A whistleblower is a person who raises the alarm or reports wrongdoing within their organisation. The Swedish Government is now proposing new legislation with the purpose of enhancing the protection of whistleblowers, to come into effect on January 1, 2017. Rebecka Thrn and Josefine Wir summarise the main points of the proposed legislation and give some advice on how your company can handle alarms raised by employees.

It is in the interests of the employer as well as the employee and the company or organisation that conduct harmful to the business comes to light and can be handled. However, research shows that many people refrain from raising the alarm because of fear of reprisals. This is one of the factors leading to the proposed legislation, consisting of a new law (hereinafter the "whistleblower act") protecting whistleblowers from reprisals from the employer, as well as an amendment to the act on public disclosure and confidentiality under which the principal rule will be that a duty of confidentiality will apply to whistleblower cases.

Meaning and implication of the proposed legislation

The enhanced protection of whistleblowers in the whistleblower act consists of a statutory liability to damages for the employer who exposes an employee to reprisals, as a consequence of the employee raising the alarm. "Reprisal" means everything from termination and dismissal to reduced employment benefits or isolation in the workplace. According to the Governments proposal, not only employees will be covered by the new law agency staff are also to be protected from reprisals in the client company.

The whistleblower act distinguishes between internal and external alarms. Internal alarms are those directed to the employer or a representative of the employer, for example a senior manager, as well as alarms communicated through the employers internal whistleblowing system. External alarms are alarms directed to an authority or disclosure of information to the public. In the case of internal alarms it is proposed that concrete suspicions on the part of the person raising the alarm are sufficient for the enhanced protection to take effect. External alarms are to have higher requirements regarding the accuracy of the information provided, namely that the person raising the alarm has factual grounds for her allegation of serious wrongdoing. According to the proposed law, it is also, as a main rule, required that the employer first raises the alarm internally and gives the employer an opportunity to rectify the wrongdoing in question before the employee is entitled to raise the alarm externally.

For the whistleblower act to apply and to trigger protection against reprisals, an alarm must relate to serious wrongdoing. The requirement that it should concern serious wrongdoing if the notification is to be dealt with as a whistleblowing matter is already in place as a consequence of rules in the Personal Data Act.

Personal Data Act

Companies that establish a whistleblowing system, in which information on breaches of law may typically be processed, must follow the Personal Data Act and the special rules for whistleblowing systems issued by the Data Protection Authority (DPA).

Under the DPA's rules, only the following information may be handled within the framework of a whistleblowing system:

  • suspicions of serious abuse relating to:
    1. bookkeeping, internal audit, audit, bribery, criminality within the bank and finance sector; or
    2. other serious abuse concerning the company's or the group's interests or individual's lives and health such as serious environmental crime, major shortcomings in workplace safety and very serious forms of discrimination and harassment.
  • Additionally, the serious abuse must be committed by a person in a leading position.

How can a whistleblowing system be structured?

A whistleblowing system is a reporting channel in which primarily employees can report serious abuse. The company establishing a whistleblowing system will itself choose whether the system is to be open to, for example, employees and agency staff or whether other categories such as partners and suppliers may also report via the reporting system. If the company chooses a whistleblowing system that is open to several categories, it should be clearly informed in the system's instructions on the limited scope of the whistleblower act, as the act will only apply to the alarms of employees and agency staff.

The construction of a whistleblowing system can vary and consist of everything from an indicated telephone number or an e-mail address to which reports can be made, i.e. a sort of hotline, to more sophisticated systems with technical solutions (often web-based) provided by external suppliers and/or a solution whereby the alarm is raised to a unit external to the company, such as a law firm. The law firm can, in such a system, also be responsible for investigating incoming alarms and reporting the result of the investigation to the company's board or a specially appointed group or person within the organisation. The greatest benefits of engaging an external recipient of incoming alarms are the confidence created in the service; the safeguarding of anonymity for the provider of information and quality assurance of the handling of the process. Delphi has been appointed by a client to be such an external whistleblowing unit and is also responsible for investigating matters arising thereof.

Why a whistleblowing system?

Today, the majority of the largest Swedish listed companies have introduced a whistleblowing system. Small- and medium- sized companies as well as municipalities and public sector organisations are also establishing various types of whistleblowing systems. By establishing a special reporting procedure in which it is clearly communicated to the employee why the system exists and how it is to be used, a company can increase its chances of receiving more and better notifications with the aim of picking up and managing harmful conduct in the business. Experience shows, however, that it is not a matter of any larger number of reports that are made to the companies through their whistleblowing systems. Suppliers of webbased whistleblowing systems state that the number of incoming alarms is about one to two reports per thousand employees and year and many companies state that they would like to receive more reports. Perhaps the proposed whistleblower act and the enhanced protection will bring a change in this respect as more people dare to blow the whistle.