Internal investigations – What to do when there is a suspicion that an employee is infringing Competition Law

By Patricia Linan, Candela Sotés


Article summary

  • Companies can be held liable for anticompetitive behaviors of their employees, irrespectively of whether it authorized or not such behaviors. 
  • What should compliance policies provide to allow effective investigations?
  • How to design a specific action plan to carry out an internal investigation?
  • Can the company monitor its employees' communications? How to balance employees' personal privacy and corporate power?
  • Differences across countries should be taken into account when conducting an internal investigation.

 A company can be held liable for anticompetitive behaviors of its employees, irrespectively of whether it authorized or not such behaviors. This exposes the company to high fines, expensive damages claims and significant reputational costs. 

In some jurisdictions, employees (usually, legal representatives of the company but also officers and directors) can be held liable for the infringements and face administrative fines or even criminal sanctions (including prison). But this does not exclude the company’s own liability which is normally grounded in the lack of appropriate surveillance of the employees (culpa in vigilando).       

In this context, the implementation of robust compliance policies and appropriate protocols to avoid anticompetitive behaviors is essential to minimize the economical and reputational risks associated with the infringement of competition rules. But when policies to prevent infringements fail, compliance requires a plan to quickly and effectively detect, investigate and react to such infringements. 

Internal investigations as part of a compliance program

Effective internal investigations should be a key element of any compliance program. They might serve to abort infringements and to adopt measures that could reduce the consequences by, for example, allowing the company to consider entering into a leniency program to avoid or minimize the fines that competition authorities could impose. 

Internal investigations have to be effective and, at the same time, respectful of the employees' rights, particularly those relating to privacy. Finding the balance between the effectiveness of the investigation and the full respect to Labor, Privacy and Data Protection laws might be a challenge, particularly in those jurisdictions, such as Spain, that protect the employee. 

Based on our experience, these are the main issues that should be generally considered in internal investigations. Most of them are common to all jurisdictions. However, local regulations differ as regards requirements that guarantee the lawfulness of the internal investigation. 

Steps for conducting effective internal investigations

First step: checking internal policies in place

Today, most companies have competition law compliance programs in place. We have observed, though, that not all of them include specific protocols on internal investigations. More importantly, some of them do not have adequate policies in place that would allow future effective investigations.   

Firstly, the employee shall be informed in advance of the possibility that the company carries out unannounced internal investigations and the specific measures that can be implemented for such investigations. 

Secondly, the company needs a specific policy limiting the use of corporate devices (computers, laptops or phones) to strict work purposes and prohibiting their use for personal matters. In particular, all employees shall be informed that, in case of suspected irregularities in the performance of their duties, communications may be monitored without notice. 

As further explained below, a lawful access to electronic documentation of the employees is only possible if said Policy had been duly communicated in advance to the employee. In future administrative or judicial proceedings, the evidence gathered during the internal investigation would only be valid if the company proofs that the employee was informed about the existence of the policy, of the restrictions foreseen and of the scope and nature of the possible monitoring by the employer. 

Second step: the design of a specific action plan for the internal investigation

In case the company suspects that there could have been a breach of competition law, the design of an ad hoc action plan is essential in order to ensure that the investigation is effective and, at the same time, that legal guarantees are respected and that the evidence obtained is valid in future judicial proceedings.

The action plan must be clear and structured, setting out the steps to be followed and respecting during all the investigation the rights of the employees, for instance: right of privacy; right of confidentiality; right to have legal assistance from an attorney or the right to not incriminate oneself.

Although, employees' obligations may vary between jurisdictions, they generally must collaborate with the company when conducting an internal investigation, including their participation in internal interviews, and making the devices assigned for professional purposes available for the company to review. 

This action plan shall be carried out with the highest level of confidentiality and it is recommended to evaluate the following elements: 

Establishing the scope of the investigation 

Based on the initial evidence, the company should establish what the suspected conducts to be investigated and who the employees that could have been involved are. The scope of the investigation might change in view of the findings but having an initial position on the objective and subjective scope of investigation is key to take the next decisions on the design of the action plan. 

Setting up a team 

Generally, there are no legal requirements in relation to who must carry out this type of investigations. However, the following shall be taken into account:
  • internally, the people that are typically involved are Legal, Compliance and HR;
  • the support of competition law experts is highly advisable: the previous experience in investigations and the knowledge of the subject matter is particularly useful for carrying out the interviews or designing the IT searches;
  • the support of digital forensics experts is also highly advisable in those investigations where access to electronic documentation is envisaged; apart from their expertise, as third parties, they might witness that the access to communications was done with all guarantees in case this needs to be proved in administrative or judicial proceedings.   

Planning and conducting the internal investigation 

The objective should be to gather as much information as possible and comply with all the steps of the process. 

The elements to consider are essentially, the interviews and/or the access to documentation (including or not communications):  

  • Conducting interviews and/or questionnaires to (i) the employee/s under investigation (ii) the employee/s who reported the suspected conducts, if any, and witnesses or people who normally work with the alleged offender (e.g. co-workers or superiors) to verify the facts and the context in which they occurred;
  • Conducting an IT Search and monitoring the employee's communications. 

The internal investigation can consist in only interviews, only IT Search or in a combination of both. The decision will depend on the seriousness of the suspected conducts, the complexity and the likelihood that the employee could be cooperative or not during the search. Obviously, the unannounced access to communications is the most aggressive measure and shall be reserved to the most serious cases.

When planning the investigation, the company should also consider sending preservation letters to the employees under investigation to inform them of the need not to delete physical or electronic documentation until the investigation has finalized.

Ultimately, a final report shall include the conclusions of the investigation, as well as the measures taken by the company with regard to the facts discovered and the consequences for the employee, if any.

Special care over monitoring of employees' communications

The monitoring process of the employee's communications must have all the guarantees.

This point has been the most controversial as it leads to a confrontation between the employer's powers of supervising and monitoring of their employees and the employee's own right to preserve their private life and correspondence. 

In 2017, the judgment of the Grand Chamber of the European Court of Human Rights ("ECtHR") in the case of Bărbulescu v Romania[1]  clarified how to maintain the balance between these rights. The Bărbulescu test makes the lawfulness of the access to communications of the employee conditional to the following:

i) the employee has to be clearly notified in advance of the possibility that the employer might take measures to monitor correspondence and other communications; 

ii) the monitoring may be carried out on the devices provided by the company only, never on the employee's personal devices;

iii) the duration of the monitoring by the employer must be only the necessary to verify the possible infringement and must not be exceeded by accessing personal or non-related information for the purpose of the investigation;

iv) the number of people accessing the communications should be reduced to the minimum necessary;

v) the employer has to provide legitimate reasons to justify the monitoring of the communications; 

vi) if possible, employer should establish a monitoring system based on less privacy-intrusive methods (i.e. that no other less restrictive measure is equally effective achieving that purpose); and

vii) the use of the results by the employer should be strictly limited to achieve the declared aim of the measure.

This test has already been applied by some national courts. In 2018, the Spanish Supreme Court decided on the Inditex case[2] by stating that a company access must be necessary and justified based on a reasonable suspicion of irregular conduct by the employee in question. 

From a practical perspective, these are other issues to consider:

  • The company may need to copy information (including professional documents and e-mail correspondence) located on the Company servers or electronic devices assigned to the employees for business purposes.
  • The presence of the employee during the access to the communications is not typically mandatory, although it may be advisable under certain circumstances to give more transparency to the process and to promote the collaboration of the employees involved. 
  • The company may need to request the authorization of the employee in order to investigate his professional mail box in case the company has not implemented business policy on this matter or it cannot prove that such policy has been duly notified to the employee. 
  • The search should be strictly limited to the object of the investigation, so it is standard practice to filter the information with a narrow list of keywords used in the context of the employees' responsibilities that can be of utility in identifying relevant information in relation to the conducts under investigation. In addition, this search should be also limited to a reasonable time period according to the events that triggered the investigation. 
  • Even if the information copy is filtered, it is possible that private e-mails not identified as such may be inadvertently accessed. So, the company must commit to leave private e-mails identified as such out of the scope of the investigation. 
By way of example, the Spanish Supreme Court established in the Trimarine case[3] , illegitimate access to the employee´s electronic devices makes the evidence invalid and the company cannot make a fair dismissal by presenting such evidences.

Final steps: considering possible disciplinary measures

If the internal investigation confirms that there is a breach of competition law, the company needs to consider the implementation of certain disciplinary measures against the employees. 

The possibility of adopting disciplinary measures may vary from country to country.  

Generally speaking, the appropriate measure would depend on the seriousness of the infringement ranging from a warning notice to dismissals:

  • For minor misconducts, consequences for the employees might involve warnings or withholding of salaries and bonuses for a limited period. In these cases, companies shall considering reinforcing competition law compliance trainings in order to prevent future violations.
  • In case of serious infringements, the company may decide to terminate the contractual relationship with the employees involved. It must again be recalled how important it is to comply with all guarantees during the gathering of the evidences proving the employee's infringement, so that it can be considered a justified dismissal.
But the consequences for the employee are not limited to the internal scope of the company. 

Potential fines for employees participating in the infringement 

A significant number of countries envisage heavy fines for employees participating in the infringement. In United Kingdom, for example, the CMA can seek the disqualification of an individual from holding company directorships for a maximum period of 15 years, where that individual is a current or former director of a company that has infringed UK competition law. 

The consequences for employees infringing competition law may even be more severe, as some jurisdictions contemplate prison penalties for individuals participating in competition law infringement. In Europe, this is the case of Denmark, United Kingdom, France, Czech Republic or Hungary. The US and Australian legal systems also establishes this possibility.

In any event, it is advisable to regularly re-evaluate the effects that such investigation may have on the employees' performance and activity of the company. 

Additional considerations: applying for leniency

Corporations and individuals who report a cartel activity and cooperate with competition authorities can avoid fines and criminal conviction, where applicable, if they meet the requirements of a leniency program.

In those cases where, as a result of the investigation carried out internally, the company detects evidence of a cartelization , the submission of a leniency application shall be considered in order to obtain full immunity from the sanction (only for the first in the queue) or at least a reduction in the amount. The pace of gathering evidence to submit a complete leniency application to the correspondent competition authority is essential, for which collaboration of employees involved may be crucial.

At European level, except in certain jurisdictions such as France, Finland, Italy, Czech Republic or Hungary, both legal and natural persons may submit a leniency application, hence employees can benefit from the advantages of this program on an individual basis. 

In fact, leniency applications submitted by the companies may be extensive to their employees, since the exemptions or reduction of the potential fines granted to the company would also benefit its employees who are considered as personally liable of the participation in the cartel in question (e.g. Denmark, Germany, Spain or United Kingdom). However, it should be taken into account that this extension may not be automatic, given that some jurisdictions require that employees explicitly declare that they want to be considered as co-leniency applicants or closely cooperate with the leniency application filed by the company (e.g. the Netherlands or Belgium, respectively).

It should be taken into account, however, that this does not apply the other way around (i.e. leniency application submitted by individuals does not cover their employers). This situation shall become problematic when it is the employee who applies for leniency separately, which can lead to a direct conflict of interests between the employee and the company. This usually happen, for instance, in situations of dismissal as a consequence of the investigation conducted internally.

This is certainly sensitive matter that requires the company to balance and treat with caution the measures implemented. 

Appendix: overview of different jurisdictions

Most jurisdictions present strong similarities in relation to applicable law and procedures carried out when the companies suspect that an employee is infringing competition law. Nonetheless, significant differences can be seen among countries, even within the European Union.

In particular, the consequences for natural persons involved in a competition law infringement and the submission of leniency applications may considerably vary from one country to another. 

The following table has been drawn up to provide a brief overview of sizeable differences across countries.

Therefore, seeking local advice on what are the appropriate steps that should be carried out regarding an internal investigation and rules that should be followed can be a determining factor for a successful development of the investigation.

For further information or questions, our Bird & Bird offices have lawyers with extensive experience in this area and are well positioned to address the national specificities that companies can face when conducting internal investigations. 


[1] Judgement of the European Court of Human Rights on Case Bărbulescu v Romania (Application no. 61496/08) - 5 September 2017.

[2] Judgement of Spanish Supreme Court (Appeal No. 1121/2015; ECLI: ES:TS:2018:594) – 8 February 2018.

[3] Judgement of Spanish Supreme Court (Appeal No.1674/2017 ECLI: ES:TS:2018:3754) - 23 October 2018.