Whistleblowing channel and whistleblower protection: what an organisation of 50 must do
The Whistleblower Protection Act requires organisations of 50 or more to run a reporting channel: acknowledgement in 7 days, feedback in 3 months, a ban on retaliation.
· 6 min read
In brief
The Finnish Act on the Protection of Persons Reporting Infringements (1171/2022) implemented the EU Whistleblower Protection Directive. It requires organisations that regularly have at least 50 people in an employment or public-service relationship to set up an internal reporting channel through which breaches within the act's scope can be reported. The channel has minimum requirements: reports can be made in writing or orally, receipt is acknowledged within seven days, measures taken are communicated within three months, and the reporter's identity is confidential. Retaliation against the reporter is prohibited. The obligation is largely organisational, and its weakest point is usually that staff do not know about the channel or handlers do not know the deadlines.
Who the act binds
Section 10 of the act lists the organisations that must set up an internal reporting channel when the number of people in an employment or public-service relationship with them is regularly at least 50. The list includes state administrative authorities, agencies and institutions, wellbeing services counties and joint authorities, municipalities, joint municipal authorities and municipal enterprises, parishes and parish unions, entities entered in the Trade Register such as limited companies and cooperatives, and foundations, pension institutions, insurance funds and unemployment funds. Supplementary pension institutions are covered regardless of headcount.
An organisation that has set up a channel must allow its own staff to report through it. It may also allow others, such as suppliers' employees or former employees, but it is not obliged to. For a municipality or a wellbeing services county the threshold is practically always exceeded, so in the public sector the question is not whether there is a channel but whether it works.
The act's scope is limited. It covers breaches in specific areas of Union law, such as public procurement, financial services, product safety, environmental protection, consumer protection, protection of privacy and personal data, and the security of network and information systems. Internal workplace disputes or inappropriate treatment are not as such within the act, although an organisation may take them into the same channel under its own rules.
What is required of the channel
Section 15 sets the minimum requirements for an internal channel. Reports must be possible in writing or orally. Where oral reporting is possible, it must work by telephone or another voice messaging system and, at the reporter's request, in a face-to-face meeting within a reasonable time. The organisation must provide information on reporting to the internal channel and to the Office of the Chancellor of Justice's centralised external channel, on the procedures and on the conditions for protection, in a clear form and easily accessible.
| Requirement | Deadline or content | Section |
|---|---|---|
| Acknowledgement of receipt to the reporter | 7 days from receipt of the report | 15 |
| Information on measures taken | 3 months from the acknowledgement | 16; Article 9 of the Directive |
| Report handlers | Persons designated by the organisation; only they process the reporter's and the subject's personal data | 29 |
| Deletion of data | 5 years from the report's arrival, unless retention is necessary; irrelevant personal data at once | 29 |
| Informing staff | Internal and external channel, procedures, conditions for protection | 15 |
The information requirement is the one most often met weakly. A channel may exist and meet every technical requirement, but if an employee does not know it exists or what can be reported through it, it does not serve its purpose. At level 1 of our skills catalogue every employee knows that the organisation has a reporting channel, what can be reported through it and that a reporter may not be put at a disadvantage. That is a five-minute course, and its completion is evidence of the information duty.
The ban on retaliation
Section 23 prohibits retaliation. The employer, or another organisation for whose benefit the reporter works, may not take retaliatory measures against the reporter for reporting or disclosing information on a breach, nor act with the purpose of preventing reporting. A prohibited retaliatory measure is any conduct or decision by the employer that worsens the terms of the service relationship, ends it, lays the person off or otherwise treats them unfavourably or exposes them to other negative consequences because they reported or took part in investigating the breach.
The ban protects, besides the reporter, the other persons referred to in section 5 of the act, such as those assisting the reporter and people close to them. For a supervisor this means that decisions concerning the reporter made after a report must be justifiable on grounds independent of the report. At level 3 our skills catalogue requires the handler to recognise retaliation; that is often harder than handling the report itself.
The reporter's identity is a special case of processing
Section 32 lays down the duty of confidentiality. Anyone who, in handling reports, has learned the identity of the reporter or of the person concerned, or other information from which identity can be inferred directly or indirectly, must keep it confidential. If a report arrives through a route other than the statutory channel or is received by someone other than a handler, the recipient must keep the information confidential and forward the report in its original form to a handler without delay.
Section 33 lists when identity may be disclosed: to a person designated to investigate, if necessary; to the competent authority, criminal investigation authorities and the prosecutor; and to the person concerned for preparing or defending a legal claim. The reporter must be informed in advance of the disclosure of their identity, unless that would jeopardise the investigation, a criminal investigation or court proceedings.
This is also a data protection question, and our skills catalogue says so directly: the reporter's identity must be protected also when the report turns out to be unfounded. Section 29 limits the processing of personal data to the designated handlers, and the GDPR's Article 14 duty to inform the person concerned must be reconciled with the reporter's protection. This is level 4 competence: building the channel and its handling process so that it withstands scrutiny under both whistleblower protection and data protection, and resolving the conflict between an anonymous report and the interest in investigating.
What the act does not require
The act does not require an external service provider; the channel can be run in-house as long as designated handlers, deadlines and confidentiality are in place. The act does not require allowing anonymous reports, but does not forbid them, and if the organisation allows them it decides for itself how an anonymous reporter receives feedback. The act does not oblige an organisation under 50 people to set up a channel, supplementary pension institutions excepted. The ban on retaliation and the reporter's protection do not depend on headcount, however: they also protect a small organisation's employee who reports to the Chancellor of Justice's centralised channel.
And the act does not turn the reporting channel into a general feedback channel. Its scope is limited to specific areas of Union law, and when informing staff an organisation does well to say clearly what the channel is and is not, and where other matters go. The compliance whole in which the reporting channel is one instrument of accountability is covered in Training evidence for the regulator.
Frequently asked questions
Who is required to have an internal reporting channel?
Organisations that regularly have at least 50 people in an employment or public-service relationship: state authorities, agencies and institutions, wellbeing services counties, municipalities and joint municipal authorities, parishes, entities entered in the Trade Register such as limited companies and cooperatives, foundations, and pension, insurance and unemployment funds. Supplementary pension institutions are covered regardless of headcount. The organisation must let its own staff report through the channel and may allow others to do so.
What deadlines apply to handling a report?
The reporter receives an acknowledgement of receipt within seven days of the report being received. The reporter is told of the measures taken within three months of the acknowledgement. Data received through the channel is deleted five years after the report arrived, unless retention is necessary for rights or obligations laid down in law, and personal data clearly irrelevant to handling the report is deleted without undue delay.
What counts as prohibited retaliation?
Any conduct or decision by the employer that worsens the reporter's terms of service, ends the service relationship, lays the reporter off or otherwise treats them unfavourably or exposes them to negative consequences because they reported a breach or took part in investigating it. Conduct intended to prevent reporting is also prohibited. The ban also protects people who assist the reporter and those close to them.
Who may know the reporter's name?
Only the people the organisation has designated to handle reports. They are bound by a duty of confidentiality covering the identity of the reporter and of the person concerned, and any information from which identity can be inferred. If a report arrives by another route or reaches someone else, the recipient must keep the information confidential and forward the report in its original form to a handler. Identity may be disclosed only in the situations listed in the act, and the reporter is told in advance unless that would jeopardise the investigation.