Whistleblowing and the Whistleblower Act of Finland

Finland has adopted a new Act on the protection of persons reporting violations of European Union and national law (hereinafter "Whistleblower Act") - the Act entered into force on 1.1.2023. Although some of the provisions are subject to a transitional period, many sections of the law are applicable immediately.

The Whistleblower Act, based on the Whistleblower Directive (EU 2019/1937), was due to enter into force already on 17.12.2021, but its national implementation was delayed due to the extent of the documentation and feedback received. Now that the Whistleblower Act has finally entered into force, employers should start preparing for the establishment of reporting channels required by the law.

Nordic Law offers a so-called WhistleBuddy service, which helps actors/employers comply with the provisions of the whistleblower protection law. Please contact us if you would like to discuss the topic further.

Background to the legislation

The background to the legislation on whistleblower protection has been the EU's growing concern about corruption, which was accentuated in the European Commission's 2014 report, which found that corruption costs the EU approximately €120 billion every year. Public procurement and related misconduct were of particular concern.

On this basis, the EU began to look for a legislative solution to the situation, and already at an early stage it was found that the amount of funds returned to society were linked to the volume of whistleblower reports. It was therefore appropriate to set out to create a legislative framework for the protection of whistleblowers in order to increase the number of reports and the abuses revealed through them.

Purpose of legislation

From the EU's point of view, whistleblower protection is about harmonising legislation, which sets common minimum requirements for whistleblower protection for member states. The aim of the legislation is to protect individuals who detect and are ready to intervene in misconduct in companies or public organisations. This can prevent threats and serious harm to the public interest.

The purpose of the legislation is to create a framework for whistleblower protection, which would allow early intervention in misconduct. At the same time, the aim is to protect the whistleblower's identity and protect him or her from possible retaliatory measures by the organisation, so that whistleblowers also dare to use the reporting channels to be established.

Main content

The Whistleblower Act lays down clear rules for different organisations. The relevant obligations relate, for example, to the minimum requirements for the reporting channel, the receiving of reports, the processing of reports and the necessary measures to address misuse. The Act also provides for milestones and deadlines for the notification and follow-up procedures. In addition, the organisation's personnel must be aware of the introduction of the reporting channel, the procedures related to reporting, the notification to the authority and the conditions for obtaining the protection of the whistleblower. The Whistleblower Act also lays down confidentiality obligations to protect the identity of the whistleblower and the persons subject to the report.

Scope of the legislation – reporting channels

Essential to the scope of application of the Whistleblower Act are, in particular, the number of personnel and the sector in which the organisation operates. Organisations that regularly employ at least 50 employees are legally obliged to establish an internal reporting channel. This obligation is independent of the sector in which it operates. Nevertheless, operators in the sector, as well as potential whistleblowers and authorities, need to note that only notifications related to certain sectors, such as public procurement, the financial sector and consumer protection, are protected. Thus, not every notification is protected by law.

The Act will also have a material impact on organisations with fewer than 50 employees. Firstly, certain organisations, particularly those operating in the financial sector, are already subject to the obligation to establish an internal reporting channel, regardless of their sisz. Special legislation is still applicable to these organisations, but they will also be subject to the Whistleblower Act as a general law. Secondly, the Whistleblower Act will apply to those organisations that have established a reporting channel voluntarily, regardless of the size of the organisation.

As a further point, it should be noted that groups – including at international level – may, under certain conditions, maintain a common reporting channel, as long as it meets the requirements of each country. Different organisations can also outsource the organisation of an internal reporting channel to a service provider.

Conditions for obtaining protection

The most crucial aspect of the Whistleblower Act is the protection offered to whistleblowers. This requires that the notifier had reasonable grounds to believe that the reported information was accurate at the time of reporting and that the notification was within the Act's scope. Additionally, protection requires the use of a three-tier reporting system for misuse. Firstly, the report should be made through an internal reporting channel. If necessary, it should then be escalated to an external reporting authority. Only as a last resort should the information be made public. This is beneficial for organisations as it prevents potential irreversible reputational damage based on a possible misunderstanding.

If appropriate measures have not been taken within a reasonable time to investigate the misuse at the reporting stage, the reporting process can move on to the next step. As it were, this creates a momentary exclusive right to investigate misuse for organisations, as the report can only be made to the authorities within three months if no action has been taken, or within seven days if no acknowledgement of receipt has been issued. For public authorities, the corresponding period is between 3 and 6 months.

There are exceptions to the three-tier requirement, such as if the infringement directly endangers the public interest. Also, suspicions of breaches of financial sector regulation do not primarily need to be reported through the internal reporting channel.

Protection granted

If a person makes a report using the reporting channel appropriately, they will be protected from retaliation by the employer. There is no exact time limit for protection. A person enjoying protection is protected, for example, from termination of employment, postponement of promotion or warnings or other negative sanctions, as well as from threats thereof. In addition, the report must not be blocked.

Decisions related to the employer's right to direct may cause ambiguity now that the Act has entered into force, and there is no absolute certainty as to which all measures can be considered unlawful in practice. In this case, importance is given not only to the nature of the procedure, but also to temporal proximity, causality and whether the treatment differs from that of other workers.

Consequences of non-compliance and violations

The Whistleblower Act does not provide for sanctions for failure to establish a reporting channel. Instead, the consequence of non-compliance is that the whistleblower is not required to report the misconduct to the organisation; The notifier may report directly to the authorities or, in certain cases, make the information public.

Organisations that are not subject to the obligation to establish a reporting channel should also be prepared for the fact that their employees can report abuse to the authorities or the media if they do not have an internal channel at their disposal. Thus, the Whistleblower Protection Act applies to all organisations, from micro-enterprises to conglomerates.

If the employer violates the prohibition of retaliation, the notifier must be compensated for the damage suffered and, depending on the situation, compensation or compensation for the unjustified termination of the employment contract. On the other hand, the declarant who intentionally reported or made public false information must also compensate the subject of the report for the financial damage he has thereby caused.

Now vs. Future

Before the Whistleblower Act came into effect, there was no general legislation on the protection of whistleblowers in Finland. However, certain areas were and are subject to specific legislation on the protection of whistleblowers. This specific legislation particularly concerns financial sector operators. There is also legislation related to whistleblower protection, especially related to trade secrets, the protection of sources in the press, and discrimination.

Many public sector actors, such as the Police and the Financial Supervisory Authority, as well as some private organisations, already have some kind of reporting channel in place. Many organisations have also anticipated the entry into force of the Whistleblower Act and have established voluntary whistleblower reorting channels.

Transitional period

During the transitional period, considerations have been made for the varying capabilities of organisations of different sizes to adapt to the new Act's requirements. As such, larger companies, those with at least 250 employees, are given a three-month window following the law's enforcement to set up a reporting channel and ensure compliance with the Act's stipulations. Conversely, smaller companies, with up to 249 employees, have been afforded an extended transition period until 17.12.2023. This extended transition period also extends to companies with fewer than 50 employees that have proactively established a reporting channel on a voluntary basis.

Our Associate Trainee Savva Kuparinen took part in writing this article.