Although essential procedures for an effective domestic and cross-border investigation are the same, there are certain fundamental differences that need to be borne in mind. Considering legal, cultural and other complexities which may arise, upfront, can ensure that a cross-border investigation starts correctly and ends with adequate results.
Initiation: reporting of and responding to an allegation
Knowing the local culture and regulations about the triggers of cross-border investigations can help companies customise reporting channels to best fit the ways in which foreign employees might report allegations. When a lead or an allegation is received in a foreign language, it is critical to accurately translate it, to prevent any misinterpretations, as even minor errors could lead to significant inaccurate findings. Furthermore, a company needs to act quickly, efficiently and effectively when responding to allegations. For this reason, compliance officers, in-house counsel, human resources professionals and other members of management who work for multinational companies need to be prepared to respond to allegations in a planned and consistent manner.
Immediate action steps
Depending on local laws, it may be necessary to temporarily suspend or place employees who are the subject of the concern on leave or to take measures to preserve evidence and relevant documentation. Some countries also require notification to an employee who is the subject of an allegation or to an employee representative or work council.
Planning the investigation
Labor, employment and data privacy laws can seem counterintuitive to common practices in many countries; it is therefore critical to understand them at the initial planning stage of an investigation. Time should be taken to assess the matter critically for the sake of confidentiality and privacy.
Proactively developing a case management system and investigative procedures that align with the company’s values, standards and principles and take into account region-specific or country-specific requirements, customs and practices will aid in planning the investigation appropriately. Often, one size does not fit all and procedures will need to be customised to meet the requirements of a particular jurisdiction for multi national companies. Therefore, development of case management and investigative policies and procedures should be a collaborative exercise between compliance leaders at headquarters and their colleagues around the world.
Other aspects to consider during the planning phase of cross-border investigations are:
- the timeframe within which an investigation must occur
- data privacy and the transfer of information
- notifications to employees or their representatives
- notifications to governmental agencies or law enforcement
- deadlines for reporting disciplinary measures taken by the company
- words/expressions used when dealing with notifications of foreign employees (for example, the word “investigation” may elicit negative emotions that have a negative effect on the process. “Review,” “analysis,” or “discussion may be more appropriate)
- jurisdictional differences that may impact the investigation, the information that can be collected, and the individuals who can be interviewed
- who should be notified? It is important to keep the circle of trust small and to remind members of management about confidentiality and the integrity of the process
- who will oversee and manage the investigation? It is important that those who oversee and manage the investigation become intimately familiar with the local business and its operations, while at the same time, understanding the legal and cultural environment.
Execution: conducting the investigation
Proactively identifying and addressing legal and cultural differences is the key to conducting an effective cross-border investigation. Significant differences between cross-border investigations and domestic investigations include data privacy laws and regulations, interviewing employees and reporting findings.
(a) Data privacy
Preserving and collecting information: foreign data privacy laws and regulations pose some of the greatest challenges to conducting cross-border investigations because of restrictions on the kinds of data that can be collected and transferred out of the jurisdiction. Many countries have enacted laws that place a high priority on protecting personal data, including establishing a fundamental legal right on the privacy of personal data, even if such data are contained on an employer’s system or computer. Failing to anticipate the impact of local data protection laws not only significantly impedes an investigation, but it also can be costly in terms of added expenses, sanctions, and, in some cases, prosecution.
One of the biggest hurdles is complying with limitations on collecting and reviewing data in a company’s readily-accessible files, such as emails on the company’s server, internet use records, documents on an employee’s hard drive and even hard copy documents in an employee’s office.
Transferring data: many foreign data privacy laws, including those in Europe and parts of Latin America and Asia, prohibit transferring data out of the local jurisdiction without first establishing data export channels. Data export channels are methods of ensuring that country-specific data protection procedures are followed, such as adopting corporate policies that adhere to foreign data protection laws; incorporating model contract clauses that provide a “safe harbor” under laws like the EU Directive; and, in some cases, obtaining consent from employees. It is extremely important to establish these data export channels before an investigation arises to prevent delays and lack of cooperation in a cross-border investigation.
Confidentiality of investigation materials: many countries require that investigators disclose personal data included in investigation materials to the individuals who are targets of the investigation if they request the data. Additionally, labor laws in some countries may require companies to disclose investigatory procedures involving data processing systems to labor unions or employee rights work councils if personal data could be impacted. Some countries prohibit outdated personal information from being retained, even if it is contained in investigatory materials. This runs counter to certain laws and regulations that may require a company to maintain investigatory materials and work product for a period of time.
(b) Interviewing employees
In many countries, employees have the right to refuse to cooperate with an employer-led investigation, even if they are not its target. Some labor laws mandate that an employee representative or union committee be consulted before an employer may interview its own employees in an investigation. Employees also have the right to have a lawyer or employee representative present at the interview.
Due to different cultures, a company should be aware that talking about fraud, theft, and manipulation of financial statements is accepted in some countries; while in others, those words will make people feel uncomfortable. In addition, body language, such as looking someone in the eye, may be considered rude in some countries; while normal in others. Different languages, dialects, slang and local jargon can also make interviewing employees a challenge.
Conducting an interview in a confrontational manner may be effective, but in many countries, the interviewing style needs to be softened.
(c) Reporting findings
The form and content of a report prepared at the conclusion of a cross-border investigation needs to be carefully considered. There may be advantages to providing only an oral report; however, labor laws in a particular jurisdiction may require a written report, especially if disciplinary action will be taken.
Many countries have data privacy laws that allow a target or a witness to have access to certain investigatory material, including a written investigation report. Being compelled to disclose data in this way could affect the applicability of domestic and foreign legal privileges and could expose the company to data privacy and defamation claims.
A company should be mindful that the report may contain data that is restricted from being transferred out of a jurisdiction, such as names of individuals, financial information, or personal data. Therefore, the proper data export channels need to be established before providing a report (even a report in draft form) to management or directors outside of the country.
Knowing beforehand if reporting restrictions exist can help to avoid difficult situations and delays at the conclusion of a cross-border investigation.