In part one of this series, we established that the scope of the Private Investigations Act (the “PIA”) is considerably broader than one might assume: if you carry out a workplace investigation internally within a company, you are in principle caught by the stringent provisions of the PIA.
In this blog, we zoom in on the procedural requirements for an investigation.
Before the start: legitimate interest and documentation
The employer must have a legitimate interest in the results of the investigation, which must be set out in a written investigation assignment document before the investigation begins (or in the assignment register, if the investigation is being conducted by the internal investigation service).
An investigation into an employee is only permitted if the possibility of doing so is expressly and transparently laid down in a set of internal regulations. We will deal with this requirement specifically in part three of this blog series.
Prohibited fields of investigation
The PIA prohibits investigators from gathering and disclosing to the employer information concerning, among other things:
- political opinions, religious, philosophical or ideological beliefs, and involvement in or membership of trade unions or health insurance funds;
- genetic data or biometric data for the purpose of unique identification;
- a person’s sexual behaviour or sexual orientation;
- health data;
- non-public suspicions, prosecutions or convictions, administrative sanctions or security measures;
- racial or ethnic origin; and
- disputes submitted to courts, tribunals and administrative courts which have not yet been the subject of a publicly pronounced decision.
Indirect inference is prohibited as well: it is not permitted for the investigator to provide information from which the principal can, without further intelligence, deduce those categories of data.
Means, methods and the interview
The PIA is explicit: the investigator has no special rights or powers. They may not perform acts other than those flowing from the rights available to any person, supplemented by what the PIA expressly permits, and may not perform acts that impede the individual rights and freedoms of the subjects of the investigation. Furthermore, the investigator must choose what evidence is adequate and relevant, without being excessive in relation to the private sphere of the persons concerned and without going beyond the investigation result agreed with the principal.
Investigators may only enter a place which is not accessible to the public with the written consent of the person who has actual enjoyment of that place, or their appointee. The PIA lays down its own rules for observation, investigative techniques applied to goods and persons, and the consultation of personal data held in automated files not accessible to the public.
The interview
An interview may only take place if the person to be questioned has consented. Furthermore, the investigator must refrain from any question, suggestion, threat or other act that could give that person the impression they cannot answer in complete freedom, and the investigator must provide detailed information to the person before the start of the interview.
If the interview is recorded (image and/or sound), the investigator must expressly inform the interviewee and obtain prior consent, and the interviewee is entitled to a free copy. It is advisable to capture that consent in the recording itself. Every interview must in any event be the subject of a written report.
An entrapment prohibition also applies: the investigator may not induce the person concerned to do something they would not have done on their own initiative. Using information or evidence obtained through an offence or otherwise unlawfully is prohibited, as is inciting others to obtain it unlawfully.
Notification after completion: two scenarios
Once the investigation is complete and the final report has been submitted, the principal must state in writing to the investigator, within thirty days, whether it intends to act on the information:
- Scenario 1: no follow-up. The principal may no longer use the information and must immediately destroy the interim and final reports. No information is communicated to the person who was investigated (the data subject).
- Scenario 2: follow-up. The assignment holder must notify the data subject, and every other identifiable person whose personal data was processed as part of the investigation, in writing and without delay. The principal may not use the information until those persons have been able to exercise their rights.
An employer that does not intend to act immediately, but wants to keep the report as a possible starting point for a later investigation (following new facts), would be well advised to opt for the second scenario.
Report and file
No later than one month after the last investigative act, the assignment holder must transmit a written investigation report to the principal, signed by the assignment holder and all private investigators involved. In urgent cases, reporting may initially be oral, followed by a written report within eight working days.
In addition, the findings must meet the criteria of lawfulness and accuracy, and the information must be adequate, relevant and limited to what is necessary for the purposes for which it is processed. The principal may disclose the information to third parties only in so far as strictly necessary for the defense of its legitimate interests as described in the investigation assignment document; making it public is prohibited.
The investigation file must be kept for three years from the date of transmission to the principal and must then be destroyed.
The HR exception
In our first blog in this series, we mentioned that HR professionals who carry out investigative activities on behalf of their own employer in the context of an “incident investigation” concerning their own employees are not required to hold an identification card and are therefore exempt from the associated licensing requirements. The other obligations outlined in this blog will, however, apply in full to such investigations.
What if things go wrong?
The court before which the findings of a private investigation are produced must verify that they were obtained in accordance with the PIA, and assess their evidential value. The court may attach no legal effect to the findings where:
- the investigation was carried out by an unlicensed company or service, or by a private investigator without a valid identification card;
- elements of the findings were obtained through the most serious breaches of the PIA, such as investigating prohibited fields or obtaining findings unlawfully;
- the notification requirements in relation to the data subject were not complied with, or the findings were used unlawfully.
Please note that not all findings are necessarily tainted. Where several working methods were used to establish the same facts, a single unlawful method does not taint findings that are also supported by correctly applied methods.
Supervision and sanctions
Supervision lies with the Data Protection Authority, the police services and inspectors designated by Royal Decree. A sanctioning officer may issue a warning, propose a settlement or impose an administrative fine. Moreover, every official report establishing an infringement of the GDPR is forwarded to the Data Protection Authority. The Authority’s full sanctioning arsenal therefore applies as well. The exposure, in other words, is twofold.
In part three of this series, we will turn to the most pressing obligation on the calendar: the internal regulations that must be in place by 16 December 2026.
To discuss how the Belgian Private Investigations Act may affect your operations and how we can assist your business, please reach out to Marga Caproni, Partner and head of the Belgian Labour & Employment practice.
Recent Comments