Reporting channel: who must set one up and what the law requires

In brief

• An internal reporting channel must be set up when the number of people in an employment or public-service relationship with the organisation is regularly at least 50 (section 10).
• A channel set up voluntarily is covered by the Whistleblower Protection Act with all its deadlines and obligations (section 13).
• The acknowledgement of receipt must be sent within seven days and the information on the measures to be taken within three months (sections 15 and 16).
• Data is normally erased five years after receipt. Longer retention requires a statutory basis; irrelevant personal data must be erased without delay (section 29).

The Act on the Protection of Persons Reporting Infringements of EU and National Law (1171/2022), the Whistleblower Protection Act, obliges an organisation to set up an internal reporting channel when the number of people in an employment or public-service relationship with it is regularly at least 50. The obligation extends beyond the existence of a channel: the Act lays down how a report must be able to arrive, who handles it and within what time the reporting person gets an answer. It also limits what a report must concern in order to fall within the Act – and that limit is narrower than many assume.

The obligation to set up a channel starts at 50 people

Under section 10, an internal reporting channel must be set up in organisations where the number of people in an employment or public-service relationship is regularly at least 50. The obligation covers, among others, the entities referred to in section 3, subsection 1, paragraphs 1, 2 and 4–6 of the Trade Register Act – limited liability companies, co-operatives, and general and limited partnerships – and in addition foundations, state and municipal organisations, wellbeing services counties and parishes.

An organisation that has set up a channel must give the people in an employment or public-service relationship with it the opportunity to report through the channel. The organisation may also allow other people to report, and this is one of the decisions to make at set-up: if the channel is also intended for subcontractors or job applicants, for example, the channel’s instructions must say so.

A voluntary channel brings the Act’s obligations with it

An organisation with fewer than 50 people may set up a channel by its own decision. If it sets up an internal reporting channel for reporting infringements within the scope of this Act, then under section 13 the provisions of the Act apply to the channel, to internal reporting and to the protection of the reporting person.

A decision on a voluntary channel is therefore also a decision to take on the seven-day acknowledgement of receipt, the three-month feedback, the designation of a handler, the duty to inform and the retention period. That is worth knowing in advance, because a channel is easy to open and the deadlines then run of their own accord.

The Act covers infringements in certain sectors, not workplace conflicts

The scope is in section 2. The Act applies to persons who report infringements of EU law or national law in the following sectors: public procurement; financial services, products and markets; the prevention of money laundering and terrorist financing; product safety and compliance; transport safety; environmental protection; radiation and nuclear safety; food and feed safety and animal health and welfare; public health; consumer protection; the protection of privacy and personal data and the security of network and information systems. The Act also applies to reports of infringements concerning, among other things, EU funds, grants and state aid, competition rules, corporate taxation and sanctions.

Besides the sector, the nature of the act is decisive. The Act applies to acts or omissions that are punishable, that may lead to a punitive administrative sanction or that may seriously endanger the attainment of the objectives of public interest pursued by the legislation.

Not every employee matter falls under whistleblower legislation. An ordinary working-time or personnel dispute does not qualify by itself. The organisation can still receive it and refer it to HR or occupational safety. Assess the content before classifying it: an internal matter can also concern personal-data protection and fall within the Act.

The handler has to draw the line for every report. Four questions are usually enough:

1. Does the observation concern one of the sectors listed in section 2, or EU funds, competition rules, corporate taxation or sanctions? If not, the report is handled under the organisation’s own procedures.
2. Is it an act or omission that is punishable, that may lead to a punitive administrative sanction or that may seriously endanger the attainment of the objectives of public interest pursued by the legislation?
3. Was the infringement observed in the organisation’s activities? The primacy of internal reporting in section 7 concerns precisely these observations.
4. If points 1–3 are met, the report is handled under the procedure in the Act: acknowledgement within seven days, necessary investigation and information on measures within the deadline in section 16.

The line is worth recording report by report, because it also explains why a particular report was moved to another procedure.

The internal channel is the primary route

The internal channel is the primary route for breaches in an organisation’s operations (section 7), but using it is not an absolute requirement in every situation. Section 8 permits external reporting, for example when no internal channel is available or there are reasonable grounds to fear retaliation or doubt effective internal action.

Also tell employees about the Office of the Chancellor of Justice’s central external channel and the conditions for protection. Protection does not depend on the suspicion ultimately proving correct: at the time of reporting, the person must have reasonable grounds to believe the information is accurate and within the Act’s scope (section 6).

The channel’s minimum requirements are in section 15

An internal reporting channel must allow reporting in writing or orally. If oral reporting is possible, it must be possible by telephone or through another voice messaging system and, at the reporting person’s request, at a face-to-face meeting arranged within a reasonable time.

The reporting person must be sent an acknowledgement of receipt within seven days of the report being received. The Act gives the acknowledgement of receipt seven days, so holiday seasons and cover arrangements are part of planning the channel.

The organisation must provide information on reporting to the internal reporting channel and to the centralised reporting channel of the Office of the Chancellor of Justice, on the procedures involved in reporting and on the conditions for the protection of the reporting person. The information must be presented in a clear form and in a way that makes it easily accessible to reporting persons. Confidentiality is in section 32: anyone who, in handling reports, has learned the identity of the reporting person or of the person concerned, or any other information from which the identity can be inferred, is obliged to keep that information secret. If a report arrives by another route or is received by someone other than the person responsible for handling it, the recipient must keep the identifying information secret and forward the report in its original form to the handler without delay.

A handler is designated and works independently

Under section 14, an organisation that has set up a channel must designate one or more persons responsible for handling reports, who must be able to carry out their task impartially and independently. Only the persons the organisation has designated for the task may handle reports. The organisation may also designate the experts needed to investigate whether a report is well founded.

Independence becomes a practical question when a report concerns the handler themselves or their supervisor. The designation decision should therefore settle in advance who handles a report in those situations.

Under section 16, the person responsible for handling reports must take the measures necessary to investigate whether the report is well founded and, where necessary, to intervene in the infringement. Within three months of sending the acknowledgement of receipt, they must tell the reporting person what measures will be taken on the basis of the report.

Under section 11, running the channel may be assigned to an external service provider, but the organisation remains responsible for meeting the obligations of the Act in that case too. The service provider must likewise designate a person responsible for handling reports (section 14).

Accepting anonymous reports is the organisation’s decision

Under section 17, the organisation may decide to accept anonymous reports in the internal reporting channel as well. For anonymous reports there is no need to send an acknowledgement of receipt or to give information on the measures to be taken.

Anonymity therefore has a direct bearing on what is expected of the channel. If the reporting person can be reached only through the channel, feedback travels the same route and the investigation rests on what the reporting person adds. The decision on anonymous reports belongs in the channel’s instructions, so that the reporting person knows in advance whether they will get an answer.

The default retention period is five years

Under section 29, personal data on the reporting person and on the person concerned may be processed only by the persons the organisation has designated. Information arriving through the reporting channels must be erased five years after the report was received, unless keeping it is necessary for exercising rights or obligations laid down in law, or for establishing, exercising or defending a legal claim.

The same section requires the erasure, without undue delay, of personal data that is clearly irrelevant to handling the report. In practice this concerns third-party details and attachments that come with the report, so erasure is part of the handling, not just the end of a retention period.

What to decide at set-up and what to tell staff

Opening a channel is a set of decisions worth making at once and recording:

• the technical solution: a channel of your own or a service provider as referred to in section 11;
• the ways in which a report can be made in writing and orally, and how a requested face-to-face meeting is arranged;
• whether anonymous reports are accepted (section 17);
• who besides people in an employment or public-service relationship may report (section 10);
• who handles the reports, who the designated experts are and who handles a report that concerns the handler themselves (section 14);
• how reports that arrive in the channel but fall outside the scope of the Act are passed on;
• retention and erasure (section 29).

Informing staff is an obligation of its own in section 15, and its content is listed: reporting to the internal reporting channel, reporting to the centralised reporting channel of the Office of the Chancellor of Justice, the procedures involved in reporting and the conditions for the protection of the reporting person. The form is a requirement too: the information is presented in a clear form and easily accessible to reporting persons. The instructions therefore belong somewhere staff can find them without signing in to the channel, and they are updated when the handler or the channel’s address changes.

Checklist

• The obligation to set up a channel has been assessed. The number of people in an employment or public-service relationship is regularly at least 50 (section 10), or the channel is set up voluntarily and the same Act applies to it (section 13).
• Reports can be made in the channel in writing or orally and an oral report is possible by telephone or through another voice messaging system (section 15).
• If the channel accepts oral reports, a face-to-face meeting is arranged on request within a reasonable time (section 15).
• A person responsible for handling reports has been designated and can carry out the task impartially and independently (section 14).
• Only designated persons handle reports; the experts needed for the investigation are designated separately (section 14).
• It has been decided who handles a report that concerns the handler themselves.
• The acknowledgement of receipt goes out within seven days of the report being received (section 15).
• Information on the measures to be taken is given within three months of sending the acknowledgement of receipt (section 16).
• A decision on anonymous reports has been made and it appears in the channel’s instructions (section 17).
• It has been decided who besides people in an employment or public-service relationship may report (section 10).
• Staff have been informed about internal reporting, the centralised channel of the Office of the Chancellor of Justice, the procedures and the conditions for the protection of the reporting person, in a clear form and easily accessible (section 15).
• Retention and erasure have been settled: the data is erased five years after receipt unless a statutory basis requires longer retention. Irrelevant personal data is erased without undue delay (section 29).