1. Do any specific procedures need to be considered in case a whistleblower report sets off an internal investigation (e.g. for whistleblower protection)?
There are no specific rules on whistleblower reports. Companies falling in the scope of the Anti-Corruption Law must have an anti-corruption program (the “Model Anti-Corruption Program”) in place. The respective anti-corruption authority published a template for such a program. According to this template, such programs must also include processes on the performance of internal investigations, including, e.g., responsibilities, the timing of the investigation, internal and external reporting obligations, documentation, retention periods, and retaliation measures.
As a general rule, where the internal investigation relates to potential criminal conduct, all companies are obliged to notify law enforcement authorities about “serious” and “particularly serious” crimes. A failure to notify the same is a crime.
2. Do the following persons/bodies have the right to be informed about an internal investigation before it is commenced and/or to participate in the investigation (e.g. the interviews)?
a) Employee representative bodies, such as a works council
b) Data protection officer or data privacy authority
c) Other local authorities
What are the consequences in case of non-compliance?
a) Trade unions established within individual companies (so-called “primary trade union organizations”) will only have the right to be informed about and/or participate in, an internal investigation when the investigation relates to accidents and/or occupational diseases of employees who are members of the respective trade union (i.e. a disease that occurs as a result of work or occupational activity). Violation of this right can result in a small fine.
b) Companies have the obligation to notify the data protection authority in Ukraine (the Ukrainian Parliament Commissioner for Human Rights) about the processing of sensitive personal data, not related to employment issues, within 30 days after the start of processing. This obligation also applies to internal investigations where such data is being processed.
Non-compliance with this obligation can lead to an administrative fine of up to UAH 6,800 (approximately EUR 206) for each violation and up to UAH 34,000 (approx. EUR 1,030) for repeated violations.
There are no obligations to notify the data protection officer(s) of the investigated company.
c) Where the company is public (as described in question 1), upon becoming aware of any corruption incident or after receiving information about a possible corruption incident, the heads of the public body and its departments must take measures to stop the violation and immediately inform the responsible anti-corruption state authorities.
Financial institutions (e.g. banks and insurance companies), stock exchanges and other companies conducting financial monitoring have to notify the State Financial Monitoring Service of Ukraine and the respective law enforcement authorities within a day when a financial transaction conducted or monitored by them is, or may be, related to a crime.
Private companies are not obliged to notify law enforcement authorities or involve them in internal investigations.
However, the company must notify the law enforcement authorities about the results of the investigation if a corruption offense was determined. Besides, Ukrainian law foresees a notification obligation for individuals and potential criminal liability in cases where an individual becomes aware of conduct pertaining to certain serious and/or particularly serious crimes.
3. Do employees have a duty to support the investigation, e.g. by participating in interviews?
If so, may the company impose disciplinary measures if the employee refuses to cooperate? There is no explicit obligation under Ukrainian law for employees to support an internal investigation. However, the employee is obliged to fulfill any lawful order of the employer. This can also include an order to support an internal investigation. Not supporting the investigation may trigger disciplinary penalties, including dismissal.
4. Can any labor law deadlines be triggered or any rights to sanction employees be waived by investigative actions? How can this be avoided?
There are no labor law deadlines triggered or any rights to sanction employees waived by investigative actions. However, disciplinary actions against an employee under labor law can only be conducted within six months after the violation took place. This time limit only affects labor law actions against the employee.
5. Are there any relevant data privacy laws, state secret laws, or blocking statutes in your country that have to be taken into account before
a) Conducting interviews?
The provisions relating to personal data are contained in the law “On Personal Data Protection”. Currently, Ukrainian lawmakers are working on an update of this law, which will reflect standards of the EU General Data Protection Regulation 2016/679.
Personal data includes all information which can be used to identify an individual. If a company or its representatives collect personal data of individuals during an internal investigation, the company is obliged to inform the respective data subjects about the purposes of the collection, the respective processing actions (e.g. transfer, retention, and use of the data), the persons involved in the processing actions, the data subject’s rights and potential transfers of the data to foreign countries.
We suggest obtaining a waiver of data protection rights from the interviewee beforehand and/or asking to sign a commonly used privacy notice.
Ukrainian law prohibits the transfer of personal data from Ukraine to outside Ukraine, if the relevant country does not have an adequate level of data protection compared to Ukrainian law. Under Ukrainian law, “safe” countries to transfer data to are, in particular,
Ukrainian law further prohibits the provision of data or information relating to (i) state secrets or bank secrets, (ii) falling under a professional confidentiality obligation (e.g. doctor-patient, attorney-client), and (iii) specifically labelled as confidential information by the owning company. During an internal investigation, interviewees with access to such information are prohibited to disclose it. Ukrainian law only allows the release of such information when it is officially requested by public authorities. We suggest assessing beforehand if the information requested from the interviewee can fall into one of the above categories.
We suggest anonymizing the collected personal data as far as possible to avoid any potential violation of Ukrainian Data Protection law and not to burden the investigating company with unnecessary notification obligations.
b) Reviewing emails?
Reviewing private emails without a court ruling can constitute a violation of the constitutional right for secrecy of correspondence and can be a criminal offense.
The potential obligations for the investigating company in relation to data privacy, state secrecy and confidentiality outlined above at question 5a also apply in relation to the collection and review and other use of emails of employees and/or third parties. The investigating company would have the obligation to inform each data subject about the processing actions and the purpose, as well as about safeguarding actions undertaken (e.g. in cases of data transfer abroad).
In this regard, we also suggest anonymizing the collected personal data as far as possible.
c) Collecting (electronic) documents and/or other information?
The potential obligations for the investigating company in relation to data privacy, state secrecy and confidentiality outlined above at question 5a also apply in relation to the collection and use of other documents and information. In this regard, we also suggest anonymizing the collected personal data as far as possible.
d) Analyzing accounting and/or other mere business databases?
Accounting or business databases may contain personal data or information constituting state secrets or bank secrets. In such cases, the restrictions and obligations as outlined above in question 5 a) would also apply here.
6. Before conducting employee interviews in your country, must the interviewee
a) Receive written instructions?
There is no obligation for a company to provide any instructions to its employees before interviewing them as part of an internal investigation.
b) Be informed that they must not make statements that would mean any kind of self-incrimination?
The right not to incriminate oneself is a constitutional right. An employee can assert it during any internal investigations.
There is no obligation of the employer to inform interviewed employees about this right.
c) Be informed that the lawyer attending the interview is the lawyer for the company and not the lawyer for the interviewee (so-called “Upjohn warning”)?
There is no such concept in Ukrainian law and no obligations in this regard.
d) Be informed that they have the right that their lawyer attends?
There is no such obligation for the employer. Such an obligation only applies to public criminal proceedings, and not interviews conducted as part of an internal investigation. However, the employee at their sole discretion has a right to take a lawyer to the interview.
e) Be informed that they have the right of a representative from the works council (or other employee representative body) to attend?
There is no general obligation for the employer to notify the interviewed employees about such right. Further, such right only exists where the investigation relates to accidents and/or occupational professional diseases of employees, who are members of the respective trade union.
f) Be informed that data may be transferred cross-border (in particular to the United States)?
Yes. When transferring personal data outside of Ukraine, the employee must give a prior general consent to the transfer and the receiving country must have an appropriate level of data protection (for countries with an appropriate level of data protection, see question 5a above).
When the receiving country does not have the appropriate level of protection (e.g. the United States), the employer can only transfer personal data to such country if one of the following exceptions is met:
The law requires the employer to inform its employees that their personal data has been passed to third parties within 10 days after the transfer. This can be done by the prior signing of a privacy notice. Notification is not required when such transfer is required by investigating authorities, or if the employee signed a waiver of notice.
g) Sign a data privacy waiver?
Ukrainian law does not require employees to waive their data privacy rights before conducting employee interviews. However, the employer can ask the employee to sign such waiver on a voluntary basis.
h) Be informed that the information gathered might be passed on to authorities?
Yes. The law requires the employer to inform its employees that their personal data has been passed to third parties within 10 days after the transfer.
i) Be informed that written notes will be taken?
Ukrainian law does not provide for such an obligation.
7. Are document hold notices or document retention notices allowed in your country? Are there any specifics to be observed (point in time/form/sender/addressees, etc.)?
Yes. Although it is currently not common practice in Ukraine, we recommend to always use document-retention notices in connection with internal investigations and to include an adequately long period of retention. Such an approach can be very helpful in case of later investigations conducted by law enforcement authorities (e.g. the prosecutor department).
8. Can attorney-client privilege be claimed over findings of the internal investigation? What steps can be taken to ensure privilege protection?
Attorney-client privilege can be claimed in Ukraine and has no time limitation. However, attorney-client privilege covers only attorneys who have a special attorney license and are independent.
Attorney-client privilege covers client information, substantive advice, consultations, clarifications, documents drafted by the attorney, and other documents and information received from the client as part of the provision of legal advice. It also applies to the information provided by a person who consulted an attorney but did not become a client.
We suggest trying to include as many outside attorneys as possible when conducting an internal investigation to secure privilege, also with regard to foreign law regimes (e.g. the United States or the European Union).
In practice, Ukrainian public authorities occasionally still infringe attorney-client privilege. However, there are court proceedings which can help to protect the privilege rights.
9. Can attorney-client privilege also apply to in-house counsel in your country?
Attorney-client privilege in Ukraine covers only attorneys who have a special attorney license and are independent. Most lawyers practicing in Ukraine, including in-house counsel, do not have such a license. In-house counsel (i.e. those in possession of an attorney license) can act as attorneys for their employers on the basis of a legal assistance agreement.
However, an in-house counsel may not be seen as independent as necessary to obtain attorney-client privilege. Therefore, attorney-client privilege may not apply to in-house counsel. Future case law will show if the formal requirements will be sufficient to obtain a solid attorney-client privilege.
Nevertheless, it is generally advisable to try to include as many outside attorneys as possible when conducting an internal investigation to secure the privilege rights, also concerning foreign law regimes (e.g. the United States or the European Union).
10. Are any early notifications required when starting an investigation?
a) To insurance companies (D&O insurance etc. to avoid losing insurance coverage)?
D&O insurance is generally not offered by Ukrainian insurance companies. For other types of insurance (e.g. professional indemnity insurance, third-party insurance, product liability insurance), notification obligations are set by individual insurance contracts.
b) To business partners (e.g. banks and creditors)?
Relations between business partners are usually regulated by contract. Notification obligations may be set out in such contracts.
c) To shareholders?
The law does not specify an express obligation to inform shareholders when starting an internal investigation.
However, under Ukrainian law, the director is generally obliged to act in the interests of the company, in good faith and reasonably. This obligation can also include an upfront notification of shareholders before launching an internal investigation. Such an obligation should be assessed on a case-by-case basis.
There is an additional obligation for the director to provide information about the company’s activity, also including an internal investigation, at the shareholder’s explicit request.
The Model Anti-Corruption Program establishes an obligation to notify shareholders if a corruption violation has occurred or is suspected. Although this obligation is only obligatory for companies that participate in a public procurement procedure for projects exceeding UAH 20 million, and only during the specific tender procedure, state authorities recommend that other companies also should use such approach.
Corporate governance rules in this regard are not well-developed on a legislative level, although usually companies develop detailed internal regulations. An obligation to notify the shareholders might, therefore, also be based on the individual charter or policy of the respective company.
d) To authorities?
The Anti-Corruption Law and Model Anti-Corruption Program provides an obligation for the authorized representatives of the company (e.g., the CEO) to notify the respective public authorities about an administrative or criminal corruption offense known and discovered within an internal investigation. The Anti-Corruption Program is obligatory for companies participating in a public procurement procedure for projects exceeding UAH 20 million (currently, approx. EUR 606,060) and only with regard to the specific tender procedure. However, state authorities recommend that other companies also should adopt this approach.
11. Are there certain other immediate measures that have to be taken in your country or would be expected by the authorities in your country once an investigation is started, e.g. any particular immediate reaction to the alleged conduct?
Private companies have no obligation to take immediate measures with regard to an internal investigation. However, as a matter of practice, the company should try to stop any ongoing misconduct and consider remediation measures.
12. Will local prosecutor offices generally have concerns about internal investigations or do they ask for specific steps to be observed?
There are no concerns or specific steps required by prosecutors regarding internal investigations.
13. Please describe the legal prerequisites for search warrants or dawn raids on companies in your country. In case the prerequisites are not fulfilled, can gathered evidence still be used against the company?
Searches can be conducted only within the scope of an open criminal investigation. They are based on the mandatory ruling of the investigating judge. The initiators can be a prosecutor, or an investigator together with a prosecutor.
The court ruling must be provided to the company. The scope of the search must be within its outlined purpose. When the search is at a company’s premises, the search record is provided to the representative of the company.
Dawn raids without the prior approval of the investigating judge can be conducted by the investigator in exceptional cases, such as to save people’s lives or when chasing a suspect. Even in this case, the dawn raid must be authorized by the investigating judge retrospectively. If the dawn raid is not subsequently authorized, its results are considered invalid and inadmissible.
14. Are deals, non-prosecution agreements, or deferred prosecution agreements available and common for corporations in your jurisdiction?
Ukrainian law does not provide for deferred prosecution agreements or non-prosecution agreements. However, in criminal proceedings there is the possibility to conclude:
– а settlement agreement between the victim and the accused of minor crimes, crimes deemed to be of average weight and in criminal proceedings in the form of a private prosecution; and
– а plea agreement between the prosecutor and the accused for:
Criminal liability (currently, in the form of penalty fines of up to UAH 1,275,000 (currently, approx. EUR 38,636), confiscation of property and compulsory liquidation of the entity) can also apply to companies. In such cases, a settlement agreement or a plea agreement cannot be concluded.
A plea agreement requires the prior consent of the person whose private interests have been damaged. The agreement has to be approved by the competent court. Such agreements are common in Ukraine.
15. What types of penalties (e.g. fines, imprisonment, disgorgement, or debarment) can companies or its directors, officers, or employees face for misconduct of (other) individuals of the company?
Under Ukrainian law, directors can face liability for: (i) tax evasion (fines up to UAH 425,000 (currently, approx. EUR 12,878), and loss of the right to hold specific posts for up to three years and confiscation of assets), (ii) forgery of documents submitted for state registration of a legal entity (fine up to UAH 34,000 (currently, approx. EUR 1,030) or custodial restraint for five years and loss of the right to hold specific posts for up to three years), (iii) contentious insolvency (fine up to UAH 51,000 (currently, approx. EUR 1,545) and loss of the right to hold specific posts for up to three years), and (iv) violation of labor law.
Furthermore, directors can face liability claims from shareholders based on improper management which causes damage to the company. This is based on the director’s obligation to act in the best interests of the company.
Criminal liability for the company can be based on the misconduct of the employee (or its authorized agent) benefitting the company. These offenses may include, for example:
Criminal liability measures for private companies include a fine of up to UAH 1,275,000 (approx. EUR 38,636), confiscation of property or compulsory liquidation of the entity. The private company also has to compensate all losses, and, in case of a corruption offense, the amount of illegal benefit received or which could have been received as a result of the offense.
Public bodies, public entities financed from state or local budgets, or by international organizations are as legal persons exempted from certain criminal liabilities. However, their public officials and executives can, as individuals, be penalized for committing corruption offenses, including potential imprisonment of up to 12 years.
16. Can penalties for companies, its directors, officers, or employees be reduced or suspended in case the company implemented an efficient compliance system? Does this only apply in case the efficient compliance system had already been implemented prior to the alleged misconduct?
Yes, according to Ukrainian legislation, the existence of an implemented compliance system (in other words, measures taken by the company to prevent a crime) may reduce potential penalties. However, Ukraine has no strong case law or administrative guidelines for courts on how to take an existing compliance system into account. Therefore, a previously existing compliance system may influence the court’s decision, but this will rather depend on the specific judge.
17. Please briefly describe any investigations trends in your country (e.g. recent case law, upcoming legislative changes, or special public attention on certain topics)?
Recently, the Ukrainian Parliament adopted an updated Anti-Money Laundering Law. The new law implements international legislative standards for anti-money laundering regimes. At the same time, the number of internal
288 European Investigations Guide 2020 investigations is further increasing. For example, alleged corruption offenses committed by the former executives of the Ukrainian state company “Ukroboronprom” are now the subject of an internal investigation. Finally, Ukrainian subsidiaries of global companies and Ukrainian individuals have, in recent years, become subjects of official FCPA investigations relating to allegedly illicit activities in Ukraine.