Brazil: handling internal investigations

In the past years, Brazil has been at the epicentre of the battle against white-collar crime, especially corruption, antitrust violations and money laundering.

‘Operation Car Wash', also known as the Petrobras investigation, has completely changed the political, economic and legal scenarios in Brazil. The investigation targets a bribery scheme and the financing of political campaigns involving the state-owned oil and gas company, its employees, and their connection to politicians and private companies.

This unprecedented enforcement has also had an impact on corporate compliance and internal investigations. If internal investigations were previously considered superfluous or a luxury exclusive for subsidiaries of multinational companies concerned with enforcement in their home countries, nowadays they are a reality not only for multinationals but also for Brazilian private and public companies.

A notorious example is the investigation conducted within Petrobras to unveil all sorts of violations, which encompassed major document review, interviews and reporting to the authorities in Brazil and the US.

Private construction companies, most of them with 100 per cent Brazilian capital, have also, for the first time in their history, conducted internal investigations to unveil facts and personnel involved in potential violations in connection with the bribery scheme at Petrobras. In an also unprecedented move, some of the construction companies disclosed the findings of their internal investigations to the authorities in exchange for leniency.

Following the international trend, the enforcement authorities in Brazil have started to share, or in some cases, fully transfer, the duty to investigate to private parties.

In late 2016, the Federal Police and the Federal Prosecutors in the capital Brasilia launched a very large operation called Greenfield, which focused on investigating schemes in the four largest pension funds of the country.

The police and the prosecutors innovated largely by entering into agreements with the companies under investigation and conditioning the release of frozen assets to the conduction of internal investigations and the full disclosure of its findings to the authorities.

In other words, the authorities requested the investigated parties to conduct an internal investigation, its final report was presented in the files and became part of the authorities' investigation. So, it is not that the parties waived privilege - there was no privilege in the first place, given that the internal investigation was made upon the request of and to be addressed to the prosecutors.

The tough and continuous enforcement led to the impeachment of president Dilma Rousseff, and the new president Michel Temer is also at risk of being impeached as a consequence of the facts disclosed in an agreement entered into by an entrepreneur and the criminal prosecutors.

In that scenario, fully and dramatically changed by the outstanding enforcement, both corporations and the authorities started to pay much more attention to compliance, and internal investigations have become more relevant than ever before.

Introduction

Great expectation surrounded the Brazilian Clean Companies Act's (BCCA) enactment. Huge pressure from the public as well as a constant push from the OECD made the bill of law become a reality on 1 August 2013.

Two innovations brought by the BCCA are noteworthy: the possibility of companies involved in corruption violations to enter into a leniency agreement with the authorities, and the fact that the existence of an integrity programme in place started to be considered as a mitigating factor upon the appliance of the sanctions provided in the anti-corruption legislation.

The parameters of the evaluation of an effective integrity programme were only established in March 2015, when Decree No. 8420 was issued, and later in October 2015, when the Office of the Comptroller General issued the Integrity Program Guidelines for Legal Entities.

The Guidelines provide directions on reporting channels, disciplinary and remediation actions. There are some broad and general directions on internal investigations, in the topic that addresses remediation actions, which are focused on the immediate interruption of the wrongdoing, potential solutions and reparation of the effects caused.

Therefore, companies are free to choose how to conduct an internal investigation in Brazil.

Although there are multiple and widespread authorities throughout the country (regulatory, administrative, criminal, civil), none of them has ever issued a detailed guideline on internal investigations and it is not usual for the authorities to give instructions or oversee an investigation in progress.

Despite the lack of regulation, and, therefore, specific rules on how to conduct an internal investigation in Brazil, there are some best practices that follow the international standards.

This chapter does not aim to cover all the steps that are usually taken in an internal investigation, but rather touches upon various topics that have to be taken into consideration when conducting a corporate investigation in Brazil.

Whistleblowing

Whistleblowing has not historically been a common practice in Brazil, mostly due to cultural factors and also due to the lack of legal provisions on self-disclosure.

However, the enactment of new legislation, alongside the tough and constant enforcement in the past years towards both individuals and corporations, has played a very important role in changing the culture of non-reporting. This change is enabling the creation of an environment of good practices and more efficient corporate governance.

As in other countries, blowing the whistle in Brazil may happen in two ways: internal or external disclosure.

Internally reporting means providing the company with information on any wrongdoing that regards corporate activities. After receiving the information, the company decides whether or not to disclose it to the authorities.

In an external report, the individual discloses a wrongdoing directly to the authorities, who then have to take action, provided that if they do not, they may be subject to criminal liability. The advance of enforcement has been pushing and increasing the self-disclosure of the practice of wrongdoings in connection with corporate activities to the authorities.

Internal disclosure

The BCCA lists the incentive to reporting wrongdoings as one of the mitigating factors to be considered upon sanctioning a company that has committed a violation.

In the same vein, the Guidelines issued by the General Comptroller's Office set forth that developing irregularity reporting or detection mechanisms (red flags, reporting channels and whistleblower protection mechanisms) is one of the pillars of an integrity programme.

There are no legal provisions on benefits for whistleblowers who make an internal report. Companies may have such a provision, although it is not common practice either.

Robust compliance programmes usually spread the ‘do the right thing' message and, therefore, internally reporting a wrongdoing should not aim at getting benefits, but rather doing the right thing and being part of a clean corporation.

Furthermore, the Guidelines of the Comptroller's Office state that reporting channels must provide whistleblowers with anonymity and non-retaliation guarantees.

External disclosure

Disclosure to the authorities may be performed by (i) an employee of a corporation who reports a wrongdoing in which he or she has not participated or (ii) the wrongdoer him or herself.

In Brazil it is not usual for an individual to report a wrongdoing directly to the authorities, when he or she has not taken part in the illegal activity.

Besides the cultural factor, there are no provisions on rewarding or benefiting whistleblowers in exchange for information about the practice of wrongdoings, such as the provisions of the False Claims Act and the IRS Whistleblower Reward Program, in force in the US.

On the other hand, there is a different scenario when it comes to self-disclosure to authorities by the wrongdoers themselves.

An individual who committed a crime and is already under investigation or is being prosecuted may report the wrongdoing to the authorities in exchange for being granted leniency that may range from a penalty reduction to a judicial pardon.

Cooperation with the authorities is not new in Brazil but became a trend after increased enforcement of the law.

The antitrust legislation, for instance, provides full immunity on both administrative and criminal levels for companies (administrative only) and individuals that self-report. This mechanism of rewarding the first offender to self-disclose turned out to be very effective and has become a common practice in the antitrust field, in which the Brazilian authorities - both the regulator and the criminal prosecutors - are, and have been, very active.

When it comes to corruption and other white-collar crimes, the Organized Crime Act, enacted in 2012, enables individuals to cooperate with the authorities and be entitled to negotiate a kind of a plea agreement, also known as ‘rewarded collaboration'.

The same rationale was adopted by the BCCA, which provides that companies are entitled to cooperate with authorities through leniency programmes.

Such mechanisms allow individuals and companies involved in wrongdoings to receive benefits from the authorities in exchange for information of the misconduct. The practice is similar to the plea bargaining agreements, and requires that the individual or company wishing to enter into an agreement fulfil specific requirements, such as the disclosure of all the details of the wrongdoing and each individual and/or company that may have participated in it.

Although it is a new instrument and thus far very controvertible, collaborating with the authorities has been used by several individuals targeted by the Brazilian authorities. Brazilian criminal lawyers have criticised the mechanism, saying it is an unethical way of gathering evidence. The authorities, on the other hand, consider it a new instrument of investigation and facts elucidation.

Labour aspects that may impact internal investigation in Brazil

After learning about a wrongdoing and making the decision to start an investigation, a subject that deserves specific attention by corporations is the Brazilian labour legislation.

As in many other Latin American countries, the Brazilian labour legislation is outdated, complex and largely inclined to protect employees. It is no overstatement that there is a culture of judicial claims by employees against employers in the country, even in cases of weak or lack of proper grounds. As a result, Brazil is one of the countries with the highest number of judicial labour claims in the world.

Despite the deep and complex social matters that surround the relationship between employer and employee, the risk of the company's labour exposure is an important factor to be considered upon conducting corporate investigations in Brazil.

Every step of the investigation, from the definition of the scope to the enforcement of disciplinary measures, should be planned and performed taking the ‘labour aspect' into consideration and in a way to mitigate such exposure.

We will address four steps that companies should take to protect themselves during and after the internal investigation:

• The first step to mitigate labour exposure is to consult a labour lawyer to provide guidance in the internal investigation. A specialised professional with knowledge on the company's internal rules and local labour legislation is crucial to support investigators on the possibilities and the extent of investigative measures.
• The second step is to preserve and secure the confidentiality of the investigation as well as the privacy and the intimacy of employees involved. Many labour claims in Brazil involve demands for damages due to allegations of illicit exposure of the employees within the workplace, especially in cases of termination for cause.
• The third step is to keep accurate records of all investigative measures conducted, such as relevant corporate emails identified and minutes of interviews. The proper documentation of the investigation enables a better defence of the company in potential labour claims filed due to or as a consequence of the investigation. Furthermore, the documents may be used as evidence in terminations with or without cause.
• The fourth step is to ensure the enforcement of disciplinary measures in compliance with confidentiality and proportionality. Inconsistency in disciplinary measures may give grounds for employees to file labour claims seeking indemnification or the return to work.

Termination for cause is the harshest disciplinary measure and must be applied only in extreme situations, as quickly as possible and based on sufficient evidence. Examples of extreme situations are corruption, fraud, unfair competition and breach of corporate secrecy. Brazilian labour courts have been ruling that companies have the burden of proof in terminations for cause.

As a final note, companies in Brazil may impose remunerated leave - also called suspension - on employees while conducting the internal investigation or in cases of risk of evidence destruction, witness coercion and other situations that may harm a corporate investigation. This is a common and efficient practice in Brazil, especially in relation to employees in management positions.

Despite the lack of specific legal provisions, labour counsel recommend that this suspension should not exceed 30 days to avoid allegations of indirect rescission of the employment contract by the employer. It is also recommended that the leave is formally recorded with signatures of the employee on both their departure and their return.

Data collection

One of the most common, efficient and important investigative measures in Brazil - and generally everywhere else - is the data monitoring and gathering from corporate devices made available for employees, as innumerable amounts of relevant information may be stored in such devices.

Companies have the right to access most of the information stored on servers and corporate electronic devices used by their employees, but this activity cannot be done indiscriminately.

Brazilian labour courts have been ruling that corporate devices, such as emails, computers and cellphones are company property not subject to employees' privacy and intimacy rights. Companies may hold civil liability for wrongdoings committed by employees through such devices; therefore, employers are allowed to monitor and gather relevant information from such devices for corporate investigation purposes.

Employees should be clearly informed that corporate devices must be used exclusively for professional purposes and are subject to monitoring. Such communication is usually performed through the company's code of conduct, corporate device policies and specific clauses in the employment contract.

A great deal of controversy surrounds the monitoring of personal data. As a general rule, and in a conservative approach, companies are not allowed to monitor personal emails and communications, even when they are not in compliance with corporate device polices. All personal data casually gathered on corporate devices with no relation with the investigated facts must be excluded from the investigation and have its confidentiality preserved to avoid undue exposure of the employee's privacy and intimacy.

When it comes to data collection, companies must take all of the necessary precautions to preserve the integrity of the data and of potential evidence gathered when conducting an internal investigation. Digital data are volatile (ie, they can be easily created, modified, damaged or even deleted).

There is no legal provision on the need for prior notification of the employee whose corporate devices will be collected due to an internal investigation. Therefore, there is no need to issue a hold notice, although several companies prefer to do so. Lawyers usually prefer to make the assessment and the recommendation on the hold notice on a case-by-case basis. The common practice in Brazil is to communicate to the employee about the investigation only at the time of the collection, mainly to avoid the loss of data.

Notwithstanding, considering that corporate electronic devices may contain information in connection with the employee's privacy, it is advisable to, whenever possible, obtain a prior and formal consent of the employee before proceeding with the data collection. This measure is also important to avoid allegations of harassment, conflicts of interest and violation of the privacy laws.

The collection of electronic data must respect specific technical procedures in order to preserve the custody chain of the files. It is recommended to delegate this activity to an independent forensic company specialised in collection in compliance with forensics standards as well as to have the collection procedures monitored and recorded by a public notary.

After the collection, all files extracted from the devices may be analysed, including the employee's corporate email account.

In spite of the fact that corporate investigations cannot reach the employee's private email accounts, the data analysis may also encompass private emails if they were sent to or received by the employee using his or her corporate email account.

Likewise, if the employee has accessed private cloud servers and social network accounts via a corporate electronic device, registering his or her password automatically to facilitate the access, although the company may have access it should not extract information from these accounts.

Personal electronic devices (computers, smartphones, tablets, etc) cannot be collected by the company, unless the employee consents.

Interviews

The interviews are is a key stage in any internal investigation and it is no different in Brazil, as it is a very important source of information gathering.

The first step is to plan the communication of the interview to the employee.

The interviewee has to be previously notified to attend a meeting with the investigation team. If they are an employee, the notification is usually sent by their immediate supervisor, by the human resources department or by the legal department of the company.

When involving former employees or third parties (business partners, suppliers, competitors, etc) the notification process may become much more challenging. There is no official notification or provision for official notice to be sent to the potential interviewees. In addition, it is usual to use the word meeting instead of interview   to prevent the employee from having the impression that they are being investigated or accused of a wrongdoing.

Employees, former employees and third parties cannot be compelled to attend an interview.

They may also attend the interview and refuse to answer the questions or request their attorney to be present at the meeting.

Another major difference in Brazil, when compared to other countries, is that employees do not have the duty to cooperate or to tell the investigators the truth. There is no perjury and the National Constitution assures the right not to self-incriminate, even in a judicial claim.

As a result, it is common for investigation teams to receive vague answers, for the interviewee to allege not to recall details about the subject or to state that a certain task was not their responsibility.

However, the recent experience, especially after Operation Car Wash, has shown that interviewees usually attend the interviews without an attorney and answer the questions in an effort to show cooperation.

The interviews are often conducted in the employee's native language, because Brazilian employees feel much more comfortable participating in an interview that is conducted in Portuguese.

The Upjohn warning is not required under Brazilian legislation, however its content may be presented to the interviewee as an introduction, given that it is usually the first communication between the investigation team and the interviewee, and to settle the grounds of the questions. When the investigation involves multi-jurisdictional issues, it is common for the foreign counsel to conduct the Upjohn warning, although national counsel may also do it in Portuguese.

The interview may be recorded if necessary, but this is not usual. It is controversial whether recording the interview requires the interviewee's authorisation. The common practice in Brazil has been to take notes during the interview and to prepare a brief summary of the main topics addressed in the interview or a minutes of the meeting afterwards.

The main purpose of the interview is to collect more information about certain issues, to clarify information collected during the document review and to confirm or review documents and information with individuals involved in the matter. Still, regardless of the existing information and documents, accusations towards the interviewee must be avoided during the interview as to prevent future labour claims on the grounds of harassment.