A U.S. corporation that becomes aware of internal wrongdoing in foreign operations and moves to investigate the allegations and take appropriate responsive measures will be faced with the difficult task of ensuring that it complies with local laws that may restrict both the investigative techniques that can be employed and the remedial steps that may be taken. This difficulty is particularly acute in the European Union in light of the strong — and disparate — data protection laws applicable to employees’ “personal data,” a category of information that generally carries a very broad definition.
This same dilemma confronts foreign corporations that are U.S. issuers and may wish to avail themselves of the benefits of internal investigation and/or voluntary disclosure. Summarized below are the principal difficulties that these laws present and an overview of justifications for steps corporations may take to avoid frustration of compliance measures and the pursuit of internal inquiries.
