Recent case law has clarified whether employees can expect personal information used in disciplinary investigations to remain private