Hello and welcome to the webinar today with Quimbee. This is launching and leading a cross-border internal investigation, strategies for probing allegations of wrongdoing across corporate operations worldwide. I'm Don Dowling. I'm a shareholder at Littler, the international law firm. And let me give you a little background on me just because, because we're talking about employment issues and I think it'll be helpful for you to understand where I'm coming from and I guess where I'm not coming from. I'm at a big law firm. It's actually the biggest boutique law firm that handles only labor employment law and we advise only employers. So I'll be speaking very much from an employer standpoint on conducting internal investigations as opposed to, I suppose, a claimant or employee standpoint. And my practice is exclusively advising multinationals on their cross-border operations, usually multinationals headquartered in the US. So I guess my, the reason I'm trying to make this clear front is I'm assuming that, that the listeners will be, have that same context or orientation that we're talking about a multinational company, maybe not necessarily, but probably a US headquartered company that's a multinational and by definition a multinational as operations and therefore employees outside the US. And we'll be talking about doing an internal investigation driven by US headquarters, but with aspects to the investigation that come up outside the US. So we'll be talking about the outside US pieces to an internal investigation at a multinational where the multinational is used to doing US domestic investigations, but now there's issues coming up in Brazil or France or, or Japan or some other country outside the US or maybe a bunch of countries at the same time. And so we're taking that US mindset on how we conduct internal investigations and I'll be talking today about the legal issues and, and traps and strategies and cautionary tales I guess, that come up overseas. Here's a roadmap or kind of a table of contents of what I wanna talk about today. First, I'll talk about the context of five elements in responding to a suspected breach of workplace rules because there's lots of, because an internal investigation comes up in as part of looking into something that might have gone wrong. And there there's different issues around how you get suspicions or allegations or wrongdoing and, and how you treat people as far as discipline and what you do after the investigation's over. And I just wanna separate all those issues out. There's five elements and you'll see on the next slide, the investigation is one of those five, but the other four are related, but not, they're not things we're talking about today. 'Cuz today we're talking about the investigations. Then we'll talk up just one quick slide on internal investigation processes, exporting US best practices. Again, I'll just do a little deeper dive in what I just mentioned is what I think is the context here, which is a US headquartered multinational that's used to doing US domestic internal investigations and is exporting them and maybe doing an investigation now in another country, and there might, you might need to change your mindset a little bit on that. So we'll just talk about almost just the process or the framework for doing an investigation outside the US. Then we'll do conceptual or strategic approaches to internal investigations outside the US and and ways you should reorient perhaps your approach outside the US. Then the next two sections. Four and five go together I suppose. One is cross border investigations as opposed to foreign local. And the other is foreign local investigations as opposed to cross border. We'll do a deeper dive on that. But a foreign local investigation would be an investigation just in one overseas country. Let's say something in Brazil, you're investigating something in Brazil and it's a Brazil issue, Brazil investigation period. A cross border investigation is one that involves a number of countries at the same time, maybe including the US headquarters and the foreign country and maybe other countries as well. Then we'll talk about American investigatory procedure law issues in the international context. And there I'm gonna take the issues that we, that Americans are always asking about. The lead one for example, will be attorney client privilege, something you don't hear, foreign lawyers, especially in civil law countries raising as quickly or as urgently when they do their foreign investigations. And we'll talk about why some of these issues that are very important in internal investigations in the US are treated differently under law in other countries. Then we'll talk about laws worldwide that regulate internal investigations specifically. Sometimes somebody's saying, Hey, we're doing an internal investigation in Germany. Are we allowed to do that? What does the law say? Do we have to do an internal investigation in Germany? What does German law say about how we do an internal investigation? We'll talk about that generally around all, all the countries of course we're talking about internationally all at the same time. And then lastly, we'll talk about data protection, law compliance and internal investigations. Because GDPR in Europe and other omnibus or data protection laws affect internal investigations very directly and will have that final section on that. Okay, so with that, let me do this bit on context and where internal investigations fit. When you're responding to a suspected breach of a workplace rule outside the US. One is you need to have a rule. If you're going to do an investigation, you're gonna be investigating something that somebody may have broken a rule, it may have been a work rule, may have been a law, but they must have broken something. If someone just tells you some casual fact about somebody and what their hobbies are, you're not gonna do an investigation there. But if someone tells you that someone in one of your outside US workplaces is committing insider trading or has a conflict of interest or something, you'll do an investigation there. So the first thing is laying down more or at least understanding what the rules are that you would be investigating. And that would mean thinking about having, and it's probably a best practice to have an internal global rule book, which would be a global code of conduct or certain policies your company might decide need to be addressed globally. Like a good example would be bribery policies, right? Because if you're a US headquartered multinational, you have to comply with the Foreign Corrupt Practices Act which regulates bribery outside the US. So it's a very strong best practice to have a global work rule on bribery and improper payments. That would be an example of a specific global HR policy. One on bribery and improper payments. You might have a code of conduct that's essentially a clear in house for lots of global policies on improper payments and on insider trading and conflicts of interest discrimination and harassment and other social media, other issues that come up in the workplace. But the point is just that you, you need the rule first because if you're gonna investigate somebody violating your social media policy, you need first to have promulgated a social media policy that reaches people overseas. 'Cuz we're talking about the international countries. Also there are foreign local work rules. For example, two examples are Korea and France, are countries that require by law employers at least those over about 10 employees or so to have a list of internal work rules. And that you have to issue that list if you ever fire someone or discipline someone for cause it has, you have to be able to point to what rule they violated. If you don't have the rules, you're violating the law. So you might have a situation where someone in France is alleged or is suspected to have broken one of your French work rules. But that would be another example of work rules that you would've promulgated first. Then there's just the law obviously whether or not you have a work rule or an internal rule on some topic. If something is against the law then you, you'd investigate the breach, a suspected breach of the law, a law against sex harassment for example, or a law against insider trading. And when we talk about what are the laws that affect your employees and workforces outside the US there's US extraterritorial laws. I already gave the example of the Foreign Corrupt Practices Act, that's a US law that regulates conduct outside the US. In fact, if you bribe someone in the US you can't violate the US Foreign Corrupt Practice Act because it only applies outside the US but it's a US law nonetheless a US extra territorial reaching law. There's also of course, foreign local law sticking with bribery. If somebody's in Egypt or Jordan and alleged of bribe to government official, that might, if the bribe happened might violate the foreign corrupt private Act, but it might also violate a local Egyptian or a local Jordanian law. Then there's employment law versus employees violating non-employment laws. And by that I'm just pointing out that in the internal investigation context, it's inherently an employment related activity 'cuz you're looking at the activities of your employees outside, you're doing an investigation asking your employees, and I guess we could say independent contractors, but for these purposes, including them as your staff, you're asking questions and you're investigating actions that happened in the past by your staff. You're doing an internal investigation looking at documents of your employees, looking at employee emails, talking to or interviewing employees. But what you're investigating may or may not be an employment law. If you're investigating an allegation of sex harassment, that would be an employment law 'cuz laws against sex harassment are employment law. But if you're investigating an allegation of insider trading, insider trading is a securities law. It has nothing to do with employment, right? It's a securities law, a law about trading stock. But the point is just that although you're may be investigating an allegation of applicable law, whether it's a US law or a foreign law, remember that the law may or may not be an employment law. It doesn't really matter, I'm just making, I guess that's an obvious point, but I'm just saying it. So once you've got that work rule in place, then you get to the issue of we're leading up to an investigation of course. So if you're investigating a specific breach of the rule, somebody somehow you will have had a suspicion of wrongdoing and that may or may not come in through a whistleblower report. And if you have a whistleblower hotline and under the new EU whistleblower direct, you have to have a EU whistleblower hotline. And if you're publicly traded in the US and regulated by Sarbanes-Oxley section 301, you have to have whistleblower procedures for the anonymous employee submission of complaints or concerns on auditing or accounting fraud. So you likely do have a whistleblower hotline. So setting up the whistleblower hotline as a static channel, and I'm saying static channel cause I'm not yet getting to a specific report yet. I'm just saying having the hotline there and available for a whistleblower if they may or may not want to use it someday, that's another topic that's important. But for purposes of today, I'm pointing out that it's a separate topic and it's not really part of an internal investigation. You might have questions about hotlines, you might have questions about the new EU whistleblower director and it's hotline mandates. We do presentations on that. That's an important topic to study, but it's a different topic from today cuz we're talking about investigations, we're not talking about hotline. Then next is a report. You get a specific whistleblower incident report. It may come, remember that whistleblowers don't always whistleblow through your hotline, even if you have a hotline. Whistleblowers might just tell their boss, tell their manager. They might submit some anonymous note on somebody's chair. They might make an anonymous phone call, they might not necessarily call your hotline, but you might get a whistleblower report of somebody saying that somebody else is doing something wrong. Nobody's gonna report it themselves, I don't think, or that's highly unlikely. And then there's rules around how you respond to, or at least there's, there's best practices around how you respond to a specific whistleblower report, whether you acknowledge the report and how you follow up. And by the way, that new EU whistleblower directive I mentioned has some rules, some laws on how you have to follow up to certain whistleblower reports. Those are important. But we're not talking about those today because again, we're not even talking today about, about fielding a report from a specific whistleblower. Rather we're talking to, and on my slide, it's number four, doing an internal investigation. That's why the internal investigation chunk of this slide is in bold. That is what we're talking about today. So today we'll talk about once you've got that whistleblower report or you otherwise have a suspicion of wrongdoing, remember you might suspect somebody's committing insider trading for some reason other than a whistleblower report. You might have have that suspicion. Let's say it's theft, you might know somebody stealing office supplies. So you need to do an internal investigation to find out who's stealing them. You might not have a whistleblower tell you that office supplies are being stolen. You might just notice 'cuz the supply room is empty. Let's say I'm just using that as a simple example, that not all internal investigations are sparked by a whistleblower report. They can also be sparked by just a general suspicion of wrongdoing, okay? So once you've got that suspicion or wrongdoing weather from a whistleblower or not, you conduct the internal investigation. That's what we're talking about today. We'll talk about investigation process, the process for conducting your investigation. That's our topic of today. And again, how the investigation sparked is it is, not important because once you decide you're gonna do the investigation, that's what we're discussing, how you do that investigation. And then also at the end of the investigation, there'll be an outcome and a report, and then you'll have an investigation file and there'll be issues about retaining or purging the file consistent with data protection law. We'll get to that because that is all on, again, it falls under number four on this slide here. So that's all what we're discussing today. But then after you finished the investigation and you deal with retaining or purging the investigation file, then you get to the issue of post, post investigatory follow up, closing the case with the whistleblower. Circling back to the whistleblower, if there was a whistleblower, imposing discipline, let's say that the investigation finds somebody did commit insider trading or did commit a conflict of interest violation, then you need to discipline that person. You'll need to avoid whistleblower retaliation, which is very important these days. You'll need to avoid a defamation or privacy breach if someone claims that the investigation process somehow defamed them. And you, you'll wanna confine communications of the findings to people who only have a need to know. And you might even implement remedial measures to prevent a recurrence. If, let's say the investigation found out there was some breach of security in your organization that led to something wrong happening, somebody doing some wrongdoing, you might say, let's close the barn door. Now the cow got out, right? You might take some remedial measures. All that stuff is important. But the purpose of this slide is just to point out that today our topic is just the internal investigation piece. It's not the lead up, the establishing the rule, and establishing the hotline and fielding a specific whistleblower report on your hotline or otherwise. And it's not the post investigatory stuff about implementing remedial measures and avoiding retaliation and imposing discipline. How you discipline someone outside the US whether you can fire someone for that, those issues, they're all important, but those are not what we're addressing today, okay? Next is the way the structure for today's program. I just wanna make a comment, and maybe this is because I've spoken on programs a lot about internal investigations and I used to have a very different structure and I wanna, and I wrote an article with that other structure and I wanna just point that out because the article's part of the course materials, and you can take a look at that. What I did in that article and the way I used to do these presentations is I say, Hey, if you're a US headquarter, multinational, you're used to doing best practices in internal investigations in the US looking into wrongdoing in Chicago or St. Louis or San Francisco or wherever. And you're probably pretty comfortable that you're doing investigations thoroughly and you're doing them in a best practices way. And once you need to step outside the US and do an internal investigation, but in your operations in France or Brazil or Japan or some other country, you'll probably want to export your US investigatory best practices, so what I used to do is, and what my article does do is I said, let's break down a US internal investigation into its stages and steps and let's talk about each one of those stages and steps. But what you need to think about, what you need to tweak, what you need to change and what maybe you don't need to change if you're now doing an internal investigation internationally in foreign countries in, you know, Belgium or China or Argentina or whatever other country. So take a look at that article if that's helpful. You wanna do a deeper dive 'cuz the article I wrote a few years ago, but I think it still does a pretty good job, or at least it attempts to do a good job of, of breaking down into four stages and 30 steps, how US investigatory best practices work when you're doing a US domestic internal investigation and then discussing each one of those stages and steps internationally. So the article does that, I'll leave that to you if you want to look at the article today though. We're slicing and dicing the apple in a different way and I'm gonna focus more on the legal issues and the laws that regulate internal investigations internationally rather than the steps of the investigation. And we'll tangentially address investigatory best practice tips, but remember that we're not, that not all internal investigators are lawyers and not everything that has to do with an internal investigation is a legal issue. Some of these are more strategic issues about how you get information both collected from documents and how you do a conduct a good interview and effective interview. And so we'll talk about some tips along the way, but the point is we're focusing on legal issues more than on strategy that way, okay, next conceptual or strategic approaches to doing an internal investigation outside the US in this case, I just, this one slide I just want to kind of point out that when you're, if you, again, assuming you're used to conducting or overseeing internal investigations domestically in the US and now you're stepping outside the US and you're conducting an investigation in another country, okay, you might want to pause and rethink your approach to how you do the investigation just from a conceptual standpoint. And what I'm about to say is a generalization, and I apologize if it doesn't apply to you or if you don't agree with the generalization, but I think by definition all generalizations have exceptions, et cetera. But generally speaking, remember that we in the US are the only employment at will jurisdiction, which is the only jurisdiction in the world where it's legal to fire some employee or discipline employees for any reason or no reason as long as it's not a discriminatory or retaliatory reason. There's other countries that kind of come close, but even in those countries like Nigeria and Singapore, there are certain rules around imposing discipline. I think maybe this is my theory more than anything, but I think that because we come from an employment at world jurisdiction when it comes to doing internal investigations, we're a little more quick. We're a little quicker to take an iron fist and velvet glove approach and say, hey, this is important. Somebody might be committing insider trading or bribery or some important infraction. We gotta get to the bottom of this and we're not gonna soften our approach to investigating what might be some serious wrongdoing here just to be nice for HR purposes. Again, it's a generalization but I think that might be kind of an approach to American investigators. By the way, a lot of times in the US when we do internal investigations, if it's a big enough issue and remember internal investigations range, somebody might be accused or there might be a suspicion that somebody's stealing office supplies or stealing toilet paper out of the men's room, if that's happening, you need to look into that. You can't allow a petty theft to keep continuing in your workplace. So you will conduct an investigation into petty theft. That's important but that's an investigation on one end of the spectrum. Also, you might have, somebody might argue, might complain that a boss is being rude, not committing illegal harassment but just being rude. That might a rude boss might, your company might determine it's worth investigating that. And if there's a pattern of rudeness, you might counsel that boss. That would be another example of kind of a, an investigation that might be important. But it would be at the low end of the spectrum of importance. Whereas at the other end would be insider trading or bribery or accounting fraud or theft, you know, grand larceny type theft or let's say nuclear power plant has safety violations in your, and there's allegations that somebody's committing safety violations that could have catastrophic ramifications. I'm just pointing out that internal investigations look into allegations and suspicions of wrongdoing on a wide spectrum and sometimes you listen to these presentations on investigations and they seem to assume all investigations are at that heavy end of the spectrum where, where there's millions of dollars at stake. Those are of course the most important investigations, but they're probably some of the least frequent, most statistically most internal investigations are looking into things that were, let's say, millions of dollars are not necessarily at stake. And we're talking about all those, but at least in the bigger ones. Now I'm mentioning that in the US if you have a, a big investigation into something that could be catastrophic damage and you're conducting it internally in the US you're often gonna get a lawyer, you know, in the white collar practice of a law firm that may have been a former prosecutor, former justice department person 'cuz they have the expertise for these and that's great, but they come, at least I'm aware in many investigations during the, let's say the investigatory interviews, the lawyer will introduce him or herself as a former prosecutor and say, I have experience with the justice department. And they might take that iron fist and velvet glove approach, which may be the best approach for an internal investigation in the US, I'm questioning now or I'm just putting on the table the question of maybe in other countries where you don't have employment at will, you might find that a different approach, you catch more flies with honey than you do with vinegar approach might be more effective in getting the information you need to get in the investigation, especially when you're outside employment at will. And you might there, it might not be as effective outside the US as it is inside the US to take the iron fist and velvet glove approach and interview witnesses, say I'm a former prosecutor, et cetera. Remember that outside employment at will, the employer has little or no power to discipline a witness for failing to cooperate in an investigation. I'm not talking about the target. Obviously if the target of the investigation is accused of having committed insider trading and you catch the target and you find out they did commit insider trading, you can discipline the target for insider trading. I'm not talking about that. I'm talking about when you have an interview, an investigatory interview of a witness and in the investigatory interview you sit down and tell the witness that they have to cooperate. And this is an investigation. You must cooperate, outside the US, I'm generalizing a bit, but it's fairly safe to say that it, that's actually a misstatement of law. If you're interviewing a witness in Germany, for example, and you sit down, again, I'm talking about a witness, not the target. If you sit down with the witness and say this is an internal investigation, you must cooperate in this investigation, you just misstated German employment law because a German employee can sit back in his chair, his or her chair and fold his or her arms and say, no, I refuse to talk to you, and if they do that, now it might depend on some context. If it's a C-suite executive and they, they're possibly involved in the wrongdoing, that might be different. But a rank and file employee in Germany and in most countries outside the US for that matter, does not necessarily have to cooperate in the investigation because if they refuse to cooperate, you can't legally discipline them for that refusal to cooperate. And so you're, you can't tell 'em you have to cooperate 'cuz you're on the defensive there. That's why you might decide you to take a, you catch more flies with honey than you do with vinegar approach. Once you realize that you can't force anybody to cooperate in your investigation outside the US. Again, it's a generalization, but it's true in most cases. Also, you remember that if you take too heavy handed an approach, you risk a moral harassment type claim. There have actually been lawsuits filed in the UK and I think some other countries where an American company, you know, sent in an American former prosecutor to do an investigation and they took this iron fist and velvet glove approach and they later got a moral harassment claim where the witness said I was, I was essentially brow beaten. And actually in UK I don't think it would be a moral harassment claim, but in France it would be that for moral harassment illegal in France, there's actually a lot of litigation around it. And I think some of those cases have come up in this precise context of the American heavy handed investigator. So my point is just that once you're stepping outside the US you may decide, you may decide that you, you are gonna take an iron fist and velvet glove approach outside the US for whatever the reason is. But just think through your approach and to generalize. Think through this iron fist and velvet glove versus you catch more flies with honey than you do with vinegar and come up with what the way you want to conduct your investigation in a way that you think it'll work the best. Realizing that out once you step outside the US you're stepping outside of employment at will. Okay, now on this slide I've got cross border internal investigations as opposed to foreign local and I'll slip ahead real quickly. The next slide's gonna be foreign local investigations as opposed to cross border. So we're talking about those two topics in tandem, I suppose, but cross border internal investigation as opposed to a foreign local one, just to define it, I already mentioned this quickly, A foreign local one would be this. You're a multinational company operating in let's say 42 countries or 16 countries, whatever number of countries you're in. And let's say you get, something comes up in your operations in Italy, let's say. And especially if it's a not catastrophic level, it's not a bribery or an insider trading issue, but maybe it's a petty theft issue of somebody stealing office supplies, I'll stick with that example. You may decide, even though you're a US headquarter company, you may decide to relegate or delegate the investigation to your Italian office, they might, frankly, maybe the Italian office finds out about this, this theft of office supplies and they conduct their own investigation from the beginning. They may or may not tell US headquarters if it, again, I'm using, I'm purposely using an example of something that's not a bet the company multimillion dollar issue, but is rather something that's important to you but it is not gonna be catastrophic. You might have just a foreign local investigation in that context, meanwhile, a cross border investigation would be one where, let's say there's an allegation that a bunch of people colluded or conspired to do some insider trading, but some of them were in your office in Belgium, others were in your office in in Poland and you know, others were in North Africa, let's say or something. So you've got a bunch of witnesses or different people or let's say there was a, a sex harassment allegation in a company conference. And let's say you had employees from a bunch of different countries attending this conference and somebody from one country alleged somebody a, a supervisor from another country committed the harassment at the conference, an offsite type event. Well that's an inherently cross-border investigation 'cuz now you have a complaining witness from one country and a target of the investigation in another country. So that would be an example of a cross border investigation. And frankly, any investigation that your US headquarters conducts outside the US is inherently a cross border investigation too, because you've got a US headquarters team conducting the investigation, even if they're looking into wrongdoing only in France or only in Poland, but certainly if they're looking into wrongdoing that has witnesses or issues or tentacles reaching into several countries at the same time. So if you're, let's start with a cross border investigation. If you're doing a cross border investigation just now taking off the table, the foreign local ones, I'm now talking about an inherently cross-border ones. Couple issues to think about first is be very clear before you start the in investigation exactly what you're investigating a breach of. Is it, let's say it's a bribery allegation, somebody in the office in let's say Qatar, this time that's on the mind, somebody in our office in Qatar may have committed bribery. Okay, well are you investigating a breach of extra territorial US law? Obviously I picked bribery because that would be a, could be a breach of the US foreign corrupt bribery Act, which is a US statute or are you investigating a breach of a global HR policy or code of conduct? You might have a no bribery provision in your global code of conduct and maybe you'd look at that 'cuz you're investigating a breach of that. You might look at local domestic foreign law, Qatar of course as laws against bribing government officials. It's a cross border facts scenario, but in this case it might have been a Qatar employee allegedly bribing a Qatar government official. So it's a Qatar local scenario except now you've got a US company and a US investigatory team and that's the cross border piece, in that example, also, it might be a local HR policy. You might, in your operation in that country you might have a local rule against bribery. But my point is, before you start the investigation, be clear on what you're investigating a breach of. And it could be some or all of those four different types of rule. Some are laws, some are internal rules. Next, think about who you're investigate, who's going to be on your investigation team. Remember we're talking about a cross-border investigation now, so it may well be that a team would have membership, it might even be led by people at your US headquarters if you're headquartered in the US, if you were a German headquarter multinational and you're investigating something in China, it would be led by people at your headquarters in Germany in that case. But think through who should be on the team. Think of the, a risk of a full delegation to local investigators. Now in some cases it might make sense to delegate the investigation to people locally, let's say in Mexico. But in others you might say, no, we need people from headquarters from the US, there was one case I'm thinking about that was in the newspaper many years ago, but it was on, ended up on the front page of the New York Times. As I understand the situation as I remember it, having read the New York Times article, there was an allegation in that case in Mexico of wrongdoing and it got to the general counsel in the US and the US general counsel asked the Mexico general counsel to look into it and the Mexico General Council ultimately did look into it, came back and said, I looked into it, I didn't see anything, I don't think there's anything here. You know, nothing to see here. So they closed the file and then later turned out there was a big problem. And it turned out that the Mexican general counsel's investigation was not adequate and didn't uncover the problem, in that case, let's assume those facts that may or may not be exactly what happened in the situation I'm thinking of, but just assume that is a hypothetical. Obviously in that case, the US headquarters organization should have stayed involved and been on the investigation team and should not have relegated or delegated the investigation to the overseas office. But that said, when you're assembling a cross-border investigatory team think of who should be on it, including headquarters versus local investigation team members, you wanna avoid local influence and tipping off locals. Let's say you're looking into something that somebody, one of the local managing directors might, is committed of doing, let's say whether it's harassment or theft or something, you might think, well if we have locals from that office on our investigation team, they might be reporting to the target and they might tip off the target. So that would be a factor to think about including them on the investigation team or not. On the other hand, remember there's significant benefits from having local people on the investigation team if the investigation's centered on a specific foreign country operation, of course you've got the benefits of the local language and knowledge of the local law and and conditions and they know who's who and et cetera. So it can be very helpful to have someone on your investigation team who's local as well. But that's all gonna depend on different factors. And then think of issues around cross border investigation logistics, in today's world with Zoom, you might be able to conduct the whole investigation with people from different countries on the investigatory team without anyone getting on an airplane and, and flying to that location, especially if you have that, that would be another reason to have local people on the investigation team by the way, but think through the logistics as well. So those are just issues around across border investigation. Now let's go to a foreign local investigation. Remember this is one I'm defining as you're a multinational company so you operate in a bunch of countries at the same time, but this would be an investigation of something, something probably that's not, not potentially catastrophic and a bet the company issue, but rather something on the smaller end of the spectrum, but still important, but something that would be appropriate to delegate to the foreign local office to do a foreign investigation. One scenario might be the headquarters global hotline receives a foreign local whistleblower allegation with only one country involved and no material ramifications at the regional or headquarter level. Let's say someone calls your hotline and says, I'll stick with my theft of office supplies. Someone from Netherlands calls and says somebody stealing office supplies in the office, in the, you know, supply room here in Amsterdam, well that's important. You don't want people stealing office supplies in Amsterdam, but that might not have material ramifications at the regional or headquarters level and you might be able to completely delegate that to a Dutch foreign local investigatory team. If you do that, you'll wanna think about training and aligning foreign local investigatory teams with headquarters expectations. In other words, if you have your own developed best practices expectations on how we conduct our internal investigations at our company and a situation might arise where you're going to delegate an investigation to a local team, you wanna make sure the local teams understand what the expectations are and how you expect them to conduct local investigations, so the point there is in advance, you'll wanna have some kind of training or some initiative. So you have people in local countries who can conduct these foreign, local investigations. Another is to keep headquarters involved in the investigation process. If in this scenario where the whistleblower complaint came into headquarters on the whistleblower hotline, you just tell Amsterdam office, Hey, we got a tip that somebody's stealing office supplies. You might wanna look into that and that's the end of it. Or on the other hand you wanna say, look, we're delegating that to you, you should look in, you must look into it. Please do look into it and tell us when the finals close. When you get somewhere, we wanna know, in other words, how much is headquarters gonna track an investigation that they're delegating to a foreign local office? And do you require that the results get communicated up to headquarters? All those are important, it's not rocket science, but they're important issues to think about on the front end. If a scenario might come up where you're gonna be delegating foreign local investigations to foreign local investigatory teams, then also think about the scenario of what I'm calling a locally received report submission, let's stick with the office supply thing. Let's say somebody in the Amsterdam office tells somebody else in the Amsterdam management that hey, somebody's stealing office supplies. In that scenario, nobody at headquarters even knows that there's even a suspicion of office supply theft in the Dutch office, right? So should there be a process or even a requirement that local offices, when they investigate something that's inherently local, in this case the theft of the office was, is I'm using that as an example where you're probably not gonna need regional or global involvement in the investigation, but should they tell headquarters that they're doing investigation? Or on the other hand, is it okay if they do an investigation like that? And if so, you'd wanna define for them, hey, what level are they supposed to tell headquarters and bring them in? Obviously if there's an allegation in the Dutch office of bribery of government officials, US headquarters is definitely gonna wanna know about that 'cuz the Foreign Corrupt Practice Act. So the point is, you might need training or some protocols around the scenario when suspicions or allegations come in locally and when they need to get pushed up to US headquarters. And maybe your answer is all of them must, even if it's, if it's something as mundane as theft of toilet paper out of the bathrooms. But think through that and be realistic. Remember that not all investigations look into these big ticket items and you wanna be practical in your protocols and your rules and think around training and aligning your foreign local investigation teams with headquarters expectations as we've talked about. Okay, next. Now I mentioned I wanna talk about American investigatory procedure law issues that come up in the international context because when there's Americans on the investigation team, Americans leading the international investigation, these I wanna talk about the biggest legal issues that we're used to, just reflexively raising because they come up in US investigations and I just wanna talk through them, kind of brainstorm with you how those is those legal issues that are by definition important in a US internal investigation, how they play out in foreign investigations, in investigations outside the US we're talking about the outside US piece to a cross border investigation. First, let's start with attorney client privilege. Now we're talking about attorney client privilege and international internal investigations. This is maybe a pet peeve of mine, but usually if you're doing an internal investigation, let's say you're going into Belgium and Netherlands, I'm just picking countries, often I hear isn't there an attorney-client privilege in Belgium or Netherlands or is there an in-house privilege? 'Cause sometimes they say, well it's an in-house lawyer's gonna be doing this investigation. Is there an in-house internal? Because attorney-client privilege law differs by country. Of course it's a very inherently local issue that whether there's an attorney client privilege at all and whether it extends to in-house lawyers differs from country to country to country. So when you're going into a country, the Americans are quick to say, is there a privilege? Is there a privilege? Is there an in-house privilege? I suggest being more strategic and don't just ask about whether there is a privilege. Rather consider the attack on the privilege scenario because how the privilege might get attacked is really what you want to know. You want answers to the right scenario. Now remember, an attack on the privilege means if you have internal information, let's say you're in the case of an internal investigation, the information would be your investigation file. You conduct an investigation, you've got a file with interview notes and you've looked through different emails and documents, they're all in your investigation file. You wanna say the file is privilege, we don't have to give it up. Well, if it's privilege, what that means is you don't have to give it to someone who wants it, who you don't want to give it to. Obviously you can give it to anybody you want to, although you might get in trouble for disseminating it too broadly. But if you're asking about privilege, you're assuming a scenario where we don't wanna give that file away. We don't wanna show it to someone, but we have to, by law, the law's forcing us to, and we say, oh, but it's privilege. But the law says no, the privilege doesn't count here. You have to turn it over. That's what I mean by an attack on the privilege. Who would ask for the file? Well, it might be the target, right? Data subject access request. We'll talk about that when we get the data protection rules. It might be the target asking for the file and it, but it might in litigation, you might have a lawsuit, you might fire the employee and they might seek the file as part of discovery. And it might be the government, it might be some gov, let's say it's a bribery investigation and the government might be looking into bribery or insider trading. Those would be attacks on the privilege, one scenario. But think through, okay, if this goes to court or if we get in a scenario where someone's gonna be insisting that they have a legal right to see this file, even though we're claiming it's privilege, would that likely come up in an American court proceeding? Now if, let's say it's an insider trading claim and let's say your company is traded on the New York Stock Exchange or NASDAQ, well if it's insider trading and there's a lawsuit that comes out of this, it probably will be in an American court because it's an American trade in stock. So all of a sudden, even though we're doing a foreign investigation, we're thinking in terms of the attorney client privilege that we might need to assert in a US court proceeding in an American court, probably a federal court versus would it be in a foreign court? If you're looking into let's say an allegation of sex harassment and it's a local situation in your office in Portugal, it would probably, if it went to court at all, it would probably be in a Portuguese labor court, right? So that would be the attack on the privilege would come up in a court proceeding, yes, but in a Portuguese court in that case. Now an interesting observation. If the likely scenario of having to turn of, of someone claiming you have to turn over the darn documents is gonna be in a US court. Look, you're gonna have a US judge or a US magistrate adjudicating that and the US judge or US magistrate will understand the privilege the way we Americans do. And you can expect they'd be much more sympathetic to the privilege than let's say a Portuguese judge would be if you say, Hey your honor, this was an in-house lawyer who was asking these questions. And so the documents are privileged, we're just generalizing. But you're probably gonna get a much more sympathetic response to a privilege claim in a US court 'cuz it's gonna be a US judgment or magistrate adjudicating it. Then in a foreign court in the issue of, oh no, under Portuguese law, technically an in-house lawyer doesn't confer the privilege on documents. Well it's probably unlikely a US judge would be very sympathetic to that argument 'cuz they'd see an in-house lawyer. So the point is think through how you might have to turn these documents over. Are you worried about a data subject access request under data privacy law? If you are, do you have any grounds not to turn the documents over? That might not even be a privilege issue as much as it would be a a data privacy issue. If you think that you might have to turn the documents over in a court proceeding, think through who the court is. Remember though, and this is the big point I'm leading up to, you don't have discovery in these foreign civil cases the way you do in the US and it's highly unlikely that you have to turn over documents in discovery in a foreign country. In fact, one example is, I was looking at something a German lawyer wrote about privilege in this exact context. It was a German lawyer writing about privilege in the context of German documents in a German internal investigation. And the German lawyer writing this talked about the privilege when you're trying not to turn documents over in a quote "seizure by public prosecutors". In other words, the German lawyer was talking about privilege in an investigation and the only context the German lawyer came up with was a seizure by public prosecutors. Now that could happen in Germany if the issue might go to a government proceeding, the public prosecutors might come in and seize documents. But I'd think it's safe to say the vast majority of issues that companies look into in internal investigations are not the kinds of things that public prosecutors go after. Now if it's some big issue about bribery or insider trading, maybe it is, especially if the insider trading, if the stock is traded in that country. But most issues aren't gonna go to a seizure by a public prosecutor. So the point is in let's say you're doing an internal investigation into an allegation of theft of office supplies, I'll stick with that in Germany, the point is, what scenario would ever come up where you, somebody might insist you have a legal obligation to turn over the investigatory file and you'd wanna say no, no, no it's privileged. It's probably unlikely there is such a scenario 'cuz the public prosecutors aren't gonna get involved. There's no civil discovery in Germany and maybe there'd be the data subject access request issue, but you'd probably deal with that on data protection analysis rather than privilege anyway. So the point is that's what I meant when I said think about the attack on the privilege rather than whether what the privilege law is, you should first think through, look is there any likely scenario where we'd ever be, somebody would say we have a legal obligation, turn the file over or turn over certain information relevant to our investigation over and if so then think how would we rebut that privilege plays into that a little, but you're not, it's a very different question of saying do lawyers confer the privilege or not? And remember that you're not outside the US. The good news is you're highly, you're much less likely to have to turn over documents in discovery. And so the privilege is less relevant only 'cuz you're not trying to fight a document disclosure in document discovery because you don't have the discovery. So at the end of the slide I say do Americans get too distracted by my privilege analysis? I'm not trying to say it's not important, but I'm saying sometimes the questions I get about privilege in the international investigation context don't seem to be focused on the issue as precisely as they could be or should be. Okay, next we're still talking about American investigatory procedure law issues that come up in intern in the international context, in an international investigation. And next let's get to the Upjohn issue. The Upjohn case is a US Supreme court case that basically says you have to give an analog of Miranda rights and should be telling witnesses, Hey we represent, we're doing an internal investigation here. We represent the company as the employer. We don't represent you. Whatever you tell us is not gonna be attorney client privilege, et cetera. I'm just summarizing I guess what Upjohn warnings are, sometimes you get the question, do you have to give Upjohn warnings in the international context, I'd say, well obviously the Upjohn case is a US Supreme court case. So in the vast majority of times you're interviewing witnesses outside the US Upjohn itself in and of itself is not necessarily gonna come into play because it's a US law for US situations, but you probably should. I think it's a, it's a best practice and it's clear and you wanna be fair You don't wanna trick your interview subjects into thinking you've got, you know, that you're representing them and that there's a privilege if they're a witness and, and therefore you should probably give Upjohn warnings. But it's less than a matter of is that the, the law then that's a good practice. Next is the accompanying representative issue. In the US we, I don't know if we still call it, I think we do the wine garden issue, but it used to, there's an old labor law case where in the labor union context, if you're calling someone in for a disciplinary meeting that might lead to discipline and they're in a union, they're allowed to bring a union representative or somebody to accompany them from the union. That's called the Weingarten case. Weingarten rights. So in the US we've got in the labor union context, you might have to bring, allow someone who's been that we're not talking about a witness, usually we're talking about more the target, somebody who's in an investigatory interview that might lead to discipline against that person. And in the US you've got these Weingarten rights issues. I think the Weingarten rule comes and ebbs and flows as labor law does in the US depending on the administration, et cetera. But outside the US you have analogs of Weingarten rights. First of all, distinguish the right to bring a lawyer versus the right to bring a labor representative or a coworker. There's very few countries, there might be a couple countries on earth, but probably very few where there's any legal doctrine under local labor employment law that says if you call an employee into an investigatory interview, even if it's the target, the employee, if they wanna bring their lawyer, they have a right to bring their lawyer to that meeting. I don't, I think it's safe to say that in few, if any countries on earth this, is there a, a black and white hard black letter rule that employees can bring a lawyer to an investigation. There might be one or or two. But that would be the exception, the issue though is more the Weingarten one where the person says no, but I wanna bring a coworker or a support person or usually someone who's also an employee on the payroll of the company. Maybe a union representative or a labor representative somewhere from the work council. Or there might be an employee, a staff delegate in France or something like that, that they wanna bring, in some countries, they do. And first of all, distinguish not only what country work you're talking about, but whether the investigatory interview is of a target and might reasonably lead the discipline versus an investigatory interview of a witness that's not likely to lead to discipline of that witness 'cuz they're just a witness, they're a third party in this, they're not the target, in some countries. Examples are Belgium, Ireland, and Finland. Those are just three examples. The law will say that, that at least in the case of the target, they will right to bring someone, not necessarily a lawyer, but a coworker or a labor representative. That might even depend on the context. But the point is it's a, it's a legal issue under law and you should check the law in each country. Make sure when you check the law that you check the context of whether it's the target versus whether it's a third party witness. But the answer is in some countries you don't have to allow them to bring someone if they ask, usually it'll be another employee or somebody from the, the worker representative group like the works council or union. Rarely if ever will it be a right to bring an actual lawyer. So that's how that plays out. And then lastly, the witness confidentiality instruction. Here's the one issue and the whole presentation today that I'm gonna tell you that the law outside the US is better for employers than it is inside the US. So there's a rule that we Americans might be used to adhering to that you get to put aside when you step outside the US and that's the rule against confidentiality instructions. My understanding is under US labor law that employers in the US, even those that are not unionized, can't instruct a witness in an investigatory interview to keep confidential everything that went on in this room, during the interview. 'Cause if you tell the witnesses, you're not allowed to talk about this to anybody that could be argued to chill, protected, concerted activity under US labor law, I think that's still the case. I know that's certainly legal issue, whether you're allowed to tell 'em or imply that confidentiality's important or something. How you say that that's an, an issue of US law outside the US I'm generalizing, but I think it's safe to say in all the countries of the world, even Canada, which is our, you know, neighbor closest to our system, I guess, the law does not have have a rule like that. You're allowed to instruct witnesses that they have to keep the investigation confidential and in fact, for data protection reasons in Europe, for example, under GDPR, you probably should instruct them that it's confidential. If you have a sensitive investigatory interview with a rank and file employee witness, and then you just let that witness run out and blab around the factory or around the office that you know that you are asking all these questions about somebody's behavior that could give rise to a data protection problem. So the rules outside the US certainly data protection laws like GDPR and other laws in many other countries that are similar, you have an interest in telling people to keep the investigatory interview confidential. I think the US is the one country where that's a legal issue and you don't have to worry about the issue in other countries. Okay, next laws regulating internal investigations. Specific people say, oh, we're doing an investigate. I'll go back to Poland, we're doing it. Or let's take Poland and Chile just to pick another country. So we're doing an investigation in Poland and Chile, we have employee witnesses in Poland and Chile, and we need to start doing interviews and start looking at documents. What does the law say about how we conduct our internal investigations in Poland? What does Polish law say about it? What does Chilean law say about it? First is to point out that internal investigations as opposed to government investigations are not traditionally regulated, most countries have few laws specific to internal investigations. Now obviously an internal investigation can trigger legal issues all over the place and we'll get to those. But if you're asking the question, what does the law say about how we conduct an internal investigation, sometimes they'll say, do we have to conduct an internal investigation or are we allowed to, usually the answer is the law is silent on internal investigations. Again, government investigations is totally different. A big issue under laws, even in our, our Bill of Rights in the US right? About government investigations. But we're putting that aside. We're talking about non-government employers conducting internal investigations, so I guess the point is, contrary to widespread assumptions, laws tend not to tell you anything about internal investigation procedures specifically. So if you say, who has to conduct the investigation? Does someone from the local country have to be on the investigatory team? How do we interview the witnesses? Do we have to inform the target of the investigation? And how long do we have to investigate? And what kind of report do we have to draw up? Local lawyers will have opinions on those and there might be legal doctrines under employment law that give rise to good advice under those. But there's rarely, if ever gonna be local laws that answer those black in a black letter way that say the investigation must be conducted within three months. Or there must be representation from the local office on the investigatory team there. It's rare. You're rarely gonna see those laws because laws in countries worldwide, I'm generalizing, tend not to talk about investigatory procedures specifically in per se, okay, that said, distinguished legal doctrines that are silent on investigations, but get triggered in an investigation such as collective labor representation, attorney client privilege, we already talked about those, data privacy, we'll get to that next, proportionality in employment law and discipline scenarios. People will tell you, if you don't do an investigation, you could be held liable because you didn't do a proper investigation and somebody got hurt. Well, that's true, but that's not the same as a law telling you have to do an investigation. Somebody could also say, if you do a sloppy investigation and you don't do it right, you could get in trouble because you should have done a better, more thorough investigation and uncovered the wrongdoing. Your sloppy investigation led to a conclusion. Nobody did anything wrong, and that was an improper result. Well, that maybe is a good point. Might be a good point. You should do a thorough investigation. But again, my point now for today, for this slide is just to say that's different from saying that a law in Chile or a law in Poland says you must conduct a thorough investigation, by the way, there's a little of a, there's some exceptions, especially in sex harassment in a couple countries. Two examples would be India and South Korea, if it happens to be a sex harassment allegation. And remember, the vast majority of internal investigations are not investigating sex harassment. They're investigating other things. Sex harassment comes up plenty of times, yes, but most investigations don't have to do a sex harassment. Sometimes local lawyers will tell you in these countries, oh, you have to do an investigation 'cuz it's in our sex harassment law. But then the answer is, well, we're not talking about a sex harassment investigation. We're talking about an investigation into theft or into insider trading or something. The laws tend not to discuss that, by the way, the new data protection law in, I'm sorry, the whistleblower law in Europe does require doing some kind of investigation in certain violations when you're investigating certain violations of European law, but the whistleblower law is not too granular on that. It just says you have to do some kind of investigation, but it doesn't tell you how or how long or anything. Although it does require a three month follow up with a whistleblower. And by the way, one specific issue around this is, is a suspension. Sometimes a company wants to suspend the target pending the outcome of the investigation. Suspension becomes, should it be with pay without pay? In most countries, you're gonna have to suspend with pay. Not always though. I've got at the bottom of the slide there, internal or even paid suspensions are illegal in Germany, but they in Thailand, they have to be paid. And there's a seven day cap in Hong Kong, there's a 14 day cap in India, a workman who are lower level employees get half paid. So my point is, there is law around unpaid or paid suspensions during an investigation. That's one area where there is law. Okay, next is we're talking about there are some laws that expressly regulate internal investigations. I mentioned the sex harassment exception. There's also exception, like in Canada for industrial accidents. There may be a law that says if somebody gets their arm chopped off in a factory, you must conduct an investigation. And if you say, no, we're not going to, that's a violation of the law. But my point is that other than those very specific contexts of some countries and sex harassment, industrial accidents, and there might be one or two other examples in one or two other countries, but generally there aren't laws that say you must conduct an investigation. That's not to say you shouldn't be conducting these investigations, it's just pointing out the laws don't regulate that. And I mentioned the new whistleblower directive already, that does require follow up. You'll see the articles up there, articles 5 , 9 , require following up. And the follow up is essentially an investigation to allegations of 12 specific topics of European union law. But even that directive does not give a lot of detail on what the investigation has to be, what the follow, they don't even call it an investigation. They use the phrase follow up and pointing out the, these laws, I think it's safe to say, don't pose much real world enforcement risk. I don't think, especially US headquartered multinationals ever or rarely ever get challenged in court proceedings saying you never conduct an investigation even though the law required a sex harassment investigation in India, for example. I think most US companies are, are going to conduct that investigation. So I don't think you see much enforcement action even in the few specific scenarios where companies must conduct an internal investigation. Okay, now the final topic is data protection law, compliance and internal investigations, if we were conducting our session today, you know, 10, 15, 20 years ago, I'd focus a lot on European Union data protection law. Nowadays that's GDPR. Back in the old days, that was the data privacy directive in Europe. But in the last 10, 15, 20 years, many countries beyond Europe have passed overtly copycat type data protection laws. Now you have GDPR like laws, or at least European Union data protection directive like data protection laws in Argentina, Mexico, South Korea, South Africa, the Philippines, Singapore, and many, many other countries around the world. So I kind of look at the world as in those countries that have laws like that and those that don't. The US obviously doesn't. There's the California Privacy Act, but that is only California and it's not nearly as robust as GDPR, so I'm not counting, I'm counting the US as a country that does not impose an omnibus data protection law, but many, many other countries do, again, including in Latin America, Asia, and certainly all of Europe and beyond the EU. In Switzerland for example, which is EEA, they all have these data protection laws that are roughly like GDPR or predecessor EU law. So in those countries only, putting aside the ones that don't have data protection laws like that, in those countries only, when you create an investigation file, you need to comply with overseas data protection laws. And you need to be thinking about the concept of a data subject access request that's in these laws, especially in GDPR. But in the other laws says that a data subject, someone who has identified information about that person has a right to ask for information about him or herself. Only you redact the names of others, but you have, that person has a right to have you turn over information about him or herself. So a target of an investigation would say, I'm gonna see the whole investigation file about me. You may have to turn that over in the context of an investigation. There may be exceptions or at least least you may be able to defer the timing on that. But in some countries, you're gonna want to essentially destroy investigation files so that you don't have to turn them over. Or you might consider that, I don't wanna say you're gonna decide to do that, but you need to think about the fact that you may have to turn over investigation files to the people that who are named in the file if they do a data subject access request. So if you write it down, consider that, consider the tape. Any taping of a interview would count under that. And also there's the issue of under these data protection laws, you can't disseminate personal information overly broadly. So you need to confine investigatory data to those who the business need to know and you wanna be careful of the, people on your investigation team, of course, all ever need to know, you might wanna memorialize their business, need to know. Also remember that in GDPR and in many of these other laws, criminal data, a data about a criminal offense. And that doesn't mean a conviction is sensitive data. Under GDPR Article 10, so many investigations, even theft of course, but investigations into insider trading or bribery are looking into something that might be a crime. And if it might be a crime, your whole investigation file might be sensitive data again in GDPR under Article 10. So think through that and address that issue in advance when you're assembling your investigation file. Also, there's the issue of cross-border data exports. If the data file is going back to US headquarters, you're exporting personal information. You need to have model contractual clauses or something in place for that. And then we mentioned the data subject access requests and there's the issue of retaining or purging investigation files under European GDPR. The legal system would like you to destroy investigation files quickly. American companies aren't gonna be comfortable doing that, but you need to be careful how you retain and whether you purge investigation files. So with that, I'm just putting this slide back up to remind you that today we talked about the context of internal investigations, but remember that that's just one piece and a bigger issue around imposing work rules, having a whistleblower hotline channel, processing whistleblower reports that come in over your hotline, then doing the investigation and then following up and imposing discipline and avoiding whistleblower retaliation, et cetera. Thank you very much for hanging with us on this program and I hope that's helpful as to how to conduct internal investigations outside the US. Thank you.