by Daniel Vaknine
A number of global and large national companies already have centralised group-wide reporting systems in place and have relied on the adequacy of this global solution after 17 December 2021, when the new EU Whistleblowing Directive entered (or was supposed to enter) into force. The European Commission has however clearly rejected this interpretation.
Why a group-wide whistleblower system is not enough according to the EU
The idea of a centralised whistleblowe system was rejected by the European Commission in the interpretative guidelines they published in response to a joint letter from industry associations from several Member States, in which these industry organisations criticised the need for groups with companies with more than 250 employees to set up completely separate whistleblowers.
The Commission explained that the Directive clarifies that each private entity with more than 50 employees is obliged to implement its own internal reporting system, regardless of whether the entity is part of a group or not.
“Group-wide whistleblowing systems can only exist in parallel with reporting systems at the individual company level”
The European Commission clarified in this regard that it is mandatory for all legal entities with more than 50 employees to provide their own whistleblower system (Article 8 (3) of the EU Whistleblower Directive). This is clear from the wording of the Directive and applies equally to independent companies and group companies, regardless of whether there is a group-wide system for whistleblowing or not.
It is considered necessary both for the efficiency of the systems and due to the expected different implementation of the EU Directive at the national level to separate the reporting channels. Consequently, in the view of the European Commission, group companies cannot be qualified as “third parties” in the field of whistleblower systems outsourcing.
The directive does not prohibit centralised group-wide whistleblowing systems, but these can only exist in parallel with whistleblowing systems at the individual company level. The Commission has justified its opinion by saying that the system is more effective if the problem is dealt with at company-level where the case was reported and by the various legal provisions that will be adopted at the national level.
All Member States must respect this interpretation when implementing the Directive. Therefore, if you have more than 50 employees, you should start preparing for the implementation of your own whistleblower system, even if you already have a comprehensive whistleblower system in place within the Group. It is likely that you will need to update your routines, even if your country’s local legislation currently says otherwise.
Sharing whistleblowing resources within a group is permitted, to some extent
If companies have up to 249 employees, they may, in accordance with the Directive, pool resources to examine a report with their parent or sister company. Still, the following conditions must be met, according to the Commission’s interpretation:
- The whistleblower must be able to report at subsidiary level, i.e. the subsidiary’s internal whistleblower channels must be active and functional.
- The whistleblower must be informed about who at the parent company level will have access to the report to carry out the investigation.
- The whistleblower must always have the opportunity to refuse the parent company to investigate the reported misconduct and request an investigation of the matter through the subsidiary’s whistleblower system.
- The responsibility for maintaining the report’s confidentiality, giving the whistleblower feedback, and taking corrective action in connection with the reported misconduct always lies with the subsidiary.
The above simplifications do not however apply to large (subsidiary) companies with more than 250 employees. In the opinion of the European Commission, it is therefore mandatory for these companies to have their own whistleblower system that can process incoming information independently of and outside any central whistleblower systems that may exist in parallel.
In other words, corporate groups can maintain a central whistleblowing system, but this cannot replace a decentralised whistleblowing system at each subsidiary level. If not all of the above points can be met, Group companies cannot share a whistleblowing system.
Actually implementing a whistleblowing system
It does not necessarily have to be cumbersome or particularly time-consuming to implement whistleblowing solutions for every company within the group. Find a system provider that has helped multi-national Group companies in the past to get experienced help. The system provider should also be able to give you discounts for the group setup.
We believe that one of the main difficulties for companies will be to find relevant recipients for the cases in each Group company. One solution for this could be to outsource the case handling to a law firm or such, however many of these charge unreasonably high fees. Read our blog post on how to choose the right external case management service for a more thorough guide on how to do just that.
If you have any questions about if your current solution is in line with the European Commission’s point of view or anything else whistleblowing related, you’re always welcome to reach out.
The author, Daniel Vaknine, is CEO and Partner of Visslan, a Sweden-based whistleblowing solution to simplify whistleblowing and compliance with the new EU Whistleblowing Directive. Daniel and his team meet Compliance Officers and Legal Counsels on a daily basis to help them with whistleblowing. Through these encounters, many frequently asked questions arise from which they write articles to provide an answer to the question to a broader audience.
