Background: Finland and the EU Whistleblowing Directive
The EU Whistleblowing Directive aims to end a confusing patchwork network of whistleblowing protection legislation across all member states, bringing the bloc to a new and universal protection standard. Governments had a December 2021 deadline for implementation and the process was delayed in the majority of member states.
Under the new measures, all private and public sector employers with 250 or more employees were required to establish a whistleblowing system by April 2023. Smaller entities with between 50 and 249 employees were also required to take action and they were given an extended deadline of December 2023.
Finland did not have comprehensive protective measures in place for whistleblowers before the EU Whistleblowing Directive entered into force, though it did have some sector-specific requirements. The Finnish Ministry of Justice set up a working group for the transposition of the Directive in February 2020 and more formal consultation followed in a series of meetings in November 2020.
Following a subsequent period of public consultation, a new bill was expected to be presented in parliament in September 2021 but this was delayed. In May 2022, the Lainsäädännön arviointineuvosto (Legislative Review Board) reviewed the bill, concluding that it fell short in several areas. The board recommended more clarity about the main impact on the rights and obligations of employees and employers as well as the process of setting up new channels in place of existing systems used by public authorities.
In September 2022, Finland issued the “Whistleblower-laki” or “Whistleblowing Law”, significantly strengthening protection for whistleblowers and obliging companies to implement reporting channels. The law was approved by the Finnish parliament in December 2022 and it entered into force on January 01, 2023.
The scope of Finland's new law
Under Finland’s new law, private sector entities employing at least 250 people and public sector entities with at least 50 employees were required to establish an internal reporting channel by 01 April 2023. Private sector entities with between 50 and 250 employees were given an extended deadline of 17 December 2023 to comply with the new requirements. Similarly, organisations with fewer than 50 employees who voluntarily established an internal reporting channel must bring it into compliance with the new legislation by the same date.
The personal scope of the Whistleblowing Law in Finland goes beyond the whistleblower and takes into account individuals such as board members, volunteers, unpaid trainees, shareholders and job applicants. Receipt of a report must be acknowledged within seven days while feedback on any action taken has to be provided to the whistleblower within three months. If the whistleblower reasonably concludes that the employer’s actions were insufficient or the feedback provided is satisfactory, he or she is entitled to protection at the organisation’s expense. In such a scenario in Finland, the whistleblower can also decide to report via a public channel through The Chancellor of Justice’s Office or later to the general public.
Finland’s law does not require private employers to implement anonymous reporting but many organisations will likely offer this option in practice. Even if an organisation decides against anonymous reports, the law still recommends establishing such a channel given that it can prove useful for communication with the anonymous whistleblower.
Under the new legislation, whistleblower reports must be exclusively processed by appointed persons who are appropriately trained in a qualified case management system. Processing of reports can be outsourced, given that the body responsible adheres to the GDPR and relevant national regulations. While the new law allows for group implementation, it falls short when it comes to intragroup whistleblowing solutions in areas such as data transfer and liability allocation.
Penalties and consequences for non-compliance
In Finland, the unauthorised disclosure of a whistleblower’s identity is considered a punishable offence that can result in up to two years imprisonment, though no new offences are planned for employers failing to establish whistleblowing channels. However, the reversed burden of proof on management essentially means that if a whistleblowing framework is not in place, management’s discharge from liability may be considered void.
Retaliation or the initiation of vexatious proceedings against whistleblowers is subject to summary court proceedings and liability to pay damages and compensation. They are not subject to the cap for damages set out in the labour law. Even though the level of compensation is not regulated, it is assumed to be somewhere between several thousand euros and around €15,000.
Conclusion
Finland’s law is undoubtedly a step in the right direction, introducing sweeping improvements in protection levels for whistleblowers and bringing the country in line with the latest European protection standard. Nevertheless, it has attracted criticism, particularly due to the absence of an anonymity requirement and the lack of direct penalties against companies failing to implement whistleblowing channels.
Guide to the Introduction of Whistleblowing Systems
How to successfully implement a whistleblowing system in your organisation.
