Workplace Investigations Versus Privacy: Why Investigation Data Does Not Automatically Belong In Personnel Files

Compared with Anglo-American jurisdictions, Germany has traditionally imposed stricter requirements on background checks and the processing of employee personal data. This is due in no small part to the GDPR and the high value placed on the protection of individual privacy rights. As a result, the tension between internal investigations and data protection has been a recurring issue for employers.

Following a recent decision by the Court of Justice of the European Union (CJEU) (CJEU, judgment of 4 June 2026, Case C-312/24, Darashev), it is now clear that personal data may not be retained indefinitely in a personnel file merely because it was originally collected lawfully in the context of an investigation. Once information obtained during a criminal or internal investigation is transferred into a personnel file, this constitutes a new processing purpose and therefore a separate processing activity. In most cases, that activity falls within the scope of the GDPR and requires an independent legal basis. For companies with well-established compliance and investigation frameworks, the judgment has significant practical implications.

The decision is particularly relevant for banks and financial institutions, as few sectors process information stemming from compliance investigations, anti-money laundering reviews, whistleblowing reports or fit-and-proper assessments as frequently as the financial services industry.

The Case

The case concerned a police officer who had been subject to a criminal investigation that was subsequently closed without charges being brought. Nevertheless, his status as a suspect was recorded in his personnel file to support employment-related decision-making and career management. Relying on this information, the employer later denied him a promotion.

The CJEU was asked to determine whether the retention of such information in the personnel file merely constituted a continuation of the original processing carried out by the investigating authorities or whether it represented a separate processing activity subject to the requirements of the GDPR.

The Decision

The CJEU drew a clear distinction between the two processing activities. The collection and processing of the data by the investigating authority during the criminal investigation fell within the scope of Directive (EU) 2016/680. By contrast, the subsequent storage of the same information in the employee’s personnel file served employment-related purposes and therefore fell within the scope of the GDPR.

According to the Court, a personnel file cannot be regarded as a mere extension of the investigation process. Rather, the transfer and storage of investigation-related information in a personnel file creates a separate data protection context that must be assessed independently. In particular, the processing must be evaluated against the requirements of Article 6(1) and (3) GDPR, while also taking into account the principles reflected in Article 17 GDPR and Article 52(1) of the Charter of Fundamental Rights of the European Union.

The fact that information was lawfully obtained during an investigation does not automatically justify its subsequent inclusion in a personnel file. Employers must instead determine which specific legal basis supports the HR-related processing. Depending on the nature of the employer, the role of the individual concerned and the purpose of the storage, relevant legal bases may include Article 6(1)(c) GDPR (compliance with a legal obligation) or Article 6(1)(f) GDPR (legitimate interests), each subject to a rigorous proportionality assessment.

The Court further required a separate assessment of the scope of the processing, retention periods and access rights. Even where data has been lawfully collected, it may only be transferred to a personnel file to the extent that it is genuinely necessary for the specific HR purpose pursued and proportionate to the interference with the employee’s rights. The applicable legal basis must be “clear and precise”, its application must be “foreseeable”, and it must pursue an objective of public interest to which it is proportionate.

Key Takeaways

The real significance of the judgment lies at the intersection of workplace investigations and human resources management. The CJEU makes clear that information cannot be retained in a personnel file simply because it was lawfully collected during an earlier investigation. Once transferred to a personnel file, the information becomes subject to a separate GDPR processing activity that requires its own legal justification. The storage of such data is therefore permissible only where the underlying purpose is sufficiently defined and supported by an appropriate legal basis.

Employers should carefully assess and document why particular information is relevant for personnel administration and on which legal basis its retention is justified. This includes considering whether sector-specific legal requirements actually mandate the processing or merely permit it. Employers should also document who is granted access to the data and how long it may be retained.

Particularly where the information relates to allegations, suspicions or investigations that were discontinued or never concluded, the impact on the employee’s rights will often be significant. In such circumstances, narrowly defined processing purposes, strict role-based access controls, and robust review and deletion mechanisms are likely to be necessary to ensure compliance with data protection requirements.