Legal Alerts/21 Jan 2022
Delay in the Implementation of the EU Whistleblower Directive
Companies employing at least 50 employees and certain entities that are required to report under the Finnish act on preventing money laundering and terrorist financing are subject to new reporting channel requirements, rules protecting whistleblowers and other regulation introduced by the EU Whistleblower Directive. Although companies employing less than 250 employees will apparently be granted an extended implementation period, organisations should be prepared for the new Whistleblower regulation. However, it was announced in December that the legislative proposal implementing the Whistleblower Directive in Finland has been delayed.
The national implementation of the Whistleblower Directive in Finland
The deadline for implementing the EU Directive on the protection of persons who report breaches of Union law (Directive (EU) 2019/1937, the “Whistleblower Directive”) in the Member States was by 17 December 2021.
A proposal concerning Finnish legislation to implement the Whistleblower Directive in Finland was submitted for a round of comments during the period of 2 July to 27 August 2021. Comments of some 80 commentators were submitted and published on the Finnish Ministry of Justice’s website.
The Governmental proposal refers to a survey that was carried out by the Central Chamber of Commerce of Finland according to which three reports have been submitted on average through companies’ whistleblowing channels as per 1,000 employees.
On 8 December 2021, the Ministry published a statement noting that the implementing legislation will be delayed due to the extent of the Directive’s requirements and the large number of comments made to the proposal.
Therefore, the new target is that the amended regulatory proposal will be submitted to the Parliament during week 8 (the week starting on 21 February) 2022. Once the Government’s amended proposal has been submitted, the Parliament will process it and decide on the timeline for the enactment of the proposed Whistleblower regulation.
The Ministry’s statement also notes that an individual whistleblower cannot gain the legal protection planned under the whistleblower regulation until the national implementing legislation enters into force. Consequently, the statement says that it is not appropriate to establish whistleblowing reporting channels in accordance with the upcoming regulation for protecting whistleblowers before the regulation enters into force.
Companies and organisations required to establish internal reporting channels
The original governmental proposal imposes a requirement on private legal persons (companies, co-operatives, associations etc.) that regularly employ at least 50 employees to establish an internal reporting channel.
The proposed regulation imposes a corresponding requirement on public sector organisations (the state, municipalities, government agencies and institutes as well as majority state owned companies), and regulated financial institutions, as well as organisations required to report under the Finnish act on preventing money laundering and terrorist financing, irrespective of the number of employees employed (these organisations include auditors, providers of bookkeeping services, attorneys, providers of legal, tax and financial services etc.).
The Governmental proposal includes a transitional provision for private sector legal persons that employ a maximum of 249 employees, allowing them to postpone the establishment of the internal reporting channel (or implement changes to the reporting channel to meet the requirements of the new regulation) to 17 December 2023.
It is unclear at his point, however, whether the delayed implementation of the national whistleblower legislation will extend the transitional provision.
The aim of the general regulation in Finland
The act included in the Governmental proposal is intended as a general regulation on the protection of reporting persons and it is designed to meet the Whistleblower Directive’s minimum requirements. The aim of the regulation is to ensure that persons that in the course of their work observe or suspect activities in breach of the public interest can report those observations or suspicions in a safe manner.
- The proposal affords companies a discretion as to the design and technical setup of the reporting channel. Companies may set up their own internal reporting channel or order it from an external service provider. Existing reporting channels may need updating to fulfil requirements introduced in the proposal relating to the receiving, processing and follow-up actions on the reports submitted through the channel. Legal entities in the private sector with 50 to 249 workers may share resources as regards the receipt of reports and any investigation to be carried out.
- The Governmental proposal prescribes that the reporting channel must be functional and effective. The reporting channel should identify the person, unit, or service provider responsible for processing and follow-up measures of notifications reported through the channel. The responsible person or unit must be neutral and independent.
- All reports made through the reporting channel are confidential and access to the reporting channel must be prohibited from all other parties than authorised persons. The reporting channel must enable reporting orally or in writing or both. If oral reporting is possible, it must be allowed through phone or other audio messaging service.
- Parties included in the scope of the whistleblower regulation are required to give information on the internal and external reporting channel, procedures relating thereto and on the protection of the whistleblower.
- The responsible person, unit or service provider must confirm receipt of the report no later than seven days after receiving the report and inform the whistleblower within three months of receiving the report what actions are taken based on the whistleblowing report.
The Chancellor of Justice of Finland (in Finnish: Oikeuskansleri) serves as a centralised external reporting channel, receiving all reports intended for all authorities, and transfers the reports to the respective authority in charge of supervision of regulation in the areas defined in the regulatory proposal. In certain situations, the proposed act also allows the notifier to disclose the information in public.
Protective measures for whistleblowers
The Governmental proposal includes several provisions intended for the protection of whistleblowers, including:
- Employers, principals, or other organiser of work may not impose any direct retaliatory measures against the whistleblower or another person based on a report submitted under the whistleblower regulation.
Prohibited retaliatory measures by the employer or its representative include weakening the terms of employment or service, ending the employment or service, or placing the employee on furlough, treating the employee otherwise unfavourably.
- It is also prohibited to prevent or attempt to prevent a whistleblower from reporting information concerning a breach.
- The proposed legislation includes a reversed burden of proof, meaning that if it can be assumed that the prohibition on retaliatory measures has been breached, the counterparty would have to demonstrate that the prohibition has not been breached in order to reverse the assumption.
The proposed regulation includes provisions requiring compensation to be paid for damages caused by retaliatory measures and for intentionally submitted or published reports including incorrect information. A natural person being subjected to retaliatory measures is entitled to compensation.
How to be prepared?
While no definitive timetable is currently available in terms of the implementation of the national legislation that will subsequently implement the Whistleblower Directive in Finland, companies and organisations within the scope of the proposed legislation should consider plans, e.g., for their reporting channels and processes to deal with possible reports, and consider, among other things:
- Possibilities to utilise existing reporting channels.
- Prepare impact assessment concerning data protection issues.
- Plan and draft guidelines concerning technical implementation of their reporting channel and processing of reports.
- Inform personnel and other target groups of the processing of personal data; and
- fulfil the information requirements imposed by the co-determination regulation.
Our team will monitor any developments in terms of the upcoming implementation. If you have any questions regarding this matter, please feel free to contact any of Borenius’ attorneys listed in this alert or those with whom you usually work.
Categories
Additional information
