How to manage legal risks in a time of crisis?

An internal investigation is usually led by an ad hoc committee. Depending of the seriousness of issues to be investigated, the committee often includes the general counsel (or a member of the general counsel’s office) and one or two members of the (executive) management and/or supervisory board. The committee members must be independent, i.e. they must neither be involved in the issues under investigation nor supervise the department or business line in which the issues occurred. The committee forms and instructs the investigative team, often led by external legal counsel, not least to secure legal privilege. Other key members of the investigative team are usually representatives of the IT, internal audit and HR department.

Robin Moser, Loyens & Loeff Switzerland

As a result of the COVID-19 pandemic, (partial) remote working has become the “new normal”. This also influences the way investigations should be conducted. Please find below some important considerations when conducting an internal investigation remotely. 

Lay down deviations from (analogue) processes in advance in a protocol

As far as deviations from the normal (analogue) procedures are concerned, it is preferable to record beforehand how and why you deviate. In principle, remote working does not change the reporting lines itself, but it will influence how the reports are made. After all, everything has to be digital. Exemplary deviations may be that documents will be shared via email and that the employee is instructed to delete these documents within a certain period. Furthermore, it may be agreed that interviews will be conducted via a digital medium such as Teams or Zoom and that the person who will be interviewed has to make sure that the camera is on and that he/she is alone (or only with his/her legal advisor) at the time of the interview. 

Consider how to deal with the provision of confidential documents

In this respect it is advisable to think carefully about how you show certain documents to witnesses. Normally you do this in a physical space and you have control over what a witness sees. If everything happens remotely, you have to consider how documents will be provided. For example, you could agree with the IT department that documents are automatically deleted after viewing. Also, consider that witnesses may take photos. In this respect you may want to consider blacklining certain parts of the documents in advance.

Decide in advance how to deal with the discipline of employees involved

In the Netherlands in case of a concrete suspicion a suspect can be suspended pending an investigation (with retention of salary). The question is whether this is necessary in a remote environment since the complainant will probably not come into contact with the suspect. An alternative might be to temporarily adjust the reporting lines. Also take into account that a suspension may have an extra impact on the psychological state of suspect, which is already precarious in times of the COVID-19 pandemic. Which measure is considered most appropriate will depend on the circumstances of the case.

Pay extra attention to communication and consider the presence of third parties

In times of the COVID-19 pandemic, many employees suffer from isolation and psychological complaints. Communication is therefore important. Because everyone works from home, there will also be a greater need for a spouse/domestic partner to be present. You are not obliged to agree to this, but it is worth considering as it makes employees feel more supported. However, you should pay extra attention to the confidentiality of the information provided.

Gina Hensen, Loyens & Loeff The Netherlands

A first response to this question can be found in the mechanisms put in place by the Whistleblower Directive itself. It provides that upon receipt of a report from a whistleblower, the designated staff must acknowledge receipt within 7 days. Follow-up steps must then be taken to address the report. These “follow-up” steps are an opportunity to demonstrate that the company handled the whistleblowing report impartially and carried a serious and in-depth internal investigation. If, based on the result of that internal investigation, the company is convinced that the whistleblowing report is ill grounded, it should record all evidence (or lack thereof) in written, in a report that is as detailed as possible. Also, feedback entailing actions or lack thereof must be given within 3 months from the expiry of the 7-day time-limit for acknowledgement of receipt. This feedback should also be taken as an opportunity to show that the suspicions of the whistleblower were seriously investigated but nevertheless considered ungrounded for objective reasons, i.e. for reason that are unrelated to the whistleblower.

If, the company later takes any measure vis-à-vis the whistleblower that could be claimed to be a retaliation measure (e.g. suspension, lay-off, demotion, withholding promotion, etc.), it should make sure that this decision is equally grounded on objective criteria (i.e. totally unrelated to the filing of a whistleblower report) and, to the extent possible, it should collect all available and in-written evidence thereof (e.g. evidence of objective financial difficulties, emails sent to the employee in question to remind him/her of his/her obligations towards the company/colleagues, potential appraisal reports, etc.). The ability to show that the decision was taken based on objective reasons and not as a retaliation means is critical in view of the reversed burden of proof provided in the Whistleblower Directive. For the recall, from the moment that a person can demonstrate that (i) he/she disclosed information (by internal or external reporting or by public disclosure) and that (ii) he/she encountered any act of retaliation, the burden of proof shifts to the natural or legal person responsible for that act or retaliation. Hence, it is for the later to demonstrate justifiable grounds, which it can do by demonstrating that (i) the whistleblower report was considered and handled impartially and seriously and that (ii) the alleged “retaliation” measure was taken for objective reasons, unrelated to the filing of a whistleblower report.

It should also be noted that, pursuant Article 23 of the Whistleblower Directive, Member States shall provide for effective, proportionate and dissuasive penalties applicable in respect of reporting persons where it is established that they knowingly reported or publicly disclosed false information. Member States shall also provide for measures for compensating damage resulting from such reporting or public disclosures in accordance with national law. Based on the implementing provisions which will be adopted by the Member States, the company which is the victim of a malicious use of the whistleblower system may consider filing a civil/criminal legal action.

Clémence Van Muylder, Loyens & Loeff Belgium

Luxembourg law provides a special protection of employees in the fight against corruption, influence peddling and illegal taking of interest. There are specific provisions in the Luxembourg Labour Code to protect employees who inform their superiors or competent authorities about the existence of illegal taking of interest, corruption or abuse of influence. According to article 271-1 of the Labour Code, an employee who has reported such an act in good faith to a superior or the competent authorities or has testified on it, cannot be subject to reprisals by his or her employer and his or her employment agreement cannot be terminated in reason of the whistleblowing.

Any contractual stipulation or act contrary to these provisions, and in particular any termination of the employment contract in violation of these provisions, shall be null and void.

In the event of termination of the employment contract, the employee may request, within fifteen days of notification of the termination, by simple request to the president of the labour court, who shall rule urgently, with the parties heard or duly summoned, to declare the termination of the employment contract null and void and to order that the employee remains in the company, or, where applicable, that the employee is reinstated.

Henri Dupong, Loyens & Loeff Luxembourg

The answer to the question may vary from one jurisdiction to another, depending on the investigatory powers and means recognized to criminal authorities by national law. However, investigating authorities of all jurisdictions are generally well-equipped to secretly infiltrate computer system. Uses of such type of investigating measures were recently reported in the press relating to the dismantling of international criminal organizations (see EncroChat or Sky ECC scandals). However, in view of the invasion of privacy that they entail, such measures are generally limited to investigations on the most serious crimes and subject to strict conditions.

It should also be noted that criminal authorities (or even regulatory bodies) often have the power to request service providers to hand them over information relating to one of their users, which may help investigators to implement more invasive investigative measures vis-à-vis a suspect (e.g. wire-tapping, infiltration into computer systems).

Clémence Van Muylder, Loyens & Loeff Belgium

Luxembourg criminal law does not contain any general provisions obliging a citizen, who has knowledge of a crime, like corruption, to report it, subject however to Article 140 (1) of the Penal Code, which makes it an offence, for anyone who has knowledge of a crime, the effects of which it is still possible to prevent or limit, or whose perpetrators are likely to commit new crimes that could be prevented, not to inform the judicial or administrative authorities.

However, the situation is different for people who work in the public sector or who have a public mission. According to article 23 (2) of the Luxembourg Criminal Procedure Code, any constituted authority, any public officer or civil servant, as well as any employee or agent entrusted with a public service mission, whether hired or mandated by virtue of public or private law provisions, who, in the performance of his or her duties, acquires knowledge of facts likely to constitute a crime or an offence, is required to notify the State Prosecutor without delay and to transmit to this magistrate all information, reports and acts relating thereto, notwithstanding any rule of confidentiality or professional secrecy applicable to him or her.

So, persons who are working in the public sector or are executing a public mission and who observe an act of corruption, must report it to the public authorities.

Henri Dupong, Loyens & Loeff Luxembourg

Switzerland has a blocking statute which may limit the cross-border gathering and transfer of information (art. 271 of the Swiss Penal Code). While the Swiss blocking statute is not per se targeted at internal investigations, it may nevertheless apply in the context of an internal investigation, in particular if the investigation is conducted upon the instruction of a foreign authority or if it is clear that the findings will be reported to a foreign authority. As several other European countries know blocking statutes as well, it is advisable to check with local counsel whether any restrictions to the gathering and transfer of information apply if an investigation has cross-border aspects. 

Robin Moser, Loyens & Loeff Switzerland

If we look at ‘crisis’ in terms of a dawn raid by authorities, a good way to stress test a company would be to organize a dawn raid training for the employees, and, if desired, followed by a (unexpected) mock dawn raid with attorneys acting as the authority officials. During a mock dawn raid, the attorneys will create a formal setting and will ask the questions that authorities would ask as well. They will test relevant employees, such as the receptionist, the contact person and the IT specialist. Afterwards, it can be discussed with the employees how it went; what went well and what could have gone better. A hard-copy dawn raid instruction can be provided to the employees, so that they can use this instruction if a real dawn raid occurs. In our experience a proper dawn raid instruction and training can help management and employees to feel more confident in case of a dawn raid, because they know their obligations and rights. In the past, some of our clients have requested us to include in the dawn raid instruction a high-level overview of the powers that are most used in practice by the relevant authorities, so that they know what to do, ask and/or allow (or not) once the authorities have arrived and the lawyers are not yet present.

Susanne van Breukelen, Loyens & Loeff The Netherlands

It is important to educate and instruct employees (and relevant business relations) adequately on how to act in compliance with the company values and the law. Providing them with periodic training, such as an interactive face-to-face training and/or e-learning, as well as having compliance policies and procedures in place and showing a clear ‘tone at the top’, will result in a ‘culture of compliance’ and will help them understand how to be compliant. Implementing policies with respect to, for example, the authorization of payments, expense declarations, the acceptance of gifts and hospitality, and by maintaining a four eyes principle for transactions with a certain purpose and/or threshold, can help preventing/minimizing (also unwilling or unknowing) fraud. Furthermore, by having a whistle-blower policy in place, you provide the opportunity for employees to report irregularities confidentially if they come up. Other compliance measures can be considered as well, such as submitting a provision on compliance with the relevant laws in the employment.

Susanne van Breukelen, Loyens & Loeff The Netherlands