EU opinion on whistleblowers

By:  Cydney Posner

You may recall that, in the past year, French and German authorities have taken issue with the implementation in their countries of the SOX requirement to maintain anonymous whistleblower reporting systems, typically hotlines. (See my postings of 8/16/05, 10/31/05 and 12/20/05.) The basis for the French decisions is that, because these systems permit anonymous accusations, these hotlines violate French privacy law. The problem in Germany was procedural in that the company apparently failed to consult with the German Works Council before implementing its code of ethics in Germany.

Now, the "Article 29 Working Party" of the European Commission has issued an opinion that would apply across the EU generally, providing guidance on how whistleblower systems can be implemented in compliance with EU data protection rules. The opinion is limited to internal whistleblowing schemes related to accounting, internal accounting controls, auditing, bribery concerns, banking and financial crime. The opinion notes the current uncertainty of the extent of the extraterritorial application of SOX to European subsidiaries of U.S. companies and to foreign private issuers in light of the recent opinion of the First Circuit that SOX provisions on the protection of whistleblowers do not apply to foreign citizens working outside the United States for foreign subs of companies otherwise required to comply with SOX. While acknowledging that whistleblowing schemes may be useful in complying with corporate governance requirements, the opinion stresses that whistleblower systems must be implemented in accordance with EU data protection rules, which seek to avoid, among other things, victimization of the person incriminated by the whistleblower. Some of the recommendations, however, include concepts such as consideration of limitations upon the number of persons who can report and be reported (?), promotion of identified and confidential, as opposed to anonymous, reports, "proportionality" and accuracy of data collected, compliance with strict data retention periods, warnings to whistleblowers that abusers of the system may face sanctions, protection of the information and other rights of the accused and notification to national data protection authorities. The opinion contends that these principles should help to assure the proper functioning of whistleblowing systems. In appropriate cases, these rights may be subject to narrow restrictions to strike the proper balance between the right to privacy and the proper goals of the system. The opinion may mean that companies with subsidiaries in the EU will be required to set up a whistleblower system in the EU that is different form the U.S. version. In addition, it is still possible that countries within the EU may have additional idiosyncratic requirements applicable to whistleblower systems.