Report on the IMKR Lecture “Data Protection and Labor Law in Internal Investigations” by Attorney Dr. Grau
For the third lecture in the IMKR series for the summer semester 2019, Prof. Rösler welcomed attorney Dr. Timon Grau – a specialist in labor law and partner at the law firm Linklaters LLP in Düsseldorf – on June 5, 2019. As part of the reformed master’s program, Dr. Grau will serve as a lecturer on “Labor Law in Practice” at the Faculty.
Under the title “Data Protection and Labor Law in Internal Investigations,” Dr. Grau provided insight into the prevailing issues and challenges in internal corporate investigations into legal violations and compliance deficiencies that attorneys and in-house counsel face in practice. Compliance refers to adherence to or conformity with the rules within a company. Failure to comply may result in sanctions for company management under § 130 of the Act on Regulatory Offenses (OWiG) and, where applicable, under special laws such as the German Securities Trading Act (WpHG) and the German Banking Act (KWG).
Dr. Grau began by illustrating the relevance and timeliness of the topic using various examples that have been extensively discussed in the media, such as the diesel and Cum-Ex scandals. He then presented the background and objectives of internal investigations. The focus is on investigating past violations and preventing future violations of internal policies and legal provisions.
Common areas of concern include violations of antitrust law, regulatory requirements, white-collar crime laws, and environmental regulations. A compliance department must employ various internal control mechanisms to enable both a successful legal defense and the prevention of future harm. Efforts undertaken could reduce corporate fines under § 30(1) OWiG. They also provide a knowledge advantage, enabling the company to professionally address any investigations or allegations from authorities and the media.
A central problem for in-house investigators is the authority of public prosecutors’ offices and, in particular, international authorities. Legal documents pertaining to internal investigations can quickly be subject to a risk of disclosure (see BVerfG NJW 2018, 2385). In Dr. Grau’s view, the insufficient protection of the attorney-client privilege is particularly problematic, as it simultaneously complicates ongoing investigations due to disclosure risks. Dr. Grau compared the different approaches and rights of German and U.S. authorities in this regard.
Dr. Grau further pointed out that labor and data protection concerns regarding affected individuals require complex preparations for internal investigations to avoid conflicts with existing company agreements and other requirements. This problem is particularly evident in the investigation of electronic communications. An employer could quickly be regarded as a telecommunications service provider if the work email account is also used for personal emails. Consequently, the employer might be obligated under § 88(2) sentence 1 of the Telecommunications Act (TKG) to protect telecommunications secrecy (see, for example, the recent ruling by the Hesse Regional Labor Court, NZA-RR 2019, 130). There are various solutions to this issue. However, some are cumbersome in practice or do not always provide definitive legal certainty, meaning that companies should ideally take the hurdle of telecommunications secrecy into account when designing their corporate email systems. Regardless of this, it is particularly important to ensure that the filtering and access process for evaluating electronic communications is proportionate.
Furthermore, Dr. Grau addressed the issue of non-anonymized personal data in internal corporate investigations. A clear difference emerges when comparing intra-European processes with those involving countries such as the United States. Transfers to countries considered “unsafe” from a data protection perspective require additional justifications (Art. 44 et seq. GDPR) that go beyond the standard requirements. Such justification could, for example, arise from the data subject’s consent under § 26(2) of the Federal Data Protection Act (BDSG), although the GDPR imposes far-reaching transparency requirements in such cases.
Among other things, Dr. Grau addressed the significance of §§ 80(2) and 87 of the Works Constitution Act (BetrVG) (general right to information and the works council’s rights of participation) with regard to the tension that arises in the context of existing works agreements and planned electronic data analyses. Ideally, such agreements should address any requirements or obstacles related to data access or its use. To facilitate internal investigations, “investigative works agreements” are drawn up in practice, which may, under certain circumstances, provide additional legal grounds for data processing (see § 26(1) sentence 1 BDSG). It is also important to involve the works council, as this facilitates cooperation from employees – who serve as sources of information – during internal investigations. A carefully designed employee survey contributes to this, as does, under certain circumstances, an amnesty program.
In conclusion, Dr. Grau noted that internal investigations face enormous challenges, particularly due to the large number of stakeholders involved, regulations, and, in some cases, the international powers of third parties. Nevertheless, they are an extremely helpful and necessary tool for ensuring the company’s compliance with the law. A pending draft bill to reform the law on corporate sanctions and to regulate internal investigations could provide a solution to the outstanding issues (see the Federal Government’s response of April 16, 2019, to an inquiry from the Bündnis 90/Die Grünen parliamentary group, Bundestag printed paper 19/9443, p. 5, in German).
