INTRODUCTION

There are several practical reasons for taking a closer look at internal investigations as a large number of corruption and embezzlement cases, such as the recent Wirecard scandal (a German e-payment giant that went bankrupt after fooling its investors), have shown. And yet the legal framework for internal investigations in Germany is vague at best. This, however, is about to change with the upcoming Corporate Liability Act that will have a significant impact on the importance of internal investigations. This article will provide an overview of the status quo and will examine the changes by the upcoming legislation. Our checklist at the end will help companies to successfully navigate through an internal investigation in Germany.

WHY CONDUCT A WORKPLACE INVESTIGATION IN GERMANY?

The practical needs to conduct internal investigations are often illegal actions, embezzlement, and fraud, which can lead to high financial losses for a company and threaten its very existence by fines, sanctions, liabilities, and massive damage to the company's image. Workplace investigations can uncover these wrong-doings and avoid or reduce the financial risk.

Also, if there is suspicion of illegal activities in a company, the management is obligated by law to investigate the possible misconduct. An effective internal investigation can even result in reduced legal liability. For example, violations of the European General Data Protection Regulation (GDPR) can result in fines of up to - 10,000,000 or up to 2% of a company's total annual global sales. In this regard, an effective workplace investigation can be worth millions - literally.

ARE EMPLOYEES OBLIGED TO COOPERATE?

Interviewing employees is the most important source of information in an investigation. It provides a valuable insight into the company's daily practice that usually cannot be obtained from mere paperwork. Thus, it is important to clarify the extent to which an employee has to cooperate during the investigation. They are obligated to appear in person to their interview and answer the management's questions truthfully. Additionally, the employee has a contractual duty to inform her/his employer of any misconduct and/or legal violations that are known to her or him.

Whether the interviewee has the right to be accompanied by a lawyer or a works council member in the meeting has to be determined on a case-by-case basis. If the interview is merely a means to investigate the situation at hand, the employee cannot claim legal counsel being present in the meeting. However, this may be different, if allegations are more substantiated to the extent that the interview can be seen as a hearing to prepare a termination of the employment for misconduct based on that strong suspicion. In this case, the employee has the right to involve a lawyer.

IS THE COMING CORPORATE LIABILITY ACT (VERBANDSANKTIONENGESETZ) A GAME CHANGER?

The new German Corporate Liability Act is expected to be enacted into law in 2021 and will certainly be a game changer. For the first time under German law, not only will individuals be held liable but the entire corporation can be held liable for company-related criminal activities committed by its senior employees. Furthermore, fines for corporate misconduct are going to increase substantially to up to 10 percent of the average annual global sales for big corporations.

An effective compliance management system and corresponding internal investigations will be considered a mitigating factor in the sanctioning process. Although this might sound familiar to similar sentencing guidelines in the U.S., the German Corporate Liability Act will unfortunately not be nearly as transparent or extensive. Nonetheless, for those companies that want to avoid increased sanctions, conducting an effective internal investigation in cases of misconduct is a must. The new law will contain provisions on how to conduct the internal investigation:

  • the employee will have the right to bring a lawyer or a works council member of her or his choice to the interviews;
  • an obligation to inform the employee that the obtained facts from the interview may be forwarded to the authorities and/or used in a court of law; and
  • the employee will have the right to refrain from giving an answer that would incriminate herself/himself.

DATA PRIVACY FRAMEWORK FOR WORKPLACE INVESTIGATIONS

Even in the most effective internal investigation, e.g., by screening the employees' emails or by using other technical surveillance, the EU and German data protection framework is crucial. Employees' data may be processed based on section 26 para. 1 Federal Data Protection Act:

  • if there is a documented reason to believe the data subject (this often means the employee) has committed a crime, or
  • if there is a suspicion of a serious breach of duty (by the employee), which does not amount to a criminal offense.

In both cases, processing the data must be "necessary." Therefore, the measures taken in the course of the investigation cannot be disproportionate to the infringement of the suspect's right to privacy. This was the problem in a case years ago, when the German state-owned Railway Company checked more than a hundred thousand private account transactions of their employees while investigating allegations of corruption.

In the course of an investigation, it can also be helpful to involve the company's data protection officer since she/he has extensive expertise in the relevant data protection law. This is a best practice: to seek the data protection officer's attention on all measures affecting the employees' data while preparing the internal investigation.

Data protection is also extended to whistleblowers, who often initiate an internal investigation by reporting misconduct.

CROSS-ATLANTIC TRANSFER OF DATA GATHERED FROM A WORKPLACE INVESTIGATION

Closely related to this is the transfer of the collected personal data abroad; in particular to the USA. Due to the invalidity of the EU-US Privacy Shield as of July 2020, it can no longer provide legal grounds for the transfer of personal data to the U.S. Now a permissible data transfer requires:

  • appropriate safeguards pursuant to Art. 46 GDPR, such as the Standard Contractual Clauses;
  • binding corporate rules according to Art. 47 GDPR; or
  • derogations according to Art. 49 GDPR, e.g., if the employee explicitly consented to the transfer.

In many cases, the transfer of personal data to the U.S. is no longer legally possible. A solution is anonymizing the personal data before the transfer. By doing so, the data transfer would no longer fall under the scope of the GDPR.

From a practical point of view, however, this might not be necessary: For example, U.S.-lawyers can conduct interviews with employees face-to-face and evaluate the data in Germany, rather than sending the interview transcript to the U.S. But if interviews are conducted using video conference e.g., Zoom or Microsoft Teams, this brings back the data processing issue.

CO-DETERMINATION FRAMEWORK FOR WORKPLACE INVESTIGATIONS

It is also important to look to the works councils' co-determination rights. If the management decides to conduct employee interviews, the works council has a right to be informed. Furthermore, the works council has a right of co-determination as soon as the employer decides to resort to technical surveillance as part of the investigation, e.g., video surveillance at the workplace or screening the employees' emails with software.

NOW WHAT? - CHECKLIST FOR SUCCESS

How should internal investigations be carried out to be effective on the one hand and legal, in particular concerning data protection regulations, on the other hand? The following checklist may help. This list points out and illustrates the basic requirements that companies can use as a guide when carrying out internal investigations in Germany:

  • Internal investigations should be well structured, with a clearly defined object of investigation, to ensure a swift process without delay. This should not compromise a thorough investigation of the facts. All incriminating and exculpatory circumstances should be investigated.
  • Employee interviews should be well prepared and entail notification of the consequences arising from the interview. Although this might not be a requirement under the current legal framework, it is recommended to look at the changes the upcoming Corporate Liability Act will bring.
  • Complete documentation is essential, both concerning the subsequent cooperation with the authorities and the data protection compliant procedure. This should include suspects and the facts supporting the allegations, the damage that has already occurred or is imminent, the evaluation of the interviews, and all incriminating and exculpatory circumstances.
  • While conducting the investigation, it is essential to keep the whole process strictly confidential. Allegations against one or more employees should not become public knowledge in the company. This could compromise the employee(s) and result in a substantial fine for data protection violations.
  • The company's data protection officer should be involved while preparing the internal investigation in order to get advice on measures affecting the employees' data.
  • The works council should be involved at an early stage to ensure compliance with co-determination rights.

CONCLUSION

With the new Corporate Liability Act, the importance of internal investigations will increase substantially. They are an essential mechanism for companies to avoid or reduce drastic legal and financial liabilities. Being prepared is key. Now is the time to allocate and adjust resources to be able to conduct an effective and legal workplace investigation in Germany.

The content of this article is intended to provide a general guide to the subject matter. Specialist advice should be sought about your specific circumstances.