Internal investigations in Switzerland: recent developments

Saverio Lembo
Bär & Karrer AG, Geneva
Saverio.Lembo@BaerKarrer.ch

Pascal Hachem
Bär & Karrer AG, Zurich
Pascal.Hachem@BaerKarrer.ch

Role of Whistleblowing

Whistleblowers are a pivotal part of the compliance and investigation environment in Switzerland. Frequently, internal investigations are triggered by the report of a whistleblower. In particular, large companies have set up sophisticated whistleblowing systems and put procedures in place to triage and address reports coming from whistleblowers. Directive (EU) 2019/1937 of the European Parliament and of the Council of 23 October 2019 on the protection of persons who report breaches of Union law (the ‘Whistleblower Directive’) has led to further activity among companies in setting up the required reporting systems to comply with European Union requirements.

That being said, the legal protection of whistleblowers in Switzerland is minimal at best and, within the company, depends on the company’s approach to whistleblowing. There is no legislation – employment related or otherwise, especially in criminal law – protecting whistleblowers. Consequently, when going public, whistleblowers still face liability towards their employer for damages for breach of their employment contract and criminal liability, carrying monetary and even custodial sentences.

Based on the approach taken by the Swiss Supreme Court, the current view in Switzerland is that, while within companies it is desirable for employees to blow the whistle on misconduct, making such information public will typically not be justified by the objective to preserve justified interests. Therefore, individuals going public take significant risks under criminal law. In light of the Swiss Parliament's recent refusal to enact specific legislation to address the issue of whistleblowers, protection in Switzerland remains virtually non-existent once information is divulged to recipients outside of the relevant company. On the other hand, terminating employment will typically be regarded as abusive where an individual made a bona fide whistleblower report within the company.

Given that many Swiss companies have operations in the EU and meet the thresholds set forth in the Whistleblower Directive, this Directive and its contents have become – as a factual matter – also applicable in Switzerland. The private sector will, therefore, in effect be the key driver in terms of whistleblower protection.

Data privacy considerations

Swiss data protection law is enshrined in the Swiss Data Protection Act (DPA). It applies to all personal data processed in Switzerland, even if the data is received from abroad. Furthermore, if a person domiciled abroad processes personal data of an individual or entity domiciled in Switzerland in breach of the DPA, the affected individual or entity can claim their rights under the DPA in Switzerland (in the place where the harm was inflicted). The current DPA protects the personal data of individuals as well as legal entities (Article 3(b) of DPA). Under the upcoming revised DPA, which is expected to enter into force on 1 September 2023, the personal data of legal entities will no longer be protected.

In the course of internal investigations, the general principles contained in Swiss data protection legislation must be observed. The two key principles are transparency and proportionality. Transparency means that the manner of processing is transparent to the affected individual or entity and the purpose for which the data was initially collected must at least be evident from the circumstances or required by law. The proportionality principle requires any type of processing activities to be restricted to what is absolutely necessary to achieve the purpose of the processing. Both the purpose and the method of processing must be proportionate.

Employment considerations/employee rights

Article 321a(1) of the Swiss Code of Obligations (CO) sets forth the general duty of care and loyalty of employees. This includes the obligation to provide to the employer any information relating to any facts and circumstances the employee became aware of in the context of the employment relationship. The employee must contribute to the employer's internal investigation and this obligation intensifies the higher up in the corporate hierarchy the relevant employee ranks. Although subject to dispute, the majority view still appears to be that this also means that the employee must incriminate himself towards the employer as part of the employee's duty of loyalty, even though such evidence may then not be usable in subsequent criminal proceedings (see further on this topic below).

Under Article 321b of the CO, the employee must hand over any work product to the employer. The notion of ‘work product’ includes any data the employee creates, develops, or revises in the course of performing, or on the occasion of performing, the employee's contractual duties. It includes, in particular, any kind of business-related communication (ie, physical documents as well as electronic communication, such as emails). Consequently, the employer is entitled to any professional communication of the employee. In contrast, private communication of employees does not fall under the scope of Article 321b of the CO. Accordingly, the employee has no obligation to disclose any private communication to the employer.

The counterweight to the employee's duty of loyalty is the employer's duty of care, as laid down in Article 328 of the CO. This provision explicitly mentions the employee's personality right, sexual integrity, and personal health, but is generally read to establish a general duty of the employer to give due regard to the employee's interests. It follows that in any given case where the employer relies on the employee's duty of loyalty in the course of an investigation, it must be examined whether there are prevailing interests of the employee that the employer must preserve under the employer's duty of care. Specific to internal investigations, this means that the employer must apply proportionate measures when investigating, in particular, when it comes to the review of data secured and collected from the employee. Finding facts and identifying evidence must follow a process that is least intrusive to the personality and privacy rights of the employee.

Client identification in cross-jurisdictional investigations

The identification of the client can present problems in larger settings where the relevant company is active in multiple jurisdictions through subsidiaries. In such cases the cause for the investigation may lie with a foreign subsidiary, but the effects materialise at the seat of the parent company (ie, at group level).

In such scenarios, it is not unusual that, over the course of the investigation, the interests of the parent company and the subsidiary may become inconsistent and expose members of the board at the subsidiary to conflicts of interests, if at the same time they are also corporate officers of the parent company.

For law firms conducting the investigation, it is therefore important to have absolute clarity on who exactly the client is, to whom the law firm owes its services and reporting obligations. Furthermore, only the legal entity that has retained the law firm will, in general, be protected by attorney-client privilege. While there is an argument to be made that whenever the parent company retains a law firm, all communication between subsidiaries and the law firm should also be protected by attorney-client privilege, this is by no means a given and hence might leave significant parts of the investigation unprotected.

Existence of a legal privilege on the results of the internal investigation

In Switzerland, legal professional privilege does not per se protect internal investigations conducted by law firms and work products created in the course of such investigations in their entirety. That being said, it remains clear that legal advice – also in the course of internal investigations – remains protected by legal professional privilege. Investigating facts remain protected where directly relevant to the basis for legal advice. However, if such investigative activities concern facts that the company would have to investigate anyway and produce to authorities as part of its legal obligations, legal professional privilege does not apply.

In view of the jurisprudence of the Swiss Supreme Court, it is recommended to take particular precautions when conducting internal investigations in Switzerland. It is important to clarify specifically in the engagement of the law firm to which specific legal issues the investigation relates and what are the legal questions that the law firm should answer on the basis of the facts to be investigated. Factual investigation and legal evaluation should be kept separate. In case of doubt, law firms should create two separate work products: (1) a descriptive, objective report of the facts that should not go beyond a summary of the pre-existing documents and information and consist as far as possible of direct quotes from the reviewed materials and avoid paraphrasing or any other type of language that could be read as an interpretation or evaluation; and (2) a legal analysis of the facts including legal risks and recommendations. The former should be drafted on the hypothesis that it must be produced to authorities, whereas the latter, if restricted to legal advice, will be protected by legal professional privilege.

Possibility to enter into a non-prosecution agreement in case of internal investigation and self-reporting

There are no Non-Prosecution Agreements or Deferred Prosecution Agreements under Swiss law to resolve corporate investigations. The instrument closest to such agreements is the penalty order procedure under Article 352 et seq of the Swiss Criminal Procedure Code (SCPC). Initially conceived as an instrument for public prosecutors to address cases of minor offences carrying relatively low sentences in a quick and efficient manner, penalty orders have become an important tool in the resolution of investigations of corporations without the matter ever going to court.

Resorting to the penalty order procedure as a means of resolving the investigation in an expedited manner is, however, within the discretion of the investigating prosecutor and by no means a given. Entities are therefore incentivised to cooperate with the public prosecutor, in order to avoid years of criminal proceedings resulting in an indictment with a full trial, and resolve the investigation by way of a penalty order. This instrument also mitigates the risk of reputational damage created by the publicity of a trial. Accepting responsibility under Article 352(1) of the SCPC means pleading guilty to the offence and the penalty order, despite being issued by the public prosecutor and not a court, remains a conviction of the entity and will state that the public prosecutor by way of penalty order convicts the entity.

Importantly, and similar to the United States Non-Prosecution Agreements and Deferred Prosecution Agreements, the penalty order must contain, among other information, ‘a description of the act committed by the accused’ (Article 352(1)(c) of the SCPC), ‘the offence constituted by the act’ (Article 352(1)(d) of the SCPC), ‘the sanction’ (Article 352(1)(e) of the SCPC) and ‘details of any seized property or assets that are to be released or forfeited’ (Article 352(1)(h) of the SCPC). Per Article 102(1) of the Swiss Criminal Code (SCC), the sanction will always be a fine of up to CHF 5m. Cooperation with the public prosecutor, and early self-reporting in particular, may lead to a reduction of the fine (even down to a symbolic one franc fine). However, according to Article 352(2) of the SCPC, the fine may be combined with measures in accordance with articles 66 and 67e-73 of the SCC. This includes, in particular, Article 70 of the SCC (forfeiture of assets acquired through the offence) and Article 71 of the SCC (compensation of equivalent value, if the assets acquired through the offence are no longer available for forfeiture). In contrast to the fine set forth in Article 102(1) of the SCC as not exceeding CHF 5m, there is no ceiling to forfeiture. In practice, penalty orders typically order forfeiture of assets (which include financial gains) acquired through the offence, which typically amount to a multiple of the fine. Economically, legal entities resolving their investigations through penalty orders will therefore typically feel the forfeiture more than the fine.

A penalty order is only subject to court review if the accused, other affected persons, or, in defined cases, the Office of the Attorney General of Switzerland, or of the canton in federal or cantonal proceedings, respectively reject the penalty order in writing within ten days from its issuance (Article 354 of the SCPC), and the public prosecutor stands by the penalty order despite the rejection (Article 355(3)(a) of the SCPC). Then the case must be referred to the competent first instance court (Article 356(1) of the SCPC). In the typical scenario where corporate investigations are resolved through a penalty order, the rejection of the penalty order and hence court review of the penalty order are rare exceptions. This being said, unlike the Deferred Prosecution Agreement, the penalty order's drawback is that the company/individual will have a criminal record. As a matter of fact, a penalty order has the same effect as a judgment.