Over the past few years, US and multinational corporations have invested heavily in assuring compliance with the stringent demands of the 2002 Sarbanes-Oxley Act (SOX). As its scope extends far beyond United States boundaries, US executives must not only restructure corporate policies in parent companies, but also those of foreign subsidiaries.

Currently, there are approximately 375 US companies with subsidiaries in Denmark (excluding multinational corporations listed on the US stock exchange). Questions as to whether the SOX Code of Conduct is actually applicable in Denmark remain, as of today, unanswered.

One issue, the whistleblowing issue and the proportions it has taken in the SOX Code of Conduct (e.g. anonymous hotlines, etc.), has raised particular concern: although Danish legislation does not specifically deal with this problem, whistleblowing policies could, to a certain degree, be in direct conflict with local case law, legal customs, culture, etc.

As a result, US and multinational corporations enforcing SOX whistleblowing policies in their Danish subsidiaries have absolutely no indication as to their actual legality in Denmark.

Cultural Considerations

When implementing codes of conduct in foreign jurisdictions, companies should always consider factors such as cultural background and local environment.

In Denmark, the concept of whistleblowing is said to be "a very unfamiliar method of revealing fraud"1. This presumption reveals itself to be quite accurate given the degree of protection whistleblowers are granted (close to nothing). This is mainly due to two factors: first, the duty of loyalty; and second, the limited rights employees possess when dismissed without cause (small amount of damages, scarce chance of reinstatement).

The Duty Of Loyalty

A major principle governing employment relationships in Denmark is the employee's duty of loyalty, under which an employee must not harm the employer's interests and by no means disclose confidential information.

Hence, if at any moment an employee becomes aware of a colleague's misconduct, or dishonesty, his duty would be to report to the employer. If he "blows the whistle" and addresses a critique directly to the press or any third party, such behaviour would constitute a breach of his obligations, and justify termination or even liability for damages2 . Furthermore, loyalty may even, under certain circumstances, prevent an employee from addressing issues directly to upper management: he must first resolve them with his direct supervisor.

Thus, on this first point, there would seem to be a conflict between loyalty and whistleblowing policies, especially when considering the use of anonymous whistleblowing "hotlines".

However, it is worth noting that only a few Danish cases have dealt specifically with the applicability of SOX codes of conduct, or employees reporting illegal activities.

There is one case3 where the Danish Supreme Court considered an employee's right to inform third parties of company related information. The facts are as follows: an employee, during a private meeting with his bank, informed the clerk of financial difficulties which the company he worked for was facing. Even though the information was requested by the bank, the Supreme Court found that it constituted a violation of the employee's duty of loyalty.

The case evidently does not offer much guidance as to the legitimacy of whistleblowing in Denmark, nor to the reporting of illegal activities. However, it does establish some form of precedent that stresses the importance of loyalty in employee/employer relationships.

Another case4, although not particularly recent, demonstrates just how an employee may legitimately report illegal activities to third parties. Kaj Christiansen, an employee of a toy factory, became aware of certain tax violations committed by the company (tax evasion). Having confirmed the fraud, he dealt with the problem internally by addressing the issue to the employer, who ultimately decided not to react. The employee therefore proceeded to alert the authorities of these illegal activities, and he was, as a result, immediately fired. The Court declared in its decision that the dismissal was unjustified.

Accordingly, the protection of an employee's right to report illegal activities will truly rely on whether his intentions were to harm the company. Indeed, putting this into perspective with the last case, the employee was considered to have acted in good faith because he addressed the issue to his employer first, before going to the authorities. It is worth noting that he would not have been entitled to start a public debate, which could have drawn unwanted attention to the company, and demonstrated harmful intent.

The Nordic Approach

Sweden, which shares many legal traditions with Denmark, has several cases that deal with public denunciation by employees. The decisions of the Swedish Court give us an idea of how SOX whistleblowing policies will be implemented in Denmark.

In a case judged by the Swedish Labour Court5, a Scandinavian Airlines (SAS) flight engineer publicly revealed, by means of a magazine article, confidential information regarding staff-related issues and criticized the allegedly insufficient attention given to flight safety. The article also contained information which, according to the collective agreement, was not to be disclosed to third parties. For these reasons, the flight engineer was found to have breached his duty of confidentiality. The Labour Court affirmed that, since the article was capable of causing damage to SAS, the employee had seriously breached his duty of loyalty, and therefore, SAS had the right to dismiss him immediately. Finally, it emphasized the fact that the employer had the right to report the incident to the authorities.

In another case before the Swedish Labour Court6, a night clerk and receptionist, working at a hotel, contacted the license department of the Swedish Agency of Entailed Estates (Lensstyrelsen) to report serious violations allegedly committed by the hotel management (e.g. selling of spirits after hours, tax fraud, etc.). Even though the judges recognized that an employee should report misconduct to the authorities, it made it equally clear that such whistleblowing could also constitute a breach of the employee's duty of loyalty. According to the Court, special weight should be given to the question of whether or not the employee had approached the management first. In this case, the night clerk and receptionist had not. As a result, the judges decided that the report caused damage and inconvenience to the employer, and justified the dismissal.

What is interesting in these two cases is that the Labour Court did not necessarily condemn the employee for appealing to a third party, but rather because he did it in such manner that explicitly demonstrated disruptive intentions. In other words, if it is proven that an employee reveals confidential information to a third party for the purpose of bringing positive change to the company, judges would be far more inclined to accept whistleblowing. That is precisely why Swedish judges suggest that employees raise criticism to the company's management first, before presenting it to the relevant third party: for probatory reasons. In such situations, it is easier to presume that the wage-earner's intent was bona fide.

In Norway, another jurisdiction with shared legal traditions, the courts have taken a more favourable approach from an employee standpoint to the issue, compared with the Swedish Labour Court.

In a case decided by the Oslo District Court7 (Oslo Tingsrett), Siemens Business Services was found liable for unjustified termination of an employee. The employee had reported an incident of improper accounting procedures approved by local management to the group management. After being terminated he reported the issue to a newspaper. The Court applied a two-step test to determine if the employee was protected against whistleblower retaliation. Firstly, the court viewed whether the reporting was justified, based on an evaluation of the true nature of the allegation. Secondly, the Court considered whether the employee had a justified reason to react. The Court found that, since the immediate management had violated internal procedures, the employee had a right to report the incident to the group management and since he had reason to believe that the company would remove evidence, he had good reason to go to the press. The employee was awarded damages of NOK 750,000.00 and an additional NOK 750,000.00 in compensation for tort.

In contrast to the Swedish Labour Court, the Oslo District Court did not consider whether the employee should have gone to the authorities before going to the press. Instead of considering the employee's intentions to harm the company, the Court emphasized whether the employee had good reason to report the incident. Comparing these decisions to Danish case law it must be expected that the Danish courts as the Swedish Labour Court would consider the intention to harm the company as an important part of the test in whistleblower cases.

The Public Sector

The duty of loyalty often conflicts with freedom of speech. This becomes most evident in the public sector, where Section 77 of the Danish Constitution prohibits the state from exercising censorship, including on its own employees. On the other hand, Section 152 (2) of the Danish Criminal Code penalizes public employees who breach their duty of confidentiality. This conflict has given rise to a few cases with wide media coverage.

In the "Tamil" case, the Special Court of Indictment found that the former Minister of Justice gave illegal instructions to his staff regarding the denial of Tamil family reunion. Several of the officers were dismissed after the trial. The judges suggested that the staff should have addressed the issue following a specific pattern: first, the problem must be dealt with internally, by reporting to a superior; second, if such measures fail, action may be taken externally by contacting the authorities, union, or shop steward. Resorting to the media must only be used as an ultimate measure.

In the latest case, the so-called "Grevil" case8, a former army intelligence officer, Frank Grevil, passed on some classified information concerning the threat reports from Iraq. The purpose of the exposure was to prove that the Danish Government had actually lied about the reasons for going into war. Frank Grevil was found guilty under the Danish Criminal Code and sentenced to four months' imprisonment.

Following the "Grevil" case, the Danish Parliament demanded new legislation protecting whistleblowers. The Government thus, as of 2004, commissioned a report on possible legislation for public sector employees. The commission's report concluded that the current protection of public employees was adequate and consequently the Government decided not to introduce special legislation in this area.

Even though the public sector evidently raises different concerns than the private sector, the balance between loyalty and freedom of speech can be dealt with quite similarly. Therefore, if the Parliament enacts laws on whistleblowing in the public sector, it may guide us on how the courts will deal with SOX code of conducts in the private sector.

Data Protection

The European Council Data Protection Directive (95/46/EC) could equally be a source of conflict.

This text, implemented by the Danish Parliament in May 2000, reflects general rules of lawfulness and fairness in the processing of data. Specifically, it sets forth strict conditions for the collection, use, and disclosure of personal information. Thus, there are many potential conflicts between EU data protection laws and SOX.

For instance, the Directive requires that the processing of data must not adversely affect the personal freedom of individuals, and as a result, imposes consent and disclosure requirements. How could such provisions possibly be respected if companies set up anonymous whistleblowing "hotlines"? Indeed, when an employee calls a hotline to report a colleague's fraudulent activities, he will necessarily have to reveal personal information without consent (who would give approval to such denunciations?). This would constitute a serious breach of data protection regulation (in particular article 6 relevant to fair processing).

To further complicate matters, the Directive also greatly restricts the transfer of personal information to certain countries, namely the United States.

It is not surprising that on 26 May 2005, the French data protection authority (the "CNIL") refused to allow two companies (McDonald's France and Compagnie européenne d'accumulateurs or CEAC, an affiliate of Exide Technologies) to operate anonymous reporting systems such as those required by SOX. In its decisions, the CNIL considered, inter alia, that the collection of data by way of these proposed hotlines was unfair, as the concerned employee was only to be informed several days later. Moreover, the CNIL found that setting up such hotlines could strengthen the risk of defamatory accusations and stigmatize employees concerned by anonymous denunciations.

Such a decision may very well have repercussions in Denmark, as it has implemented the same EU Directive as France.

Conclusion

Given all these potential conflicts, US and multinational corporations may face liability in several jurisdictions: in Denmark if they enforce Sarbanes-Oxley's whistleblowing provisions; or in the US, if they comply with Danish law. It is thus essential to ensure that such hotlines are drafted carefully and administered in accordance with the principles of loyalty developed by the Danish courts and that procedures are implemented to ensure that the hotlines apply minimum standards of data protection, fairness and due process.

Footnotes

1. Public Concern at Work – Whistleblowing, fraud and the European Union, 1996

2. According to Section 10 (2) of the Danish Marketing Act, the employee may not disclose trade secrets or other similar confidential information to third parties. If the employee were to do so, he would be in breach of his duties to the employer, who would then be entitled to dismiss him, or even sue for damages.

3. Ufr.1987.495H

4. SHT 1955/62 (see also SHT 1942/81: conflicting case, but due to historical factors)

5. AD 1961 no 27

6. AD 1986 no 95

7. Oslo Tingsrett decision of 29 September 2005, referred to in Lov & Data no. 87, September 2006

8. The Eastern Appeal Court decision of 23 September 2005 (Ufr.2005.65)

The content of this article is intended to provide a general guide to the subject matter. Specialist advice should be sought about your specific circumstances.