The Whistleblower Protection Act, which came into force this year, will provide protection for employees, shareholders and clients against misconduct at companies, but confusion reigns regarding the content of reports, and improperly filing a report could spill business secrets.
Telia has had a whistleblower system for more than 10 years. “In the interests of clarity, we have simplified it a great deal both for those processing reports and those lodging complaints. We say that you can file a report in regard to any violation of law or unethical conduct occurring in the organisation, with no limitation imposed by European Union law or the content of the complaint,” said Telia’s Data Protection Officer Andrus Hinrikus.
When they set up a whistleblower system, there’s no basis for companies to fear that complaints will come in by the hundreds, said Grant Thornton Baltic’s Partner, Head of Legal Kristel Tiits.
“But if a company does start receiving a great deal of complaints via the whistleblower line, perhaps it will serve as a good feedback for management since there used to be no way to talk openly about such problems or take preventive action,” said Hinrikus. “We have 1500 employees, hundreds of thousands of customers and hundreds of partners and we’re talking about 10 or so complaints a year coming in through this system.”
Avalanches of complaints can be prevented by training employees. Employees have to know what sort of content is expected to be received through the channel, what the reporting process is like and who will start processing the reports, said Grant Thornton Baltic’s Legal Manager Eliis Talisainen.
Processing can take place at three levels: in-house, externally and in public. Going public is something that will take place in extreme situations and can result in much damage to reputation for a company, said Talisainen.
“It can also be a risk for the whistleblower if they have gone through the internal and external level and the report has not had a satisfactory resolution and the tipster goes public. If that happens, they can wind up afoul of clauses on confidentiality of business secrets,” added Tiits.
Tiits talked about a case of one client from a couple of years ago when an employee who experienced harassment at a company picnic reached out to management. Since the company was a pan-Baltic entity and the management was based in Lithuania, the complaint was not dealt with. “After a few months, the situation escalated since the victim and the harasser were assigned to conduct a joint inventory,” said Tiits.
Had there been a whistleblower system and the duty to process reports, the awkward situation for the victim would not have happened. “If there had been an internal and external instance for processing the complaint, they would have been required to address the matter within a term set forth by law,” said Tiits. “Once the case came up before management, things had already gone sour.” Although the problem was resolved, the employee ended up leaving the company a couple months later.
Hinrikus added that usually whistleblowers’ reports did not have to do with harassment or discrimination but rather problems with procurements, conflicts of interest, other unethical conduct or individual problems with employment relations.
The new legislation also protects companies’ reputations. “It’s always good if all the problems see the light of day within the company and can be resolved internally – better than if the employee feels that they have no choice but to go public,” said Hinrikus, adding that the system had proven its worth.
Fines can be levied for obstructing whistleblowers from reporting, pressuring employees or violation of confidentiality clauses. “But the legislation does not provide for monetary fines for failing to establish the system required by law. So today, such a company only faces damage to reputation if they don’t set up the system,” said Tiits.
The fines are 300 fine units for individuals and up to 100,000 for companies.
“This was a political decision,” Tiits added.
Estonia was late adopting the act. “Here the blame rests with legislators and politicians. The European Union has launched violation proceedings since we were late transposing the directive. Actually, the law should have come into force two or three years ago.”
The purpose of the act is to protect employees against discrimination and ensure protection for people who have reported a violations at the company. The law covers not only employees but also shareholders and partners, management, even interns and volunteers. The law makes it compulsory for companies to set up a channel where problems can be reported and where the company has to take action and conduct proceedings on the reports.
The law does not explicitly require anonymity to be guaranteed. But it does require confidentiality to be preserved.
“Total anonymity isn’t in fact needed; what’s essential is that it’s confidential,” said Tiits. “Our experience is that the average whistleblower actually doesn’t insist on anonymity and will file under their own name, but there may be extraordinary cases or circumstances. Without anonymity being offered, some might keep their mouth shut or avail themselves of other options outside the company,” added Hinrikus.
It all comes down to the company, Talisainen said. “Perhaps at some companies, anonymity is a must-have, but it is certainly more costly in terms of expenses.”
The company itself has to be capable of mapping their potential problem vectors. Whistleblowing channels also depend on the company. The more a company works at it, the more comprehensive the solutions for resolving and preventing problems become. “Often the management is well-enough equipped to assess what the in-house problem areas might be,” Talisainen said. “It’s not like we send out some sort of template to all clients. Everything takes place in close cooperation.”
If you have similar challenges and questions, please contact our specialists.
