Attention to inappropriate behaviour in the workplace has increased considerably in recent years, including at SMEs. Employers are also responding more adequately when reports of inappropriate behaviour come in. Employers do this, for example, by starting an internal investigation or by engaging an external firm. However, the privacy rules that come with this are still sometimes forgotten. What is allowed, and what isn’t? And how, as an employer, do you prevent well-intentioned action from leading to legal problems?
In this article we clarify what employers need to pay attention to, in order to avoid as many legal risks as possible and to accommodate the interests of the parties involved.
What does the law say?
When launching investigations into inappropriate behaviour in the workplace, privacy legislation plays a major role, in particular the following two sets of rules:
- The General Data Protection Regulation (GDPR) – applying to all employers who process personal data.
- The Privacy Code of Conduct for Private Investigation Agencies (PPO) – specifically for external investigation agencies that carry out person-focused investigations, but also potentially applicable to employers who have an investigation carried out other than through a licence-holding organisation.
In many situations, employers are themselves responsible for the processing under the GDPR. Where personal data is collected, such as during interviews or when analysing emails, the processing must in any event be lawful and proportionate.
Is a licence also needed?
External investigation agencies are sometimes required to hold a licence to carry out “investigative activities”, such as targeted investigations into individuals.
Is the investigation focused solely on broader questions about “organisational culture”? Then such a licence is not necessary. But still be careful: an investigation can “change colour” and end up being focused on individual matters after all.
For employers this means they must check in advance whether the investigation agency meets the statutory requirements. If there is no licence, the entire investigation may have to be halted. This can lead to reputational damage or legal claims.
Employee consent? Better not to rely on it.
A common misconception is that employers always need employees’ consent to use their data in an investigation. The Dutch Data Protection Authority states that this is in fact not desirable. Employees are in a position of dependency vis-à-vis their employer and are therefore not able to give that consent “freely”. Consent is then not a valid legal basis for the processing.
The correct GDPR basis is usually the employer’s “legitimate interest” — think, for example, of safeguarding a safe working environment under article 3 of the Working Conditions Act (Arbowet). An employer must, incidentally, be able to substantiate this.
Work with clear purposes
Under the GDPR, personal data may only be collected for a specific and legitimate purpose. It is therefore of great importance to ensure that the purpose has been clearly set out in advance, for example in:
- an internal protocol on inappropriate behaviour;
- an existing privacy statement (on the website) or a manual for the investigation;
- an arrangement that has, where applicable, been agreed with the works council under article 27 of the Works Councils Act (WOR).
Right of access and confidentiality
Employees have the right to know what personal data about them is being processed, and may also request access to it from their employer under article 15 of the GDPR. The right of access relates only to the personal data of natural persons.
However, this right of access is not absolute. An employer can refuse this access where it would endanger the rights of others, such as reporting parties or colleagues who have given confidential statements.
So make sure that, before launching an investigation, you have thought about:
- how you will keep certain statements anonymous;
- how you will weigh the interests of the parties involved;
- and how you can legally substantiate a refusal of any access request.
What if you don’t arrange this properly?
As an employer, you are obliged to act carefully and proportionately. If employees’ privacy rights are breached, the following risks may arise:
- court proceedings in which the evidence from an investigation is challenged, on the grounds that it was unlawfully obtained through a breach of privacy legislation;
- damages claims or requests for (high) equitable compensation;
- reputational damage, especially if the investigation has been leaked.
Note: even if evidence has been unlawfully obtained, the court can still take it into account in its ruling. On the other hand, unlawfully obtained evidence can indeed lead to sanctions or damages.
Need help?
Balancing decisive action on inappropriate behaviour in the workplace with careful conduct is difficult — especially for companies without their own legal department. The corporate lawyers at The Legal Company are happy to help you with:
- drafting internal protocols;
- assessing investigation plans or protocols in light of GDPR obligations;
- a (legal) licence check of investigation agencies;
- handling access requests from data subjects.
Contact us via info@thelegalcompany.nl or call 020 345 0152. Together, we will make sure your organisation acts carefully and on solid legal footing.
