Employment Law Investigations: The Investigative and Legal Side

Employment law investigations after suspicions of misconduct in the workplace: how do you approach them, what sanctions do you apply?

By Dennis van der Meer and Lydia Milders (employment lawyer)

Introduction

You suspect that your employee is sharing confidential company data with third parties or is competing unlawfully – what are the research possibilities? And what disciplinary measures do you take prior to, during, and after the investigation?

Employment law investigations form the link between compliance signals about misconduct in the workplace and concrete personnel measures. A report about unauthorized side activities, theft of confidential information, or transgressive behavior ultimately leads to the question: which sanction is appropriate, and does it hold up in a procedure?

In this fifth article in our series Compliance Investigations, we describe how these investigations proceed in practice. Dennis van der Meer highlights the forensic and factual side, while Lydia Milders (Milders law) sets out the legal frameworks and pitfalls. Together, we provide as complete a picture as possible of what HR, compliance, and management must know to allow an employment law investigation to proceed successfully – and which disciplinary measures can be applied.

From signal to employment law investigation

Employment law investigations often start as a logical follow-up to earlier reports: a manager who passes information to competitors, an integrity signal about unauthorized side activities, or a finding that an employee has copied customer data. As soon as the facts are sufficiently concrete, the focus shifts to the individual employee and the employment law consequences.

That transition is not self-evident. A trade-off must be made: is there enough to investigate further, and if so, how deep do you dig? In this regard, two central tensions play a role:

Proportionality versus depth

The investigation must be firm enough to be able to support a possible sanction – from warning to dismissal. But it may not go further than necessary. A too-invasive investigation can be deemed disproportionate, certainly if it appears afterwards that the suspicion was unfounded. The art is to align the research means with the seriousness of the suspicion.

Speed versus diligence

In the case of serious suspicions – for example, of fraud or theft – you want to act quickly to prevent further damage. At the same time, the investigation must be diligent: the employee must be heard, findings must be recorded, and the file must withstand the test of the judge. He who shifts gears too quickly risks an incomplete file; he who waits too long can be blamed for not having intervened adequately.

And the GDPR? Employment law investigations by definition process personal data, so GDPR-awareness is required. In employment law practice, however, this rarely forms an obstacle. Below we go further into that.

The end result of the investigation must in any case be resistant to legal testing. That means: a clear file, a traceable investigation process, and findings that hold stand in a possible procedure at the Subdistrict Court (kantonrechter).

Three typical scenarios

Employment law investigations often revolve around concrete behaviors that damage the employment relationship. Three common situations:

Scenario 1: Unauthorized sharing of company secret and competition-sensitive information

A sales manager is suspected of funneling confidential customer data and pricing information to a new employer. The investigation focuses on the use of an own device for work mail, downloads of CRM data, correspondence with external parties, and possible side activities.

Scenario 2: Dereliction of duty through side activities

A controller runs, alongside his employment, his own consultancy firm in the same industry and advises customers who also work for the employer. It is investigated whether the side position was reported, whether working hours were used for private purposes, whether there is overlap with the customer base, and whether confidential information was leaked.

Scenario 3: Transgressive behavior

Reports about inappropriate remarks, abuse of power, or (sexually) intimidating behavior from a manager toward juniors. Here, the investigation revolves around patterns: are there multiple reporters, WhatsApp groups, witness statements, and HR interviews?

In all these scenarios, privacy questions also play a role. The legal framework for that is addressed further on.

The forensic approach in employment law investigations

Financial investigation and data analysis

In breach of trust cases, investigators check expense claims, travel and accommodation costs, and use of company resources. Data analysis detects unusual patterns in hour registration or claims that point to side activities.

Digital forensic investigation

Mail traffic, chat history, CRM access, and device use are secured. In employment law investigations, forensic imaging of work devices is often essential, but immediately raises privacy questions. Mailboxes at external IT-administrators form a practical problem: without clear agreements, access can cause delay.

In the case of larger volumes, eDiscovery comes into view: WhatsApp groups, Slack channels, and email around incidents are filtered with keyword searches and AI clustering. Privacy infringement is minimized by a focus on work-related data and redaction of private messages.

Interviews and hearing/rebuttal (hoor/wederhoor)

Conversations with the suspect, reporters, and witnesses are crucial, but ask for finesse. The suspect is presented with concrete accusations with hearing and rebuttal. Recordings only with explicit permission.

It is of importance that the accused is presented with accusations as concrete as possible, so that he or she can defend themselves well. That is generally not possible with anonymous reports, unless the report contains sufficiently concrete facts that can be presented without revealing the reporter. Anonymous reports can therefore usually form no independent basis for a person-oriented investigation, but can give cause for a general culture or signals investigation.

Open source investigation

Investigation can be performed in various open sources, whereby among other things side positions, Chamber of Commerce (KvK) registrations, LinkedIn, and media are screened to test statements made.

Legal framework on the basis of scenarios

Violation of confidentiality obligation

Inthe case of suspicions of sharing company secret information with third parties, the contractual confidentiality obligation is usually central. Often, high fines are set on violation. Additionally, good employership (Art. 7:611 Dutch Civil Code) plays a large role: the employee owes loyalty to the employer and may not just share confidential company information with third parties, certainly not with competitors.

The legal route depends on the seriousness of the violation. In the case of proven violation of the confidentiality clause or theft of company data, summary dismissal (Art. 7:677 jo. 7:678 DCC) is obvious, provided the urgency requirement is met. In the case of less serious violations – or when the employer wants to avoid the risk of a failed summary dismissal – he can choose dissolution due to culpable acting (e-ground) or a disrupted employment relationship (g-ground).

The burden of proof lies with the employer. He must demonstrate that the shared information concerns company secrets and that the employee has acted culpably.

Side activities and conflict of interest

Side activities are not by definition prohibited, but are limited by the employment contract, possible side-work clauses, and the doctrine of conflict of interest. Since the Implementation of EU Directive on Transparent and Predictable Working Conditions Act (August 2022), it applies that a side-work clause is only valid if the employer can put forward an objective justification ground. A general prohibition on side-work is therewith no longer tenable.

When side activities lead to conflict of interest – for example because the employee serves customers of the employer via an own enterprise – this can yield dereliction of duty and be ground for dismissal due to culpable acting (e-ground). In serious cases, such as actively competing with the employer or funneling away customers, an urgent reason can even exist.

Transgressivebehaviour

Transgressive behaviour falls under the statutory duty of care of the employer for a safe working environment (Art. 7:658 DCC and the Working Conditions Act). The employer is obliged to take (preventative) measures against unwanted behaviour and must do (or have done) investigation in the case of signals.

The appropriate sanction depends on the seriousness of the behaviour, the context, possible repetition, and the position of those involved. A one-time inappropriate remark generally justifies no dismissal, but structural intimidating behaviour by a manager can justify firm disciplinary measures, including dismissal.

The burden of proof is often complex: it usually concerns contradictory statements – word against word. A diligent investigation with multiple witnesses, documentation of patterns, and application of hearing and rebuttal is essential to be able to take disciplinary measures that also hold stand in law.

Privacy and GDPR

In an internal investigation into fraud or other abuses, privacy always comes around the corner. In employment law practice, however, the impact is usually not too bad. In the case of concrete signals of fraud, conflict of interest, or other serious integrity violations, the employer is generally given a lot of space by the judge to do investigation.

The Supreme Court made this clear already in 2001 in the Wennekes Lederwaren judgment (HR 27 April 2001). An employer had hung up a hidden camera because of a suspicion of embezzlement. The employee appealed to privacy and wanted the images to be left out of consideration. The Supreme Court did not go along with that: the employer had a justified interest, the suspicion was concrete, and the evidence could not be obtained in another way. Even in the case of an infringement on privacy, that does not yet mean that the evidence may not be used.

That line has since then been maintained. In 2014, the Supreme Court formulated the general rule: in civil cases, unlawfully obtained evidence is in principle not excluded. The interest of truth-finding weighs heavier. Evidence exclusion is only an issue in the case of additional circumstances, and that threshold lies high.

The GDPR of course just applies, but does not stand in the way of an investigation. The basis is usually the justified interest of the employer (Art. 6 paragraph 1 sub f GDPR). In fraud cases, that balancing of interests almost always turns out in favour of the employer.

In short: document the investigation well, record the GDPR-basis, and perform the investigation decently. But do not let yourself be paralyzed by privacy concerns if there are serious signals on the table. The chance that a judge keeps the evidence outside the door is – provided the investigation is performed diligently and proportionally – very small.

Suspension as an interim measure

Consider placing the employee on non-active status immediately after the first serious signal, with retention of salary. This gives space for investigation without the employee having access to systems or colleagues, and emphasizes that the employer takes the matter seriously.

The employee can challenge the suspension via preliminary relief proceedings (kort geding). The judge then assesses whether the suspicion is sufficiently concretely substantiated, whether hearing and rebuttal has been applied, whether the measure is proportional, whether the suspension has come about procedurally diligently, whether alternatives have been considered (such as coaching, warning, or a conversation), and whether the employer is not unacceptably anticipating a dismissal procedure.

Dismissal routes: which do you choose when?

The choice between the different dismissal routes depends on the seriousness of the misconduct, the strength of the evidence, and the risk appetite of the employer.

Summary dismissal (urgent reason)

Summary dismissal is the most drastic sanction and requires an urgent reason (Art. 7:677 jo. 7:678 DCC). Examples from the law are theft, embezzlement, threat, and gross insult, but also serious violation of the confidentiality obligation or unlawful competition can yield an urgent reason. The employer must communicate the urgent reason to the employee without delay; this means as quickly as possible after the person authorized to make decisions has become familiar with the facts.

The risk of summary dismissal is considerable: if the judge rules that no urgent reason existed or that it was not acted upon without delay, the employee can have the dismissal annulled. This can lead to reinstatement of the employment agreement with back pay. If the employee does not choose annulment but acquiesces in the dismissal, he can instead make a claim to a fair compensation (billijke vergoeding) which, in the case of an unjustified summary dismissal, is often substantial.

Dissolution due to culpable acting (e-ground)

When the behavior is culpable but possibly insufficiently serious for summary dismissal – or when the employer wants to avoid the risk of a failed summary dismissal – he can choose a dissolution request at the Subdistrict Court due to culpable acting (e-ground, Art. 7:669 paragraph 3 sub e DCC). The judge tests whether the acting or omitting is so culpable that it cannot in reasonableness be required of the employer to let the employment agreement continue. In the case of seriously culpable acting, the judge can rule that no transition payment is due; in the case of “normal” culpable acting, this is due.

In the case of doubt about the seriousness of the misconduct or about the expeditiousness of the investigation, the employer often chooses a dissolution request via the Subdistrict Court: less risk, more procedural certainty.

Cumulation ground (i-ground)

Since 2020, the employer can make an appeal to the cumulation ground (Art. 7:669 paragraph 3 sub i DCC) when there is a combination of circumstances from multiple dismissal grounds that are individually insufficient, but together do justify a dismissal. Upon allocation on the so-called “i-ground,” the judge can award an extra compensation of maximum 50% of the transition payment.

The i-ground is especially useful when the employer has multiple “half” grounds – for example, partly culpable acting and partly a disrupted employment relationship. The disadvantage is the possible extra compensation, but that sometimes outweighs the certainty of dissolution.

Settlement Agreement (VSO)

In practice, a large part of employment law disputes is resolved via a VSO. The strength of the investigation file determines the negotiation position: a watertight file generally leads to a quick VSO on terms favorable to the employer, while a weaker file gives the employee more negotiation space.

Investigation duration and the urgency requirement

An important point of attention in summary dismissal is the tension between investigation duration and the urgency requirement. The employer does not have to act overhastily – a diligent investigation is precisely required to establish the facts well. However, the employer must act expeditiously during the investigation and be able to account for why the investigation took the time that it took.

Concretely this means: document the investigation timeline accurately, avoid unnecessary pauses, and consider suspension as an interim measure. The “without delay” (onverwijldheid) starts to run at the moment that the employer (usually: the person who is authorized for dismissal) has sufficient certainty about the facts. The obtaining of legal advice or the waiting for an investigation report can suspend this term, provided this happens expeditiously.

The hearing of the employee prior to the dismissal is not a statutory requirement, but is strongly recommended. Giving the employee the opportunity to react to the findings strengthens the legal position.

Judges accept investigation periods of several weeks, sometimes even months in complex fraud cases, provided the employer can demonstrate that he acted expeditiously.

From findings to employment law decision

An employment law investigation ends with a report that meets three requirements. Firstly, factual separation: hard facts are separate from interpretation and without legal interpretation (which is reserved for the legal advisors). Secondly, reproducibility: the methodology must be traceable for the Subdistrict Court. Thirdly, privacy-proof: which data was processed, on which basis, and how is it secured?

The report forms the basis for the decision-making of the employer. That decision-making follows a sanction ladder: from written warning, via salary suspension and dismissal with mutual consent, to dismissal via the Subdistrict Court or summary dismissal. The central question is always: is the file strong enough for an urgent reason (summary dismissal) or for culpable behavior (dissolution)? Alternatives such as mediation, redeployment, or temporary adjustment of the function always remain in view.

Trends and points of attention

Professional investigation, prevent paying fair compensation: from much case law it follows that employers drop stitches in (having done) good investigation, and the correct application of hearing and rebuttal. With the consequence that a high fair compensation must be paid to the employee because of seriously culpable behavior of the employer (think of on average 4 – 12 monthly salaries, or more). This emphasizes the importance of a thorough and independent investigation, in the case of suspicions of (serious) misconduct in the workplace.

Whistleblowers Protection Act (Wbk): it occurs that a whistleblower who reports an abuse, himself also becomes subject of investigation – for example because he is suspected of involvement in the reported facts, or because his report is seen as an attempt to mask own misconduct. This yields a particular area of tension. The Wbk protects reporters against disadvantage, but that protection is not absolute: if the reporter himself has acted culpably, the employer can do investigation into that and if necessary impose sanctions. The art is to keep both tracks – the protection of the reporter and the investigation of possible misconduct – procedurally pure and to document well why certain measures are taken.

AI and data-analysis: advanced tools make it possible to detect patterns faster in large datasets, but ask for awareness of the limits.

Hybrid working: the use of private devices and working from home makes the forensic boundaries more difficult to guard and asks for clear agreements beforehand (in code of conduct, handbook etc.).

Forensic readiness remains crucial: logging on, clear IT-contracts, protocols for incidents, and training of key users in data preservation.

Finally

For employment law practice it applies; take the time that is necessary for a sound investigation, but let no gaps fall. Document every step and be able to explain afterwards why the investigation had the lead time that it had. Disciplinary measures (including dismissal) can only be applied after diligent investigation and sound application of hearing and rebuttal, and serve always to be proportional.

Outlook: due diligence investigations

In the sixth article, the focus shifts to due diligence and reputation research: how do you screen external parties before acquisitions, partnerships, or large contracts? Forensic methods, OSINT, and integrity checks come together in a preventative approach.

Get in touch

Dennis van der Meer | +31618948848 | dennis.van.der.meer@compliancechamps.com

Boy Custers | +31649935735 | boy.custers@compliancechamps.com

The Landscape of Compliance Investigations: Employment Law Investigations: The Investigative and Legal Side