Guide to Whistleblowing

Contributing Editors

In this new age of accountability, organisations around the globe are having to navigate a patchwork of new laws designed to protect those who expose corporate misconduct. IEL’s Guide to Whistleblowing examines what constitutes a protective disclosure, the scope of regulations across 21 countries, and the steps businesses must take to ensure compliance with them.

Learn more about the response taken in specific countries or build your own report to compare approaches taken around the world.

Choose countries

 

Choose questions

Choose the questions you would like answering, or choose all for the full picture.

07. Should employers manage the reporting channel itself or can it be outsourced?

07. Should employers manage the reporting channel itself or can it be outsourced?

Flag / Icon

Australia

  • at Lander & Rogers

ASIC Regulatory Guide 270 notes that it is good practice but not mandatory that an entity has mechanisms in place for monitoring the effectiveness of its whistleblower policy.

ASIC suggests an entity could set up:

  • oversight arrangements for ensuring its board, audit or risk committee are kept informed about the effectiveness of the policy;
  • a mechanism to enable matters to be escalated to the entity's board or the audit or risk committee; and
  • periodic reporting to the board, audit or risk committee.

The guide also notes that entities may consider involving an independent whistleblowing service provider authorised to receive their internal disclosures. This is especially so for smaller entities. Using an outside service provider may encourage more disclosures since disclosers can:

  • make their disclosure anonymously, confidentially and outside business hours;
  • receive updates on the status of their disclosure while retaining anonymity; and
  • provide additional information anonymously.
Last updated on 23/08/2022

Flag / Icon

Belgium

  • at Van Olmen & Wynant

The reporting channel can be outsourced to a third party (eg, to a payroll provider, compliance experts or lawyers). However, the employer will remain legally responsible for the implementation and use of the system.

Last updated on 01/08/2022

Flag / Icon

Brazil

  • at CGM
  • at CGM
  • at CGM

There is no statutory requirement in this regard. Accordingly, employers can manage the reporting channel directly or outsource it to an external supplier.

Last updated on 29/07/2022

Flag / Icon
Croatia

Croatia

  • at Babic & Partners
  • at Babic & Partners

Under the WBP Act, the internal reporting channel is a WBP officer and their deputy, as appointed by the company. This officer and deputy are solely authorised to receive the whistleblowing reports and conduct investigations (ie, the conduct of these actions cannot be outsourced to any third person).

However, the WBP Act does not preclude companies from appointing individuals employed or hired by an external service provider as a WBP officer or deputy (noting, however, that the company may make such appointment at its own discretion only if these appointments have not been proposed by either the works council, or, if there is no works council, the union trustee, or if there is no works council or union trustee, by at least 20% of the  company’s employees).

Even if the company appoints individuals employed or hired by an external service provider, the appointed persons must keep confidential the identity of any whistleblowers and any information contained in the whistleblowing report, and will not be able to directly involve external service providers in the investigation without express consent from each whistleblower. However, the  company may engage an external service provider to indirectly assist these appointed persons (regardless of whether the individuals appointed are employed by the  company or by the external service provider, and regardless of whether the whistleblower provides express consent for disclosure of his or her identity and the content of the report), if such assistance will not lead to disclosure to that provider of the identity of the whistleblower and any information contained in the whistleblowing report.

Last updated on 29/07/2022

Flag / Icon

Denmark

  • at IUNO
  • at IUNO

The whistleblowing channel can be outsourced wholly or partly to an external third party (for example a specialised platform, lawyer, or auditor).

Companies can outsource the whistleblowing channel but will remain fully responsible for complying with the Whistleblowing Act. For that reason, written declarations must be drafted with the provider to make sure that the requirements relating to impartiality, confidentiality, data protection, etc, are satisfied.

Last updated on 30/11/2022

Flag / Icon

France

  • at Proskauer
  • at Proskauer

Employers can subcontract the management of the whistleblowing procedure to an external supplier, which will be in charge of:

  • setting up the reporting channel available;
  • receiving complaints; and
  • investigating the reported facts.

In practice and as an example, the external supplier can set up a telephone hotline or an email address for the collection of reports. These are then transmitted to the employer to decide on any action to be taken.

Last updated on 29/07/2022

Flag / Icon

Germany

  • at Oppenhoff
  • at Oppenhoff

In principle, the draft bill of the Whistleblower Protection Act intentionally does not specify which persons or organisational units are best qualified to carry out the tasks of the internal reporting office or to manage the corresponding reporting channel. However, the internal reporting office may not be subject to any conflicts of interest and it also must be independent. The EU Whistleblower-Directive mentions, for instance, the head of the compliance department or the legal or data protection officer as possible internal reporting offices.

If, in addition to the (internal) persons responsible for receiving and processing internal reports, other (external) persons have to be involved in a supporting activity, this supporting activity is legally only permissible to the extent that is necessary for the supporting activity. This applies, for example, to IT service providers that provide technical support for reporting channels.

It is also legally permissible to appoint a third party to carry out the tasks of an internal reporting office, including the reporting channel (section 14 (1) HinSchG-E). Third parties may include lawyers, external consultants, trade union representatives or employee representatives.

However, engaging a third party does not relieve the employer of the obligation to take appropriate action to remedy a possible violation. In particular, for follow-up actions to check the validity of a report, there must be cooperation between the commissioned third party and the employer.

Last updated on 29/07/2022

Flag / Icon

India

  • at Khaitan & Co
  • at Khaitan & Co

While the reporting channel may be outsourced, in respect of Covered Companies, the mechanism should be overseen by the Audit Committee or Board of Directors, as applicable.

Last updated on 29/07/2022

Flag / Icon

Japan

  • at City-Yuwa
  • at City-Yuwa
  • at City-Yuwa

The business operator may outsource the establishment of a point of contact to a third party, such as a subcontractor or parent company[1].


[1]   Id, Section 3 II (1)(i)(c), at p.7.

Last updated on 29/07/2022

Flag / Icon
Latvia

Latvia

  • at Ellex Klavins
  • at Ellex Klavins

The Whistleblowing Act allows employers to use third-party services for whistleblowing procedures. Therefore, the management of a reporting channel can be organised by outsourcing management service providers. On the other hand, such outsourcing cannot be used to implement group whistleblowing procedures (eg, to use a reporting channel established at a group level or in a related company).

Last updated on 29/07/2022

Flag / Icon
Lithuania

Lithuania

  • at Ellex Valiunas

Companies may outsource internal channel administration services to other companies providing such services or external third parties, provided that they ensure that the principles of independence, confidentiality and data protection are observed. Administrative services provided by third parties do not include the investigation of information about the breach and any subsequent decision-making.

Last updated on 29/07/2022

Flag / Icon
Luxembourg

Luxembourg

  • at Castegnaro
  • at Castegnaro

The legal entity may subcontract the monitoring of reports (articles 6 and 7 of Bill 7945).

Last updated on 29/07/2022

Flag / Icon
Malta

Malta

  • at Camilleri Preziosi
  • at Camilleri Preziosi
  • at Camilleri Preziosi

In theory, the Directive states that the reporting channel may be operated internally or externally by a third party. The Act requires the employer to designate an officer from within the company (whistleblowing reporting officer – WRO), who may or not be the same person receiving reports, to follow up on reports.

Last updated on 16/11/2022

Flag / Icon
Nigeria

Nigeria

  • at Bloomfield LP

The reporting channel can either be internally managed or outsourced for transparency and objectivity.

Last updated on 29/07/2022

Flag / Icon

Poland

  • at Baran Książek Bigaj
  • at Baran Książek Bigaj

Employers may outsource maintaining reporting channels (as part of ICT solutions) and receiving reports.

Last updated on 17/11/2022

Flag / Icon

Portugal

  • at Cuatrecasas
  • at Cuatrecasas

The internal reporting channels may be operated internally or externally, and independence, impartiality, confidentiality, data protection, secrecy and the absence of conflicts of interest must be guaranteed.

Last updated on 29/07/2022

Flag / Icon

Romania

  • at STALFORT Legal. Tax. Audit.
  • at STALFORT Legal. Tax. Audit.

Both options are available for companies. At first glance, internal channels controlled by its own employees (auditors or compliance officers, in-house legal counsel or even an internal hotline) may be more effective for companies, since this ensures that potential wrongdoings are checked internally and do not compromise the image of the company. However, whistleblowers may not trust internal channels that allow easy identification of the individual whistleblower and are usually established to act in the best interest of the company (and not necessarily the whistleblower). Groups of companies must give more thought to the organisation; in many cases, outsourcing to third parties (eg, a recognized law firm) may be a better and more cost-effective solution.

Last updated on 16/08/2022

Flag / Icon

Spain

  • at Cuatrecasas
  • at Cuatrecasas
  • at Cuatrecasas

Yes, the management of internal reporting channels can be outsourced as established in section 6 of the Draft. However, a third party managing the reporting channel must provide adequate guarantees of respect for independence, confidentiality, data protection and secrecy. This third party would be considered a “data processor”, whereas the person or persons appointed by the company as “responsible for the system” will still be responsible for the reporting channel, even when it is outsourced.

Management of an internal information system by a third party should not undermine the guarantees and requirements established for this system in the Draft.

Last updated on 29/07/2022

Flag / Icon

Sweden

  • at Lindahl
  • at Lindahl
  • at Lindahl

Businesses may choose to manage reporting channels in-house or to outsource the management of reporting channels to third parties. Regardless, businesses should designate independent and impartial persons or departments (including third-party entities) to receive reports, maintain communication with whistleblowers, follow-up on reports and provide feedback to whistleblowers.

Last updated on 02/08/2022

Flag / Icon

United Kingdom

  • at Proskauer
  • at Proskauer
  • at Proskauer

The reporting channel can be outsourced. Where an employer’s whistleblowing policy or procedure authorises disclosure to a third party (eg, an external hotline), UK law will treat a disclosure to the third party the same as a disclosure to the employer.

The Department for Business Innovation and Skills guidance on whistleblowing identifies that larger UK organisations may have a designated team who can be approached to make a disclosure. The guidance recommends that smaller organisations should have at least one senior member of staff as a point of contact for whistleblowers. However, the guidance also acknowledges that there are commercial providers who can manage a whistleblowing process on behalf of the employer.

Last updated on 29/07/2022

Flag / Icon

United States

  • at Proskauer
  • at Proskauer

A reporting channel can be managed internally or outsourced.

Advantages of an internal reporting channel include:

  • better understanding of the organisation; and
  • better understanding of the context in which complaints may arise and be escalated.

Advantages of a third-party reporting channel include:

  • increased independence and transparency; and
  • broader expertise in handling whistleblower reports.
Last updated on 29/07/2022

20. Can the whistleblower be sanctioned if the facts, once verified, are not confirmed or are not constitutive of an infringement?

20. Can the whistleblower be sanctioned if the facts, once verified, are not confirmed or are not constitutive of an infringement?

Flag / Icon

Australia

  • at Lander & Rogers

Generally, there should be no further action against a whistleblower if their accusation was founded on a reasonable cause. If the whistleblower had a reasonable but erroneous belief in the wrongdoing, and as a result they are dismissed by their employer, then they would potentially have a claim for unfair dismissal.

However, if the whistleblower did not have a reasonable ground, further action may be taken. This will depend on the parties involved and what the company or organisation decide to do. For instance, if following an investigation, it is found that the whistleblowing was deliberately false (ie, was not founded on a reasonable ground), then disciplinary action may follow. Such disciplinary action may include dismissal, termination of services or cessation of a service or client relationship.

Last updated on 23/08/2022

Flag / Icon

Belgium

  • at Van Olmen & Wynant

Whistleblowers cannot be sanctioned if they had reasonable grounds to believe that the information on breaches they reported was true at the time of the reporting. This should be judged in light of a person in the same situation and with the same knowledge as the employee. If this is not the case, the whistleblower falls outside the scope of the protection for reporters and therefore could be sanctioned, if necessary.

Last updated on 01/08/2022

Flag / Icon

Brazil

  • at CGM
  • at CGM
  • at CGM

The whistleblower must report facts in good faith, and unconfirmed reports made in good faith are not an infringement.

However, bad-faith reports can lead to the termination of the employment agreement. Also, it can trigger personal criminal liability for the whistleblower.

Last updated on 29/07/2022

Flag / Icon
Croatia

Croatia

  • at Babic & Partners
  • at Babic & Partners

No, whistleblowers cannot be sanctioned for submitting a whistleblowing report or publicly disclosing irregularities (regardless of whether or not the facts are confirmed or such facts constitute an infringement), unless it can be proven that the whistleblower did not have a legitimate reason to believe that the information on irregularities was true at the time of making the report or disclosure, or did not have a legitimate reason to believe that the information falls within the scope of the WBP Act.

Last updated on 29/07/2022

Flag / Icon

Denmark

  • at IUNO
  • at IUNO

Whistleblowers who had reasonable grounds to believe that the information was correct cannot be sanctioned. Whistleblowers who knowingly report wrong information will not be protected under the Whistleblowing Act and can also be fined.

Last updated on 30/11/2022

Flag / Icon

France

  • at Proskauer
  • at Proskauer

The whistleblower must report the facts in good faith. Thus, reports of unproven facts in good faith are not condemnable.

However, a whistleblower guilty of false accusation is liable for criminal penalties of up to five years’ imprisonment and a fine of 45,000 EUR.

If the whistleblower does not respect the whistleblowing procedure, he or she will not benefit from the regime provided by the law.

Last updated on 29/07/2022

Flag / Icon

Germany

  • at Oppenhoff
  • at Oppenhoff

As a principle, the disclosure of inaccurate information about violations is prohibited under the draft bill of the Whistleblower Protection Act (section 32(2) HinSchG-E). A whistleblower may, however, not be sanctioned if the facts, after being verified, are merely not confirmed or do not constitute a violation in the final analysis. If the information disclosed was incorrect, the following legal consequences will apply:

On the one hand, the whistleblower must compensate for any damage resulting from intentional or grossly negligent reporting or disclosure of incorrect information (section 38 HinSchG-E). The whistleblower's liability for damages is based on the fact that a false report or disclosure has far-reaching consequences for the person affected or accused. The effects may no longer be completely reversible. According to the draft bill of the Whistleblower Protection Act, claims for damages resulting from merely negligent incorrect reporting should not arise. Besides, only whistleblowers acting in good faith are protected from further repercussions.

On the other hand, the whistleblower acts improperly if he intentionally discloses incorrect information in violation of the draft of section 32 (2) of the Whistleblower Protection Act (section 40 (1) HinSchG-E). This administrative offence may be punished with a fine of up to 20,000 EUR (section 40 (5) HinSchG-E).

Last updated on 29/07/2022

Flag / Icon

India

  • at Khaitan & Co
  • at Khaitan & Co

There are no sanctions prescribed under the Companies Act if the facts, once verified, are not confirmed or do not constitute an infringement.

However, as per the Whistle Blower Protection Act, only persons who make any disclosure with a mala fide intention or knowing that it was incorrect or false or misleading, shall be punishable with imprisonment for up to two years and a fine of up to 30,000 rupees.

Last updated on 29/07/2022

Flag / Icon

Japan

  • at City-Yuwa
  • at City-Yuwa
  • at City-Yuwa

The business operator cannot sanction the whistleblower simply because the facts are not confirmed or do not constitute an infringement. However, if the report is made with a wrongful purpose, it will not be protected as “whistleblowing”, and the worker who made that report may also be subject to disciplinary action. The business operator bears the burden of proof of the wrongful purpose.

Last updated on 29/07/2022

Flag / Icon
Latvia

Latvia

  • at Ellex Klavins
  • at Ellex Klavins

An administrative fine may be imposed for knowingly making false statements using a whistleblowing mechanism or making them publicly. The amount of the fine ranges from 30 EUR up to 700 EUR.

Last updated on 29/07/2022

Flag / Icon
Lithuania

Lithuania

  • at Ellex Valiunas

The whistleblower will not incur any contractual or non-contractual liability, or liability for the insult of honour and dignity, if he or she reasonably believed the information provided was correct at the time. The whistleblower will be liable for damage caused by the provision of the information only if it is proved that the person could not reasonably believe that the information provided was correct.

Also, the status of “whistleblower” granted to a person may be revoked if the whistleblower has intentionally provided false information in the notification.

Last updated on 29/07/2022

Flag / Icon
Luxembourg

Luxembourg

  • at Castegnaro
  • at Castegnaro

No. The whistleblower can only be sanctioned if:

  • he or she knowingly reported false information;
  • he or she reported facts in bad faith when he or she had no reason to believe that the facts were true.

Good faith is presumed and it will be up to the legal entity to prove that the conditions for protection are not met and that the concerned individual should not be granted whistleblower status.

Last updated on 29/07/2022

Flag / Icon
Malta

Malta

  • at Camilleri Preziosi
  • at Camilleri Preziosi
  • at Camilleri Preziosi

The Act protects the whistleblower even if they are mistaken on the import of the information disclosed, provided the disclosure was made in good faith and was based on a reasonable suspicion.

The protections afforded under the Act do not apply to an employee who knowingly discloses information they know or ought to reasonably know is false. The Act further allows any person or company (excluding the employer or officers or shareholders of the same, in the case of a company) prejudiced by the disclosure of such false information to pursue any legal action or remedy available under any other law in respect of such prejudice, provided that the identity of the whistleblower has been obtained or otherwise revealed under the provisions of the Act.

Providing false information is also an offence that can lead to imprisonment under article 101 of the Criminal Code (Chapter 9 of the laws of Malta).

Last updated on 16/11/2022

Flag / Icon
Nigeria

Nigeria

  • at Bloomfield LP

Generally, a whistleblower cannot be sanctioned if he or she made the disclosure in good faith or has sufficient grounds to believe the disclosure. However, where the disclosure is frivolous or malicious, disciplinary action may be taken[1]

 

[1] Section 6.1.4 Whistleblowing Guidelines for Pensions 2008.

Last updated on 29/07/2022

Flag / Icon

Poland

  • at Baran Książek Bigaj
  • at Baran Książek Bigaj

If the whistleblower knows that the information they are sharing is untrue, they may be subject to a fine, restriction of liberty or imprisonment for up to three years.

Last updated on 17/11/2022

Flag / Icon

Portugal

  • at Cuatrecasas
  • at Cuatrecasas

The whistleblowing or public disclosure of an infringement, carried out under the requirements imposed by Law No. 93/2021 of 20 December, shall not in itself constitute grounds for disciplinary, civil or criminal liability for the whistleblower.

Nevertheless, if the whistleblower knew, or should reasonably have known, their complaint was false, he or she may be subject to disciplinary proceedings.

Last updated on 29/07/2022

Flag / Icon

Romania

  • at STALFORT Legal. Tax. Audit.
  • at STALFORT Legal. Tax. Audit.

Yes, the whistleblower would pay a fine of up to 5,000 EUR if he or she knowingly reports false information. Additionally, criminal sanctions may apply if the details of the case prove that the abusive report constitutes a criminal offence according to the Romanian Criminal Code. Whether or not it is an infringement worth reporting is, however, not an analysis the whistleblower needs to perform, hence no sanction will be applied if the reported breach turns out to be irrelevant.

Last updated on 16/08/2022

Flag / Icon

Spain

  • at Cuatrecasas
  • at Cuatrecasas
  • at Cuatrecasas

The Draft does not explicitly pardon those who have reported information that has not been confirmed or that simply does not constitute an infraction. However, the Draft does seem to ensure that those who reported information in good faith will not be punished.

On the contrary, those who knowingly reveal false information might be sanctioned, according to section 63 of the Draft.

Last updated on 29/07/2022

Flag / Icon

Sweden

  • at Lindahl
  • at Lindahl
  • at Lindahl

If the whistleblower, at the time of reporting, had reasonable grounds to believe that the information reported was true (and of course assuming that all other conditions for protection are met) the whistleblower cannot, as a main rule, be sanctioned or otherwise held accountable.

However, this does not apply to a willful breach of qualified secrecy or to the collection of information where such collection constitutes a self-standing criminal offence.

Last updated on 02/08/2022

Flag / Icon

United Kingdom

  • at Proskauer
  • at Proskauer
  • at Proskauer

No. There are no sanctions for false reporting under the Employment Rights Act 1996.  

While the worker must have a “reasonable belief” that the information disclosed tends to show one of the relevant types of wrongdoing, there is no requirement for the worker to prove that the allegations or facts are, in fact, true. Certain disclosures carry a higher test and require the worker to show that they believed the facts were “substantially true”.  Please see the stricter restrictions outlined in question 11.

To qualify as a protected disclosure the worker must reasonably believe that the disclosure is made in the public interest. There is no longer a legal requirement that the disclosure is made in “good faith”. However, tribunals do have a statutory power to reduce compensation for unfair dismissal by up to 25 per cent where the tribunal believes that the disclosure was not made in good faith. If a disclosure is deliberately falsely made, the whistleblower may be subject to disciplinary proceedings.

Last updated on 29/07/2022

Flag / Icon

United States

  • at Proskauer
  • at Proskauer

Not if the whistleblower had a subjectively and objectively reasonable belief that misconduct had occurred.

Last updated on 29/07/2022