The draft legislation would create a three-tiered reporting system – internal, external and public. State and local government institutions will be obliged to set up internal reporting channels. So will legal entities in the financial sector and other legal entities with 50 or more employees. Thus, all companies with more than 50 employees will have the obligation to create the reporting channel. Companies with fewer than 50 employees will not have to establish an internal reporting channel.
Larger companies (250 or more employees) and all public sector organizations will have the obligation to establish the reporting channel immediately. Smaller companies (50+ employees) and those in the financial sector have a two-year transition period starting from the entry into force of the directive, i.e. they are obliged to create the channel by 17 December 2023. Creating the reporting channel by itself will not be enough, organizations will also have to appoint employees who will have to start receiving and processing notifications received through the channels.
In addition to the organizations for whom it is obligatory to create the channel, others can voluntarily create the reporting channel. In the absence of the channel (e.g in a small company)if an employee or another party wants to report a violation, they also enjoy protection, even though they cannot use an internal reporting channel. Thus, although legislation sets forth which companies are obliged to establish the internal channel, the drafters of this bill encourage all companies to do so.
For smaller organizations and companies, the receiving and processing of reports can be handled by an employee whose position allows them to simply report to the organization’s chief, such as an HR employee, in-house lawyer, occupational safety specialist or internal audit employee. Every company has the freedom to decide on this itself. Companies with a fewer number of employees should bear in mind that in the absence of internal reporting channels, tipsters have the right to use external channels.
The internal reporting channel must allow the whistleblower to make written notifications without confidentiality being compromised (e.g., the information can be submitted to an email address set up for that purpose, complaint mailbox, ordinary mail or the website, including intranet or internet or an app developed for that purpose) or orally (a telephone tip line, face to face meeting or other channel).
Organizations and companies that have set up a reporting channel must designate or authorize a person who receives incoming notifications and deals subsequently with the information, either investigating it by themselves or with the help of colleagues or involving authorities. Setting up the reporting channel will require the creation of at least one email address and a secure way to convey written and oral notifications. Companies are also given the option of outsourcing the reporting service to a third party. Such service can be provided by auditors, trade unions, employee representatives or special external platform providers.
Misdeeds can be reported in three ways: by speaking out publicly, confidentially or anonymously. The Whistleblower Protection Act obliges companies to set up reporting lines and measures that allow the whistleblower’s confidentiality to be safeguarded. It is not obligatory to create anonymous reporting channels, but it is advisable, because this allows the number of notifications to be increased; some people do not trust the established systems and prefer anonymous tips.
Public reporting of violation does not mean going to the media straight away, as attention can be devoted to misconduct within the company. In an ideal world, that would be how all whistleblowing would take place. Employees who make public reports do not seek confidentiality and the people involved in the matter know what the complaint is about and who made it. Openness allows the situation to be assessed better and a decision made on how to proceed.
A confidential notification is where an employee states their name but asks that it not be disclosed during the investigation without their consent. A confidential notification ensures a way to contact the whistleblower to get more information or give them feedback. Experts are unanimous that the confidential notification is the best option if it is not possible to talk about the misconduct openly.
In this case, the company has to do its utmost to keep the tipster’s identity confidential. Otherwise, employees will lose trust in the reporting channels, decline to use them and misconduct will go undetected. Preserving confidentiality is one of the most effective ways to protect whistleblowers – if it isn’t known who reported the violation, the whistleblower cannot be harassed. An advantage of this is the fact that if the identity of the whistleblower is not public, this keeps the focus on the reported violation, not the identity of the whistleblower.
Anonymous notification means the identity of the whistleblower is not known to the person receiving the tip, which makes it harder to determine the facts of the misconduct or to provide protection for the whistleblower. Anonymous tips sometimes make it impossible to contact the whistleblower to check details or give them feedback. However, anonymous email addresses now exist for this purpose, and there are also platforms where the whistleblower and person receiving the complaint can have a dialogue anonymously.
For the notification to be confidential (or if desired, anonymous), the company must create an internal channel for receiving the reports of infringements, allowing the complaints to be made via an email address set up for that purpose, telephone number, ordinary mailbox or face to face meeting – in a manner that ensures confidentiality (or anonymity). The company must also appoint employees who will have to start receiving and processing notifications received through the channels. The independence and lack of conflicts of interest of the person or unit administering the reporting channels must be ensured, for example, corporate executives are not suitable reporting channels. Reporting channels may also be administered by an internal unit or external third party, but in either case, instructions are necessary both for administering and processing tips and safeguarding the confidentiality of the whistleblower and other parties.
Whether evidence of the violation must be provided depends largely on what sort of offence or misdemeanour is reported. If a violation involving the whistleblower themselves or an employee is reported, the whistleblower must provide evidence. Violations committed in regard to the employee include harassment in the workplace, violation of the employee’s rights and so forth.
But if the report involves some other type of violation that is directly or indirectly related to the functioning of the company, it is not obligatory to submit evidence of the violation. But in many cases, evidence helps get to the crux of the matter and if necessary, also address rectification or elimination of the problem. In the absence of evidence, the process of ascertaining the violation can become more protracted, because without enough evidence it is not possible to start resolving the problem. Of course, reporting a violation is also important even if there is no evidence, because any report about a violation leads closer to detection or prevention of fraud, violations and other misconduct.
Merely setting up a reporting channel at a company is not enough. For a tip line to serve its intended purpose, employers must develop practices for how the information about the violation will subsequently be used. The independent unit that administers the tip line first investigates, analyses the information and evidence from the whistleblower and if necessary obtains additional evidence. If the allegation made by the whistleblower merits an investigation, the violation will be investigated, with notification made to both the whistleblower and the person named by the whistleblower. The identity of the person named by the whistleblower must be kept confidential.
Both the whistleblower and the person named in the complaint should retain all evidence about the facts involved in the matter. Both parties should also provide contact details for witnesses who could corroborate or refute the accusations. Both parties are expected to be active participants in the investigation – this makes it possible to gain clarity as to whether the whistleblower’s information is accurate or not.
The person who receives the report and the investigator are not necessarily the same person. It is important to divide responsibilities for the tip line so that different tips can be investigated by different departments. There is also always the option of outsourcing the tip line service from a third party. The advantage of outsourcing is savings on time and money, as it does away with the need to create new jobs or increase workload for current employees. Outsourcing means a professional team will be in charge of the tip line, acting in the interests of the company as an independent party.
To maintain the reporting channel’s effectiveness and trustworthiness, the draft legislation sets forth provisions on liability for both individuals and legal entitles. The draft legislation stipulates that those filing inaccurate reports will be held liable. For certain violations, the whistleblower protection directive sets out the obligation of imposing effective, proportional and cautionary punishments for both individual and legal persons. If a third party was harmed due to a deliberately inaccurate notification, that person can seek damages. Tipsters who intentionally submit misinformation about the occurrence of a violation do not enjoy protection. It is prohibited to file deliberately inaccurate reports.
Ensuring confidentiality is one of the main measures for protecting whistleblowers, but since protection does not extend to those filing false reports, that would mean the whistleblower’s identity is known to all and could fall victim to discrimination and pressure from the employer. Thus, the desire to damage someone’s reputation through malicious reports will backfire. In such a case, it is extremely important for the employers to be given information on the functioning of the channel and the consequences of its use – this makes it possible to prevent potential misunderstandings and breaches.
If you have similar challenges and questions, please contact our specialists.
