GDPR and FADP: data discipline in private investigations

A private investigation is a processing of personal data before it is a search for facts. Every observation, every register check, every interview produces information about identified or identifiable people, including those who are not the subject of the mandate: a spouse, a colleague, a neighbour, a former employer.

Investigators sometimes find this inconvenient, treating it as administrative overhead. It is in fact what separates a usable file from a fragile one. An enquiry conducted without data discipline produces material that can be neither produced, nor retained, nor defended before a judge.

Who is accountable for what

In most mandates the client is the controller and the firm acts as processor: it handles data on another’s behalf, on documented instructions, without reusing it for other cases. This allocation is not a contractual formality. It determines who answers an access request, who decides retention periods and who bears the consequences of excessive collection.

Where the firm investigates on its own account — a dispute involving itself, screening for its own hiring — it becomes the controller and must apply to itself what it recommends to clients. Consistency, at that point, is easy to verify.

One legal basis per purpose, not one for everything

Three grounds recur most often, and they are not interchangeable.

• Establishment, exercise or defence of legal claims, which covers most litigation work, provided the claim exists or is reasonably contemplated.
• Legitimate interest, which requires a documented balancing of the purpose against the rights of the individual; it does not by itself justify systematic monitoring.
• Legal obligation, specific to certain sectors — compliance, anti-money laundering — and which must be precisely identified.

Consent is the most overrated basis. In a relationship of subordination it is rarely freely given; in an investigation it is often impossible to obtain without disclosing the operation. Relying on it for convenience is building on sand.

Minimisation: the constraint that protects

Collect only what answers the question asked, and accept that a report omitting the irrelevant is stronger, not weaker. In practice: define in writing the categories of data sought before opening the first register, keep a collection log, set aside sensitive data unless necessity is demonstrated, and do not retain documents just in case.

The rule has an operational consequence that is often overlooked: a report does not contain everything that was found. It contains what is relevant, sourced and necessary to the client’s decision. The rest stays in the working file, with a defined destination.

Sensitive data — health, opinion, union membership, sexual orientation, criminal data — requires separate handling, specific justification and restricted access. It often appears by accident, in the margin of an exchange or an attachment; that is precisely where discipline is tested.

Retention, deletion, access

A retention period must be fixed at the outset, tied to purpose: the life of the case, pending proceedings, professional liability exposure. At expiry, deletion or secure destruction, with proof of the operation. Indefinite retention “for the record” is the most common defect and the most expensive in an audit or a dispute.

A processing register, kept current, is the practical instrument here: it shows what was collected, why, and until when. Without it, retention becomes a matter of memory, and memory favours keeping everything.

Access requests deserve a prompt written answer. In an investigation they carry a particular risk: disclosing the identity of a source or the existence of an operation may expose third parties. Statutory exceptions allow for that, but they must be reasoned case by case and never invoked wholesale.

Transfers, providers, security

Switzerland benefits from an EU adequacy finding, and the reverse also holds; a file can therefore move between Geneva and Paris without additional clauses. This is not true of transfers to other destinations, which require a contractual basis and an assessment of the receiving country.

In practice, leaks rarely come from an intercontinental transfer. They come from a consumer messaging service, an open sharing link, a USB stick, a transcription provider without a written undertaking. Access control, encryption and logging matter more than the clause buried in an annex.

The principle remains simple: less data collected, better protected and kept for less time produces a file that is stronger and easier to defend. If you need to frame a recurring investigative arrangement, an initial confidential consultation will test its legal basis and its weak points. It commits you to nothing. These pages are editorial information and do not constitute legal advice.