Whistleblowing laws – Useful insights

Since the implementation of the EU Whistleblowing Directive in EU Member State national laws, many companies have now the obligation to establish an internal whistleblowing channel that enables employees to report malpractice or unlawful behavior within the workplace.

However, the purpose of whistleblowing legislation is not just to oblige companies (and other entities) to establish effective reporting channels but to enhance the enforcement of EU laws, and to detect and prevent fraud and corruption, by providing a high level of protection for individuals reporting applicable breaches and unlawful behavior.

As well as helping to serve the public interest, whistleblowing channels are also in the best interests of companies, as whistleblowers can alert senior management to potential or actual misconduct and prevent further damage and future wrongdoing. From the employer’s perspective, fostering an open organizational culture where employees feel comfortable about raising concerns internally has proven to be an effective safeguard against risks such as financial loss, legal liabilities, and lasting reputational damage. [1 Transparency International Business case for speaking up https://www.transparency.org/en/publications/business-case-for-speaking-up, p.1]

Since the EU Whistleblowing Directive only sets out the common minimum standards for whistleblower protection, the exact scope is subject to the national laws implementing the Directive.

Below we have gathered some information from different Fondia countries (Estonia, Finland, Lithuania, and Sweden) to highlight the similarities and differences of whistleblowing legislation and requirements imposed on companies between the countries, as well as to provide a list of helpful notes.

In Estonia, companies with 50 or more employees will have the obligation to establish an internal reporting channel. The law will enter into force on 01.06.2022. However, companies with no more than 249 employees have a grace period until 17.12.2023 to establish the internal reporting channel.

In Finland, the legislative process of the Finnish Act implementing the Whistleblower Protection Directive is delayed and will enter into force earliest in the summer of 2022. According to the Act draft, companies with 50 or more employees have the obligation to establish an internal reporting channel when the Act enters into force. However, smaller companies with no more than 249 employees have a grace period until 17.12.2023 to establish the internal reporting channel.

In Lithuania, amendments to the Whistleblowing Act were adopted on 16.12.2021 and amended version entered into force on 15.02.2022. The Act requires that a business entity must have an internal reporting channel when employing at least 50 employees.

In Sweden, a "business operator" (Sw. verksamhetsutövare), e. g. a legal entity, with 50 or more employees have the obligation to establish an internal reporting channel and procedures for reporting. The Act entered into force on 17.12.2021. However, business operators with no more than 249 employees have a grace period until 17.12.2023 to establish the internal reporting channel. Others have until 17.07.2022.

In Estonia, according to the draft law, the law expands the material scope of the Directive to include protecting reporting of any illegal activity that becomes known during professional activities, not just those laws and regulations listed in the Directive.

In Finland, the material scope will be in accordance with the minimum standards set out in the Directive but will also cover the corresponding areas of national law. In addition, the breach must concern an act that may lead to imprisonment, a fine or an administrative sanction or that may severely endanger the public interest protected by the defined areas of law, and that the information on the breach was acquired in a work-related context.

In Lithuania, the law does not provide a definite list of infringements, which means that it covers all possible areas of public interest protection, not just those listed in the Directive. In this sense, Lithuania implements this provision to a greater extent – the safeguards provided for in the Directive apply in Lithuania to reporting of all illegal violations and therefore goes beyond the specifications in many other EU countries.

In Sweden, the Act covers situations where reporting is made in a work-related context including information on misconducts where there is a public interest. In addition, the Act applies in a work related context including information on misconducts which i) are unlawful and constitute a breach of any applicable Union act as referred to in Directive; or ii) which constitute a breach of such rules and regulations as referred to in Chapter 8 of the Swedish Instrument of Government (Sw. Regeringsformen) which implements or completes a Union act which falls within the scope of the EU Whistleblowing Directive; or iii) defeats the object or purpose of the rules in a Union act which falls within the scope of the EU Whistleblowing Directive.

In Estonia, the internal reporting channel shall be managed by a person or entity designated by the company or by an external third party who will be responsible: 1) for the receipt of notifications; 2) maintaining contact with the reporting person and providing him or her with feedback and, if necessary, asking additional; and 3) for the implementation of follow-up measures. Only the designated person will have access to the channel, notifications and other information related to the notified violations.

In Finland, companies can organize their own internal reporting channel itself or obtain it from a private or public service provider. The company must anyhow designate the person, entity, or service provider responsible for the processing and follow-up of reports, and such designated person, entity or service provider must be able to carry out his duties impartially and independently.

In Lithuania, companies may organize their own internal reporting channel itself, or they (except public institutions) can obtain it from an external service provider. In that case, the company shall have a clear system for dealing with the information received on irregularities and shall inform the company's staff clearly accordingly.                       

In Sweden, a business operator can organize their own internal reporting channel itself or obtain it from an external service provider. The business operator must designate the person, entity or service provider responsible for the processing and follow-up of reports, who must be able to carry out his duties impartially and independently.

In Estonia, a whistleblower receives protection under the law even if he or she has submitted the notice anonymously, but there is no obligation for companies to provide the option of reporting anonymously.

In Finland, companies may allow anonymous reporting through the internal reporting channel and follow up on them, but there is no obligation to allow anonymous reporting. However, anonymous reporting is not allowed through the external reporting channel and the authorities will not take further action based on an anonymous report.

In Lithuania, reports may be non-anonymous; however, such an informer will not have full legal protection: if the person reporting the information anonymously, the protection for the whistleblower provided for in Article 8 of the Law shall be applied in cases where his or her identity has been disclosed and it is necessary to protect him or her from adverse effects.                       

In Sweden, the Act does not include any requirement to implement anonymous reporting channels, neither does it include any prohibition for reporting anonymously. Companies are required to provide the option to make the report both in writing and orally and by way of a physical meeting if so requested.

In all countries the Acts include strict confidentiality rules when handling the reports.

Differences in the requirements for the whistleblowing channel in the four countries are, in the end, minor technicalities. Our Whistleblowing team of lawyers are represented in all Fondia countries and can answer your questions on how to establish the internal reporting channel, as well as give advice on best practices. Do not hesitate to contact us!

Disclaimer: This blog article is for non-binding general information purposes only and does not constitute legal advice. All offered information is without guarantee or liability for correctness and completeness.