Grievances: Confidentiality issues in workplace investigations

Colin Godfrey and Michael Chattle share their tips on how to manage the competing rights to privacy of employees who bring a grievance, colleagues they make an allegation against and witnesses

‘When the employer decides that someone needs to know about a grievance, it should carefully consider how much detail that person needs to know.’

Handling employee grievances can be tricky. By its very nature, a grievance will involve matters personal to the employee. This will make the management of confidentiality a significant and challenging part of the grievance process.

When handling information in an employee’s grievance, employers must consider both the implied duty of mutual trust and confidence and the rights of data subjects under the Data Protection Act 1998 (DPA) (and from May 2018, the General Data Protection Regulation (GDPR)). These requirements can affect not only how information is shared, but also how much information about themselves individuals are entitled to see. Employers may have to juggle competing obligations to the employee who has brought the grievance, employees who are involved in the complaint and those providing evidence as witnesses. In this article, we look at some of the key issues around confidentiality in grievance procedures and provide practical tips for employers and their advisers.

Keep the pool small

An employer considering a grievance risks breaching trust and confidence by not controlling the spread of information. Generally, an employee should be entitled to bring any concerns that they have to the employer’s attention without the risk of the information being shared more widely than is reasonably necessary. It is therefore best to keep both the existence of a grievance and its subject matter as confidential as possible, limiting the number of people who are aware of the grievance and the information to which they have access. This will reduce the risk of someone leaking confidential information and the subsequent negative impact on the parties involved (and staff morale more generally). This is particularly important if an employee raises concerns about colleagues with whom they will need to continue to work after the process has concluded.

Work with the aggrieved employee

Given the likely sensitivities about the use of information, it is important that the employee in question fully understands the grievance process and how the company intends to handle confidentiality. It is often helpful for an employer to suggest a list of people that it thinks need to be aware of or involved in the grievance and what details they need to know. It can then invite the individual to respond. It is better to tackle this upfront and get the employee’s consent whenever possible, rather than waiting until the employee raises the handling of their personal data as an issue and then having to justify the actions taken. This informed consent (or lack of it) will be even more important once the GDPR comes into force in early 2018.

Share on a need-to-know basis

When the employer decides that someone needs to know about a grievance, it should carefully consider how much detail that person needs to know to fulfil their role in the process (such as being interviewed on a specific issue). It will not always be necessary to reveal the name of the employee being investigated or the complainant to conduct a fair investigation.

An issue that often arises is whether the employee’s line manager needs to be informed of the grievance. This will depend on the exact circumstances of the grievance, including whether the manager is implicated or needs to be involved in the investigation or decision making. In some cases, the line manager may be central to resolving the grievance. Each situation will be different, but thinking early about the role that the line manager is likely to play is always sensible.

Maintain confidentiality for witnesses

Just as an employer owes duties to an employee raising a grievance, it will also have obligations to employees who provide evidence as part of an investigation of that grievance.

It is important to make those being interviewed aware of some key details about their evidence. This includes making clear:

  • what the purpose of their evidence is: this is crucial to avoid misunderstandings and can be relevant if an employee who is the subject of the information asks to see the evidence which was given (see below);
  • that their evidence may need to be shared to resolve the grievance properly: offering safeguards (such as anonymising the evidence) may resolve any concerns they have about this; and
  • that the investigation and any information shared with them as part of it are highly confidential and that any breach of confidentiality will be considered a disciplinary matter.

Comply with data access obligations

What information an employee is entitled to see about their grievance is often the subject of dispute between the parties. For instance, are they entitled to see everything said to the investigator, including interview notes and witness statements?

Take the example of notes of an interview with a potential witness to an alleged incident. The employee who has raised the grievance may be keen to see exactly what was said in the interview, but the employer will also have duties of confidentiality towards the witness, especially if the topic is sensitive.

The employer must consider the rights under the DPA of everyone involved, including an individual’s right (subject to certain exemptions) to see a copy of all personal information that an organisation holds about them. The Information Commissioner’s Employment Practices Code specifically states that the DPA applies to personal data processed in relation to grievance proceedings. Making such a request is a common tactic that employees and their representatives use to gain further information that they may be able to use to bring an employment tribunal claim. Depending on the timing of the request, the requirement to respond may overlap with the grievance proceedings (particularly once the GDPR shortens the timescale that employers have to respond to subject access requests from 40 days to one month in most cases).

To help comply with such a request, it is important to ensure that each party is aware of and consents to how their evidence may be used and to have a clear note of any objections from employees to the sharing of their evidence. This will allow the employer to weigh its competing obligations before deciding whether to disclose documents that could identify third parties such as other employees. If necessary, the employer may wish to redact individuals’ names, edit the statement or provide a summary of the document.

Managers should be made aware that the employee may see notes, emails and other documents created during the grievance process (whether under a subject access request or if they bring an employment tribunal claim).

Once the GDPR comes into effect, employees’ rights as data subjects will expand, with significant new penalties for breaches by employers. It is widely considered that an employee’s general consent in an employment contract to the processing of their personal data will be insufficient to show that the employer has truly obtained their agreement. To comply with the GDPR, employers will need to obtain ‘freely given, specific, informed and unambiguous’ consent before they process employees’ personal data.

A sensitive issue

Every employee grievance is different, raising diverse problems for the employer to handle. Confidentiality is an ever-present challenge and is one that can have serious consequences if not handled correctly. For example, a serious mistake by the employer could form the basis of a claim against it for a breach of the duty of mutual trust and confidence. It is essential for employers to handle confidentiality concerns sensitively, in accordance with the particular situation, and to communicate clearly how they will handle information and evidence at every stage of the grievance process. This will help to ensure that all those involved are properly informed, unexpected surprises are avoided and confidentiality issues do not derail the effective handling of the grievance process.

Disciplinary action resulting from a grievance

If a grievance results in disciplinary action against another employee, is the person who brought the grievance entitled to know the details of those disciplinary proceedings or their outcome?

The answer is no. The employer should inform the aggrieved employee whether it has upheld their grievance, why it reached its decision and what remedial steps it will take (if applicable). This can include informing them that it will take action against another employee under its disciplinary procedure, but not what particular action, such as dismissal, it may take. This is not only to avoid infringing the other employee’s right to confidentiality but also to avoid any suggestion that the employer has predetermined the outcome of the disciplinary process.

In a similar vein, what is the employee who is the subject of the disciplinary proceedings entitled to know of the source of the complaint against them?

It is fundamental to a fair disciplinary procedure that an employee knows the case against them. Fairness requires that someone accused should (as held in Spink v Express Foods Ltd [1990]):

  • know the case they have to meet;
  • hear or be told the important parts of the evidence in support of that case;
  • have an opportunity to criticise or dispute that evidence;
  • be able to adduce their own evidence; and
  • have an opportunity to argue their case.

The employer will clearly need to disclose some evidence to comply with these principles. Discussing the extent to which evidence may be disclosed, both with the employee who brought the grievance and any witnesses who have provided evidence, will be very helpful here so they understand what to expect.

Cases Referenced

  • Spink v Express Foods Ltd [1990] IRLR 320