Written by Global Investigations Review on November 13, 2024
Milton L Williams, Avni P Patel, Jacob Gardener, Walden Macht & Haran
This is an extract from the Edition 9 of GIR’s The Practitioner’s Guide to Global Investigations. The whole publication is available here.
This is an Insight article, written by a selected partner as part of GIR’s co-published content. Read more on Insight
1 Introduction
Unless required by contract or subpoena, employees and former employees have the right to decline to provide information or documents in connection with a corporate investigation. However, many employers will insist on employee cooperation and may impose disciplinary measures – up to and including dismissal – on those employees who refuse, even if the employee’s cooperation would tend to incriminate them.
A 2016 decision from the United States Court of Appeals for the Second Circuit in Gilman v. Marsh & McLennan Companies, Inc[1] is instructive. Two employees argued that Marsh & McLennan’s demand that they submit to an interview in an internal investigation constituted state action that infringed their right against self-incrimination. The court rejected this argument, calling it ‘the legal equivalent of the “Hail Mary pass” in football’.[2]
Although employees generally cannot refuse to participate in investigations without risking their employment, they do possess various rights implicated by corporate investigations. The sources of those rights include the employer and federal and state law.
With respect to the employer, many companies have policies and procedures for internal investigations; for instance, employee handbooks, company by-laws, written guidelines and employment agreements often contain provisions regarding employee data and document collection, workplace searches, communication monitoring, privacy and confidentiality. These documents may also provide guidance on an employee’s right to indemnification for legal fees expended during an investigation or related proceedings. In addition, many companies maintain written policies that protect employees from retaliation for participating in an investigation. These documents, and unwritten but established company procedures, should be considered to understand the protection afforded to employees in an investigation.
Federal and state law also govern the rights of employees involved in investigations. These rights, discussed below, can be divided into four general categories: (1) the right to be free from retaliation; (2) the right to representation; (3) the right to privacy; and (4) the right to indemnification.
2 Right to be free from retaliation
Although employees generally have no right to refuse to participate in a corporate investigation, they are protected from retaliation. A number of federal employment statutes prohibit retaliation against employees who participate in corporate investigations.[3] State and local laws provide similar protection.
Moreover, employees who possess information regarding corporate misconduct have some leverage in that they may become whistleblowers, who are protected from retaliation under federal[4] and state whistleblower laws.[5]
The Sarbanes-Oxley Act of 2002 (Sarbanes-Oxley) provides for both civil and criminal penalties for employers who retaliate against whistleblowers. Section 806 of the law, which governs civil penalties, prohibits publicly traded companies from retaliating against employees who assist or provide information to law enforcement, Congress or ‘a person with supervisory authority over the employee’ regarding activity the employee reasonably believes is a violation of (1) federal law regarding mail, wire, securities or bank fraud, (2) a Securities and Exchange Commission (SEC) rule or regulation, or (3) any provision of federal law relating to fraud against shareholders.[6]
Section 1107 of Sarbanes-Oxley provides for criminal penalties for retaliation against whistleblowers. Specifically, it criminalises ‘[w]hoever knowingly, with the intent to retaliate, takes any action harmful to any person, including interference with the lawful employment or livelihood of any person, for providing to a law enforcement officer any truthful information relating to the commission or possible commission of any Federal offense’.[7]
Section 922 of the Dodd-Frank Wall Street Reform and Consumer Protection Act (Dodd-Frank) provides anti-retaliation protection for whistleblowers who report possible securities law violations to the SEC.[8] Similarly, Section 748 of Dodd-Frank protects whistleblowers who report violations of the Commodity Exchange Act to the Commodities Futures Trading Commission.[9] And Section 1057, which codifies the Consumer Financial Protection Act of 2010, forbids retaliation against employees who blow the whistle on possible violations of that statute.[10] However, neither the Sarbanes-Oxley nor the Dodd-Frank anti-retaliation provisions apply extraterritorially; in other words, they do not cover persons employed overseas by a foreign subsidiary of a US-based corporation.[11]
Despite their similarities, there are important differences between the whistleblower protections contained in Sarbanes-Oxley and Dodd-Frank. Procedurally, in contrast to Sarbanes-Oxley’s requirement that complaints be filed with the Department of Labor within 180 days of the retaliatory act or the complainant’s discovery of the retaliation,[12] Dodd-Frank permits an employee to bring a private cause of action directly, without having to go through an administrative agency,[13] and allows the employee to do so within six to 10 years, depending on the circumstances.[14] In addition, Dodd-Frank provides more attractive financial incentives for whistleblowers. A whistleblowing employee who prevails under Dodd-Frank may receive up to twice the amount of wages lost due to retaliation, as well as attorneys’ fees.[15]
Under Sarbanes-Oxley, by contrast, a whistleblower’s recovery is limited to the ‘relief necessary to make the employee whole’, including reinstatement, back pay, ‘special damages’ (which include damages for non-economic harm such as reputational injury, mental anguish and suffering), attorneys’ fees and costs.[16]
Critically, however, whereas Sarbanes-Oxley protects employees who report concerns to supervisors at their company, Dodd-Frank does not. Dodd-Frank defines ‘whistleblower’ to mean a person who provides ‘information relating to a violation of the securities laws to the Commission’.[17]
3 Right to representation
Employees do not have an automatic right to counsel during an internal investigation,[18] unless contractually provided under the terms of their employment.[19] Nonetheless, employees may choose to retain counsel, particularly if they face liability.
Concerns about individual criminal liability have increased since September 2015, when the then Deputy Attorney General Sally Quillian Yates issued a memorandum titled ‘Individual Accountability for Corporate Wrongdoing’ (Yates Memorandum). The Yates Memorandum stressed the importance of combating corporate misconduct by holding individuals accountable. It listed six steps that should be part of all investigations and prosecutions of corporate misconduct, the first of which is that a corporation’s eligibility for cooperation credit depends on it providing the Department of Justice (DOJ) with all relevant facts about the individuals involved in the alleged misconduct. The Yates Memorandum also stated that all investigations must focus on individuals from the inception of the investigation and that, barring extraordinary circumstances, which must be personally approved in writing by specified DOJ personnel, DOJ attorneys will not agree to any settlement or corporate resolution that dismisses charges or provides immunity for individual officers or employees. During the past decade, the DOJ has repeatedly emphasised its focus on individual accountability and incorporated the basic principles of the Yates Memorandum in the DOJ’s Justice Manual.
On 28 October 2021, Deputy Attorney General Lisa Monaco announced that the DOJ would restore prior guidance ‘making clear that to be eligible for cooperation credit, companies must provide the DOJ with all non-privileged information about individuals’ – regardless of position, status or seniority – ‘involved in or responsible for the misconduct at issue’.[20] This announcement ended the approach used by the DOJ since 2018 that allowed companies to limit disclosures to those they assessed to be ‘substantially involved’ in the misconduct. Deputy Attorney General Monaco further articulated and refined the DOJ’s policies with respect to prosecuting corporate crime in a speech delivered on 15 September 2022[21] and in a memo[22] released the same day. Among other things, she reiterated that ‘the Department’s number one priority is individual accountability’. In March 2024, both Attorney General Merrick Garland and Deputy Attorney General Monaco reaffirmed that individual accountability is the DOJ’s ‘first priority’.[23]
3.1 Interviews without employee’s counsel
An employer may seek to conduct an interview of an employee, either with or without company counsel present, before that employee has appointed counsel.[24] Once the employee offers an account of events, it may be difficult to offer a different one later.
When counsel for individuals are appointed, they should obtain all information regarding their clients’ prior statements about the subject of the investigation, including requesting any relevant memoranda created in prior interviews. Individual counsel should also request all documents, data and other information pertaining to their clients’ involvement in the subject of the investigation. Requests for such information may be directed to the client, company counsel, law enforcement and other witnesses (or their counsel). Even if counsel is not allowed to participate in a client’s investigatory interview, they should use the acquired information to prepare their clients.[25]
3.2 Separate representation arranged by the employer
Whether the employer agrees to arrange for counsel can depend on a number of factors, such as the employee’s contractual and indemnification rights, state and local laws, the corporate by-laws and the potential conflict of interest between the employee and the corporation. Although separate representation of an employee can increase expenses and lengthen the investigation, it can also provide certain advantages to the company. It can reduce any suggestion of improper influence by the company over the employee, which can bolster the company’s credibility with the government when reporting the results of the investigation and increase the company’s cooperation credit. In some circumstances (particularly when individual counsel has a good working relationship with company counsel), it can facilitate communication with the employee. Company and individual counsel should come from different law firms.
Arranging for individual representation can also deter the government from communicating directly with the employee.
When confronted with multiple employees who warrant separate counsel, employers may seek to reduce costs by arranging for pool counsel to represent the entire group; however, this pool arrangement must be reassessed if a conflict of interest arises within the group.
4 Right to privacy
Federal and state laws protect employees from unauthorised monitoring of their personal data. An employer seeking to investigate wrongdoing through electronic surveillance must be mindful of these laws.
In most circumstances, an employer can conduct searches of its workplace and computer system to investigate wrongdoing. Such searches are largely unprotected by privacy laws as workspaces, computer systems and company-issued electronic devices are generally considered to be company property. Many companies explicitly address this in written corporate policies and employment agreements. However, unwarranted or unreasonable invasions of privacy during a workplace search may be protected under state law, including state constitutional,[26] statutory[27] and common law.[28]
Employees who use their own personal electronic devices for work should be aware that work-related data stored on those devices belongs to the employer; therefore, employees are advised to refrain from using their personal devices for work and instead maintain separate work devices. Concerns arising from the use of personal devices for work have become more salient in an era where more employees are working from home; therefore, it is all the more important now that employers maintain and update their privacy and bring-your-own-device policies and that these policies are documented and well defined and require written acknowledgement by employees. If an employer seeks to obtain or review work-related data from an employee’s personal device, the employer must be careful to exclude any personal data.
Title I of the Electronic Communications Privacy Act of 1986 (ECPA) prohibits the interception of oral, wire and electronic communications.[29] Title II of the ECPA prohibits unauthorised access to stored communications.[30] Both Sections impose criminal liability of up to five years in prison under Title I[31] and up to 10 years in prison under Title II.[32] Both Sections also provide a private right of action allowing victims to recover actual damages, punitive damages, litigation costs and attorneys’ fees.[33]
The ECPA contains two important exceptions that concern employers. First, it permits interception of communications or access to wire, oral or electronic communications when one of the parties participating in the communications has given consent.[34] Consent may be inferred from surrounding circumstances indicating that the party knowingly agreed to the surveillance. As the First Circuit has explained:
Consent may be explicit or implied, but it must be actual consent rather than constructive consent . . . Consent should not casually be inferred. Without actual notice, consent can only be implied when the surrounding circumstances convincingly show that the party knew about and consented to the interception.[35]
Implied consent is generally found whenever an employee is notified in advance about the monitoring. However, courts have refused to find implied consent based on knowledge of the mere capability of monitoring.[36]
The ECPA also permits interception of, or access to, communications by the entity that provides the electronic communications service or system. An employer may therefore monitor and search emails sent on its email system. It may also monitor and record employee telephone calls ‘in the ordinary course of its business’.[37] Employees should be aware that some employers may choose to install surveillance monitoring systems into work accounts, databases and company-provided devices. As technology and communications systems advance, employees should also be conscious of their activities on new communications platforms. Some messenger services used by companies, such as Slack, have announced privacy policies that allow employers to download all data from their workspace, including all employee data and messages.[38]
An employer seeking to investigate wrongdoing through electronic surveillance must also be aware of state law. Most states (and the District of Columbia) prohibit electronic surveillance of communications unless at least one party to the communication provides consent. Some of these jurisdictions provide exemptions for employer monitoring of employee communications. Fourteen states – California, Connecticut, Delaware, Florida, Illinois, Maryland, Massachusetts, Michigan, Montana, Nevada, New Hampshire, Oregon, Pennsylvania and Washington – prohibit to some degree, either criminally or civilly, surveillance without the consent of all the parties to the communication.[39] In addition, some states – including Connecticut, Delaware and New York – have enacted laws requiring employers to notify – and, in the case of New York, obtain express authorisation from – employees before monitoring their electronic communications.[40]
State common law rules also provide for whether and how employers may monitor employees. Most notably, states that recognise a common law right to privacy may prohibit employers from violating employees’ reasonable expectations of privacy. What expectations of privacy are reasonable generally turns on the facts, including the wording of the company’s written monitoring policies, the notice (if any) provided regarding these policies, the nature of the device (personal or company-issued) and the nature of the monitoring.[41]
In sum, if an employer insists on monitoring the devices its employees use for work, clear policies and written consent are critical.
5 Remote workplace investigations
Following the covid-19 pandemic, companies have had to adjust to remote working, which, among other consequences, has made it challenging to conduct internal investigations. If investigators proceed with remote interviews, they should take steps to prevent witnesses from making unilateral recordings[42] or interviewing in the presence of third parties, and should be mindful that the interviews may be regarded as having occurred in each of the jurisdictions where the participants are located (requiring consideration of each jurisdiction’s laws governing privilege and data privacy). Such measures are important for fulfilling one’s ethical obligation to ‘make reasonable efforts to prevent the inadvertent or unauthorized disclosure of, or unauthorized access to, information relating to the representation of a client’.[43]
6 Indemnification and advancement
Among the significant issues that may arise from in-house counsel, and often external counsel, representing the company and not the employee is whether individuals have a right to indemnification or advancement (or both).[44]
Employees have the right to choose their own counsel, even if the company pushes for joint representation by company counsel. If an employee so chooses, the complicated question of whether the company must indemnify the employee for costs around separate representation may arise. Determining a company’s obligations requires close review of any agreements and understandings that might give rise to indemnification or advancement of fees. It is critical that an employee communicate closely with company counsel to come to a mutual understanding of the company’s obligations.
6.1 Determining whether the company must advance fees or indemnify the employee
Employees should ask their counsel to engage assertively in communications with the company and company counsel to determine the extent, if any, to which the company will advance fees or indemnify the employee (or both). If the company agrees to, or must, indemnify under any agreement or other source of this right, the employee’s counsel should draft and execute a written agreement binding the company. Although the company may seek to impose unfavourable terms, it is generally advisable to reduce the indemnification or advancement obligations to writing.
Employees and their counsel should carefully review potential sources of the right to indemnification or advancement (or both). These may include company by-laws, local law in the state of incorporation, company policies and insurance policies of the employer.
6.2 Potential sources of right to indemnification
6.2.1 Corporate by-laws
Corporate by-laws often delineate the company’s obligation to indemnify an employee for costs arising out of representation for internal investigations or any matters relating to an employee’s official duties. Corporate by-laws require careful review because even if indemnification and advancement obligations are provided, they are often listed with limitations or releases from obligation. In some cases, the company will require the employee to sign an undertaking letter, whereby the employee agrees to repay any amounts received if it is later determined that the employee was not entitled to indemnification or advancement (or both).[45]
6.2.2 Local law in state of incorporation
State and local laws may impose indemnification obligations on companies for private employees. Review of state and local laws is often overlooked because employees assume indemnification provisions are exclusively contained in corporate by-laws and any employment or subsequent agreements with the company.
For example, Delaware law requires corporations to indemnify any present or former director or officer if they are successful in any defence of any proceeding (or in defence of any claim, issue or matter therein) in which the individual was a party by reason of the fact that they are or were a director or officer and so long as the individual acted in good faith and in a manner reasonably believed to be in or not opposed to the best interests of the corporation.[46] However, Delaware law grants corporations the discretionary power only to indemnify directors and officers for costs incurred as a result of threatened or pending litigation.[47] Delaware law also grants corporations the discretionary power to advance attorneys’ fees.[48]
In other states, such as Oregon and Washington, state law requires corporations to indemnify directors and officers if successful in the defence of any proceeding to which the director or officer was a party because of being a director or officer, unless the company’s articles of incorporation provide otherwise.[49]
California is an example of a state that extends mandatory indemnification protections to all employees, not only directors or officers. Under California law, indemnification is required so long as the director, officer or employee was successful on the merits in defence of a proceeding (or in defence of any claim, issue or matter therein).[50] Further, the California Labor Code provides that indemnification is required ‘for all necessary expenditures or losses incurred by [an] employee in direct consequence of the discharge of his or her duties’.[51]
Employees should be aware that even when state legislation imposes obligations on a company to indemnify a private employee for legal costs, the company is not necessarily obliged to indemnify the employee if the employee chooses to retain separate counsel. New York is an example of a state where the statutes provide that even when an employer is obliged to indemnify a private employee, the employee must show that the attorneys’ fees in question were ‘reasonable’ and ‘necessary’,[52] which places the burden on the employee to show why representation separate from company counsel is necessary. This places employees in a difficult position if they have reason to believe that their interests would be better served with separate counsel but would have to forgo having certain legal costs covered by their employer. Employees who believe they will be indemnified pursuant to state law should adequately review the statute to ensure that they understand the parameters – and potential limitations – of indemnification obligations at the onset of an investigation.
6.2.3 Company policies
Employees should also look at company policies and employment contracts or subsequent agreements as sources of indemnification rights. Employees may have contractual indemnification rights in their employment agreements.[53] Even if the company by-laws do not indicate a right to indemnification, a company must honour any obligations in individual employment agreements. As a strategic point, employers may expand the scope of indemnity to ensure cooperation of current and former employees, which may show the company in a more favourable light to any regulator or investigative body.
6.2.4 Insurance policies of employer
Many employers choose to purchase directors’ and officers’ (D&O) insurance owing to the prevalence of class actions, derivative suits and prosecutorial and regulatory investigations targeting not only companies but also their directors and officers.
If the employer has D&O insurance, the nature of the allegations and the terms of the specific policy may trigger payment of defence costs. Therefore, directors and officers should carefully review the terms, conditions, provisions and exclusions of any D&O policy.
6.3 Advocating for advancement and indemnification
Companies are not always eager to indemnify employees for representation or costs incurred during an investigation or defence. However, employees should review possible sources of company obligation and advocate for companies to indemnify them for incurred costs or advancement of fees, including before entering any employment or separation agreement.
The employer or company may become more credible and promote efficiency and effectiveness of an internal investigation by ensuring that employees are adequately represented. If company counsel recognises a conflict of interest and the need for the employee to have separate representation, the corporation benefits if the employee is cooperative. The company may therefore assess the employee’s involvement and whether failure to pay individual counsel fees or to advance attorneys’ fees will make the employee’s cooperation less likely. While in some instances employees may be required to cooperate by subpoena, it is in the best interests of the corporation to work jointly with the employee to prepare its own defence and receive information in advance through a joint defence agreement.
In addition, regulators and prosecutors cannot take into account during an investigation whether a corporation is advancing or reimbursing attorneys’ fees or providing counsel. Along the same lines, a prosecutor or regulatory body cannot request that a company refrain from taking such action. In 2008, the DOJ published the Filip Memorandum,[54] which laid out the principles of federal prosecution of business organisations. The guidelines, codified in the US Attorney’s Manual (now called the Justice Manual), state that: ‘In evaluating cooperation, however, prosecutors should not take into account whether a corporation is advancing or reimbursing attorneys’ fees or providing counsel to employees, officers, or directors under investigation or indictment.’[55]
7 Situations where indemnification may cease
Employees should be aware of the circumstances in which a company’s obligations to indemnify may cease. As mentioned, a company’s obligations to indemnify an employee may be contingent on, and circumvented by, any undertaking agreement between the parties. Further, a company is generally released from its indemnification obligations for any violation of an undertaking agreement (substantive or procedural) and fraud or bad faith.
In some instances, an employee’s failure to cooperate with a company’s investigation could absolve the company’s obligation to cover individual costs. This can create a difficult decision for an employee regarding whether to cooperate where failure to do so will affect indemnification. Even if an employee does not want to cooperate with company counsel – internal or external – and submit to an interview or otherwise cooperate, the employee may still be called to produce testimony or information pursuant to a subpoena.
8 Privilege concerns for employees
Privilege considerations become central during investigations. Because of the various permutations of attorney–client relationships with both internal and external counsel, it is important for employees to remember that they only enjoy protections over communications with individual counsel. When an employer interviews an employee, the conversation is protected by the attorney–client privilege, but the privilege belongs to the company, not the employee.
An employee and his or her counsel should note whether the company counsel issued a proper Upjohn warning and whether it was documented. If an inadequate Upjohn warning was given, an employee’s counsel may attempt to prevent or limit disclosure of any statements made by the employee in an interview where individual counsel was not present.
The Third Circuit established the Bevill standard to determine whether a company employee holds a joint privilege with the employer over communications with corporate counsel, which has since been adopted by the First, Second, Ninth and Tenth Circuits.[56] The Bevill standard holds that ‘any privilege that exists as to a corporate officer’s role and functions within a corporation belongs to the corporation, not the officer’.[57] The court in Bevill extended the privilege to officers and employees in an individual, personal capacity only when the employee satisfies the following five-factor test:
- they must show that they approached counsel for the purpose of seeking legal advice;
- they must show that when they approached counsel, they made it clear that they were seeking legal advice in their individual capacity rather than in their representative capacities;
- they must demonstrate that counsel saw fit to communicate with them in their individual capacities, knowing that a possible conflict could arise;
- they must prove that their conversations with counsel were confidential; and
- they must show that the substance of their conversations with counsel did not concern matters within the company or the general affairs of the company.[58]
Notwithstanding the foregoing, an employee would be ill-advised to confide in, or speak candidly with, company counsel given the subjective nature of the standard and make efforts to secure personal individual counsel.
Finally, as a practical matter, employees should be aware that communications with other employees or colleagues regarding the investigation are not privileged regardless of whether the colleague is also involved in the investigation or represented by the same counsel. Even if an employee believes he or she is sharing attorney communications with other employees who need to know the attorney’s advice and who also have an attorney–client privilege with the same counsel because he or she is involved or implicated in the investigation and also represented by company counsel, it is always prudent to refrain from sharing privileged information. In addition, employees should attempt to communicate with individual counsel on personal and non-company devices to ensure that the privilege is protected.
