It has been annual review season here at Squire Patton Boggs.  Looking back over my efforts this year in the usual endeavour to justify my own existence, I have spotted the same scenario cropping up with unusual frequency.  An employee tells their employer that they have experienced something at work that they are not too pleased about.  The employer suggests to the employee that the matter be treated as a grievance and properly investigated.  The employee is horrified and says that they consider the matter highly confidential and, as their anonymity could never be guaranteed, the employer must not investigate.  Instead, the employer should just “keep the information on file”.

Let’s say the matter raised by the employee is an allegation of bullying or sexual harassment by a colleague (a scenario that also crops up reasonably frequently in our practice).  The employer is left with a conundrum:  respect the employee’s wishes and do nothing, thereby allowing an alleged sexual harasser to remain at large in its workplace?  Or press on with an investigation regardless of the complainant employee’s objections, risking their wrath and potential legal claims?

A failure to take action could put the employer on the legal back foot should other employees fall victim to the same alleged perpetrator and questions begin to be asked about who knew what and when.  That is clearly so when the perpetrator’s conduct amounts to discrimination.  An employer will struggle to defend a discrimination claim on the basis that it took reasonable steps to prevent the conduct complained about if it has previously failed to investigate thoroughly and, where merited, take swift action against the harasser.  Society increasingly expects employers to take positive steps to ensure their workers are free from harassment and all other forms of discrimination in the workplace.  That expectation was reflected in law earlier this month when the Worker Protection (Amendment of Equality Act 2010) Act 2023 received Royal Assent (due to come into force in Autumn 2024), imposing a positive obligation on employers to take reasonable steps to prevent sexual harassment in their workplace.  (For more information, our alert is here).  The reputational and legal case for investigating even in the face of the employee’s wishes is therefore strong.

It is perhaps even stronger for businesses operating in the financial services sector.  A “whistleblower” under the FCA Handbook is not limited to someone who meets the traditional definition under 43B of the Employment Rights Act 1996 (i.e. someone who discloses, in the public interest, information that they reasonably believe shows certain prohibited activity taking place including, most broadly, a failure to comply with a legal obligation).  It also includes those who raise concerns about breaches of the firm’s own policies and procedures or behaviour that harms or is likely to harm its reputation or financial well-being.  The FCA’s stance on “non-financial misconduct” (NFM) has caused firms to interpret this widely.  Whilst the FCA’s strong rhetoric on NFM has not been backed up by the kind of clear definitions and guidance that one might hope for, it has long articulated its view that NFM can, through its negative effect on firm culture, damage a firm’s financial well-being and that serious instances of NFM can damage the reputation of a firm and, indeed, the sector as a whole.  That view has most recently been set out in the FCA’s consultation paper on Diversity and inclusion in the financial sector.  The upshot is that, for firms in the financial services sector, complaints that might typically be treated as grievances and only investigated at the request of the complainant might also amount to cases of whistleblowing that the FCA expects them to “assess and escalate” regardless.

However, the strong case for action does not equate to a licence to investigate without risk.  Going to HR is not something most people do lightly, and no amount of reassurance around their right to do so without fear of retribution will actually remove that fear.  Their stated wish for the complaint not to be acted upon is therefore understandable, but it is often not what they actually mean – in fact they do want it acted upon, hence the disclosure, but just not in any way traceable back to them.  A complainant employee, upset by their employer’s decision to investigate (or by the very retaliation or embarrassment that they were hoping to avoid) might consider reporting their employer to the ICO for a breach of their data privacy rights under the UK GDPR.  If they are not deterred by the prospect of bringing a claim in the courts (where failure would likely mean bearing their employer’s legal fees) they might also sue for a breach of their data privacy rights.  That claim is often accompanied by a claim that there has been a misuse of private information.  If the complainant is so affronted by the fact of the investigation that they resign, they might also try a constructive dismissal claim in the Employment Tribunal.  If there is retaliation, the employee may also have a solid victimisation claim, almost regardless of whether the underlying complaint turns out to be justified.

However, an employer’s defence to all these claims will rest, at its heart, on the answers to the same questions including, most importantly, whether the impact that investigating might have on the complainant employee is outweighed by the employer’s own legitimate need to investigate.  That is not to say that each risk does not require careful analysis before an employer decides to proceed, because it does, but simply that they are unlikely to act as a total bar to investigating. 

Before proceeding an employer should take the following steps:

The employer should determine which of the grounds for lawful processing, set out in Article 6(1) of the UK GDPR, it intends to rely on.  If it is relying on the investigation being ‘necessary for its legitimate interests’ then it should conduct and carefully document a ‘legitimate interest assessment’, balancing its own interests against the interests and fundamental rights and freedoms of the employee to ensure that they are not overridden. 

The specific content of the allegations should be considered.  If they are in any way concerned with either the complainant’s or alleged perpetrator’s sex life or sexual orientation, then the employer will be handling special category personal data.  It will then need to determine which of the additional grounds for processing in Article 9(2) UK GDPR it can satisfy.  If the allegations concern a potential criminal offence, then further conditions would need to be satisfied.

Before the investigation is commenced the investigation process and interview questions should be carefully planned to preserve the complainant employee’s anonymity and privacy so far as possible – an employer will not have a legitimate interest for processing data if it could achieve the same result (a reasonable investigation) in a less intrusive way.

The employer should explain to the complainant employee that notwithstanding his/her wish otherwise, it intends to investigate, and why.  It would be well-advised to document that discussion, be seen to consider any sensible representations that the employee makes and adapt its investigation plan accordingly.

Make sure that no inappropriate expectation of privacy is created at the time the disclosure is made by the making of promises of confidentiality the employer can’t keep.  If a promise is made but broken, the constructive dismissal argument becomes much stronger.

Press the complainant to explain what they hope to achieve by the making of a disclosure which the employer is then expressly forbidden to act upon.  What use is the information the employer then holds?  How does the complaint assist the employee in any way?  Pushed on these very practical questions, the complainant may well agree that if anything is to be done, the employer has to be allowed to look into the complaint made.

Consider whose privacy is at stake here.  If A makes a disclosure that B is harassing C, then C’s interests are at least as important as A’s in deciding what the employer should do next, so it would have to seek C’s views.

If the employer does carry out an investigation, it should seek to do so without disclosing the complainant’s name if possible.  However, but it must keep in mind that alleged bullies and harassers have rights too and they include not being penalised for conduct which they have not had a full opportunity to defend themselves against.  Identifying the maker of a complaint of this sort can allow the “accused” to make focussed representations on the motivation and context for it which would otherwise be denied to him/her.

Consider whether it has any requirement to disclose the complaint to any governing or regulatory body, again potentially irrespective of the complainant’s preference.
Employment Law Worldview