Internal investigations – Comprehensive planning and preparation is essential

As soon as the processing of personal data is associated with the internal investigations, the requirements of data protection law must also be observed here. It is particularly important to be able to demonstrate a legal basis for each step of the data processing in accordance with Art. 6 of the GDPR or § 26 of the BDSG, insofar as the persons affected are employees, and to document this completely.

The conclusion of the internal investigation is often followed by a judicial clarification of the facts. Be it that the employee takes legal action against a dismissal or that he disputes the liability for financial damages in court.

For this reason, internal investigations must always be designed in such a way that the evidence found can also be used in court and is not excluded on the basis of any prohibitions on the use of evidence.

It should also be remembered that the data subject also has judicial and extrajudicial options to influence the investigation or to obtain information about the status of the investigation. In addition to the right to inspect the personnel file, the right to information pursuant to Art. 15 GDPR should also be mentioned here, which can also be applied in such a situation.

In the case of more serious incidents, the investigation may not remain a purely internal matter for the company. If, for example, the facts constitute a reportable data breach pursuant to Art. 33 GDPR, the competent data protection supervisory authority must also be involved in good time. If the triggering suspicion is relevant under criminal law, state authorities can also initiate their own investigations. In addition, aggrieved persons may file civil claims against the company. It is also possible that the facts of the case will be picked up in press reports.

This brief description already shows that a large number of interests and specifications must be taken into account in internal investigations. Internal investigations cannot therefore be carried out satisfactorily without comprehensive planning that takes the above points into account. In order to be prepared in the event of an emergency, we recommend planning the necessary steps in advance with all relevant internal units and drafting a standard process for internal investigations.

We will be happy to support you with any questions you may have about data protection. Simply call us at our headquarters in Hutthurm at +49 (0) 8505 91927 – 0 or at our branch office in Munich at +49 (0) 89 413 2943 – 0 or use our contact form.