How should confidentiality be managed during an investigation?

• A. Limit access on a need-to-know basis, use secure storage, redact sensitive data when possible, and communicate limits and expectations.
• B. Share information with all employees.
• C. Store data in unsecured shared drives.
• D. Disclose all information to union representatives.

Answer: (C)

Confidentiality in an investigation rests on two main ideas: only those who truly need to know should see the information, and those materials must be kept secure and described clearly so everyone involved understands what can be shared and with whom. Limiting access on a need-to-know basis prevents unnecessary exposure of sensitive details, while secure storage reduces the risk of leaks, tampering, or loss. Redacting sensitive data when possible helps protect identities and specifics that aren’t essential to the facts being examined. Clear communication about limits and expectations ensures participants, witnesses, and others understand what can be discussed externally, what must remain confidential, and through which channels information may flow.

Storing data in unsecured shared drives undermines confidentiality because it broadens access beyond those who should see it and creates opportunities for leaks, misplacement, or unauthorized changes. Sharing information with all employees, or disclosing everything to union representatives, similarly increases exposure or bypasses necessary controls. The aim is to balance transparency with privacy and integrity, keeping information accessible to the right people through appropriate protections and only to the extent needed for the investigation to proceed.