Don’t Let the Cure Be Worse Than the Ailment: Ensuring Safe Harbor in Internal Investigations - Türkiye Perspective

Internal investigations are crucial for maintaining legal and ethical standards within organizations. In Türkiye, internal investigations must comply with several legal frameworks, particularly Labor Law No. 4857 (“Labor Law”) and the Personal Data Protection Law (“PDPL”). Ensuring adherence to these laws not only upholds the rights of employees but also strengthens the investigation's legitimacy, which can be critical if the findings lead to civil or criminal proceedings. This article explores key considerations under Turkish law, with a focus on labor law issues, whistleblowing, and data protection and privacy concerns.

Whistleblowing Mechanism in Türkiye

Whistleblowing mechanisms are vital for initiating internal investigations. According to ACFE Report to the Nations 2024, tips remain the leading fraud detection method, as they were in the previous two reports, accounting for 43% of cases —outperforming other methods like internal audits and management reviews by threefold. This finding emphasizes the value of speak-up programs and whistleblowing practices in the detection of occupational fraud, given that the majority of these tips came from employees.[1] However, whistleblowing and whistleblower protection programs are not regulated explicitly in Turkish legislation contrary to United States or European Union practices. Instead, these concepts are derived from general legal principles.

Under Turkish Labor Law, employees have a duty of loyalty, which includes protecting the employer’s interests and reporting occupational frauds. However, the duty to report fraud can conflict with an employee’s obligation to maintain confidentiality. In such cases, the public interest in reporting the fraud typically takes precedence over the employer's interest in confidentiality.

Article 18 of the Turkish Labor Law which states that “initiating administrative or judicial proceedings against the employer to pursue rights or fulfill its obligations arising from legislation or contract or participating in such processes, shall not constitute a valid reason for termination of the employment contract by the employer.”, protects employees from termination solely for whistleblowing, in line with International Labor Organization Convention 158. Accordingly, 7th Civil Chamber of Court of Cassation ruled in decision numbered 2016/6970 that an employee's filing of a criminal complaint against the employer's representatives could not constitute a just or valid reason for termination, as it falls under “the right to apply or complain to judicial or administrative authorities” protected by Article 18(c) of the Labor Law. Employers are also required to protect whistleblowers from discrimination, exclusion, or damage to their reputation as stipulated in the Labor Law.

Despite the absence of specific whistleblower protection legislation in Türkiye, companies are still required to protect employees who report misconduct. They are encouraged to include such protections in their codes of conduct and policies. Companies also can oblige employees in their employment agreements to report misconduct internally first due to employees' duty of fidelity, according to the standards outlined in company speak-up policies. However, companies can't prevent employees from reporting illegal activities to the relevant authorities by citing NDAs or employees’ confidentiality obligations in general.

Additionally, although Türkiye lacks specific whistleblowing regulations, Turkish subsidiaries of global companies may adhere to their parent company’s laws, provided that such adherence does not violate any Turkish laws. For example, the EU Whistleblowing Directive (Directive (EU) 2019/1937) can be utilized to design and implement complaint mechanisms in Türkiye for handling complaints from employees of Turkish subsidiaries of EU-based companies.

Key Labor Law Issues to Address in Investigations:

During an internal investigation it is important to proactively adhere to Labor Law and secondary regulations in order to avoid potential allegations such as mistreatment or breach of employment agreement by the employer that could discredit the decisions rendered as a legitimate result of an internal investigation.

  ·  Cooperation and Employee Loyalty

Employees in Türkiye are bound by the principle of loyalty towards their employers. This principle implies that employees are expected to cooperate during internal investigations and disclose any information that could impact the employer’s legitimate interests. Failure to do so may be considered a breach of this duty, potentially justifying disciplinary action against the employee. In this case, company must ensure to document the employee’s unwillingness to attend investigation interviews or provide necessary information and documents regarding the subject of the ongoing investigation with a minute signed by the investigation team and relevant witnesses.

  ·  No Discrimination and Harassment

Internal investigations must be conducted without any form of discrimination or harassment. Labor Law No. 4857 prohibits discrimination based on gender, race, religion, or political opinion, among other factors. Additionally, any investigation into allegations of workplace harassment must be handled with utmost sensitivity, ensuring that the rights of all parties involved are protected. The investigation process should be free from any bias or prejudice, maintaining fairness and objectivity throughout.

If investigators use unethical methods or exert pressure during interviews to obtain confessions, such actions could be considered criminal offenses under the Turkish Penal Code, such as defamation, threats, insults, or blackmail. Individuals conducting these interviews may face criminal charges as perpetrators. Under Turkish law, companies do not have criminal liability; however, employees may still initiate civil proceedings for moral damages.

  ·  Garden Leave and Obtaining Approvals

Garden leave can be utilized to exclude an employee from the workplace during an internal investigation. The purpose of this is to preserve the integrity of an internal investigation. For instance, an employee under investigation for fraud may pose a risk to the workplace by potentially destroying evidence, while a supervisor engaging in mobbing could disrupt company order.

Turkish Labor Law No. 4857 does not regulate or recognize the concept of garden leave, meaning that employers in Türkiye do not have an explicit legal right to impose it. Introducing garden leave would essentially create a new labor practice not supported by existing labor laws.

Although Turkish law does not expressly permit garden leave, it does not prohibit it if mutually agreed upon by both the employer and the employee. Such an agreement can be included in the employment agreement or made separately, but for legal purposes, it should be documented in writing to ensure it is enforceable in case of disputes.

In the absence of explicit regulation on garden leave, employers might consider alternatives, such as offering paid leave without deducting it from the employee's annual leave, provided the employee agrees. Imposing garden leave without an agreement could be considered an unfair practice under Turkish labor law, potentially leading to claims of unjust treatment, violation of the employee’s right to work, and even unilateral termination with compensation claims, especially in the context of ongoing internal investigations. Therefore, it is advisable for employers to avoid unilaterally imposing garden leave to mitigate legal risks.

On the other hand, there may be no need to apply for garden leave, for example, in the case of rightful termination. Since garden leave involves continuing to pay an employee’s salary, it may be preferable, depending on the case’s merits, to pay the notice indemnity and dismiss the employee from the workplace.

  ·  Representation and Confidentiality

There are no certain rights or limitations regarding employee’s representation by an attorney during the interviews. In practice, it is uncommon for an employee to attend an interview with a representative. However, if employee wishes to proceed with legal representation, the employer should accommodate this request to avoid any future allegations of depriving the employee of their right to a defense and obtaining statements under pressure and bias.

Additionally, confidentiality is paramount in internal investigations. Evidence can be brought to the interviewed employee however, employers must ensure that the investigation is conducted discreetly, with all parties involved being informed about their duty to maintain confidentiality. Breaching confidentiality can lead to legal repercussions, including claims for damages by affected employees.

Data Protection and Privacy Issues

Employers must also consider employees' right to privacy under Article 20 of the Constitution when gathering evidence during internal investigations. Common practices, such as reviewing company computers, telephones, and emails, may inadvertently capture personal correspondences of employees, and examining such personal communications could violate employees' right to privacy, thereby rendering the evidence inadmissible.

Article 419 of the Turkish Code of Obligations states that the employer may use the personal data of the employee only to the extent necessary for assessing the employee’s suitability for the job or for the performance of the employment contract. In its decision dated 24.03.2016[2] regarding application No. 2013/4825, the Constitutional Court emphasized the critical role of internal policies, agreed upon as part of employment contracts, in establishing a legitimate basis for email review. The Court ruled that if employees are adequately informed about policies prohibiting private correspondences, these policies can be relied on as a legitimate basis for investigating corporate emails. Consequently, employers may review personal correspondences sent through corporate email accounts during internal investigations without infringing on employees' right to privacy.

Similarly, The Turkish Constitutional Court’s decision in case number 2016/13010[3] serves as a critical reminder for companies conducting internal investigations. The ruling emphasizes the importance of clear communication and transparency when monitoring employee communications, particularly in corporate email accounts.

For internal investigations, these decision highlights the following key practices:

·  Explicit Notification: Employers must ensure that employees are clearly informed if their communications, including emails, will be monitored. This notification should be explicit, documented, and ideally included in employment contracts or company policies.

·  Proportionality and Justification: Any monitoring of employee communications must be necessary and proportionate to the objectives of the investigation. Employers should exhaust less intrusive means, such as witness statements or direct questioning, before resorting to monitoring emails or other private communications.

·  Legal Compliance: Employers must balance their legitimate interests in conducting investigations with the employees' constitutional rights to privacy and communication. Failure to do so can lead to legal challenges, as demonstrated in the case mentioned above, where the Court found that the employer's actions violated these rights due to insufficient notice and unjustified monitoring.

Overall, the aforementioned decisions underscore the necessity for careful planning, transparency, and adherence to legal standards in internal investigations involving employee communications.

Additionally, employers must be mindful of their obligations under the PDPL, particularly given the high likelihood of capturing personal data during internal investigations. Typically, data processing is contingent upon individual consent. However, the exception provided under Article 5(2)(f) of the PDPL allows for the processing of data if it is necessary for the legitimate interests pursued by the data controller, provided that such processing does not infringe upon the fundamental rights and freedoms of the data subject. Internal investigations may fall within the scope of a company’s legitimate interests. Nonetheless, companies must diligently ensure that they preserve the fundamental rights and freedoms of employees while gathering evidence. The investigations must be conducted in accordance with the principles outlined under Article 4, such as proportionality, ensuring that data processing strictly serves the legitimate purpose of uncovering the alleged misconducts[4].

Data Transfers

The recent amendments to the PDPL and the newly published Regulation on the Procedures and Principles Regarding the Transfer of Personal Data Abroad (“Regulation”) introduce significant changes affecting the handling of personal data obtained during internal investigations, particularly in relation to its transfer abroad.

Personal data can only be transferred abroad if certain conditions are met, including an adequacy decision, appropriate safeguards (such as binding corporate rules or standard contracts), or occasional data transfers. The Regulation emphasizes that personal data transfer should be carried out in compliance with PDPL and must ensure the protection of the data subject's rights in the receiving country.

The most commonly used method for data transfers will be through standard contracts. Companies must notify the Personal Data Protection Authority within five business days of signing these contracts. It is crucial to ensure that these contracts are compliant with Turkish law, as the Turkish version of the contract will prevail in case of disputes. Failure to properly notify the Authority or comply with the Regulation's requirements could result in significant administrative fines.

Internal investigations that involve personal data transfers abroad should be carefully planned to ensure compliance with the new regulations. Companies must conduct data transfer impact assessments and ensure that the necessary safeguards are in place. The reliance on explicit consent for data transfers abroad will become an exceptional method after September 1, 2024, making it imperative for companies to adapt their data transfer practices to the new regulatory framework.

Conclusion

Internal investigations in Türkiye require careful navigation of legal frameworks, particularly concerning labor law, whistleblowing, data protection, and privacy. Employers must balance their need to conduct thorough investigations with the rights of employees, ensuring compliance with Labor Law No. 4857, the PDPL, and relevant constitutional provisions. Whistleblowing mechanisms, while not explicitly regulated, play a critical role in uncovering misconduct, and employers must protect whistleblowers from retaliation. Similarly, although not explicitly regulated, practices such as garden leave can be implemented with mutual consent but should be approached with caution to avoid legal repercussions. Effectively addressing these issues is crucial not only during the investigation process but also in post-investigation matters. The findings may lead to civil or criminal proceedings, making adherence to legal standards essential for the legitimacy and success of internal investigations.

References

- Börekçi, E. B. (2021, September 20). Is Accessing the Employee's Corporate E-mails in Internal Investigations a Crime ? (Only in Turkish). Retrieved from Lexpera Blog: https://blog.lexpera.com.tr/kurum-ici-sorusturmalarda-iscinin-kurumsal-e-postalarina-erisim-suc-mudur/

- Individual Application Press Releases: Violation of Employee's Right to Request Protection of Personal Data and Freedom of Communication Due to Termination of Employment by Investigation of Corporate E-mail Account (Only in Turkish). (2020, October 14). Retrieved from Constitutional Court of the Republic of Türkiye: https://www.anayasa.gov.tr/tr/haberler/bireysel-basvuru-basin-duyurulari/calisanin-kurumsal-e-posta-hesabinin-incelenerek-is-akdinin-feshedilmesi-nedeniyle-kisisel-verilerin-korunmasini-isteme-hakkinin-ve-haberlesme-hurriyetinin-ihlal-edilmesi/

- Özgün, K. A., Kunt, I. İ., & Tekelioğlu, O. (2024, March 22). An Overview of Occupational Fraud 2024: A Report to the Nations by ACFE. Retrieved from CBC Law Firm: https://www.cbclaw.com.tr/en/an-overview-of-occupational-fraud-2024-a-report-to-the-nations-by-acfe

- The Constitutional Court decision regarding application No. 2013/4825 (Only in Turkish). (2016, March 24). Retrieved from The Official Gazette: https://www.resmigazete.gov.tr/eskiler/2016/05/20160510-6.pdf

[1] (Özgün, Kunt, & Tekelioğlu, 2024)

[2] (The Constitutional Court decision regarding application No. 2013/4825 (Only in Turkish), 2016)

[3] (Individual Application Press Releases: Violation of Employee's Right to Request Protection of Personal Data and Freedom of Communication Due to Termination of Employment by Investigation of Corporate E-mail Account (Only in Turkish), 2020)

[4] (Börekçi, 2021)