Challenge: Whistleblower hotlines run into significant legal challenges in Europe. Since 2006, multinationals have wrestled with well-publicized hotline regulations in France and a well-publicized opinion from an EU Working Party. But now seven other EU countries have issued written guidance on hotlines.
Sarbanes-Oxley [SOX] § 301 whistleblower hotlines raise legal issues across Europe, but until now only the French position has been widely publicized in the United States. SOX § 301 requires audit committees at SOX-regulated employers to launch "procedures" (commonly called hotlines) for the "confidential, anonymous submission" of employee "complaints" or "concerns" regarding "questionable auditing or accounting" matters (commonly called whistleblowing). Multinationals, and the SEC, generally assume that this mandate requires hotlines be made available even to employees outside the US, so that they can be whistleblowers, too. Indeed, even many non-SOX-regulated multinationals now offer international whistleblower hotlines. The trend has actually spawned a mini-industry: outsourced whistleblower-hotline call centers.
In the US, making whistleblowing procedures available rarely ever raises acute human resources concerns. But in parts of Europe, the launch of an anonymous whistleblower hotline can spark fierce push-back. Some in Europe see anonymous whistleblowing on co-workers as reminiscent of World War II and communist era anonymous denunciations of neighbors. Hotline critics champion the due process rights and the presumption of innocence of those whom whistleblowers accuse of wrongdoing, and are skeptical of an employer's ability to exonerate an innocent target through an internal investigation. As such — European interpretations of law, chiefly data privacy law but also labor law — tend to erect high hurdles to SOX-style hotlines. The clash between some European interpretations and SOX's hotline mandate has been called an irreconcilable conflict: "I have to either chop off my left hand or my right hand" (Wall Street Journal, Sept. 6, 2005, at C1).
In late 2005, France's data protection agency, known by the acronym "CNIL," issued highly publicized regulations reining in SOX-style hotlines. In early 2006, a well-publicized but non-binding advisory opinion from an EU Working Party (made up of local European data officers) took a position similar to France's. This guidance led some multinationals radically to restructure their reporting procedures within France.
Although largely unpublicized in the US, we now have written guidance specific to the hotline question from an additional seven EU member states — no two of which impose identical rules. We now have written guidance specific to the hotline question from an additional seven EU member states — no two of which impose identical rules. Therefore, employers sponsoring whistleblowing hotlines in Europe need to ensure they comply with hotline laws in all affected EU jurisdictions. This is a difficult task, for which there is no easy fix, but a multinational can comply simultaneously with the SOX hotline mandate and with the laws in all of these EU jurisdictions (with one exception: Spain's rule on anonymity conflicts irreconcilably with SOX). Compliance requires a carefully devised, company-specific strategy. In devising your strategy, do not rely on legal advice from a hotline outsourcer. Check the mandates of SOX and identify your specific corporate policy needs. Then factor in the EU Working Party opinion and local law in all affected jurisdictions Written guidance specific to hotlines (from those EU jurisdictions that have issued hotline-specific guidance) is very broadly summarized on the chart below.
Pointer: Devise a whistleblower hotline strategy that accounts for local law in every affected jurisdiction — not just France.
Whistleblower Hotlines and Data Protection Laws in Europe
EU jurisdictions that have issued written guidance on hotlines and data law, as of October 2007
This is a very broad summary of the issues. White & Case has a detailed paper on devising a strategy as to whistleblower hotlines in Europe.