Use of Analytics in Investigations

Introduction

The use of analytics in investigations refers to the application of data analysis, statistical techniques, digital tools, artificial intelligence, and other analytical methods to collect, examine, correlate, and interpret information during an investigation.

In employment and workplace investigations, analytics may be used to identify:

• unusual employee behaviour;
• attendance irregularities;
• payroll anomalies;
• suspicious transactions;
• conflicts of interest;
• misuse of company resources;
• data-access patterns;
• potential fraud;
• workplace misconduct; and
• patterns relevant to disciplinary proceedings.

However, analytical results generally identify patterns or indicators; they should not automatically be treated as conclusive proof of misconduct. Human review, procedural fairness, and the applicable employment rules remain important.

1. Meaning of Investigative Analytics

Investigative analytics involves analysing available information to determine whether there are facts suggesting misconduct or another violation.

For example, an employer investigating suspected misuse of confidential information might analyse:

• login records;
• access times;
• file-download records;
• email metadata;
• system activity;
• transaction records; and
• device logs.

Analytics can then identify unusual patterns requiring further investigation.

2. Types of Analytics Used in Investigations

A. Descriptive Analytics

Descriptive analytics examines what happened.

For example:

• number of unusual transactions;
• frequency of system access;
• number of absences;
• quantity of files downloaded.

B. Diagnostic Analytics

Diagnostic analytics examines why something may have happened.

For example, it may compare a suspicious transaction with:

• employee access rights;
• previous transactions;
• approval records; and
• relevant business activity.

C. Predictive Analytics

Predictive analytics uses historical data to identify patterns that may indicate future or potential risks.

For example, an organisation may identify transactions that statistically resemble previously detected fraudulent transactions.

D. Network Analytics

Network analysis examines relationships between:

• employees;
• transactions;
• customers;
• accounts;
• devices; and
• communications.

It can help investigators identify connections that may not be apparent from individual records.

E. AI-Assisted Analytics

AI can process large quantities of:

• emails;
• documents;
• financial records;
• access logs;
• communications metadata; and
• other digital evidence.

It may assist investigators in locating relevant information, but the reliability of the underlying data and the system's methodology must still be considered.

3. Analytics and Employee Investigations

Employers increasingly maintain large quantities of employee data. Analytics can help identify potential misconduct.

For example, an employer investigating suspected confidential-data theft could analyse whether an employee:

1. accessed unusual files;
2. downloaded a large number of documents;
3. accessed information outside normal working hours;
4. transferred information to an unauthorised location; or
5. accessed information unrelated to their duties.

Such findings may justify further investigation, but the analytical result itself should not automatically establish guilt.

4. Data Protection and Privacy

The use of analytics in investigations can involve personal information.

Employers should therefore consider:

• whether the information was lawfully collected;
• the purpose for which it was collected;
• whether the investigation is proportionate;
• who can access the information;
• how long it is retained;
• whether employees were appropriately informed;
• whether sensitive information is involved; and
• whether applicable data-protection legislation applies.

In India, constitutional privacy principles are particularly relevant when governmental or public-sector employers process employee information.

5. Right to Privacy

Case Law: Justice K.S. Puttaswamy (Retd.) v. Union of India (2017)

The Supreme Court recognised privacy as a fundamental right under Article 21 and other constitutional guarantees.

The judgment is particularly relevant to workplace analytics because employee information may include personal and sensitive information.

Principle: Collection and processing of personal information must be examined against applicable legal requirements and constitutional principles, including legality and proportionality where applicable.

6. Electronic Records as Investigative Evidence

Analytics frequently operates on electronic records.

Indian law recognises electronic records as capable of constituting evidence, subject to the applicable evidentiary requirements.

Case Law: Anvar P.V. v. P.K. Basheer (2014)

The Supreme Court addressed the evidentiary requirements applicable to electronic records under the law then governing electronic evidence.

Principle: Electronic material must satisfy the applicable statutory requirements before it can be relied upon as evidence.

7. Electronic Evidence and Certification

Case Law: Arjun Panditrao Khotkar v. Kailash Kushanrao Gorantyal (2020)

The Supreme Court clarified important aspects of the law concerning electronic records and certificates under the Evidence Act.

Principle: The manner in which electronic records are obtained, produced and authenticated can be legally significant.

Therefore, if analytics is based upon:

• emails;
• server records;
• CCTV footage;
• access logs;
• computer records; or
• other electronic material,

the investigator should preserve the underlying records and maintain appropriate evidentiary integrity.

8. Analytics Cannot Replace Natural Justice

Suppose an algorithm identifies an employee as having a high probability of misconduct.

The employer should not necessarily dismiss the employee solely because the system generated that result.

The employee may need an opportunity to:

• understand the allegation;
• respond to relevant evidence;
• explain unusual activity;
• challenge inaccurate records; and
• participate in the disciplinary process prescribed by the applicable rules.

Case Law: State of Uttar Pradesh v. Shatrughan Lal (1998)

The Supreme Court emphasised the importance of procedural fairness in disciplinary matters.

Principle: Investigative technology does not eliminate applicable procedural safeguards.

9. Automated Decision-Making and Employment

Analytics can sometimes produce an automated risk score—for example, a score indicating that an employee is allegedly at high risk of misconduct.

A legal concern arises when the employer treats the score as an automatic determination.

The investigator should examine:

• what data was used;
• whether the data was accurate;
• whether the analytical model is appropriate;
• whether relevant information was omitted;
• whether the employee can explain the result; and
• whether a human decision-maker independently assesses the evidence.

This is especially important where disciplinary consequences may follow.

10. Disciplinary Inquiry and Evidence

Analytics may assist in discovering evidence, but the disciplinary authority must still assess the evidence according to the applicable service rules.

Case Law: State of Andhra Pradesh v. S. Sree Rama Rao (1963)

The Supreme Court discussed the scope of judicial review concerning departmental disciplinary proceedings.

Principle: Courts generally do not act as appellate authorities to re-evaluate every factual finding, but disciplinary findings remain subject to judicial review on recognised grounds such as procedural illegality and evidentiary defects.

11. Investigation Must Be Based on Relevant Material

An analytical investigation should focus on information genuinely connected with the allegation.

For example, if the allegation concerns unauthorised access to confidential files, analysing unrelated personal information may raise proportionality and privacy concerns.

The investigation should therefore have:

• a defined purpose;
• relevant data sources;
• appropriate access controls;
• documented methodology; and
• reasonable limits.

12. Surveillance and Employee Monitoring

Analytics can involve monitoring:

• emails;
• internet usage;
• location information;
• access-card records;
• computer activity;
• productivity information;
• CCTV;
• company devices; and
• communication metadata.

Monitoring may have legitimate organisational purposes, but excessive or unexplained surveillance can create privacy and employment-law concerns.

Case Law: People's Union for Civil Liberties v. Union of India (1997)

The Supreme Court considered privacy-related concerns associated with telephone interception.

Principle: Surveillance and interception powers must operate within legal safeguards rather than being exercised without appropriate controls.

Although the case concerned telephone interception rather than workplace analytics specifically, its privacy principles are relevant when considering intrusive monitoring.

13. Analytics and Bias

Analytics can reproduce problems contained in the underlying data.

For example, if historical disciplinary records disproportionately identify a particular group of employees, an algorithm trained on that historical data could reproduce the same pattern.

Therefore, employers should consider:

• data quality;
• discriminatory variables;
• historical bias;
• false positives;
• false negatives;
• methodology; and
• human review.

An analytical system should not be treated as neutral merely because it uses mathematical calculations.

14. Analytics in Fraud Investigations

Analytics can be particularly useful in financial investigations.

Investigators may identify:

• duplicate payments;
• unusual vendor relationships;
• transactions outside normal working hours;
• sudden changes in payment patterns;
• unusual expense claims;
• repeated transactions below approval thresholds; and
• unexplained account activity.

The analytical result can then be combined with:

• invoices;
• approvals;
• emails;
• accounting records;
• witness statements; and
• other evidence.

15. Analytics and Chain of Custody

Where digital evidence is likely to be used in disciplinary or judicial proceedings, investigators should document:

1. who collected the information;
2. when it was collected;
3. where it came from;
4. how it was preserved;
5. whether it was altered;
6. what analytical process was applied; and
7. who had access to it.

Maintaining this record increases the reliability and defensibility of the investigation.

16. Case Law on Fairness and Administrative Action

Case Law: E.P. Royappa v. State of Tamil Nadu (1974)

The Supreme Court linked equality under Article 14 with protection against arbitrary State action.

Relevance: Where a public university or government employer uses analytics to make employment decisions, the decision-making process cannot be arbitrary merely because it is technologically based.

17. Analytics in University and Public Employment

In universities and other public institutions, analytics may be used to investigate:

• attendance;
• examination-related irregularities;
• research misconduct;
• financial irregularities;
• misuse of university systems;
• unauthorised access;
• procurement irregularities; and
• administrative misconduct.

Because public universities may exercise statutory powers, their employment decisions can additionally be challenged through judicial review.

Case Law: University of Mysore v. C.D. Govinda Rao (1964)

The Supreme Court recognised the specialised nature of academic decisions and the need for judicial restraint in appropriate cases.

Relevance: Analytical tools can assist university authorities, but courts may still examine whether the authority acted within its legal powers and followed the required procedure.

18. Important Case Laws at a Glance

19. Best Practices for Employers

Employers using analytics in investigations should ideally:

• establish a legitimate investigative purpose;
• collect only relevant information;
• ensure data accuracy;
• document the analytical methodology;
• preserve original electronic evidence;
• restrict access to authorised personnel;
• protect confidential information;
• conduct human review;
• provide procedural safeguards where required;
• avoid relying exclusively on automated conclusions; and
• maintain records of the investigation.

Conclusion

Analytics can significantly improve workplace investigations by allowing organisations to process large volumes of information and identify unusual patterns that may otherwise remain unnoticed. However, analytics is an investigative tool, not a substitute for evidence, human judgment, or due process.

The legal validity of an analytics-based investigation depends on factors such as the source and accuracy of the data, privacy requirements, electronic-evidence rules, applicable employment regulations, proportionality of monitoring, and procedural fairness. In disciplinary proceedings, an employee should receive the protections required by the applicable service rules and principles of natural justice.