Challenge: In America, internal investigations into suspicions and allegations of employee misconduct follow an increasingly well-defined approach. But exporting US investigatory best practices raises unexpected hurdles of foreign workplace laws.

Internal investigations in the US have become high-profile and big business. Corporate investigations can be hugely expensive: One American personal care products company disclosed in an SEC filing that it had spent US$247.3 million on a single investigation. And these investigations can be long and drawn-out: By the time ex-FBI director Louis Freeh wrapped up his thorough internal investigation into child rape allegations at Penn State University, his chief targets were either dead or in prison—Penn State launched its investigation after the scandal broke in late 2011; Joe Paterno died in January 2012; a Pennsylvania jury convicted Jerry Sandusky on 45 counts of child molesting in June; the investigation wrapped up that July.  

The highest-profile internal investigations tend to be complex, drawn-out and expensive. Stakes are high when an allegation involves millions of dollars and serious charges—bribery, sabotage, embezzlement, tax fraud, insider trading, antitrust collusion, workplace violence, environmental crime, audit/accounting fraud, conflict of interests. That said, huge internal investigations are the exception. Most internal investigations tend to be fairly streamlined, inexpensive and fast. Investigations into, for example, run-of-the-mill claims of petty theft, bullying, harassment, workplace accidents and expense-account fraud often get wrapped up quickly and inexpensively. But in this era of Sarbanes-Oxley, Dodd-Frank and close scrutiny into corporate compliance and ethics, an internal investigation, be it slow and expensive or fast and streamlined, needs to get done right. Wrongdoers need to get punished.

Best practices tip: Investigatory tools forged in the US do not always work well abroad. Adapt US investigation practices for the international context. Be sure to comply with foreign workplace laws.

US multinationals conducting cross-border internal investigations inevitably want to export and use their sophisticated toolkit of American investigatory strategies, which they see as vital in confronting a border-crossing criminal prosecution or civil lawsuit such as a charge under extraterritorial US federal laws like the Foreign Corrupt Practices Act, terrorism financing rules, trade sanctions laws, the Alien Tort Claims statute, international-context violations of Sarbanes-Oxley and Dodd-Frank, extraterritorial provisions of US discrimination laws—even the UK Bribery Act 2010 (which can reach US-based employers).

Recent increases in international criminal and civil charges have focused multinationals on the legal challenges to border-crossing internal investigations. Recent conferences and articles (even some books) explicate many of the legal issues in play here. These conferences and articles tend to focus on the US law doctrines reaching US-driven international investigations. Common themes include:

  • Attorney-client privilege abroad as contrasted with the privilege in the US
  • Effect of foreign "blocking statutes" and foreign data protection laws on US litigation "e discovery"
  • Contrasts between the US Foreign Corrupt Practices Act and the UK Bribery Act 2010
  • US bank secrecy laws in the international context
  • "Suspicious activity reports" of infractions committed abroad and "self-reporting" to US government agencies
  • Overseas whistleblower denunciations under the US Dodd-Frank whistleblower "bounty" program and the extraterritorial reach of US Sarbanes-Oxley "report procedure" provisions
  • US "deferred prosecution" and "non-prosecution" agreements in the cross-border context
  • Prosecutorial cooperation among enforcement authorities, parallel criminal proceedings in foreign jurisdictions and cross-jurisdictional settlements of criminal charges
  • Credit for foreign corporate compliance programs under US criminal sentencing guidelines

These issues can be vital when investigating border-crossing charges that implicate US criminal or civil laws and litigation (although these issues are less relevant to an overseas investigation into charges under foreign domestic law with no US exposure). But because these issues are all anchored in US law, these issues are distinct from the separate challenge, in a cross-border or foreign-domestic internal investigation, of complying with the local domestic law of the overseas workplace. Of course, a US multinational conducting a local investigation abroad needs to comply with local host-country law as well as US law. Indeed, US headquarters may have to investigate not only the occasional "extraterritorial" charge under US federal law but also far more common claims under foreign local laws that do not trigger exposure under US laws. These foreign domestic investigations are becoming increasingly common. Companies based in Australia, Canada and England have adopted US-like investigatory practices. In some parts of the world, conducting an internal investigation is actually mandatory in certain contexts. For example, Austria's Supreme Court requires employers to investigate sex harassment complaints (Austria Supreme Court decision 9 ObA 131/11x, Nov. 26, 2012), as do statutes in Chile, Costa Rica, India, Japan, South Africa, Venezuela and elsewhere. The British Columbia Worker's Compensation Act requires employers to conduct immediate investigations into workplace accidents that require medical treatment, as do other workplace safety laws. Because American investigatory tools were forged in the uniquely American environment of employment-at-will, US multinationals exporting and using these tools in overseas investigations run into problems. The law of the US workplace imposes fairly few constraints on how American employers can investigate suspicions of employee wrongdoing (Weingarten rights and Upjohn warnings aside). Overseas, though—especially in Europe—the environment differs greatly. Internal investigations abroad are subject to a panoply of restrictions under the local law and culture of the foreign workplace. A General Electric in-house lawyer, speaking at an American Bar Association conference in Atlanta (November 1, 2012) put it simply: "One of the biggest mistakes an investigator can bring to a foreign investigation is an American mindset." So a US-headquartered multinational conducting an internal investigation across borders needs to retool American-forged investigatory practices for the very different workplace regulatory environment abroad. Because foreign workplace laws that reach internal investigations tend to have no counterpart under US employment-at-will, they often spring up and catch American investigators off-guard. In this particular respect, lawyers and investigators based overseas actually wield an advantage over their US counterparts because they escape the counterproductive "American mindset." A London solicitor addressing American lawyers about internal investigations outside the US explains:

Most corporations that have faced a significant [international] investigation will be familiar with the need to balance the thoroughness of the investigation with the need to respect the [overseas] suspect and the informant's data protection rights. Increasingly we are seeing [overseas employee] suspects and their advisors seek to exercise these rights to slow down or halt an investigation [outside the US]. In at least one case where I have been involved, injunction proceedings were threatened [to stop the US-driven internal investigation]. [J.P. Armstrong, "Anti-Corruption and Bribery Compliance: The U.K. Perspective," NY State Bar Int'l Chapter News, Fall 2012, at 5, 9-10 (emphasis added)]

Having to retrofit investigatory tools for more-regulated overseas environments can frustrate an American investigator reluctant to tamper with effective strategies and unwilling to compromise best investigatory practices. But failing to modify American investigatory practices abroad when necessary threatens a serious consequence: It exposes an investigator himself to a charge of breaking the law. Investigators might get denounced (perhaps over a company whistleblower hotline) for breaking the local law of the workplace if they investigate illegally. Then another investigatory team might have to go investigate the original investigators. Just as no police detective ever wants to face charges of violating suspects' rights in a criminal investigation, no corporate internal investigator ever wants to stand charged with breaking the law. Here is a 30-point checklist for adapting domestic American investigatory practices and tools for overseas investigations. The 30 points fall into the four stages of a thorough American-style internal investigation:  

  1. Launching an international investigation protocol or framework
  2. Initial response to a suspicion or allegation arising abroad
  3. Interviewing witnesses outside the US
  4. Communications, discipline and remedial measures in a cross-border investigation

A. Launching an International Investigation Protocol or Framework Americans like flexibility. As to investigatory practices, Americans are reluctant to lock themselves into formal protocols or frameworks that mandate specific steps for conducting all internal investigations. But overseas, an investigation protocol or framework can be helpful for a number of reasons. An Australian law firm addressing Australian clients about internal investigations explains that "[l]ong before a complaint is made or an incident occurs, there are some steps an employer can take that will make it easier to conduct an [internal] investigation when the need inevitably arises." Harmers Work Insights (Australia), Winter 2012, at p. 9. To pave the way for future internal investigations overseas, take affirmative steps to empower investigation teams that will later look into overseas suspicions or allegations of wrongdoing. Build an investigatory protocol or framework to facilitate a rapid headquarters response.


1. Implement a Code of Conduct: Impose on all affiliate employees worldwide a well-thought-out internal code of conduct or business ethics. In the code, forbid all acts the organization has a compelling business reason to prohibit—insider trading, environmental crime, conflict of interests, bribery/payments violations, intellectual property infractions, audit/accounting impropriety, discrimination/harassment, other offenses. Having drafted, communicated and imposed a tough internal code of conduct becomes essential when an allegation of wrongdoing surfaces later and the organization needs to point to a clear rule that prohibited the alleged misdeed. Without a tough code of conduct, the target may be able to argue he did nothing wrong or even claim he tried to help the organization by, say, paying a bribe or colluding with competitors or cutting corners in disposing of hazardous waste. Be sure both the code of conduct content and the code launch (roll out) comply with local employment law in each affected jurisdiction. See our Global HR Hot Topic for March 2012.

2. Launch a Whistleblower Hotline: In the US, communicating a whistleblower hotline is a clear best practice for eliciting allegations, complaints and denunciations for an employer to investigate and then remedy. By law, US publicly-traded companies and "foreign private issuers" must make available report "procedures" for the "confidential, anonymous submission by employees" of "complaints and concerns regarding questionable accounting or auditing matters." [Sarbanes-Oxley Act of 2002, Pub.L. No. 107-204, at § 301.] Liberia and perhaps other jurisdictions have mandated whistleblower hotlines even at non-publicly traded organizations. Further, the US Dodd-Frank government whistleblower bounty program motivates employers to launch robust international hotlines to attract whistleblower denunciations that might otherwise go straight to US government enforcers.

So launch an effective global whistleblower hotline that complies with applicable laws. Overseas, especially in Europe, regulations specifically regulate whistleblower hotlines and are surprisingly complex—Europeans actively invoke their data protection laws to rein in American-style anonymous hotlines. Germany, the Netherlands and other EU member states require consulting with employees before launching a hotline. Belgium, France, Spain and other EU states require government filings that disclose hotlines—and in some cases a government agency must affirmatively approve a hotline. France, Germany and others confine hotlines to accepting denunciations about only a limited pool of infractions. Spain, Portugal and perhaps France prohibit employers from accepting anonymous whistleblower calls (or at least from disclosing that their hotlines accept anonymous calls; France's data protection authority has flip-flopped on this point). Beyond Europe, in Hong Kong and elsewhere employees may need to consent to a whistleblower hotline. See Donald C. Dowling, Jr., "How to Launch and Operate a Legally-Compliant International Workplace Report Channel," 45 ABA The International Lawyer 903 (2011).

3. Build Channels for Cross-Border Data Exports: A US multinational conducting a cross-border investigation inevitably sends ("exports") back to US headquarters personal information that identifies overseas employees—whistleblowers, targets, witnesses. Data protection (privacy) laws in Europe and parts of Latin America and Asia prohibit exporting employee data without first building data export channels. In Europe these channels are currently "model contractual clauses," "safe harbor," "binding corporate rules" and (in some contexts only) employee consents. (Europe's data protection law regime will change under an incoming EU data protection "regulation" that will replace the 1995 EU data "directive.") Local data protection laws in Belgium, the Netherlands and elsewhere specifically limit cross-border transmissions of workplace accusations, and the Article 29 Working Party (the EU's advisory data protection agency) has considered imposing EU-wide restrictions specifically on exporting investigatory data. So before launching any overseas investigation in a jurisdiction with a comprehensive data protection law, build channels that facilitate the export of internal investigation data or expand any existing channels so they specifically reach internal investigation data. Building and expanding these channels can be slow and expensive, but waiting until a specific allegation or suspicion triggers an actual investigation will be too late. See our Global HR Hot Topic of May 2007.

4. Grant Necessary Data Subject Access: American investigators keep their investigation files confidential, safeguarding the integrity of investigations and protecting witnesses and whistleblowers. Counterintuitively, data protection laws in Europe, Argentina, Canada, Hong Kong, Israel, Japan, Mexico, Uruguay and beyond expressly require "data controllers" such as employers to turn personal data including internal investigation notes, reports and files over to the very investigation targets and witnesses identified in these files, at least if they ask to see the information. This is because in Europe and elsewhere targets and witnesses in internal investigations, as "data subjects," enjoy broad rights to be told investigation files exist in the first place, then to access the files, and ultimately to request deletion or "rectification" of information that names or identifies them. (The employer should redact others' names when showing each witness the file.) In jurisdictions like Hungary, employee rights in this regard are particularly strong. One EU body has decreed that employers must tell investigation targets they are being investigated and that an investigation file exists as soon as there is no substantial risk that notice to the target "would jeopardize" the investigation. [Opinion 1/2006, Article 29 Working Party, 00195/06 WP 117 (Feb. 1, 2006).] This said, though, not all data protection laws are so strict in the investigatory context. The British Columbia (Canada) Personal Information Protection Act, for example, offers an investigatory exception that relieves certain obligations to collect employee consents to processing data.

Having to clue in investigation targets and witnesses about the existence of files naming them while an investigation is in full swing frustrates American investigators. Indeed, some investigators have actually breached data access laws in the name of upholding the integrity and confidentiality of the investigation. Yet again, a rogue investigation that breaches local laws is itself illegal and could itself become the target of denunciations and enforcement proceedings—a scenario every employer needs to avoid. So balance investigatory confidentiality against targets' and witnesses' legal rights to access data about themselves. Strike this balance before a real-world investigation target comes forward and demands access in the heat of a specific investigation. As part of an internal investigation framework, articulate a legitimate business case for delaying employee access until an investigation reaches a stable point. Then grant access requests later, after access becomes legally unavoidable.

5. Disclose Investigation Procedures: Europe and other jurisdictions with robust data protection laws might deem an employer's in-house internal investigation framework or protocol a system for processing personal data, and therefore subject to data laws, even before a specific investigation launches implicating actual personal data about individual employees. Many European jurisdictions affirmatively require that employers disclose, both to the local "Data Protection Authority" and to employee "data subjects," "personal data processing systems" including an investigatory framework. In addition, labor laws in Europe and elsewhere can require disclosing ("informing") in-house investigatory frameworks to employee representatives like "works councils" and "health and safety committees." Labor laws may also require bargaining ("consulting") over these frameworks with employee representatives. To Americans, all this disclosure and consultation over an investigation protocol seems intrusive—American multinationals like keeping their investigatory tactics confidential for the same reasons the Secret Service and the CIA do not broadcast investigatory techniques. But a multinational that "bites the bullet" and discloses the outline of its investigatory framework or protocol both complies with local data protection laws and frees itself up to conduct broader international internal investigations when the need arises later.

B. Initial Response to a Suspicion or Allegation Arising Abroad

International internal investigation protocol/framework in hand, a multinational is ready to investigate any suspicion or whistleblower allegation that comes in from abroad. When one comes in, first decide whether it is investigation-worthy—too many multinationals claim to investigate "all" allegations when in fact many are unworthy of investigating (some are too vague, some are obviously groundless, some, even if true, amount to merely questionable judgment or rude behavior, and some are merely mischaracterized human resources gripes best referred to the HR team). Also be sure upper management will support an investigation, whatever the result—avoid the scenario of an investigation report that strongly points to firing a target whom the ultimate decisionmaker insists on protecting. In conducting an investigation of an investigation-worthy suspicion or allegation, tailor the investigation to the specific allegation and to local laws. Begin with a strategic initial response.

6. Appoint an Investigator or Investigation Team: An employer might conduct a streamlined investigation into a simple allegation using just a single investigator (supervisor, outside expert or lawyer) who checks a few records and asks a few questions. At the other end of the spectrum, a complex internal investigation can be a costly months- or years-long project that requires mobilizing a team of internal executives, experts, human resources leaders and in-house counsel as well as company directors, outside lawyers, accountants, consultants, forensic experts and translators. See Laura Brevetti, "Self Detection: So Key, So Difficult," New York Law Journal, July 13, 2009, at S2. Depending on the complexity of a given overseas investigation, either appoint a single investigator or assemble an investigatory team. Select an investigator or team leader competent in investigatory technique, familiar with applicable law and experienced with how investigations in the jurisdictions at issue differ from US domestic investigations. Avoid appointing an all-star team of Americans expert in US law, US investigatory best practices and US criminal prosecutions but with little experience abroad. Many US-led investigations purposely exclude target-country locals from the investigation team on the theory that locals might be incompetent investigators susceptible to bias, prone to confidentiality leaks, or too likely to fall under the influence of the local target himself. In some contexts these might be legitimate concerns. But where appropriate, consider including at least one local outsider (consultant or outside lawyer) on the investigation team who knows the local players, culture, language, and law.

Be sure no one on the investigation team has a conflict of interests or might be a witness. Include on the team someone with expertise in the subject of the allegation. Consider language fluency. Consider including someone from the internal audit function and an in-house or outside lawyer who can invoke attorney-client privilege (below ¶12). As to outside lawyers, consider tapping investigatory counsel who is not the organization's regular advisory counsel and so is less likely to trigger a lawyer-as-witness conflict.

7. Impose Immediate Discipline if Necessary; Take Interim Steps: Even where a target's guilt seems clear at the outset, employers conducting internal investigations never want to impose discipline until after they complete their investigation. After all, the very purpose of an internal investigation is to find out whether discipline is appropriate. To impose discipline at the outset of an investigation flies in the face of what an investigation is supposed to be. We do not "shoot first and ask questions later." Indeed, to fire even a seriously implicated employee at the launch of an investigation would defeat the purpose of the investigation itself.

This logic seems sound, but it betrays an American mindset. In an overseas investigation, immediately check whether local law imposes an almost-instant discipline deadline. Jurisdictions like Austria impose tight deadlines of only hours or days during which an employer can legally invoke evidence of misbehavior as good-cause support for a firing. In Iraq, an employer firing an employee for cause must notify the Iraqi Labour office within 24 hours of the time of the incident—not 24 hours after an internal investigation winds up. In Belgium, an employee dismissal for good cause "must occur within three working days from the moment the facts are known to the [employer, and then] the facts must be notified to the dismissed [employee] by registered mail within three working days from the date of dismissal." [Carl Bevernage, "Belgium" chap. 3 in International Labor & Employment Laws vol. IA (ABA/BNA 2009), at 3–38.] In these jurisdictions, the "clock" might start as soon as an employer gets solid, credible evidence—not after it formally wraps up a full-blown internal investigation.

Even where local law does not require imposing fast discipline, at the outset of an internal investigation take any necessary interim personnel measures like imposing a suspension (paid or unpaid) or separating an accused harasser from an alleged victim.

8. Define Investigation Scope and Draft an Investigation Plan: An investigation without a well-defined scope can take unpredictable turns. Remember the sharp criticisms Ken Starr drew when his Whitewater investigation abruptly shifted into an investigation of Monica Lewinsky. [Cf. Ken Gormley, The Death of American Virtue: Clinton vs. Starr (2010) at 324-62.] Delineate the investigation's scope. Define its goals and set its boundaries. If a corporate board of directors resolution is necessary to launch the investigation, the resolution should clearly define parameters.

In defining the scope of an overseas investigation, factor in the nature of the allegation and the logistical, linguistic and geographic barriers. In some European states, where a whistleblower allegation is anonymous, the fact of anonymity itself restricts the scope of the investigation—under data protection law in some European jurisdictions, an anonymous tip is per se less credible and hence weaker "probable cause" for conducting a broad internal investigation leading to employee discipline.

In an international investigation, a good practice is to draft an outline or plan of what the investigatory team will and will not do, consistent with the investigation's scope. According to an Australian law firm advising on internal investigations in Australia:  

An investigation plan should be drawn up. Key witnesses should be identified, and persons potentially affected by the investigation should be listed. Practical details, such as location and order of witnesses, should be set out. An outline of the questions to be asked should be drawn up. The objective of the investigation should be noted. [Harmer's Work Insights (Australia), Winter 2012, at p. 11.]  

Any investigative plan of this nature needs to account for data subject access rights in the plan itself (above ¶ 4). If the investigatory plan can somehow avoid identifying the whistleblower, target and witnesses, then the plan will not be subject to data law disclosure.

9. Comply with Investigatory Procedure Laws: Under American law, a nongovernment employer's internal investigation for the most part is a business matter, not a matter of criminal procedure, because there is no "state action." Not so everywhere abroad. In some jurisdictions in Eastern Europe and beyond, local criminal procedure laws can restrict, even prohibit, private parties such as non-government employers from conducting an investigation—the theory is that private parties cannot intrude on the exclusive investigatory power of government law enforcement. In other countries, bar association rules may limit or prohibit lawyers (even American lawyers not on the local bar) from conducting internal investigations—especially but not exclusively if the investigator needs someone to administer an oath, such as for an affidavit or deposition. Before embarking on any cross-border internal investigation, research local procedural rules restricting private-party and lawyer-led investigations. Adapt the investigation to conform. Sometimes it might be enough to recharacterize an internal investigation as mere "analysis," "checking," "verifying" or "asking questions" (below ¶ 19).

In some contexts it might be possible to conduct the investigation outside the territorial reach of local restrictions against private investigations.

Separately, comply with local laws that require disclosing evidence to law enforcement (below ¶ 28). And comply with local laws that restrict specific steps within an internal investigation, such as laws regulating: how to conduct searches of employee emails/computers/internet records (below ¶ 17); physical searches of lockers and desks; criminal background checking; video surveillance; and intercepting phone calls.

10. Research Substantive Law: The purpose of an internal investigation is to uncover evidence of wrongdoing or illegality. So always ask: Is the alleged behavior wrong or illegal? Violating an organization's internal policies is wrong; violating applicable law is illegal. So check internal policies and then ask: What is applicable law? In overseas investigations, US investigators sometimes get consumed by US laws with extraterritorial effect—US trade sanctions laws; US antitrust, securities and discrimination laws; the Foreign Corrupt Practices Act; the Alien Tort Claims Act. Yes, these US laws are "applicable law" abroad to the extent they reach extraterritorially. But never forget local substantive laws. For example, a US organization's international bribery investigation should of course investigate possible breach of the US FCPA and maybe the UK Bribery Act 2010. But do not forget to check for a breach of local domestic bribery laws. For example, one "American businessman" found "guilty of taking nearly US$5.5 million in bribes as head of [a] Dubai-based company" was sentenced to 15 years in a UAE prison, even as the US government sought to defend him." [US Businessman Gets 15 years in Dubai Fraud Cases, Miami Herald, Mar. 25, 2013.]

Similarly, in an international investigation into audit/accounting fraud under SOX and Dodd-Frank, check whether the target violated local audit/accounting mandates.

11. Safeguard Confidentiality: To guard against data privacy and defamation claims, and to avoid human resources and public relations problems, contain investigation-uncovered information to those with an actual need to know—the investigation team, retained experts, auditors, counsel, upper management, maybe the board of directors. Resist the temptation to keep too wide a circle informed as the investigation proceeds. (Whom to brief about the results of an investigation at the end is a separate issue, below ¶ 25.) Also, transmit investigation data back to US headquarters only pursuant to local legal restrictions on data exports (above ¶ 3).

Unless a self-identified whistleblower expressly consents otherwise, overseas data protection laws may in theory mandate preserving whistleblower confidentiality. But in practice, maintaining whistleblower (and witness) confidentiality can be a tough challenge where circumstances point to a source and where the whistleblower becomes a complaining witness. This is virtually inevitable with a harassment complaint. A best practice is never to guarantee whistleblowers or witnesses absolute confidentiality.

12. Secure Legal Advice and Attorney-Client Privilege: A Canadian law firm recommends, as to Canadian internal investigations: "Give some the very beginning of the process…as to whether you wish the investigation process, report and surrounding communications to be privileged. It is much easier to attempt to set this up at the beginning of the [investigation] than mid-way through." [Rubin Thomlinson LLP (Toronto), Workplace Investigation Alert #14 (Aug. 2012).] While the attorney-client privilege can be vital in an internal investigation, discovery is far less robust abroad, so overseas attacks on the attorney-client privilege may be less frequent. But foreign government agents do seek documents from private parties, and a foreign privilege issue may arise in a US proceeding. So preserving attorney-client privilege in an overseas investigation can be vital.

Decide who will advise the investigation team on applicable law in relevant jurisdictions. Account for lawyer-as-witness and legal privilege issues including any foreign law analogue for the US domestic investigatory-context privilege. (For discussions of this US domestic investigatory-context privilege, see L. Krigten, "Waiver of Attorney-Client Privilege to Protect the Company," Nat'l Law Journal, Nov. 22, 2012 at 16 and J. Nathanson, "Walking the Privilege Line," New York Law Journal, July 13, 2009, at S8.) Understand whether lawyers on the investigation team can implicate the attorney-client privilege under applicable law. Depending on the jurisdiction, the local privilege may reach locally licensed outside law firm counsel and maybe locally licensed in-house counsel—although jurisdictions like China may not recognize any attorney-client privilege. Always check whether a jurisdiction extends its attorney-client privilege to foreign (such as US) lawyers not on the local bar. Never assume a US-licensed lawyer falls under a foreign-law attorney-client privilege.

Privilege issues are much less settled in most jurisdictions outside the common law world. In some jurisdictions the privilege belongs to the lawyer, not the client. Some European Union member states recognize a rudimentary in-house counsel privilege, but there is no European-wide doctrine protecting in-house counsel with attorney-client privilege. [Akzo-Nobel, ECJ case c-550/07P (9/14/10).] Hungary, for example, recognizes no viable in-house lawyer privilege, and in France lawyers who go in-house must resign from the bar, therefore surrendering any claim to privilege. A broad overview published in Inside Counsel (12/07, p. 50) lists the "EU member states that recognize privilege for the in-house bar" as including "Denmark, Germany, Ireland, Luxembourg, Netherlands, Portugal, Romania, Spain, UK,"—but the Akzo Nobel case seems inconsistent as to the Netherlands, so Inside Counsel's list seems wrong. Always check.

13. Account for US Government Enforcement Issues: Increasingly, American multinationals launch cross-border internal corporate investigations responding to inquiries or enforcement actions from US agencies such as the Department of Justice [DOJ], the Securities Exchange Commission [SEC] and (potentially) the Equal Employment Opportunities Commission. Internal investigations responding to US government inquiries and proceedings raise unique issues of government-context attorney-client privilege waiver and advancing defense fees. The US government has taken formal but changing positions here: Compare the SEC Seaboard Report and the DOJ McNulty Memorandum that replaced the DOJ Thompson Memorandum and the McCallum Memorandum, later withdrawn. Government context privilege waiver and defense fee issues outside the US get even more complex; indeed, the various US government positions and memos here have been criticized to the extent they are said to ignore issues under foreign law. Proceed carefully.

14. Safeguard Disclosures to and from Experts: Always have retained outside experts (including forensic accountant, forensic computer specialist, investigation consultant, e-discovery provider, translator) contractually commit to uphold confidentiality and applicable data laws. Safeguard the attorney-client privilege over disclosures to experts (above ¶ 12). In Europe and other jurisdictions with robust data laws, an expert's report that identifies specific individuals may be subject to witness disclosure, even to the investigation target (above ¶ 4). Proceed carefully.

15. Impose an Enforceable Litigation Hold: "Spoliation" claims (destruction of documents relevant to litigation) are increasingly common in US domestic lawsuits. A strong best practice is to require that employees, worldwide, preserve data possibly relevant to a cross-border investigation at least until the investigation and any litigation wind down. During investigations, multinationals often order staff, across borders, to suspend routine data destruction practices like automatic email deletion and document-destruction policies. Software exists for implementing and enforcing these internal document retention orders, often called "litigation holds" or "DRNs" (document retention notices). Outside the US, litigation holds/DRNs are equally important but are less routine and so are less familiar. Fortunately, an overseas litigation hold/DRN rarely raises high legal hurdles, but better explanations and better enforcement become important in countries where these holds are unfamiliar. That said, in Europe and beyond an overbroad litigation hold/DRN in place too long butts into the data protection law prohibition against retaining obsolete personal information. In jurisdictions that require purging obsolete personal data, be sure to articulate a defensible business rationale for any long-term litigation hold. Review the need for the hold frequently.

16. Secure Evidence Within Management's Physical Custody: Actively collect and preserve documents and electronic files relevant to the investigation that management can readily get its hands on without breaking into employee-held files and systems. Data laws in Argentina, Canada, Costa Rica, Europe, Hong Kong, Israel, Japan, Mexico, Uruguay and elsewhere may prohibit management from "processing" for investigatory purposes even information already in company files unless the reasons the data had originally been collected expressly included "investigatory purposes"—which too often will not be the case. Therefore (as discussed above ¶ 5), when structuring HR data processing and export systems, be sure expressly to include "processing/storing personal data and documents for internal investigatory purposes" as an express reason for processing. And because data laws can restrict "exporting" personal data to the US, consider warehousing investigatory information locally without transmitting it stateside (unless appropriate data export channels are in place—above ¶ 3).

17. Gather Evidence Outside Management's Physical Custody: Perhaps the highest legal hurdle in international investigations is gathering up employee documents and data not yet in management's readily-accessible files—emails on the company server, internet-use records, Word documents on an employee's hard-drive, papers in an employee's desk. Staff in Europe and elsewhere may firmly believe that their personal business records, even though warehoused on company systems and on company property, are completely off-limits to their employer. And perhaps surprisingly, foreign local data protection laws may support this view even if the employer had issued a US-style policy purporting to reserve its right to search and (ostensibly) defeating employee expectations of privacy in company systems. Employer reservation-of-right-tosearch policies are as vital internationally as they are stateside, but American headquarters should not "believe its own PR" and assume its purported reservation of the right to search works overseas the same way it works stateside. Abroad, reservation-of-right-to-search policies may be a mere first step in analyzing whether, or how, the employer can legally access staff emails/internet records/documents.

Understanding when and how foreign law lets employers conduct these searches is a research project unto itself. Do a country-by-country analysis in light of the specific facts. In Continental European jurisdictions like Austria, Italy, Germany and Poland, a key issue in this analysis will be whether the employer had previously forbidden local staff from using company-owned computers/systems for even incidental personal use. In other countries a key issue will be whether employees grant "unambiguous," situation-specific consents to search, especially in the "bring your own device" [BYOD] context.

Even where an employer purportedly reserved its "right" to access employee emails/internet use/documents, always get tailored advice under foreign law before actually searching and before ordering polygraphs or drug tests, before launching surveillance tools or video monitoring, before surreptitiously monitoring employees in other ways and before invoking employer-favorable terms in a BYOD policy. Local laws on these issues can be unpredictable. In France, for example, an employer must bring in a court officer or bailiff to oversee its accessing of staff files and documents.

C. Interviewing Witnesses Outside the US

After securing documents, the time comes to interview witnesses. Work out a strategic order for interviews, such as accuse then witnesses then target. In conducting each interview, factor in overseas cultural and strategic issues. During interviews, comply with local workplace laws (employment laws and employment-context data protection laws).

18. Verify Sources: When interviewing a whistleblower or complainant, check whether the accuser will stand by the accusations. Firm up the source of the allegations and seek corroborating evidence and witnesses. As mentioned (above ¶ 8), under law in Europe an investigation into an anonymous whistleblower tip cannot plow as deep as an investigation into a tip from a verified source. So where channels to an anonymous overseas whistleblower remain open, try to get him to self-identify.

19. Neutralize or "Demilitarize" Interrogations: Sometimes an American interrogating an overseas employee conveys an air of professionalism and authority that may prove counterproductive and culturally inappropriate. The witness might "clam up." Consider neutralizing the international interrogation process by "demilitarizing" witness interviews, coaxing out better information with a softer touch. For example, an internal investigator's background as a former prosecutor enhances credibility stateside but overseas might be offputting—foreign witnesses actually have alleged harassment when an interrogator introduced himself as an American ex-prosecutor and played up criminal law themes. American witnesses may respect police authority, but abroad, downplaying prosecutorial credentials and criminal issues may help open up a foreign witness.

During overseas employee questioning, actively neutralize the semantics of the interrogation itself. Investigators might refer to their internal investigation and their interrogations as merely "some questions," "talks," "checking" or "verifying." They might refer to an allegation, suspicion, complaint or denunciation as merely an "issue" or "question." Documentary evidence and proof can be mere "papers" or "files." Call whistleblowers, informants, sources and witnesses simply "employees" (those not on the payroll are "business partners"). Call the target of an investigation "our colleague." And an investigator zeroing in on a confession can request a mere "affirmation" or "acknowledgement."

When conducting staff interviews, always be sensitive to local conceptions of privacy. Outside the US, the Ken Starr/Monica Lewinsky investigation shocked foreigners—a sitting US president actually had to answer a private lawyer's questions about his sexual life (foreigners often do not understand US civil procedure and deposition testimony subject to the felony of perjury). Outside the US, expect staff actually to believe they have a right to refuse to answer questions about their sex lives, hobbies, workplace friendships and personal notes, documents, emails and social media postings. In investigatory interviews abroad, show sensitivity for this viewpoint.

20. Instruct Witnesses to Cooperate, as Permissible: An American investigator ghost writing an employers' staff memo announcing an internal investigation might announce that all employees "must cooperate" with the internal investigation. And American investigators like to begin employee questioning by insisting that each witness "must cooperate." We get away with this in the United States because this approach works under US employment-at-will.

But this can backfire abroad. Almost universally outside the United States, foreign laws let employees refuse to cooperate with an employer investigation. Most overseas employees enjoy a labor-law right to remain silent roughly analogous to the American Fifth Amendment in the police-investigation context. Americans may think they have "good cause" to fire an employee for refusing to cooperate in an internal company investigation, but little if any authority abroad supports this view. Indeed, whistleblowing rules in Europe actually forbid employers from unilaterally imposing mandatory reporting rules, such as in codes of conduct, to force witnesses to disclose incriminatory information about their co-workers (above, ¶ 2). An employer order (as opposed to request) to "cooperate" with an internal investigation likely triggers the same legal concerns and so is an impermissible mandatory reporting rule. The lesson: Investigators should speak accurately and think carefully before requiring overseas employees to cooperate in internal investigations or investigatory interviews.

21. Comply with Consultation and Representation Rules: Labor laws in many jurisdictions (France, for example) require consulting with employee representatives before launching a slate of staff interviews. American investigators who bust into an overseas workplace and question workers without any advance word to their local labor representative (union committee or works counsel) fall into a legal trap. A separate but related issue is foreign local Weingarten rights (cf. NLRB v. Weingarten, Inc., 420 US 251 (1975)). In jurisdictions including the US, to interrogate a specific employee witness implicated in an allegation without first notifying his labor representative is an unfair labor practice (just as a lawyer interrogating a witness known to be represented by counsel without first telling that employee's representative breaches ethics rules). Be sure to respect mandatory interview-context consultation and representation rights.

22. Notify Target and Witness of Their Rights: Americans expect police to read criminal suspects their Miranda rights. But in the non-government American employer investigation context an employee witness enjoys few if any affirmative rights (beyond Weingarten, above ¶ 21, and Upjohn, below ¶ 23). Not so abroad. Employees in many countries enjoy robust procedural rights in the workplace investigation context. One sweeping right, in Europe, is the right to be told precisely what your other investigatory rights are. Even in countries outside Europe where local law does not force internal investigators to brief witnesses on their rights, local best practices may be to begin an investigatory interrogation by advising each witness that he enjoys due process protections. Australian lawyers, for example, recommend this. [Harmer's Work Insights, Winter 2012, at p. 9, 11.] Further, data law in Europe and elsewhere requires telling targets and witnesses about internal investigation notes and files that identify them, and then requires offering targets and witnesses limited access to these files and a right to "correct" them (above, ¶ 4)—even while the internal investigation is still pending. This obviously conflicts with the investigatory best practice of keeping evolving investigations strictly confidential. Strike a balance to comply with legal mandates. Genuinely "anonymizing" names and identities in investigation files eliminates the data-law disclosure obligation here. But in the context of an active investigation, anonymizing is rarely practical.

23. Give Upjohn Warnings, Demand Witness Confidentiality, and Conduct Interviews Legally: A lawyer interviewing domestic American employee witnesses in an internal investigation should always give so-called Upjohn warnings (Upjohn v. US, 449 US 383 (1981)) telling each staff witness that the investigator represents the employer and may be covered by confidentiality obligations and attorney-client privilege, and explaining that the employer might waive its privilege and offer up interview information to third parties including law enforcement. See Robert Jossen & Neil Steiner, "The Upjohn Pitfalls of Internal Investigations," New York Law Journal, July 13, 2009, at S4. As US domestic law, Upjohn is not authoritative abroad, but giving Upjohn-style warnings is a clear best practice worldwide.

Beyond Upjohn, internal investigators should always warn overseas employee witnesses to keep the interrogation and investigation strictly confidential, not discuss it with other workers. Indeed, to let a (foreign) witness talk about a pending internal investigation could actually violate overseas data protection laws. However, American investigators have recently become reluctant to demand witness confidentiality because, as of 2012, demanding confidentiality in domestic US investigatory interviews risks violating American labor law as an impermissible restriction on "protected concerted activity." See Banner Health System, 358 NLRB No. 93 (2012), questioned by Canning v. NLRB, case no. 12-1115 (D.C. Cir. 2013). Therefore, as of 2012, many American investigators stopped demanding confidentiality of stateside investigatory witnesses. But this issue is confined to US soil. The American "protected concerted activity" doctrine is all but unknown abroad—even in Canada. Banner Health raises a purely domestic US issue; multinationals should always impose a confidentiality mandate on overseas witnesses.

Upjohn warnings and the Banner Health System confidentiality issue aside, be sure to conduct overseas investigatory interviews legally, complying with local laws. Be careful debriefing employees as to what they may have told local police in criminal-context interviews—some jurisdictions prohibit this line of questioning. When electronically recording staff interviews, get recording consents from witnesses that comply with local law (in writing as necessary).

D. Communications, Discipline and Remedial Measures in a Cross-Border Investigation

After collecting documents and conducting investigatory interviews in an internal investigation, what had been an information-gathering process becomes active decisionmaking. Decide on the investigation findings. Address discipline and remedial measures. Take these steps consistent with investigation findings and with applicable employment, data protection and criminal laws. Memorialize, preserve and report on investigation results.

24. Involve the Audit Function and Comply with FCPA Accounting Rules: Where an investigation uncovered financial impropriety, money losses or bribery/improper payments, tackle the accounting and financial-statement issues. Comply with US Foreign Corrupt Practices Act accounting (payment-disclosure-reporting) rules as well as SOX accounting mandates and foreign Generally Accepted Accounting Principles. Financial losses at an overseas affiliate reach the "bottom line" of a US parent, so at a publicly traded multinational an overseas investigation might implicate US securities mandates and auditing/accounting disclosures. Manage strategy with inside and outside auditors. Involve the audit function. Implement auditor/accountant recommendations.

25. Report to Upper Management: Consider the pros and cons of delivering an oral versus written report to upper management detailing investigation findings. Keep in mind data subject rights of access to a final written report and restrictions on "exporting" investigation data (above ¶ 3). Data protection laws and privilege rules may weigh against a written report. Draft any report carefully with findings of fact grounded in evidence. Refrain from declaring anyone guilty of a crime (internal investigators are powerless to declare guilt in any criminal justice system). And limit the circle of upper management receiving an investigatory report to those with a demonstrable need to know.

26. Impose Post-Investigatory Discipline: Where an investigation uncovers solid evidence of wrongdoing (and where the employer did not already take action at the beginning of the investigation, above ¶ 7), impose discipline consistent with investigation findings and upper management buy-in. If the investigation exposed enough evidence to dismiss the suspect for good cause under local law, structure the dismissal as for good cause. See our Global HR Hot Topic of February 2013. But sometimes an investigation uncovers enough evidence of wrongdoing to convince an employer to dismiss the target but not enough evidence to support a good-cause dismissal under tough local employment laws. In those situations the employer (where legal) might decide to dismiss the target for no good cause, paying notice and severance pay.

In dismissing a guilty target (whether or not for good cause), follow local-law dismissal procedures. Chad, France, UK and many other countries impose detailed dismissal procedures on employers firing even obviously-culpable staff. When disciplining a witness, whistleblower or target who had lodged a workplace complaint, comply with anti-retaliation law, such as the laws in Europe that prohibit "victimising" whistleblowers. (US anti-retaliation prohibitions are particularly strict, but most court decisions construing the extraterritorial reach of US retaliation law tend to confine these rules to US citizens or residents.)

27. Ensure Internal and External Communications Comply: With confidentiality paramount in internal investigations, a multinational might prefer to keep its investigation results under wraps. But in the real world, especially in high-profile cases, internal and even external communications can be necessary: Employees may demand to know what happened, and word of some internal allegations may inevitably make the newspaper

As to post-investigation reporting, a good practice is to close the loop with the original whistleblower (where that channel is open)—tell him what the investigators found out and what the employer will do about it. In internal and external reporting about an investigation, be alert to defamation and tortious invasion of privacy claims. Ensure that mentions of the investigation and the fate of the target are defensible. Heed applicable data-law restrictions against disclosing and exporting personal information.

28. Disclose to Authorities Appropriately: Consider turning over to local police or enforcement authorities investigationuncovered evidence of criminal acts, especially where local or US law imposes a self-reporting obligation. However, absent a valid court order, data protection law in some jurisdictions actually restricts an employer's freedom to volunteer, even to government law enforcers, personal information learned in an investigation. Reporting to police could also raise an employment law challenge—fired staff in some jurisdictions can actually argue that a police denunciation amounts to additional, illegal employer discipline: Under local employment law, a dismissal may be legal but a denunciation to police may be excessive. On the other hand, local law in other jurisdictions actively requires denunciations to local police. Slovakia, for example, requires that parties including employers with knowledge of a criminal act notify authorities (Slovak Crim. Code no. 300/2006) and New South Wales (Australia) requires parties including employers with evidence about a "serious indictable offence" report that to local police. Heed these laws.

29. Implement Appropriate Remedial Measures: Implement remedial measures—steps to prevent the problem from recurring, such as new work rules and new tools for oversight, security, monitoring and surveillance. Be sure new measures comply with substantive law, such as data protection rules that restrict employee monitoring: Overseas, an employer cannot always unilaterally start video or computer monitoring, for example, without employee consent. (For that matter, this is also the rule in the US union context. Cf. Brewers v. Anheuser-Busch, 414 F.3d 36 (D.C. Cir. 2005).)

Also comply with procedural rules. Overseas, collective labor representation laws as well as vested/acquired rights concepts restrict an employer from tightening terms and conditions of employment (such as by imposing unpopular new remedial measures) without first consulting with employee representatives.

30. Preserve Investigation Data Appropriately: Preserve the investigation file (notes, interview transcripts, expert reports, summary report) consistent with applicable law and investigatory best practices. In America, the best practice here is simple: "The details of every investigation should be memorialized in writing, regardless of the findings, including a description of the allegation, the steps taken to investigate it, factual findings and legal conclusions, and any resultant disciplinary or remedial actions"—of course, the employer then retains that "writing" in case it may be needed later. [S. Folsom, V. McKenney & P.F. Speice Jr, "Preparing for a Foreign Corrupt Practices Act Investigation," ABA International Law News, Winter 2013 at p. 6.] Even where an investigation finds no probable cause, investigation records will be invaluable if a similar allegation later arises among the same suspects.

But this best practice of retaining investigation documents can be flatly illegal abroad. In some jurisdictions, investigatory file preservation conflicts with the data-law duty to purge obsolete personal information that there is no compelling business case to retain. Of course, any American multinational can articulate a business case for retaining investigation records indefinitely. The problem is that data protection authorities, at least in parts of Europe, will reject that argument as spurious. This can mean destroying or completely anonymizing an investigation file (including even an unanonymized summary report) surprisingly soon after an investigation ends—within two months, under one influential EU recommendation, particularly where the investigation did not lead to discipline (Opinion 1/2006, supra ¶ 4).

That said, an employer might be able to justify retaining an investigation file until any relevant statute of limitations runs. One tactic, probably not strictly compliant, is to export investigation data files outside those jurisdictions that impose strict duties to purge, maintaining the files (or copies) offshore, such as in the United States.