NORWAY Law and Practice Contributed by: Thomas Talén, Øyvind Clausen Bade, Marte Dahl and Marianne Viset, Ro Sommernes Advokatfirma AS
6.6 Communications to Authorities There are no statutory procedures imposing a duty on the employer to report a notice of concern to the police, but where there is suspicion of criminal offenc - es the employer should consider referring the matter to the police as soon as possible, especially consid - ering potential contamination of evidence/witnesses if the internal investigation continues. See also 8.4 Criminal Cases ,regarding criminal cases. There may be a duty to report if there is a breach of personal data security, in which case the appropriate authority is the Norwegian Data Protection Authority. 6.7 Other Communications There is no statutory duty to provide information after investigations have been completed. Information to other parties should be limited to what is necessary, having regard to rules on data protection, confiden - tiality and proper conduct. See also 6.5 Information on the information provided to affected parties in a whistle-blowing case. 6.8 Disciplinary Measures There are several types of sanctions available to the employer following the conclusion of a case involving a notice of concern. The WEA regulates the rules on suspension, dismissal and summary dismissal. Such formal and statutory sanctions may be a response following a concluded case involving a notice of con - cern, but this requires that the conditions in the WEA are met. Generally, it is not lawful to terminate the employment relationship unless there is objective cause. There is no requirement as to how quickly an employee can be dismissed following a concluded HR internal investigation, but the seriousness of the offence and choice of sanction will have an impact. In Norway, there are also non-statutory rules govern - ing the issue of warnings in employment relationships, which may also constitute a form of sanction after an HR internal investigation has been concluded. In addi - tion, the employer may make changes to the employ - ment relationship, for example, by removing certain areas of responsibility from the individual concerned. Such sanctions are not regulated by statute, but gen - erally it is important that the employer acts in accord - ance with the requirement of objective cause.
6.9 Other Measures It is important that employers take all reasonable steps to safeguard the working environment during and after a process involving a notice of concern. A whistle- blowing process may, depending on the specific cir - cumstances, have a significant and negative impact on the working environment. Relevant measures may include, for example, providing information about the process and any steps that have been taken, provid - ing training or courses, introduction or revision of poli - cies, and mediation between parties. The employer may collect personal data for the pur - pose of an HR internal investigation, provided that the collection complies with the requirements of the GDPR (General Data Protection Regulation – Regula - tion (EU) 2016/679) and specific regulation on con - trol measures laid out in the WEA. In particular, the employer must: • mention such purpose in its record of processing activities; 7. Data Protection 7.1 Collecting Personal Data • consult with employee representatives regarding the need for, design of, and implementation of the control measure as early as possible, in accord - ance with the WEA Section 9-2; • unless the investigation is based on a legal obli - gation, conduct a legitimate interest assessment, comparing the interest of the employer in conduct - ing the processing versus the interests and rights of the relevant employees; • if the processing may give rise to a high risk for the relevant employees (depending on the con - sequences and type of data collected), conduct a data protection impact assessment; • only collect the data that is necessary for the pur - poses of the investigation; • keep the data only for as long as it is necessary, which must be subject to a concrete assessment; • inform the relevant data subjects of the collection and processing of personal data in compliance with Articles 13 or 14 of the GDPR, and fulfil certain consultation and information obligations under Chapter 9 of the WEA, including informing affected
297 CHAMBERS.COM
Powered by FlippingBook