SWITZERLAND Law and Practice Contributed by: Rayan Houdrouge and Kathryn Kruglak, Walder Wyss Ltd
7. Data Protection 7.1 Collecting Personal Data
Specifically, it is unlawful to use surveillance or monitoring systems for the purposes of monitoring the behaviour of employees at their workstations, although such systems may be used for other rea - sons (ie, health and safety). Further, according to the Swiss Federal Supreme Court, the employer must also ensure that the use is proportional and that the employees are informed of the surveillance and moni - toring. 7.2 Specific Rules First, under the FADP, the data controller must pro - vide data subjects with information with respect to personal data being collected. In this context, if the internal investigation involves col - lecting personal data beyond what was declared in the information already provided to the employee at the start of the employment relationship, additional infor - mation should be provided, especially with respect to the purpose of the processing and the recipients. Moreover, in light of the considerations mentioned in 7.1 Collecting Personal Data , the employer must ensure that all data collection and processing is law - ful and proportional. In this context, special attention must be paid to the data collected (ie, it is limited to what is needed for the HR internal investigation) and how it is collected and processed (ie, in the least intrusive manner possible). 7.3 Access There is no specific employment law provision that an employee can invoke in order to access an internal investigation report, although an employer could be ordered to turn it over in the context of legal proceed - ings. From a personal data protection standpoint, as noted in 7.1 Collecting Personal Data , internal investiga - tion reports almost always contain personal data. Therefore, employees have the right to request that the employer inform them of the processing of their personal data, including with respect to internal inves - tigation reports, and provide them access. However, there are some limitations that may be invoked by the employer. In particular, an employer
An employer may collect personal data for the pur - pose of an HR internal investigation, within the con - fines of the rules explained below. Data Protection Law From a data protection law standpoint, the employ - er is a data controller and employees are data sub - jects. Moreover, internal investigations almost always involve the processing of personal data. Under the Swiss Federal Act on Data Protection (FADP), data processing must be lawful (Article 6 par - agraph 1 FADP) and proportional. Attention must be paid not to unlawfully breach a data subject’s rights without grounds for justification, that is: • the consent of the data subject; • an overriding interest; or • a legal basis (Article 30 paragraph 1 and Article 31 paragraph 1 FADP). However, consent must be given freely, so the nature of the relationship between an employer and an employ - ee makes it difficult to rely on this basis. Therefore, absent a specific legal basis, an employer generally will need to rely on an overriding interest (protection of employees, fulfilment of the employment agreement, business needs, etc). Employment Law Employment law provides a further limit: under Article 328b CO, “the employer may handle data concerning the employee only to the extent that such data con - cern the employee’s suitability for his job or are neces - sary for the performance of the employment contract”. That said, this typically is the case with respect to internal investigations, especially given the employer’s general duty to protect employees. Labour Law Further, the Labour Act and its ordinances pose addi - tional restrictions regarding surveillance and moni - toring, which could affect the carrying out of an HR internal investigation.
390 CHAMBERS.COM
Powered by FlippingBook