Integrity Line Blog - Current expert articles | integrityline.com

Non-Disclosure Agreements and Whistleblowing

mcc-niall — Tue, 22 Aug 2023 07:24:05 +0000

The Theranos example

The notorious case of Theranos provides a relatively recent example of whistleblowers breaching their NDAs to report a case of serious wrongdoing. Founded in 2003 by then 19-year-old Elizabeth Holmes, the blood testing startup raised $700 million and was valued at $10 billion at its peak. While it looked like Theranos was aggressively protecting its trade secrets through NDAs, it was actually covering up major shortcomings in its supposedly groundbreaking blood testing technology.

All visitors to the Theranos office had to sign NDAs. This was likewise normal for employees who were also pressured into signing severance agreements with far-reaching restrictions on what they could divulge about the company’s activities after their departure. Several former employees blew the whistle regardless and it all came tumbling down. Holmes and former company president Sunny Balwani were charged with fraud by the US Securities and Exchange Commission in 2018 and both have started lengthy prison sentences.

NDA as a gagging mechanism

As demonstrated by the Theranos whistleblowers, an NDA will not impede people with a strong moral compass. In some cases, organisations offer whistleblowers an NDA and a large financial settlement in exchange for any allegations of wrongdoing to be dropped. Alison McDermott spoke out about problems in the workforce at Sellafield, the UK’s largest nuclear site.

After having her contract terminated, Alison was offered a large settlement in exchange for dropping her case and signing an NDA. She turned down the offer despite having no income and bearing substantial legal costs.

When we asked her about this decision, she was steadfast in her response: “I wanted to air my concerns in court. I wanted the wrongdoing brought to light and I was not prepared to sign an NDA and effectively be gagged. I do not regret this decision because I could not have lived with myself otherwise. My silence is not for sale”. Alison later told her story at the European Compliance and Ethics Conference 2023 and you can view the video below.

Earlier this year, Fortune reported that some of America’s biggest technology companies including Apple and Electronic Arts are improperly using NDAs that prohibit employees from reporting bad behaviour to the regulator. The Securities & Exchange Commission said that the firms in question are using these agreements to illegally muzzle whistleblowers by threatening to sue them for talking.

NDA enforceability and employee psychology

Bravery and courage are one part of speaking out. Legal certainty is quite another. Most companies insist on NDAs being signed by employees even though they are aware that most courts are unlikely to enforce them, particularly if they are breached by a whistleblower with good intentions.

Depending on the organisation, an NDA can be complicated and contain a considerable number of clauses, some of which can be enforced. In events of obvious wrongdoing such as when a worker points out a serious health and safety violation to the relevant authority, it would constitute a good faith breach of an NDA, which would not result in repercussions.

Alternatively, neglecting internal processes, bypassing the relevant authorities and blowing the whistle via the media in an attempt to slander the employer would be a bad faith breach of the NDA that could result in legal action.

NDAs tend to act as a psychological tool to dissuade employees from speaking out and they are effective at achieving that goal. While whistleblowers can mostly avoid legal repercussions, they should still consider approaching someone with the proper expertise before making their complaint.

How to blow the whistle after signing an NDA

While NDAs are not typically binding when it comes to reporting criminal activity or information in the public interest, employees are nevertheless advised to consult a legal professional before speaking out. This could take the form of a lawyer or legal firm specialised in whistleblowing who can thoroughly analyse and evaluate the NDA, as well as any aspects of the agreement that could prove problematic in court.

Some companies utilise an ombudsman to assess disputes independently and advise both sides in accordance with the organisation’s compliance guidelines. Given that the ombudsman adheres to confidentiality and has to comply with data protection regulations, this point of contact can also provide important advice on how to proceed with a complaint in the face of an NDA. The same principle applies to a digital whistleblowing system in cases where an impartial arbitrator is utilised as the resolution mechanism.

A digital solution can also be effective when complaints are both submitted and resolved internally. This can empower employees to air their grievances within the company which helps the organisation investigate and resolve issues internally at an early stage. Keeping things internal also avoids a public violation of an NDA along with any ensuing legal consequences.

Conclusion

Unfortunately, internal solutions can only function when organisations implement an effective compliance and speak-up culture whereby proper confidential reporting channels are made available to employees. As Theranos has shown, some companies are still intent on using NDAs to muzzle or gag their employees so that they can cover up bad behaviour. In such situations, it is important to remember that an NDA is not a barrier to blowing the whistle and most of its provisions are likely not enforceable. However, potential whistleblowers should still exercise caution and only speak out after thoroughly examining the situation with a legal expert.

Whistleblowing Laws in the European Union

A glance at the implementation of the EU Whistleblowing Directive in EU Member States

https://www.integrityline.com/wp-content/uploads/2023/08/eqs-blog-NDA.png

Der Beitrag Non-Disclosure Agreements and Whistleblowing erschien zuerst auf EQS Integrity Line.

The UFO Whistleblower’s Extraordinary Congressional Hearing

mcc-niall — Fri, 28 Jul 2023 07:43:09 +0000

Explosive claims at Congress

In June 2023, Grusch publicly claimed that unnamed officials informed him that the US government maintains a highly secretive UFO recovery program, possesses “non-human” spacecraft and has recovered “dead pilots”. Those allegations led to intense global interest, speculation and excitement.

The following month, he made those claims in the most high-profile setting imaginable – Congress. He testified under oath before a House Committee on Oversight and Accountability where he outlined the existence of a multi-decade UAP (unidentified aerial phenomena) crash retrieval and reverse-engineering program to which he was denied access.

He also stated that the government has been covering up its activities for close to a century and that he has personal knowledge of people who have been harmed or injured as a result. Grusch limited his statements to what he could publicly divulge without violating laws dealing with classified information.

During the hearing, Grusch was one of three witnesses. He was joined by Ryan Graves and David Fravor, two former US Navy fighter pilots. Graves previously remarked that he had seen UAP activity off the Atlantic Coast “every day for a couple of years” while Fravor recounted his experiences of encountering a UAP during a mission in 2004, stating that “the technology we faced was far superior to anything that we had”.

Deciding to blow the whistle

At the hearing Grusch said that he became a whistleblower “following concerning reports from multiple esteemed and credentialed current and former military and Intelligence Community individuals that the US government is operating with secrecy above Congressional oversight with regards to UAPs”.

He explained that his testimony was based on information provided by individuals with a longstanding track record of legitimacy and service to the US. He added that many of them shared compelling evidence in the form on photography, official documents and classified oral testimony.

Grusch filed a whistleblower complaint with the US Office of the Intelligence Community Inspector General to support his plan to share classified information with the Senate Select Committee on Intelligence in 2022.

Retaliation

Whistleblowers often experience retaliation and this case is no exception. Grusch filed a complaint alleging reprisals by his superiors due to complaints he made in 2021. When asked about whether he faced any retaliation or reprisals during the July 2023 hearing, he cited the ongoing investigation as the reason he could not go into detail.

However, he confirmed that he has faced “very brutal” retaliation since he spoke out and that some of the tactics used “hurt him both professionally and personally”. He added: “I do have knowledge of active planned reprisal activity against myself and other colleagues and it’s very very upsetting to me”.

When quizzed on where these threats are emanating from, he pointed the finger at senior leadership at previous agencies he was associated with. He also stated that “certain colleagues of mine were brutally administratively attacked” in activity Grusch described as “administrative terrorism”. He went on to describe threats against career paths and reputations that helped silence people.

When a committee member asked if he had feared for his life, Grusch stated “Yes, definitely”. Referring to his motivations for speaking out, he said that “I am hopeful that my actions will ultimately lead to a positive outcome of increased transparency”.

Conclusion

Allegations that the US government has been covering up mankind’s most extraordinary secret are not new, and rumours have circulated for decades. Over the past six years, however, the UAP issue has made its way to the highest levels of government and whistleblower David Grusch has found himself at the very centre of the discussion. The well-respected former intelligence officer admirably served in sensitive positions and used proper channels and procedures to blow the whistle. While many will still consider his extraordinary claims outlandish, they could well change the world.

Whistleblowing Laws in the European Union

A glance at the implementation of the EU Whistleblowing Directive in EU Member States

https://www.integrityline.com/wp-content/uploads/2023/07/EQS-UFO-Whistleblower.jpg

Der Beitrag The UFO Whistleblower’s Extraordinary Congressional Hearing erschien zuerst auf EQS Integrity Line.

Whistleblowers: Heroes or Traitors?

mcc-niall — Fri, 21 Jul 2023 09:41:25 +0000

Ellsberg is considered one of the first whistleblowers and his case was as spectacular as his revelations were shocking. He was charged with espionage and faced up to 115 years in prison before being acquitted in 1973.

Whistleblowers, negative labels and mockery

Decades later, American whistleblowers such as Edward Snowden and Chelsea Manning would draw the ire of the US government in a similar manner to Ellsberg and divide public opinion as a result of their revelations. While some view them as traitors, others value their disclosures as a service to society.

Time and again, however, whistleblowers are stigmatised – even by some of the most prominent voices in society. Back in 2021, Elon Musk joked about whistleblowers while promoting some merchandise, urging his tens of millions of Twitter followers to “blow the whistle on Tesla”. His tweet and link to the Tesla-branded whistle came amid lawsuits over alleged sexual harassment and racial abuse at the carmaker’s Fremont factory in California.

Whistleblowers have a strong moral compass

Rather than profiting from their activities, whistleblowers actually expose themselves to risks such as not being taken seriously, rejection, disadvantage and punishment.

Employees who observe incorrect or criminal behaviour within a company usually turn to their direct supervisors to try and arrange a hearing in their own corporate environment so that attention can be drawn to the grievance(s). Only when their own organisation fails to believe them or places them under pressure do whistleblowers usually turn to the general public or media. This is because their moral compass is so strong that they cannot close their eyes to injustice.

When a whistleblower takes action, working relationships are put at risk and, in certain circumstances, speaking out can cost that person their career. In other words, they are prepared, if doubts arise, to accept personal disadvantages in order to stand up against misconduct, improper business practices, corruption or other forms of injustice.

Politicians have finally understood that this type of commitment does not only deserve respect, it is also worth protecting. This can be seen in the European Union where the EU Whistleblowing Directive has established new protective standards for whistleblowers.

Abuse of power by whistleblowers is unlikely

Even though companies across much of Europe are now required to implement reporting channels due to the new legal standards, many companies still fear that these outlets will be abused by vengeful employees. The myth persists that employees will misuse reporting channels – especially anonymous ones – to take revenge on their employer or dent their reputation. However, the laws that have come into force across Europe stipulate that people are liable for damages if they have been found to have submitted false or grossly negligent reports.

In fact, practice also shows that the fear of deliberate false reporting is largely unfounded. Effective internal reporting systems ensure that whistleblowers can initially raise their concerns within the organisation while companies have a chance to respond at an early stage. If an organisation neglects investigating a report of wrongdoing or makes an employee fear disadvantages for speaking out, the risk of that individual turning to external reporting entities or the media increases.

Statistics show whistleblowers are an asset

According to recent research, the number of instances where whistleblowers actually filed reports to intentionally harm their organisation is in the single digits. For example, the BKMS® Benchmarking Report 2021 found that 78% of respondents reported that the proportion of improper reports constituted less than 2% of the total. 43% reported a figure of less than 1%.

Whistleblowers actually help their companies in the long run. By exposing wrongdoing at an early stage and giving organisations the opportunity to respond promptly, they can save companies from damage, possible prosecution and hefty fines. The Whistleblowing Report 2021, for example, found that in 2023, approximately one third of companies surveyed were able to uncover more than 80% of the total financial damage caused by wrongdoing thanks to an internally established whistleblowing system.

Guide to the Introduction of Whistleblowing Systems

How to successfully implement a whistleblowing system in your organisation.

https://www.integrityline.com/wp-content/uploads/2023/07/integrityline-blog-denunziant.png

Der Beitrag Whistleblowers: Heroes or Traitors? erschien zuerst auf EQS Integrity Line.

Hinweisgeberschutzgesetz: Germany Transposes The EU Whistleblowing Directive

mcc-niall — Fri, 12 May 2023 13:16:37 +0000

What is Germany's Whistleblower Protection Act?

The Whistleblower Protection Act is Germany’s implementation of the EU Whistleblowing Directive, which aims to establish standardised protection for whistleblowers across the EU for the first time.

The law regulates the protection of natural persons who have obtained information about violations in the course of their professional activities and pass it on to internal or external reporting bodies (whistleblowers). This includes employees, civil servants, self-employed persons, partners, interns, volunteers, employees of suppliers as well as persons whose employment relationship has already ended or has not yet begun and is in a pre-contractual stage.

The new whistleblowing law in Germany prohibits any reprisals or retaliation against whistleblowers.

EU member states had until 17 December 2021 to transpose the Directive into their national laws. Such a law is overdue and up until now whistleblowers have been provided with insufficient protection from reprisals or negative consequences. In Germany, there was a first push towards whistleblower protection in 2019 with the “Gesetz zum Schutz von Geschäftsgeheimnissen” or “Act on the Protection of Business Secrets”.

We are pleased that whistleblowers in Germany now finally have legal certainty when they report wrongdoing or criminal offences in the company, not just in the case of violations of EU law but also in the case of criminal offences such as corruption or tax evasion. This comprehensive protection is an important step towards more integrity in business”, stated Achim Weick, founder and CEO of EQS Group.

Whistleblower Protection Act: the timeline

End of 2020:  The then Minister of Justice Christine Lambrecht (SPD) submits a first draft for coordination in the ministries.

April 2021: Minister Lambrecht’s draft bill is overturned by CDU/CSU and the grand coalition under CDU and SPD fails to reach an agreement for the national implementation of the Directive.

November 2021: In their coalition agreement, the three traffic light parties – SPD, Greens and FDP, agree to implement the EU Whistleblowing Directive “in a legally secure and practicable manner” while clearly positioning themselves as being in favour of whistleblower protection. They also intend to go beyond the minimum requirements of the European Union Directive 2019/1937 and extend the scope of application to national law. The coalition agreement is a concrete indication of the planned implementation period.

December 2021:  The deadline for transposing the Directive passes on 17 December 2021 without a German law.

February 2022:  The EU Commission initiates infringement proceedings against several EU countries, including Germany, for failing to transpose the Directive within the specified timeline.

April 2022: Justice Minister Dr. Marco Buschmann has a draft bill prepared by his ministry and it is sent to other ministries for review on 5 April. The content of the second draft is based on the first draft of former Minister of Justice Christine Lambrecht (SPD) from the end of 2020.

July 2022: The Federal Government passes a draft bill.

September 2022: The Bundesrat issues a statement on the proposed legislation and the Federal Government intends to submit its counterstatement at a later point. The bill is discussed in a first reading on 29 September 2022.

December 2022: On 16 December, the law was passed in the second and third reading in during the last session of the Bundestag. A bill amended by the Legal Affairs Committee was presented to MPs for discussion.

January 2023: Opposition brings draft law to a halt in the Bundesrat.

May 2023: Bundestag agrees on a compromised version of the draft law on May 11 and it is passed a day later.

June 2023: The law was announced in the Federal Law Gazette on 2 June.

July 2023: The law enters into force

What do companies need to know now in order to be prepared for the new whistleblowing law in Germany?

1) There will be two mandatory reporting channels: internal and external

An internal reporting channel in the organisation, e.g. a digital whistleblowing system, staff from the compliance department or an ombudsman.
An external reporting channel will be established at the Federal Office of Justice. It will be responsible for the federation and federal states and will accept information from the private and public sectors. In special areas of responsibility, the Federal Financial Supervisory Authority and the Federal Cartel Office, with their already established whistleblowing systems, should function as external reporting channels with special responsibilities. In addition, the federal states can also establish their own reporting channels.

The hotlines may also process specially protected data according to the GDPR.

Organisations with 250 or more employees must have implemented secure whistleblowing channels by 02 July 2023 while those with 50-249 employees have a transition period until December 2023.
The whistleblowing procedure must be verbal or written and, if desired, in person
Internal confirmation of the receipt of the report must be provided to the whistleblower within 7 days.
Protected areas of application: EU law and national law if the offence is criminal or administrative in nature while endangering health or life.
Within three months, the whistleblower must be informed about any action taken as a result of their report, e.g. the initiation of internal investigations or the forwarding of the report ot the competent authority.
Companies must protect the identity of whistleblowers and comply with GDPR requirements
Companies must provide information about the competent supervisory authority(ies).

2) Companies should develop incentives for the use of internal reporting channels

Whistleblowers are free to decide whether they want to make internal reports or submit information externally. However, the law stipulates that internal reporting channels should be used as a matter of priority.

Companies should therefore create incentives so that whistleblowers prefer to use internal reporting channels without hindering the submission of reports to external reporting bodies. For example, companies should provide clear and easily accessible information on the use of the internal reporting procedure.

In particular, external reporting bodies should also inform the whistleblower about the possibility of making an internal report.

If a whistleblower’s tips remain unacknowledged or if the person concerned sees sufficient reason for a “threat to the public interest”, they would then fall under the protection of the Act when going public (via the press, media or social media).

“Around 90% of all whistleblowers first try to address observed grievances internally before turning to the authorities, media or public – provided they find suitable channels and an open company culture”.

– FISCHER, EVA (2019): EU COMMISSION AND EUROPEAN PARLIAMENT CLASH OVER WHISTLEBLOWER PROTECTION

3) The scope of application should cover infringements of European AND national law

The law extends the material scope of application to violations of national law and thus goes beyond the minimum requirements of the EU Whistleblowing Directive. The prerequisite here is that the offences must be a criminal or administrative and endanger health/life.

The German legislator wants to avoid “value contradictions” with the extension, because in reality, the restriction of whistleblowing for violations of exclusively European law could cause uncertainty among whistleblowers. They could then refrain from reporting for fear that their report would not be covered by the law.

Whistleblowers could then draw attention to violations such as corruption or tax evasion. The Digital Markets Act of the European Union is now also to be included in the material scope of the law.

4) Processing anonymous tips is not obligatory

Originally, the law obliged reporting channels to process anonymous tips and to take precautions to enable anonymous communication with the whistleblower(s). Changing this was a key aspect of the compromise about the draft and companies do not have to design their reporting channels in such a way as to enable anonymous reporting. However, if such reports are received, they should still be processed according to the law.

5) Shared systems and outsourcing

For organisations with between 50 and 249 employees, the law provides for the sharing of whistleblowing systems. Similarly, companies/groups, regardless of their size, are allowed to use joint reporting channels. Here, the parent company can assume the role of the third party supervising the reporting system. Furthermore, it is possible to outsource the reporting channel to an institution outside the company such as an ombudsperson.

6) Reversal of the burden of proof in favour of the whistleblower and damages after reprisals

As required by the Directive, the law aims to prohibit possible reprisals against whistleblowers and to invoke the reversal of the burden of proof. The employer must therefore prove that there is no link whatsoever between an employee’s dismissal and whistleblowing.

7) Exceptions for classified information

The Whistleblower Protection Act does not cover information that is classified, and information that falls under the medical/lawyer’s duty of confidentiality or judicial secrecy.

However, an exception applies to the lowest level of secrecy “VS-Nur für den Dienstgebrauch” (classified information for official use only), as long as it concerns violations that are subject to punishment and are reported via an internal channel. This exception does not apply if a third party – pursuant to Section 14(1) – is entrusted with the internal reporting channel.

8) Sanctions and claims for damages

In case of non-compliance with the legal requirements, the law provides for sanctions against natural and legal persons.

Violations are to be punished as administrative offences under section § 30 OWiG with a fine. This includes, for example, obstructing reports or taking reprisals but also for knowingly disclosing incorrect information.

In the event of a violation of the prohibition of reprisals, the person providing the information must be compensated for the resulting damage. Persons who pass on false information – intentionally or through gross negligence – must pay for the resulting damage.

Anybody attempting to intimidate a whistleblower, prevent reporting or breach the confidentiality agreement can be subject to fines of up to €50,000.

What does whistleblower protection mean?

Whistleblower protection means that persons (whistleblowers) who uncover illegal wrongdoing by reporting it, and supporting society as a result, are shielded from reprisals by law. For example, the cashier in the supermarket who notices that the store manager is relabelling spoiled food and the accountant who discovers that the CEO is financing his private trips through the company account are probably asking themselves the same question: Should they report the wrongdoing and endanger their future as a result? This is because whistleblowers have not had it easy in the past. Not only do they have to fear for their job, but they often fail to find a new one.

Whistleblowers do not enjoy comprehensive protection, even though they often take great professional and private risks to inform society about abuses. The stigmatisation of the “informer” is still too widespread, even though it takes a lot of courage to disclose grievances.

This is exactly where the new law wants to have an impact:

Whistleblowers should be protected in the future from reprisals such as dismissal, warning, denial of promotion, change of assignment, damage to reputation, disciplinary measures, discrimination or bullying. In the event that whistleblowers suffer financial damages due to retaliation, they have the right to compensation.

What have been the biggest points of contention so far regarding the Whistleblower Protection Act?

In the first draft, the CDU/CSU disliked the SPD’s move to extend the law beyond the EU’s requirements to take German law into account and it accused its former coalition partner of imposing an additional burden on German companies during the pandemic. The CDU/CSU therefore demanded that the law be limited to the requirements of the EU Whistleblowing Directive.

The SPD countered that in this case whistleblowers could report data protection violations and would be protected. However, if a whistleblower disclosed extensive fraud – as in the Wirecard case – he or she would in no way be protected from reprisals under EU law. The same would apply to violations of German criminal offences such as corruption, tax evasion or bribery payments.

The CDU/CSU parliamentary group also expressed scepticism about the second draft and already announced that it was “anything but approvable”. For example, it lacked incentives for whistleblowers to first seek internal clarification of the facts.

Criticism of the Whistleblower Protection Act

Early drafts of the law were also met with criticism from other quarters.

NGO Transparency International Deutschland in particular saw a great need for improvement in some aspects, especially in terms of dealing with reports without clear names. This has now been amended as whistleblowing channels are also obliged to process anonymous reports.

Annegret Falter, chair of the Whistleblower Network, welcomed the measures as a great step forward but saw some gaps in protection for whistleblowers, especially in the area of classified information. According to the law, it only protects reports “if they relate to the lowest level of secrecy, concern criminal offences and are kept absolutely internal by the authorities”.

Our tips for companies

Along with the EU GDPR and the Lieferkettensorgfaltspflichtengesetz (Supply Chain Due Diligence Act), the Whistleblower Protection Act is another compliance regulation where there is a broad spectrum of impacted organisations.

1.) Do not wait too long to comply with the law

Companies should set up professional compliance structures immediately to encourage whistleblowers to report through internal channels. Practice shows that a whistleblowing system is particularly successful when it is embedded in a trustworthy and transparent corporate culture.

2.) Information and communication are the be-all and end-all

The better the channels are communicated and can be found on a company’s website or intranet, the more employees will be aware of them and access them when needed. All relevant information about the law must therefore be made available to employees.

In our White Paper “Whistleblower Protection for Businesses“, you can find many inspiring examples of successful communication of whistleblowing systems in companies and the public sector.

3.) Best Practice: Digital Whistleblowing System

The professional use of digital whistleblowing systems in companies and the public sector can prevent or solve many crimes and scandals at an early stage. It is telling that more and more organisations are introducing digital whistleblowing systems for internal and external reporting, a trend that is expected to continue due to the new legal landscape in Europe.

If a whistleblowing system is already in place within a compliance management system, companies should adapt it to the requirements of the Directive or relevant national law so that they comply and legal uncertainties can be avoided.

4.) Effective whistleblower protection is possible for SMEs without high costs

Cost-effective solutions for medium-sized and small companies are readily available. Often, a digital system will be bundled with an external ombudsperson, usually a lawyer from a neutral law firm.

Sources:

Press release from the Deutschen Bundestages

Presse release from the German Justice Ministry

Legal Tribune Online

Transparency International Deutschland e. V.

Deutschlandfunk Kultur

Guide to the Introduction of Whistleblowing Systems

How to successfully implement a whistleblowing system in your organisation.

https://www.integrityline.com/wp-content/uploads/2020/12/2024-04-hinschg-infos-1200-1.png

Der Beitrag Hinweisgeberschutzgesetz: Germany Transposes The EU Whistleblowing Directive erschien zuerst auf EQS Integrity Line.

Why the EU Whistleblowing Directive Is Relevant Beyond EU Borders

mcc-niall — Tue, 18 Apr 2023 13:12:21 +0000

New whistleblower protection standards within the EU

Across the European Union, protection for whistleblowers used to consist of a patchwork of laws and measures varying tremendously in scope. While some member states lacked protection entirely, laws did not go far enough in others. The EU Whistleblowing Directive was introduced to create a single uniform protection standard across the bloc and while the transposition process has been slow, its requirements have now been largely implemented.

The different interpretations at national level uphold the Directive’s requirement for companies with at least 50 employees and municipalities with more 10,000 employees to introduce whistleblowing systems while shielding those speaking out from all forms of discrimination such as dismissal and degradation. In most cases, the new laws in Europe extend protection to a wider range of stakeholders such as job applicants, former employees, journalists and external suppliers.

EU law and ramifications beyond Europe

Down through the years, the enactment and enforcement of extraterritorial legislation by the United States was well known. As the EU grew into a powerful international economic actor itself, it put similar measures into place whereby foreign behaviour influencing its markets could be regulated. That has seen the principle of territorial extension incorporated into EU law whereby countries outside the EU-27 have to comply with regulations directly influencing the single market.

There are numerous examples such as the EU’s Timber Regulation which stipulates that third-country operators have to ensure both timber and timber products meet certain EU due diligence standards. Likewise, seafarers serving on EU-registered vessels must receive training and certification meeting EU standards. If they are trained in a third country, for example, the level of training provided must be recognised by the EU as meeting all the requirements laid down in the Seafarers’ Training, Watchkeeping and Certification Convention.

Directives form part of the EU’s secondary law and they can have ramifications for non-EU countries. The EU Whistleblowing Directive is no exception, and it will impact non-EU companies employing personnel and operating within the 27 member states.

The EU Whistleblowing Directive and non-EU companies

Companies headquartered outside the EU that conduct business within an EU member state by maintaining branches or subsidiaries with at least 50 employees are subject to the requirements of the Directive. Whether they are based in Switzerland or the United States, organisations with an EU-presence need to examine whether the scale of that presence brings them within the scope of the Directive and implement appropriate measures if necessary.

After the recent divorce with the EU, employers in the UK should not have a false sense of security and think that the Directive will not apply to them in the wake of Brexit. Despite being a member of the EU until the end of January 2020, the UK does not have a legal obligation to transpose the Directive and it is held to the same conditions as any other non-EU country.

Organisations based outside Europe falling within the remit of the Directive may face some compliance hurdles. A key issue is that the Directive sets a common framework of minimum standards and each member state can go beyond them at their own discretion. For example, some countries have made anonymous whistleblowing mandatory as part of their national laws transposing the Directive while others have not enforced this requirement.

As a result, non-EU companies with a presence in multiple member states will have to examine the precise legal requirements across all of their markets and possibly introduce a patchwork compliance programme differing on a country-by-country basis. While a single framework is possible, organisations need to carefully assess whether it is universally applicable to all markets. They of course also have the option of complying with the rules from every jurisdiction at the highest possible protection standard and this is best achieved through the introduction of a comprehensive digital whistleblowing system.

EFTA and the Whistleblowing Directive

The European Economic Area (EEA) also includes the European Free Trade Association (EFTA) states of Iceland, Liechtenstein and Norway. While they are not EU member states, they are linked to the internal market by the same basic rules and they are obliged to adopt parts of EU law. This includes Directives regulating the internal market which have to be included in the EEA agreement and implemented into the respective countries’ national legislation.

According to the most recent EFTA update, the EU Whistleblowing Directive is still under scrutiny by Iceland, Liechtenstein and Norway. Oslo ordered a report to be compiled as to whether the new EU legislation will require changes in Norwegian law and it was published for public hearing in June 2022. It recommends implementing the Directive through a new EEA Whistleblower Act along with supplementary regulations for some of its provisions.

All three countries are certainly in a strong position for the rollout of a new EEA Whistleblower Act. Norway already offers protection for whistleblowers speaking out about working conditions, though it falls short of the Directive in some areas, particularly when it comes to extending the scope of protection to individuals beyond employees. In Liechtenstein, whistleblowers can submit reports to the Financial Market Authority Liechtenstein (FMA) either anonymously or by disclosing their identity. As opposed to the EU Directive, whistleblowers in Liechtenstein are not informed about any of the initiated measures.

Iceland adopted protective measures for whistleblowers in 2008 and they were strengthened in 2019 through the Disclosure Protection Act which dismisses liability for disclosing wrongdoing while preventing retaliation. Despite the existing legislation in Norway, Liechtenstein and Iceland, companies in all three countries should follow further developments closely, shore up existing business operations within the EU and prepare for the arrival of a new EEA Whistleblower Act at some point in the future.

Summary

With 26 million active companies, 131 million people employed, over half a billion consumers and a value of more than €16 trillion, the European single market is a complex place governed by layers of bureaucracy. The EU Whistleblowing Directive is a landmark piece of legislation with major compliance ramifications for all organisations with 50 plus employees doing business in at least one of the 27 member states, even if their presence there only constitutes a branch office or subsidiary.

Businesses with a primary presence beyond EU borders but who may still be impacted by the Directive are advised to closely monitor developments and take several steps. They should conduct an internal clarification process to gauge the extent to which branches and subsidiaries are bound to comply with the new measures so internal processes can be revised accordingly. If they are indeed impacted by the Directive, they should take prompt action to introduce internal reporting channels and communicate the new rules to their employees and key stakeholders as quickly and as comprehensively as possible.

Whistleblowing Laws in the European Union

A glance at the implementation of the EU Whistleblowing Directive in EU Member States

https://www.integrityline.com/wp-content/uploads/2023/04/eqs-group-blog-whistleblowing-laws-outside-eu.jpg

Der Beitrag Why the EU Whistleblowing Directive Is Relevant Beyond EU Borders erschien zuerst auf EQS Integrity Line.

What HR Professionals Need To Know About Whistleblowing & Whistleblower Protection

mcc-niall — Tue, 28 Mar 2023 12:35:46 +0000

Laying a foundation

HR departments play an important role in building a trusting and pleasant corporate culture. They should of course be well acquainted with the Code of Conduct, represent the values of the company and even live those values themselves.

All areas of the company – from top management to middle management to all departments – must actively exemplify and support compliance to create a credible compliance strategy. This is also the case when it comes to developing a speak-up culture where employees behave ethically and correctly from a legal standpoint while also daring to speak up and report grievances.

HR can bring the knowledge and prerequisites for this to the individual departments in the form of regular training sessions. If ethics, transparency and responsible behaviour are established and consolidated as a corporate culture, HR can then encourage employees to make use of the internal reporting channels.

HR should therefore directly inform new employees about the Code of Conduct during the onboarding process and point out that the company has internal reporting channels in place. They should also ensure that the whistleblowing system is easily accessible to all employees by, for example, linking to it on the intranet.

Cooperation with the compliance department

In addition to the works council who represent employee interests, the compliance department also directly affects the HR department’s areas of responsibility as it sets the rules for employee conduct. It is advisable for HR to work closely with the compliance and legal departments to jointly develop the compliance guidelines and Code of Conduct.

If violations do occur, the disciplinary consequences lie with the HR department and should be implemented in coordination with the legal department. Last but not least, HR management should ideally support the development and maintenance of the compliance culture through training while informing employees of their rights.

Looking inwards

Despite all the focus on wider employees, HR departments must not forget to look inwards. Are their own team members also behaving in accordance with the Code of Conduct and the applicable regulations? HR should ensure that the processes within their own department are also transparent and check or develop a concept on how to react and deal with misconduct (or reports of misconduct) within their own ranks as well as the likely consequences. As HR departments are important points of contact in the event of a compliance case within organisations, they themselves also have to meet the highest compliance standards.

The EU Whistleblowing Directive

Across Europe, more and more countries have transposed their own national interpretations of the EU Whistleblowing Directive which requires companies with at least 50 employees to establish a secure whistleblowing system. Generally, the new national laws coming into force oblige organisations to establish an internal reporting channel and provides for external reporting to a third-party entity. In Italy, for example, this will be the Autorità Nazionale Anticorruzione (National Anti-corruption Authority) while in Germany, it will be the Bundesamt für Justiz (The Federal Office of Justice).

When worst comes to worst

When a report is received, the company has to act quickly. The EU Whistleblowing Directive stipulates that an acknowledgement of receipt of the report must be sent to the whistleblower within seven days while feedback on the outcome and consequences of the investigation have to be provided within three months. This is also reflected in the implementation of the legislation at country level.

If the report is not investigated by an external expert but only investigated internally, HR staff may be called to support the compliance team. HR is frequently best placed to assess the validity or consequences of an allegation, particularly if it directly relates to an individual’s misconduct.

Within a compliance procedure, the HR team can also discuss ethical issues with the individual involved through the whistleblowing platform’s messaging channel and allay fears of reprisals. The whistleblowing process can prove stressful and emotional for employees speaking out and it can also be part of HR’s responsibilities to ensure employees feel secure in terms of labour law.

Labour law and whistleblowing

Under the EU Whistleblowing Directive, employees must not suffer reprisals at work for whistleblowing and this takes into account bullying and discrimination, denial of promotion, punitive transfers and, of course, suspension or dismissal.

If the report is not anonymous and the name of the whistleblower is known internally, it is not only the task of the works council to speak up for the employee. The HR department should also be concerned about protecting employees from reprisals in order to maintain employees’ trust in the company and in credible compliance.

If, after an internal report, labour law measures are taken against an employee, companies must be able to prove in a case of doubt that any action taken is not related to the person’s whistleblowing report. To safeguard themselves, HR departments should sufficiently document the reasons and legal steps taken in the sense of shifting the burden of proof, so that the company’s behaviour can be explained in the event of a labour court despite.

In the extremely rare case that a whistleblower makes a deliberately false report, the HR department should take over disciplinary measures including warnings or dismissal. Even criminal proceedings against the employee are not excluded from the disciplinary process.

Whistleblowing Laws in the European Union

A glance at the implementation of the EU Whistleblowing Directive in EU Member States

https://www.integrityline.com/wp-content/uploads/2022/11/integrityline-blog-HR-whistleblowing.jpg

Der Beitrag What HR Professionals Need To Know About Whistleblowing & Whistleblower Protection erschien zuerst auf EQS Integrity Line.

Italy Transposes The EU Whistleblowing Directive

mcc-niall — Mon, 20 Mar 2023 09:52:14 +0000

Background and prior whistleblowing protection in Italy

Across Europe, protection for whistleblowers consisted of a patchwork of national legislation that varied considerably in the levels of protection provided. The EU Whistleblowing Directive sought to introduce a universal and comprehensive protection standard across the bloc whereby companies would be obliged to establish whistleblowing channels and retaliation is prohibited.

Italy was one of the countries in Europe that had existing measures in place to protect whistleblowers. That legislation was introduced all the way back in 2001 when Article 54-bis of Legislative Decree no. 165 brought in protective whistleblowing measures for public sector employment while Article 2 brought them to the private sector.

That law was amended in 2014 and more substantial changes followed in 2017. While it did provide Italian whistleblowers with protection in certain situations, Law 179/2017 fell short of the more stringent requirements of the EU Whistleblowing Directive. Limitations included a lack of provisions for anonymity, constrictions whereby private-sector employees could only report internally and the fact that organisations only had to establish whistleblowing channels if they had adopted and implemented Model 231.

Italy and the EU Whistleblowing Directive

The Senate of the Republic, the upper house of Italian Parliament, passed a draft law in October 2020 mandating the government to begin the transposition of 33 EU laws, including the EU Whistleblowing Directive. Given the shortcomings of Law 179/2017, NGO Transparency Italia called upon to the government to improve the state of the existing legislation to meet the requirements of the Directive.

It is understood that the Ministry of Justice and the Department for European Policies at the Office of the Prime Minister overtook responsibility for implementing the Directive and it was announced that the process had started in April 2021. The situation remained largely the same well into 2022 and it was criticised both for a lack of inclusivity and transparency.

There was progress in September 2022 when a new delegation law was approved to further the transposition process of 14 Directives and 21 regulations including the EU Whistleblowing Directive. The new mandate gave the government three months to draft a transposition bill and it was approved by the Council of Ministries in December. Cabinet subsequently approved the final examination of the Legislative Decree implementing the legislation in March 2023.

The requirements of Italy’s new law

The new Italian law obliges private and public sector entities to establish internal reporting channels that guarantee the highest levels of confidentiality. Reports can also be made to the Autorità Nazionale Anticorruzione (National Anti-corruption Authority) provided the internal channel has been used in advance. This can occur in the following situations:

While the requirement to establish a whistleblowing system applies to all companies with an average of more than 50 employees, organisations operating in sectors deemed sensitive such as finance will still have to implement them, regardless of the size of their workforce. Organisations with at least 250 workers had to have their reporting channels in place by 15 July 2023 while entities with between 50 and 249 workers will need to follow suit by 17 December 2023.

Italy’s new measures protect individuals reporting violations of national or EU law of which they have become aware in a work-related context. Protection is extended to include a whole range of whistleblowers beyond just employees and it also takes into account self-employed workers, freelancers, volunteers, trainees, shareholders and “facilitators” such as colleagues or relatives of the person reporting.

Notably, the the new whistleblowing law in Italy provides that protection is recognised in the event reports or disclosures later turn out to be unfounded, if the whistleblower had reasonable grounds to believe that his or her concerns were true. However, protection ceases if the reports are found to have been made through wilful misconduct or gross negligence.

Retaliation and Sanctions

Retaliation against whistleblowers such as dismissal, demotion, suspension, failure to promote, salary reduction, harassment or otherwise unfavourable treatment is expressly prohibited by Italy’s new law. This extends to the failure to convert a fixed-term employment contract into an open-ended contract if the whistleblower has a legitimate expectation of this occurring. It also takes into account damages to the whistleblower’s reputation, particularly on social media, or financial circumstances such as the loss of economic opportunity.
The Autorità Nazionale Anticorruzione can apply a series of pecuniary sanctions against those responsible including fines of between €10,000 and €50,000 where it has been found that retaliation has been committed, a report has been obstructed (or an obstruction attempt) or that the obligation to observe confidentiality has been violated pursuant to article 12.
Fines in the same range can also be imposed when it has been determined that no reporting channels have established or no procedures have been implemented for filing and managing reports. Finally, sanctions between €500 and €2,500 can be levied against the reporting person for the crimes of defamation or slander.

Conclusion

Compared to many other European countries, Italy has shown plenty of initiative when it comes to protecting whistleblowers. While what became Law 179/2017 was progressive, it did have serious shortcomings, and these have been addressed through the transposition of the EU Whistleblowing Directive. Italy can now boast comprehensive whistleblower protection and a law conforming to the new universal European standard.

Whistleblowing Laws in the European Union

A glance at the implementation of the EU Whistleblowing Directive in EU Member States

https://www.integrityline.com/wp-content/uploads/2023/03/integrity-line-blog-whistleblowing-law-italy.jpg

Der Beitrag Italy Transposes The EU Whistleblowing Directive erschien zuerst auf EQS Integrity Line.

Church & Whistleblowing: What Religious Institutions Need to Consider

mcc-niall — Thu, 09 Mar 2023 12:57:16 +0000

What does the EU Whistleblowing Directive require?

The EU Whistleblowing Directive was conceived to protect employees who discover and disclose wrongdoing in the course of their professional activities, requiring organisations with at least 50 employees to introduce a whistleblowing system. They need to acknowledge a report within seven days and provide feedback on action taken within three months. Retaliation against the whistleblower(s) and, in most cases their close contacts, is prohibited.

EU member states have introduced their own interpretations of the Directive within their national legal frameworks and while they broadly conform to a single universal standard, some of the finer details tend to vary between countries. Nearly all countries have now managed to transpose the Directive, though the process was delayed considerably.

Does the church need to introduce compliance measures?

In many countries, new national whistleblower protection laws explicitly name both the Protestant and Catholic churches, along with their respective parishes, as employers. Other ecclesiastical districts such as dioceses, archdioceses and deaneries are considered corporate bodies and are thus affected. Furthermore, privacy law applies to legal entities including registered associations, limited liability companies and foundations.

Many of the different national laws implementing the EU Whistleblowing Directive take volunteers into account and this will have ramifications for the church. In Ireland, for example, the Coast Guard told its volunteers that they are now ‘explicitly included’ under the country’s new whistleblowing law, despite the fact that they do not receive remuneration and are not economically dependent on the organisation (which includes full-time paid employees along with unpaid volunteers).

In Ireland and other countries, church volunteers will be similarly impacted by new legislation and this means that even smaller church institutions exceeding the 50-employee threshold (including unpaid volunteers) will be compelled to introduce a whistleblowing system. The situation remains somewhat nebulous in certain EU member states, such as Germany. While the country’s Hinweisgeberschutzgesetz does not specifically protect volunteers who are unpaid, it is open to interpretation. Only lay judges are explicitly excluded from the legislation and one could conclude that all other volunteer groups can be considered employees.

Has priest-penitent privilege been taken into account?

There are legislative questions surrounding confession and priest-penitent privilege. In France, Germany and Poland, for example, Catholic clergy are not obliged to inform the authorities about crimes heard in confession, even if they involve child abuse, while information does not have to be disclosed in court. Ireland announced its intentions to reverse the privilege in the wake of a plethora of scandals involving child sex abuse, but the church informed the government that priests would not comply with the provision, regardless of the consequences. In the UK, the status of priest-penitent privilege has not been absolutely determined.

So far, the EU Whistleblowing Directive has taken the professional secrecy of occupations such as lawyers, notaries, doctors and pharmacists into account while the pastoral confidentiality of the church has been omitted. This has attracted criticism. In Germany, for example, where section 5 paragraph 2 or the law states that the professional confidentiality of a number of occupations is exempt from disclosure, religious organisations are absent. This has resulted in the Protestant and Catholic churches demanding that their clergy be included due to their duty to uphold pastoral confidentiality.

Can churches establish a central whistleblowing hub?

Church institutions have asked whether it is possible to pool resources to establish a central whistleblowing hub. In principle, this possibility does exist for registered associations and other legal entities with between 50 and 249 employees. In Denmark, France, and Austria, for example, the employee threshold for group whistleblowing systems can be interpreted as being unrestricted.
There are exceptions, however, and Germany provides another example. While registered legal entities can amalgamate resources under private law, regional churches, dioceses and deaneries cannot take the same step according to the current wording of the draft. The Protestant and the Catholic churches in Germany released a joint statement criticising the situation, calling for similar treatment to the federal government, federal states and municipalities who are allowed to form organisational units for the creation of an internal whistleblowing hub.

Flawed rules and view from the Vatican

In May 2019, Pope Francis issued moto propio, an Apostolic Letter entitled Vos estis lux mundi (“You are the light of the world”) setting forth new accountability rules for Roman Catholic bishops committing sexual abuse or cover ups. While the new measures attracted praise and made it mandatory to report abuse, they were seriously flawed.
Investigations still had to be conducted by the church hierarchy rather than the civil authorities which raised fears of cronyism and clericalism. It is also highly uncertain as to whether victims or the civil authorities would have been informed about the outcome of investigations. While the new rules forbade “prejudice, retaliation or discrimination as a consequence of having submitted a report”, they did not specify any penalties against individuals breaching those protocols.
The rules also included a mandatory whistleblowing provision whereby a priest or member of a religious order had to report wrongdoing to the local bishop. If a bishop was involved, the priest was compelled to report it to the Holy See directly through the Pontifical Representative. Notably, this mandatory whistleblowing process still did not compel an individual to report wrongdoing to a neutral third party or the civil authorities. This is now set to change across Europe as a result of the Directive and the church will have to comply with the new secular requirements.

Setting an example

Some Roman Catholic districts have already taken the initiative to introduce their own third-party whistleblowing systems, and this provides a good example of how the church can comply with the Directive on a much a larger scale. In the United States, where the new European measures will not have an impact, a 2022 poll of more than 3,500 Roman Catholic priests found that their trust levels in diocesan bishops fell from 63% in 2001 to just 49% in 2022. Less than a quarter of priests responded that they had confidence in US bishops in general. Given this crisis in trust, it is unsurprising that some US dioceses are attempting to introduce measures to improve the situation.
The Archdiocese of Baltimore announced it was establishing a whistleblowing system for complaints against bishops in January 2019. Archbishop William Lori announced the implementation of the web-based system which routes complaints to Baltimore’s lay-led diocesan review board which is charged with reporting allegations to the civil authorities.
Shortly afterwards in March, the Archdiocese of Boston made a similar announcement, confirming that a third-party whistleblowing system would be introduced for reporting allegations of abuse or misconduct against bishops. Cardinal Sean O’Malley stated that the web-based solution would be confidential, anonymous and a third-party system.
While the Catholic Church and its ecclesiastical districts in Europe do offer whistleblowing guidance, templates and consultation, there are few examples of similar systems being put into use. One exception is the diocese of Augsburg in Germany where a platform allowing confidential reporting is in place. The diocese introduced compliance rules for its administration in 2019 and they applied to approximately 15,000 employees across its parishes and day-care centres from December 2022. This is an example of a diocese that is now well prepared for the transposition of the EU Whistleblowing Directive in Germany.
Outside the Catholic Church, other denominations are also introducing effective whistleblowing frameworks. Back on the other side of the Atlantic, the United Church of Canada, the largest Protestant Christian denomination in the country, has also introduced a digital whistleblowing system where concerns can be submitted in English and French.

How religious institutions can successfully implement a whistleblowing system

Given that big compliance changes are coming to the Protestant and Catholic churches in Europe, it is important to outline how a third-party whistleblowing system can be put into effect. Other religious institions, such as the Islamic and Jewish faiths, are also advised to place a close eye on the new legislation as the requirements could have an equally significant impact on their operations.

There are various ways to establish a whistleblowing system in principle, such as a mailbox, telephone, ombudsman or digital platform. The latter, already operating put into action by a small number of forward-thinking dioceses, has the advantage of being available around the clock while being accessible from anywhere. In addition, this solution allows for anonymous reporting, the most popular option among whistleblowers in the Whistleblowing Report 2021.

Implementation is easiest with an established technical solution and an experienced service provider. It is essential to combine the new digital whistleblowing system with suitable communication measures to make employees aware of what it can offer and how it can be harnessed. This should help develop an environment of trust where the system’s users feel encouraged to report violations.

While this article provides several examples of districts that have successfully embraced technologically advanced whistleblowing tools, the church needs only to look towards the corporate world for evidence of how these systems are revolutionising compliance and just how easy they are to implement. Regardless of the transposition of the Directive across Europe, ecclesiastical organisations are advised to proactively take their first steps right away so that they are well positioned to apply with the new secular legal requirements looming on the horizon.

Guide to the Introduction of Whistleblowing Systems

How to successfully implement a whistleblowing system in your organisation.

https://www.integrityline.com/wp-content/uploads/2023/03/integrityline-blog-kirche-und-whistleblowing.jpg

Der Beitrag Church & Whistleblowing: What Religious Institutions Need to Consider erschien zuerst auf EQS Integrity Line.

Finland Gets EU Whistleblowing Directive Over The Finish Line

mcc-niall — Thu, 09 Mar 2023 09:45:15 +0000

Background: Finland and the EU Whistleblowing Directive

The EU Whistleblowing Directive aims to end a confusing patchwork network of whistleblowing protection legislation across all member states, bringing the bloc to a new and universal protection standard. Governments had a December 2021 deadline for implementation and the process was delayed in the majority of member states.

Under the new measures, all private and public sector employers with 250 or more employees were required to establish a whistleblowing system by April 2023. Smaller entities with between 50 and 249 employees were also required to take action and they were given an extended deadline of December 2023.

Finland did not have comprehensive protective measures in place for whistleblowers before the EU Whistleblowing Directive entered into force, though it did have some sector-specific requirements. The Finnish Ministry of Justice set up a working group for the transposition of the Directive in February 2020 and more formal consultation followed in a series of meetings in November 2020.

Following a subsequent period of public consultation, a new bill was expected to be presented in parliament in September 2021 but this was delayed. In May 2022, the Lainsäädännön arviointineuvosto (Legislative Review Board) reviewed the bill, concluding that it fell short in several areas. The board recommended more clarity about the main impact on the rights and obligations of employees and employers as well as the process of setting up new channels in place of existing systems used by public authorities.

In September 2022, Finland issued the “Whistleblower-laki” or “Whistleblowing Law”, significantly strengthening protection for whistleblowers and obliging companies to implement reporting channels. The law was approved by the Finnish parliament in December 2022 and it entered into force on January 01, 2023.

The scope of Finland's new law

Under Finland’s new law, private sector entities employing at least 250 people and public sector entities with at least 50 employees were required to establish an internal reporting channel by 01 April 2023. Private sector entities with between 50 and 250 employees were given an extended deadline of 17 December 2023 to comply with the new requirements. Similarly, organisations with fewer than 50 employees who voluntarily established an internal reporting channel must bring it into compliance with the new legislation by the same date.

The personal scope of the Whistleblowing Law in Finland goes beyond the whistleblower and takes into account individuals such as board members, volunteers, unpaid trainees, shareholders and job applicants. Receipt of a report must be acknowledged within seven days while feedback on any action taken has to be provided to the whistleblower within three months. If the whistleblower reasonably concludes that the employer’s actions were insufficient or the feedback provided is satisfactory, he or she is entitled to protection at the organisation’s expense. In such a scenario in Finland, the whistleblower can also decide to report via a public channel through The Chancellor of Justice’s Office or later to the general public.

Finland’s law does not require private employers to implement anonymous reporting but many organisations will likely offer this option in practice. Even if an organisation decides against anonymous reports, the law still recommends establishing such a channel given that it can prove useful for communication with the anonymous whistleblower.

Under the new legislation, whistleblower reports must be exclusively processed by appointed persons who are appropriately trained in a qualified case management system. Processing of reports can be outsourced, given that the body responsible adheres to the GDPR and relevant national regulations. While the new law allows for group implementation, it falls short when it comes to intragroup whistleblowing solutions in areas such as data transfer and liability allocation.

Penalties and consequences for non-compliance

In Finland, the unauthorised disclosure of a whistleblower’s identity is considered a punishable offence that can result in up to two years imprisonment, though no new offences are planned for employers failing to establish whistleblowing channels. However, the reversed burden of proof on management essentially means that if a whistleblowing framework is not in place, management’s discharge from liability may be considered void.

Retaliation or the initiation of vexatious proceedings against whistleblowers is subject to summary court proceedings and liability to pay damages and compensation. They are not subject to the cap for damages set out in the labour law. Even though the level of compensation is not regulated, it is assumed to be somewhere between several thousand euros and around €15,000.

Conclusion

Finland’s law is undoubtedly a step in the right direction, introducing sweeping improvements in protection levels for whistleblowers and bringing the country in line with the latest European protection standard. Nevertheless, it has attracted criticism, particularly due to the absence of an anonymity requirement and the lack of direct penalties against companies failing to implement whistleblowing channels.

Guide to the Introduction of Whistleblowing Systems

How to successfully implement a whistleblowing system in your organisation.

https://www.integrityline.com/wp-content/uploads/2023/03/integrity-line-blog-whistleblowing-law-finland.jpg

Der Beitrag Finland Gets EU Whistleblowing Directive Over The Finish Line erschien zuerst auf EQS Integrity Line.

Group-Wide Whistleblowing Channels: Are They Allowed?

mcc-niall — Thu, 09 Mar 2023 08:19:27 +0000

Background and requirements

As a result of the EU Whistleblowing Directive’s transposition across Europe, whistleblower protection measures are becoming mandatory and these include the establishment of internal reporting channels, the facilitation of regular dialogue with individuals speaking out, effective case management and the prevention of all forms of retaliation, such as demotion or dismissal.

Understandably, the tough requirements of the new legislation have raised questions in organisations such as how to cope where resources are limited, the possible impact on subsidiaries or how to roll out a whistleblowing system across multi-country groups.

According to article 8, paragraph 6 of the EU Whistleblowing Directive, companies with between 50 and 249 workers have the option of sharing resources for the receipt of whistleblowing reports and to facilitate investigations without jeopardising confidentiality. The majority of national laws transposed in Europe upheld this provision without extending it to larger organisations and their subsidiaries. Some laws have even failed to mention group matters entirely.

Shared whistleblowing systems for groups: the interpretation in EU member states

The member states that transposed the EU Whistleblowing Directive implemented their own interpretation of the legislation and in the majority of cases, their national laws closely align with its requirements. However, there are exceptions with regards to groups and subsidiaries in a handful of countries:

Denmark

Denmark was the first country in Europe to get the Directive transposed and its iteration of the law opens up the possibility of companies operating common group channels regardless of their size. This was not the case with initial drafts and Danish legislators made adaptations following objections from interest groups and large companies. According to Danish law, a group can set up a shared whistleblowing scheme covering all subsidiaries within that group. The parent company would act as the whistleblowing hub for the subsidiaries and would process reports, engage in dialogue with whistleblowers and carry out all necessary investigations.

France

Likewise in France, the law states that a whistleblowing system can be common to several or all companies in a group, though it does not specify the employee thresholds necessary to proceed with a shared system. An October 2022 decree was supposed to offer more clarity in this area but it unfortunately failed to provide the necessary details.

Austria

Austria’s HSchG allows all legal entities to transfer the tasks of the internal reporting body, regardless of their size, and this differs from the EU Whistleblowing Directive where only organisations with 250 employees are facilitated. It remains to be seen if this will be changed in the final version of Vienna’s law.

Estonia

Estonia’s legislation also states that group companies may share or jointly manage internal whistleblowing channels and that those channels may be managed by an external third party.

Spain

Spain is another country that has granted companies the right to work in group structures. Article 11 of its law states that the internal information system can be the same for an entire group or for each company within a group of companies. The management of the internal information system can be carried out within the entity itself or by a third party, though only with confidentiality, security and privacy guarantees in place.

Germany

While Germany’s law prevents companies with more than 249 employees from operating a joint channel, it does make it possible for one group company within a larger organisation to establish a centralised whistleblowing channel regardless of its size. Through a service agreement, this centralised unit can work with several independent entities within the corporate group while the overall responsibility lies with the respective mandating group company.

Finland

In Finland, new legislation allows for group implementation but without intragroup solutions such as the documentation of employee consent or the allocation of liability.

Italy

In Italy, companies in a group employing an average of no more than 249 employees under permanent or fixed-term employment contracts in the past year can share and manage internal whistleblowing channels.

Data protection considerations

Companies and groups of companies have to be aware that whistleblowing involves the processing of personal data which requires compliance with some specific aspects of the GDPR. With regard to a multi-country group, the privacy role of each party involved must be taken into consideration. The company that the whistleblower has an employment relationship with – whether he or she is an employee, former employee or supplier – is ultimately responsible for upholding privacy and remaining compliant with the GDPR.

Depending on the specific activities carried out, other group companies involved in the receipt and management of whistleblowing reports could cover supporting privacy roles such as acting as independent data controllers or joint investigators. In the case of the independent ownership of a group company, it is necessary precisely outline the purposes and means of data processing while also guaranteeing that personal data is being protected.

When it comes to the co-ownership of processing, companies can share resources for the phase of sending, receiving and forwarding reports. They must jointly decide on the means and purposes of processing, whether there is sharing of data as well as the security measures in place. For the latter, security principles such as access limitation, segregation of duty and need-to-know principles must be in place and guaranteed whereby those handling a case can only access the data required for processing.

A group company can also act on behalf of another entity during a specific stage of processing such as the receipt and forwarding or a report or IT support. In this case, relations should be regulated through an intra-group agreement and the creation of a suitable position should be made. It is also necessary to analyse and appropriately regulate the presence of possible additional parties that may intervene in processing and come into contact with confidential data.

If data is transferred beyond EU borders, the legality of that activity must be proven pursuant to Article 44 of the GDPR. For multi-country groups with offices outside the EU, the third country destination of data should be analysed and its local legislation checked in order to ensure all transfers are lawful in the absence of an adequacy decision pursuant to Article 45 of the GDPR. This is regarding the Schrems II ruling of the EU Court of Justice on 16 July 2020 and the European Data Protection Board guidelines of January 2021.

That judgement actually sanctioned the invalidity of Privacy Shield for data transfers to the United States and ruled that third countries that are not covered by an adequacy decision from the European Commission under Article 45 of the GDPR and the measures guaranteeing transfers under Article 46 of the GDPR. This is deemed adequate if the third country where the data is being transferred can guarantee the same data protection framework as that provided by the GDPR.

To ascertain the level of data protection in place, the data importer must conduct a preliminary assessment in the form of a checklist before signing an appropriate agreement between the parties involved. If Standard Contractual Clauses (SCC) are applicable as a measure to safeguard non-EU transfers, the new SCCs adopted by the European Commission on 04 June 2021 should be referenced.

The fulfilments to be implemented when processing the personal data of whistleblowing reports are as follows:

Compliance with the principle of “privacy by design and default” pursuant to Article 25 of the GDPR whereby the treatment must be foreseen from the outset in compliance with the general principles referred to in Article 5 of the GDPR.
An impact assessment must be carried out due to the sensitivity of the information process and level of risk involved as well as the possible retaliatory effects and discriminatory measures that could be levied against the whistleblower.
Adequate security measures must be implemented such as a secure network protocol, end-to-end encryption and strong authentication mechanisms.
Appropriate organisational measures should be put in place such as the introduction of an expert whistleblowing services provider and the appointment of a suitable authority for processing personal data.

Best practice

Despite the inconsistencies in national legislation and an increasingly complex international legal landscape, groups of companies should nevertheless take some form of action such as re-structuring or updating their own whistleblowing channels regardless. To that end, they should take a number of steps. A preliminary investigation should be conducted into the local regulations where the parent organisation has its subsidiaries in order to verify differences in transposition regulations. Whistleblowing systems can then be organised in a uniform way guaranteeing the highest standards of protection.

A detailed whistleblowing policy should be established where the process of managing the report is outlined while the subjects in charge of investigations are identified. This should be communicated to all relevant stakeholders and they should also be trained in the correct use of the whistleblowing system while also being informed of the sanctions for possible violations. Reports should be treated confidentially and documented while the whistleblowing system should be aligned with privacy, data protection and cybersecurity requirements.

Digital whistleblowing systems can prove to be a powerful tool for group companies provided that they allow for the segregation of the channels used by different subsidiaries. Some of the advantages include universal access to a full suite of compliance modules, straightforward audit checks across the entire group, minimised bureaucracy between the different subsidiaries and a comprehensive overview of the entire compliance spectrum in real-time. In addition, management can define processes and handle rights management, defining who within the organisation gets informed in the case of a report.

These digital solutions are also easy to set up and maintain. Some software providers can implement completely independent reporting channels for each subsidiary whereby whistleblowers can avail of company selection and intelligent case routing.

Conclusion

While EU lawmakers took the limited resources of SMEs into account when drafting the legislation and this was echoed at national level, there is no similar allowance at subsidiary level or for larger groups of companies. In countries such as Austria, Denmark, France and Estonia, the law’s approach seems to reflect the practical reality of managing internal whistleblowing systems. Experience has shown that large organisations prefer to centralise their whistleblowing channels and optimise the resources available.

The European Commission’s decentralised approach is at odds with the preferences of larger organisations and it requires all companies with more than 50 workers to establish individual local reporting channels, even if they belong to a group. While there are a number of national exceptions, large corporate groups (and especially multinationals) will have to rethink their current reporting policies, carefully analyse the complex legal situation and consider how to best create a system where whistleblowers feel comfortable sharing their concerns with the parent organisation.

Whistleblowing Laws in the European Union

A glance at the implementation of the EU Whistleblowing Directive in EU Member States

https://www.integrityline.com/wp-content/uploads/2023/03/eqs-group-blog-whistleblowing-groups.jpg

Der Beitrag Group-Wide Whistleblowing Channels: Are They Allowed? erschien zuerst auf EQS Integrity Line.