Insights | August 30, 2021

New legislation on protection for whistleblowers in Finland and Sweden

In October 2019, a new EU directive was adopted, aimed at enhancing the protection for whistleblowers. Since then, the legislative process has moved forward, and both the Swedish and Finnish governments have issued government bills. Both the Swedish and Finnish acts are anticipated to come into effect on 17 December 2021. In the following, we will provide a brief overview of some interesting aspects of the Swedish and Finnish government bills.

In Finland, the Ministry of Justice requested stakeholders to comment on the draft by 27 August 2021. The contents of the Finnish bill will now be examined in light of the feedback obtained during the consultation period and are therefore subject to change. In Sweden, the Parliament intends to vote on the bill later this Fall and it is highly unlikely that its contents will be subject to change.

Aspects of the Swedish and Finnish government bills

• The Whistleblower Protection Directive affords protection for individuals reporting internally, externally or by way of public disclosure. According to the Swedish bill, the protection applies when an individual reports about misconduct which may be in the public interest. In this sense, Sweden’s interpretation goes even further than the Directive. The material scope is also different from the previous Swedish legislation, which only afforded protection in the event of warnings about serious misconduct (offenses subject to imprisonment or similar misconduct) in the employer’s business.  According to the Finnish bill, the material scope will be in accordance with the minimum standards set out in the Directive but will also cover the corresponding areas of national law. In addition, the breach must concern an act that may lead to imprisonment, a fine or an administrative sanction or that may severely endanger the public interest protected by the defined areas of law. Importantly, neither EU nor national employment law is covered, which is relevant to take into consideration in the communication and practices relating to the implementation of the WB channels.
• As mentioned in our previous articles (see below), the Directive introduces a general obligation for companies with 50 employees or more to have internal reporting systems, an obligation which currently does not exist in Finland or Sweden. Many Swedish and Finnish companies nevertheless already have reporting channels or hotlines in place. Going forward, companies with between 50 and 249 employees are still allowed to share some features of their internal reporting systems with other companies, e.g. reception of reports and investigation of the conditions that have been reported. However, some elements, such as the requirements to have contact with and provide feedback to the whistleblower, are imposed on all medium-sized companies. The exemption for medium-sized companies is recognized in both the Swedish and Finnish bills. As a consequence of the Directive, companies with 250 or more employees have to set up their own reporting channels and related procedures. Such large companies need to handle most of the features of the internal reporting channel independently.
• The requirements for medium-sized and large companies also apply to group companies. There are some differences in the interpretation of the Directive between Sweden and Finland as to how companies within a group should develop their internal reporting channels on a group level. According to the Swedish bill, it is not sufficient to set up a common system within a group. Hence, Swedish group companies will need to handle most of the features of the internal reporting channel independently. The Finnish bill, however, specifically provides that group companies may establish group-level reporting channels and make such channels available within the group. It is still unclear whether this means that subsidiaries with more than 50 employees could rely solely on the group-level channel. Alternatively, in addition to the possibility of utilizing the group-wide channel, such subsidiaries would need to offer a local route to report suspected misconduct.
• As a consequence of introducing internal reporting systems, there will be sensitive personal data in the system, e.g. accusations of crimes. It is emphasized both in the Swedish and Finnish bills that companies will have to make sure that these systems follow the requirements set out in the GDPR and the special provisions about personal data set out in the Directive. In Sweden, an employer will be able to process data relating to criminal convictions and offences based on its legal obligation to maintain an internal complaints handling system. In some circumstances, personal data considered sensitive may also be processed if necessary for reasons of public interest. The legislative proposal explicitly states that the processing may not be based on the data subject’s consent. Under Finnish law, an employer must generally obtain the employee’s consent in order to collect personal data from a source other than the employee him or herself. In the context of reporting channels, there are various situations where obtaining consent would be highly problematic (for example, where an employee is suspected of having committed the reported misconduct). The Finnish draft bill takes this into account and specifically sets out that, as collecting and processing information on employees via reporting channels would be based on the Finnish whistleblower legislation, it does not require the consent of the relevant employees. However, employers must notify employees of any collected personal data before making decisions concerning such employees.
• It is stated in the Swedish and Finnish bill that any act of retaliation against a reporting person or any other party, as well as any acts preventing or attempting to prevent reporting, would entitle the injured party to damages from the company.

The national legislation is anticipated to come into effect on 17 December 2021 in both Finland and Sweden. Regarding the internal reporting channels, companies with between 50 and 249 employees have to introduce the systems by 17 December 2023. In Finland, companies with 250 employees or more are required to introduce the channels by 17 December 2021. However, the deadline for large companies in Sweden is 17 July 2022.

Summary

It is important for companies in Sweden and Finland to be aware of the extended scope of the new legislation and the obligation to introduce internal reporting systems. If a company already has a reporting system in place, it needs to make sure that this system adheres to the extended scope of the Directive by 17 December 2021. Large Finnish companies need to have an internal reporting channel in place by 17 December 2021. For all Swedish companies and medium-sized Finnish companies, it is important to start preparing for the internal reporting channels and the requirements coming up in 2022 and 2023, depending on the size and location of the company.

If you would like to learn more about the Finnish and Swedish implementation of the Directive, we would be happy to assist you.

Article written by Partner Jenny Welander Wadström, Principal associate Laila Sivonen, Senior Associate Mari Mohsen and Associates Alice Göransson and Tuomas Rudanko.