When employers conduct internal investigations, they always need to process the personal information of employees. If the personal information is processed inappropriately, it may not only result in inapplicable findings and failure of investigations, but also legal liabilities for the illegal processing of personal information. The implementation of the Personal Information Protection Law (“PIPL”) has posed new challenges. In this article, we will discuss the impact of the PIPL on internal investigations and give some advices on potential compliance risks and measures to mitigate these risks.
1. Legal basis for processing personal information in internal investigations
Employers need to process the personal information of employees throughout the entire process of internal investigations, including checking the personal information registration forms submitted by employees at the time of onboarding, asking employees to provide documents and explanations related to the investigations, collecting employees’ working records and making use of the materials provided by whistleblowers. And employers have to process the sensitive personal information of employees under certain circumstances, for example, collecting materials when investigating false sick leave and accessing the bank account details of some employees when investigating corruption and bribery behaviours.
The Article 13 of PIPL provide six legal bases for processing personal information, which are also applicable...
Jared Kushner’s attorney says his legal team has formally put Vanity Fair and its parent company, Condé Nast, on notice over allegations about President Donald Trump’s son-in-law that the lawyer ch...