Do you need an external investigator?

By Helen Dyke, Senior Associate Solicitor, Irwin Mitchell

Issues of dishonesty, fraud and malpractice have, of course, continued throughout the pandemic. It is crucial to conduct fair investigations, as a wrong turn can have significant consequences in terms of expense, time and exposure to potential claims. 

Businesses are increasingly appointing external independent investigators to investigate complex and sensitive employment issues. It can provide reassurance that the process has been handled fairly and impartially. The investigator is likely to be called as a witness in the event of a claim.

Businesses that are considering appointing an external investigator should:

• Provide a detailed brief to the investigator on the issues
• Agree with the investigator what resources and access will be required
• Make appropriate arrangements to protect confidentiality
• Address legal compliance obligations, to include data protection
• Check their insurance policies
• Consider instructing a solicitor, in order to ensure that any activity is lawful and, should a claim result, emails and correspondence should be subject to legal privilege and will not be disclosed

Monitoring Employees

When conducting an internal investigation and considering the use of covert surveillance, care must be taken not to overstep the mark. As long as certain steps are taken, businesses are generally entitled to monitor communications on their networks, for example, to ensure work is being performed to the correct standard and for the prevention or detection of criminal activity.

Employers must inform employees about any monitoring arrangements and the reasons for monitoring in order to ensure compliance with the UK General Data Protection Regulation (“GDPR”) and the Data Protection Act 2018 (“DPA”). Monitoring in the workplace may include; recording on CCTV, opening mail or email, use of software to access email, checking phone logs or checking logs of websites visited.

The Information Commissioner’s Office (“ICO”) recommends employers should carry out impact assessments which aims to enable employees to assess whether the monitoring is a proportionate way to address a problem that the business is facing. Monitoring should be carried out by the employer in an open and systematic way, unless targeted or covert monitoring is genuinely justified, for example, where there are grounds to suspect criminal activity or serious malpractice by the employee. Such monitoring should only be carried out within a set timeframe and as part of a specific investigation. The ICO further recommends that businesses do not use information retained about workers merely because it might have some relevance to an investigation, if access or use would either be incompatible with the purpose the information was obtained or disproportionate to the seriousness of the matter under investigation.

Employers need to ensure that when conducting a disciplinary process, any evidence gained through monitoring is admissible and fairly used. During an investigation, it may be necessary for employers to review emails or computer records. Although this is justified in certain circumstances, employers must ensure they have sufficient evidence before acting.

ACAS guidance makes reference to the use of monitoring and surveillance methods and confirms that the employer must view evidence objectively and in full. GDPR and the DPA requires that data should be used fairly, lawfully and transparently and should be for a specific purpose.

Written data protection and monitoring policies, together with an up-to-date disciplinary policy are key – they should explain why an employer can access emails or computer records, the level of monitoring and how this can be used in disciplinary processes.

Employers may wish to monitor their workplace for various reasons, the DPA doesn’t prevent employers from doing this, but employers should remember that workers are entitled to reasonable privacy at work. Employers must tell employees about any monitoring arrangements and the reason for it.

Key Points

• Employers should have written policies and procedures in place regarding monitoring at work
• Monitoring shouldn’t be excessive and should be justified
• Staff should be told what information will be recorded and how long it will be kept
• If employers monitor workers by collecting or using information the DPA will apply
• Information collected through monitoring should be kept secure

Our Coronavirus updates

We’re working hard to keep businesses up to date with legal developments around Coronavirus. We’ve set up a portal which includes lots of helpful articles and advice to help you. If you have a query, please contact us.

This article was first published here on 9 February 2021