Whistleblowing can be a valuable tool for businesses, providing an early warning system against corporate malpractice and demonstrating a compliance culture. Hotlines are now established as an important tool in the whistleblowing process. Hotlines typically involve the personal data of both the reporter (e.g. name, location and the fact that he/she made the report) and the "wrongdoer" (e.g. name and allegation). Introducing hotlines therefore requires careful consideration as regulatory compliance steps must be taken prior to implementation to ensure adherence to data protection laws.
Whistleblowing hotlines are often rolled out on a global basis. Whilst EU data protection laws have been harmonised, to some extent, by the EU Data Protection Directive, Member States have interpreted the laws slightly differently and each country's data protection authority (DPA) takes a different approach to regulation and enforcement. It is therefore important for multinational corporations to understand that a "one size fits all" approach does not work when implementing whistleblowing hotlines in the EU, and they must instead navigate a patchwork of differing legal requirements.
Set out below are our top 10 issues that businesses should consider when implementing whistleblowing hotlines in the EU:
- Notify the applicable DPA and, where necessary, obtain its prior authorisation.
- Check whether Works Councils need to be informed and consulted prior to implementation.
- Consider the type of concerns which may be reported via a hotline; more serious matters should be, while more trivial issues ought to be dealt with through normal reporting channels (e.g. line managers).
- Think about anonymous reporting. Approaches to anonymous reporting differ from country to country; some prohibit it, while others require it to be available.
- Implement data-processing contracts whenever any third-party service provider operates the hotline.
- Put in place a mechanism for complying with EU data-transfer rules whenever personal data is transferred outside the European Economic Area, for instance, to an organisation's corporate headquarters.
- Implement policies to provide employees with information about the hotline, how it should be used, handling complaints and any rights they may have in, and to, the data.
- Train the employees responsible for processing hotline reports and consider entering into confidentiality agreements.
- Adopt appropriate technical and organisational measures to keep secure any personal data that has been gathered through a hotline.
- Place a time limit on the retention of data gathered through the hotline, which should be in line with regulatory recommendations and guidance papers.
The content of this article is intended to provide a general guide to the subject matter. Specialist advice should be sought about your specific circumstances.
