Spanish companies must balance data-privacy and CBA agreements when conducting internal investigations

Whistleblower series

In the Spanish corporate world, internal investigations are largely conducted to investigate the following types of misconduct: discrimination, harassment, violations of internal policies and criminal activity.

The scope and target of a Spanish investigation, however, greatly depends on the details of whatever collective bargaining agreement (CBA) the Spanish company applies since some agreements contain clauses that directly address internal investigations, and detail the obligations of employees throughout the process.

In short, if a Spanish company is operating under a CBA that specifies the procedures for an internal investigation and establishes a clear definition of misconduct in the workplace, a company must follow this process if faced with reports of misconduct.

If the company's CBA contains no mention of investigations, its management is free to establish investigative procedures that best suit the firm's profile. But all investigations in Spain operate under certain limitations: the details of the CBA as it pertains to employee rights (as just mentioned), personal data protection regulations centred around the EU's General Data Protection Regulation (GDPR), pertinent laws governing gender equity and labour relations and legal protections for personal rights and freedoms.

Investigatory procedures: an overview

In terms of Spanish employment law, companies are advised to implement the following procedures when launching an internal investigation. Details will be provided later in this article, but the following is a rundown.

After receiving a formal complaint of wrongdoing (or if an in-house audit reveals malfeasance), the firm should respond by initiating an internal investigation. Basically, the first thing to be done once the investigation is underway is to initiate protective measures: identify and protect possible evidence, and insure that key witnesses do not become the target of harassment or intimidation.

To do this, the suspect or affected employee alleged to have committed the wrongdoing may need to be removed from the workplace until the investigation is completed. One tool to do this is a furlough called "garden leave" where an employee can be ordered to remain at home while receiving a full salary. (More on garden leave later).

Once protective measures are in place, investigators have several ways to collect evidence and determine the accuracy of a complaint. They can conduct interviews, review documents (both hardcopy and digital records), and inspect communication records (phone, text messages and emails). After all the pertinent individuals (experts, suspects and witnesses) have been questioned and all records and documents inspected, the investigators are ready to arrive at a conclusion whether the evidence proves that a wrongdoing has taken place.

If there is sufficient evidence to prove misconduct, the company will have to respond. The first response should be to implement "corrective measures" to try to prevent this type of wrongdoing from occurring again. In cases where the wrongdoing is minor, this correction and a warning to the investigation's target may suffice in resolving the issue. For more serious cases, punishment will have to be meted out.

Although it is advisable in terms of protecting an employee’s rights and the company's interests to respond to allegations of misconduct with a disciplined internal investigation, there is no law in Spain obliging a company to have internal-investigation procedures in place.

If a company does establish procedures for internal investigations, it should ensure that they are followed to the letter if an investigation is ever conducted. It should be noted that any company with internal-investigation policies in place that punishes an employee for misconduct without following its own procedures stands the risk of having these sanctions later challenged in court and declared unfair.

Whistleblowing

Another crucial consideration is Whistleblowing. Spanish companies are currently not required to have Whistleblowing systems in place, such as a hotline, a Whistleblowing commissioner and policies that encourage employees to use this channel to report misconduct with assurances that all reports will be confidential. This legislative vacuum, however, will not last for long. As a result of EU's recently passed Whistleblowing Directive (2019/1937), member states like Spain are required to pass their own national legislation on Whistleblowing by December 2021.

Even before this deadline, companies should implement their own Whistleblowing procedures in order to reduce the criminal liability of its directors, advises Maria Jose Ramos, an Associate Lawyer with CMS Spain.

According to Ramos, if a company decides to establish procedures for internal investigations and Whistleblowing, it is obliged to consult with employee representatives or labour unions before finalising its policies. Employee representatives views should also be sought out before drafting a company Code of Conduct, and once formalised, employees should be trained on how to adhere to these regulations and what to do should they witness infringements.

In terms of consultation and employee rights, a company is not obliged to inform an employee's legal representative should he become the target of an investigation, unless the applicable collective bargaining agreement requires it. However, if an employee under investigation requests the presence of an employee representative during any investigation-related interviews, it is advisable – for the sake of fair play – to consent. Lastly, if an investigation uncovers a serious infringement by an employee that is a member of a trade union, the company should consult with the employee's union before handing down an official judgment.

Spanish companies are under no obligation to inform state labour authorities of an internal investigation they are conducting. If the investigation, however, uncovers criminal activity, the firm could inform the police or prosecutors.

Lastly, as touched upon above, it may be prudent to remove an employee under investigation from the workplace until the inquiry is concluded. This will diminish the risk of evidence tampering and witness intimidation. Under Spanish law, such a removal can be done easily and effectively by granting "garden leave" whereby an employee is asked to remain at home on call to provide answers to the investigators while receiving a full salary.

Conducting interviews

In any internal investigation, the most important method of collecting evidence is the interview process. This allows investigators to directly question the suspect and all witnesses. Spanish law includes deadlines for the completion of an investigation so that every employee under investigation is guaranteed speedy justice. (These deadlines are explained in detail at the end of the article.)

As for interviews, the questions asked and the information collected must be considered highly confidential. To protect the security of the interview process, interviews can be strategically scheduled to reduce the possibility of leaks of information.

Interviews cannot be recorded by audio or audio-visual means unless the employee gives his explicit consent. But a written record (i.e. minutes) of the interview should be produced. This record or formal protocol should be shown to the interview subject, and ultimately signed by him to confirm the accuracy of the transcript. All interview transcripts (along with all the evidence gathered in the investigation) should be retained and stored by an HR official or relevant manager for later reference.

The primary consideration, when conducting interviews, is to ensure that the fundamental rights of employees are not violated. Interviews should not be overly aggressive, punitive or designed to intimidate. Interviews are straightforward and highly effective fact-finding tools, and should be treated as such.

Interviews, however, must be structured according to the legal status of the individual to be questioned. When interviewing employees, investigators must consider and follow the firm's policies and all applicable labour code regulations, and if issuing sanctions against an employee, the company must respect any limitations present in the CBA.

Contract employees, however, are another matter. Although technically they are not subject to the same disciplinary actions as regular employees, a contactor – who is the target of an investigation – may claim the same rights and protections as an employee if he follows the same routine as regular employees: keeping regular office hours, reporting to a manager, etc. To avoid this, a company is advised not to initiate a standard internal investigation if it involves a contractor. Any potential misconduct should be investigated, but different procedures may be applied to ensure that the contractor cannot claim the status of an employee.

Data collection

When collecting evidence outside of the interview process, investigators can access "company resources" such as company phones, email servers and the Internet history of company laptops. Further to EU and Spanish data-protection laws, investigators cannot read private emails or search the contents of an employee's personal phone.

Investigation protocol

When the evidence has been collected and considered, the investigation team is obliged to issue a report or protocol detailing the inquiry's findings. The importance of issuing a comprehensive report cannot be stressed enough.

"It's very important to have an extremely complete final protocol," explained Alejandro Gil Murillo, an Associate Lawyer with CMS Spain.

According to Gil, the protocol must include the following: the allegations made by the Whistleblower or "affected employee" (particularly important in harassment cases), all the documentary evidence, and the findings of the interviews of both the subject and any witnesses. The report can also contain feedback from the union or works council representing the subject and any evidence culled from external participants, such as clients and contractors.

After the report is finalised, it should be presented to the suspect of the investigation, who should have an opportunity to respond. Copies of the final report, however, should also be given to any legal representatives of the employee or to the affected employee's union if the CBA requires it.

Lastly, it should be understood that the report will become evidence in court if the employee presents a legal challenge. Hence, the company should retain a copy of the investigation's findings in both hard copy and digital format.

But this raises the question: how final is the final protocol? After being reviewed by the suspect, can the report's findings be appealed if the suspect maintains that the conclusions are flawed or that key evidence has been overlooked?

The answer depends on each company's individual policies on internal investigations: whether a company has built an appeal process into its investigation procedures. If lacking an established appellate process, companies are under no legal requirement to entertain an appeal. In this case, if a company considers an appeal, they do so voluntarily out of a sense of fair play that could strengthen the company's legal position should the matter later go to court.

Corrective actions

If the investigation finds that the suspect is guilty of misconduct, the company is obliged to respond. In addition to any changes made to company policies that might prevent such a wrongdoing from taking place in the future, the company is obliged to apply corrective measures to the guilty employee.

Basically, the response to be made falls under three categories according to Spanish labour regulations: minor offences, serious offences, and offences categorised as very serious. Employees revealed to be guilty of minor offences can be served a written or verbal warning. Under Spanish law and the applicable Collective Bargaining Agreement (CBA), these employees can also be suspended without pay for up to three days.

For more serious offences, employees can be suspected, depending on the applicable CBA, up to 15 days without pay or prohibited from receiving a promotion for up to three months.

In cases of extremely serious misconduct, an employee can be suspended for up to 60 days (again, depending on the CBA). He can also permanently lose the right of promotion within the company. As a last resort, the employee can be dismissed.

Whatever corrective measures are issued, the company must (as stated earlier) adhere to strict deadlines for the rendering of judgments. For minor offences, companies must issue their decisions within ten days. The deadline for serious offences is 20 days. For extremely serious offences, companies must investigate and render a judgment within six months from the date the misconduct occurred. In addition, a company has 60 days from the moment it learned of the misconduct to complete the investigation and render a final decision.

Also note, because Spanish law does not mandate internal investigations, those companies without established policies requiring internal investigations can implement corrective measures as soon as an allegation of misconduct comes to light.

In the end, companies are encouraged to approach allegations of employee misconduct with the utmost care and consideration since any investigation and judgment may be challenged in court. If called upon to review a judgment and corrective measures, a labour court may do any of the following: confirm a sanction, partially revoke a sanction, totally revoke a sanction or render a company's judgment null and void. To avoid the latter, companies are advised to ensure that their response to any misconduct adheres to Spanish labour law, gender equity laws, data protection regulations, an employee's personal and civil rights, all pertinent clauses of the CBA and a general sense of fairness.

In short, companies are advised to be fully prepared for allegations by establishing internal investigation systems, a clear channel for Whistleblowers to report wrongdoing, and a strict and well-publicised corporate Code of Conduct that addresses key issues such as bullying, discrimination, harassment and corruption.

For more information on conducting internal investigations in Spain, contact your regular CMS advisor or local CMS experts:

Maria Jose Ramos, Associate Lawyer, CMS Spain

Alejandro Gil Murillo, Associate Lawyer, CMS Spain