did not waive with respect to another litigant). 157 Id. at 610. 158 Overton v. Todman & Co., 478 F.3 d 479 (2 d Cir. 2007). 159 George Clarke and Lina A. Braude, More Sticky Strands in the FCPA Web: Tax Rules and Financial Reporting May Drive Disclosure, Journal of International Lawyer, Vol. 42, No. 3, 1095 (2008). 152 153

Kent/Tomas

Reemers Publishing Services GmbH O:/Beck/Spehl_Gruetzner/3d/13_USA.3d from 06.03.2013 09:32:34 3B2 9.1.580; Page size: 160.00mm  240.00mm

436 115

§ 13. United States of America

The company should take appropriate remedial measures in light of the findings of the internal investigation. These include sanctioning identified wrongdoers, enhancing the company’s compliance program where appropriate and conducting training designed to minimize the likelihood of repeated misconduct. In addition to improving corporate functioning going forward, these measures will help the company obtain a more lenient resolution in the event that the enforcement authorities investigate the misconduct and determine that the company was liable for the misconduct of its employees.160

II. May an employer pay its employee’s legal fees if he/she is being prosecuted under criminal law? 116

See supra paras. 88 et seqq. 160

U.S. Attorneys’ Manual § 9-28.900.

Kent/Tomas