Source: https://wbos.cz/clanek-detail/News/84/en
Timestamp: 2020-02-25 12:00:37
Document Index: 193144308

Matched Legal Cases: ['Art. 20', 'Art. 18', 'Art. 22', 'Art. 22', 'arty 29', 'arty 29', 'Art. 52', 'Art. 70', 'Art. 18', 'Art. 5', 'Art. 21', 'Art. 12', 'Art. 23', 'Art. 14', 'Art. 14', 'Art. 14', 'Art. 14', 'Art. 14', 'Art. 23', 'Art. 44', '§ 11', '§ 6', 'Art. 12', 'Art. 34', 'Art. 13', 'Art. 15', 'Art. 15', 'Art. 15', 'Art. 5', 'Art. 4', 'Art. 12', 'Art. 15']

Whistleblowers - Internal whistleblowing and GDPR
Internal whistleblowing and GDPR
One of the most demanding and confusing jobs of 2018 was to handle the implementation of EU data protection regulation GDPR at a major public institution in an EU Member State which was, for various reasons, slow to respond to this regulation and did not manage to provide the public with enough information and pass this national accompanying law by May 2018 when Big GDPR came into effect. As a result, public and private organisations which were required to complete the task of implementation, have been struggling to cope with these responsibilities. The lack of supportive information had a negative impact and proved to be capable of turning public opinion against an otherwise useful and well thought out regulation. Currently, a similar threat is looming over another EU regulation which, in spite of not being passed yet, is capable of causing more panic and fear.
How to establish internal whistleblowing channel and not to violate GDPR
One of the most demanding and confusing jobs of 2018 was to handle the implementation of EU data protection regulation GDPR[1] (further referred to as “Big GDPR”, explained below) at a major public institution in an EU Member State which was, for various reasons, slow to respond to this regulation and did not manage to provide the public with enough information and pass this national accompanying law by May 2018 when Big GDPR came into effect. As a result, public and private organisations which were required to complete the task of implementation, have been struggling to cope with these responsibilities. The lack of supportive information had a negative impact and proved to be capable of turning public opinion against an otherwise useful and well thought out regulation. Currently, a similar threat is looming over another EU regulation which, in spite of not being passed yet, is capable of causing more panic and fear.
In April 2018, the European Parliament and the Council approved the Proposal for a Directive on the protection of persons reporting on breaches of Union law (i.e. whistleblowers) (further referred to as “WB Directive”)[2]. The WB Directive is now in the legislative process (trilogue between the European Parliament, the Council and the Commission) and is expected to be approved this year. Upon approval, the Member States will be required by its Art. 20(1): “to bring into force the laws, regulations and administrative provisions necessary to comply with this Directive by 15 May 2021, at the latest. Simultaneously, complying with this directive means that the affected legal entities in the private and public sector[3] must establish internal channels and procedures for reporting of whistleblowers and following up on reports[4].
Managers in the public and private sectors and those who work in compliance are already a bit confused and point out that the lack of information can cause more public outcry. What is more, GDPR and WB Directive are going to be closely linked to each other. According to Art. 18 (and Recitals 58, 79) of the WB Directive, any processing of personal data within internal whistleblowing channels (including the process of their establishment) will have to be made in accordance with Big GDPR.
It may sound difficult but, in reality, there are already existing legislative and non-legislative tools which can be used. The only problem is that they are applicable to EU institutions or, under specific conditions, to EU companies listed in US markets and EU-based subsidiaries of US companies (see below) and not to Member States’ entities3 that are going to be affected by WB Directive. However, if carefully modified and utilised, they can serve this purpose as well.
First of all, what are these already existing tools? Let´s start with data protection regulation on EU institutional level, which, for the purpose of this article, may be called „Little GDPR“ (compare to “Big GDPR” above).
Little GDPR is already existing legal framework[5] on the protection of natural persons with regard to the processing of personal data by the Union institutions, bodies, offices and agencies and on the free movement of such data. There is a link between this „Little GDPR“ and whistleblowing because according to Art. 22a(1) of the amended Staff Regulations[6]: “any (EU) official who becomes aware of facts which give rise to a presumption of the existence of possible illegal activity, including fraud or corruption, to inform without delay either his immediate superior or his Director-General or, if he considers it useful, the Secretary-General, or the persons in equivalent positions, or the European Anti-Fraud Office (OLAF) direct”. Additionally, in Art. 22c it´s required: “that all EU institutions and bodies shall lay down internal rules covering the protection of whistleblowers and ensure confidentiality of their complaints”.
In other words, since January 2014 all EU institutions have been required to implement internal whistleblowing channels. In February 2015, the European Ombudsman Emily O'Reilly found that seven out of the nine EU institutions questioned by her office have still to comply with a “January 2014 obligations”[7]. As a result, there was an internal pressure among EU institutions to fulfil the task. European Data Protection Supervisor (further referred to as “EDPS”) which is the EU institution responsible for observation of implementation and application of Little GDPR, came to help and issued “Guidelines on processing personal information within a whistleblowing procedure”[8] (further referred to as “EDPS Guidelines”). The EDPS Guidelines provided practical guidance to the EU institutions and bodies in order to ensure that they comply with the relevant data protection obligations5.
And there is another clue. At the beginning of 2006, the growing uncertainty between the European Union and USA as to the applicability of some provisions of the Sarbanes-Oxley Act (SOX) brought about the need for clear and authoritative interpretation. The Section 301 (4) of SOX requires publicly held US companies and their EU-based affiliates, as well as non-US companies, listed in one of the US stock markets, to establish within their audit committee: “procedures for the receipt, retention and treatment of complaints received by the issuer regarding accounting, internal accounting controls or auditing matters and the confidential, anonymous submission by employees of the issuer of concerns regarding questionable accounting or auditing matters”. In addition to that, Section 806 of SOX lays down provision aimed at “ensuring the protection for employees” of publicly traded companies who provide evidence of fraud from retaliatory measures taken against them for making use of the reporting scheme. The previously mentioned uncertainty compelled the European Commission´s working group on data protection agenda (further referred to as “Working Party 29” or simply “WP29” to produce the analysis on these issues – “Opinion 1/2006 on the application of EU data protection rules to internal whistleblowing schemes in the fields of accounting, internal accounting controls, auditing matters, fight against bribery, banking and financial crime”[9] (further referred to as “Opinion 1/2006”). This analysis is of recommendatory nature and was intended to be applicable on European subsidiaries of US companies and to European companies listed in US stock markets in the then legal circumstances[10]. Opinion 1/2006 provided practical guidance to these companies in the above mentioned fields of activities in order to ensure that they comply with the relevant data protection rules1.
Although Opinion 1/2006 reflects the application practise of almost a decade before May 2018, it´s still of remarkable importance for the purpose of this article. Why? Because after Big GDPR came into effect, the Working Party 29 transformed into European Data Protection Board (further referred to as “EDPB”) which is now the EU institution, supposed to observe the application of Big GDPR in Member States´. EDPB is represented by Andrea Jellinek (Chair) and is composed of the heads of data protection supervising authorities of each Member State and of the representatives of EDPS. To put it shortly, EDPB has been established out of EDPS financial and administrative resources and even though it has independent Chair and Secretariat, it can be simply described as EDPS branch. Both institutions are located in the same building and share staff and budgetary resources. The fact that the synergy between these two institutions goes beyond standard cooperation can be evidenced by the common Memorandum of Understanding between EDPS and EDPB signed in May 2018[11]. Therefore, it´s reasonable to expect that these two key EU institutions in the field of data protection, EDPS and EDPB, will interpret and apply these data protection rules in the same way as before.
To sum up, EDPS is well-established EU institution whose tasks are firmly enshrined in Little GDPR which says in its Art. 52 (3) that EDPS is responsible for: “monitoring and ensuring the application of the provisions of Little GDPR and of any other Union act relating to the protection of the fundamental rights and freedoms of natural persons with regard to the processing of personal data by a Union institution or body, and for advising Union institutions and bodies and data subjects on all matters concerning the processing of personal data”. Undoubtedly, EDPS is the most important EU authority to oversee the interpretation and application of Little GDPR in EU institutions.
Additionally, EDPB is seemingly “newly” established EU institution (although formerly WP29) whose tasks are set out in the Art. 70 (1)(a-y) of the Big GDPR, especially: “to monitor and ensure the correct application of Big GDPR, and issue guidelines, recommendations, and best practices to facilitate the interpretation and application of Big GDPR” in affected public and private organisations in EU Member States.
And the final piece to put the jigsaw together is the fact that Little GDPR was amended in October 20185 and now bears striking resemblance to Big GDPR in regard to form and content. This means that it has more or less the same wording as Big GDPR.
Now, with this in mind, how exactly can be an internal whistleblowing channel according to WB Directive established without violating Big GDPR? From the practical point of view, it´s convenient to start with a general rule for data protection[12] which says that “the right to the protection of personal data is not an absolute right; it must be considered in relation to its function in society and be balanced against other fundamental rights, in accordance with the principle of proportionality”. That means to strike a balance between personal data rules and e.g. respect for private and family life, the right to an effective remedy and to a fair trial[13]. Using this rule would help to overcome procedural weaknesses and loopholes that are likely to emerge during the process of establishing internal whistleblowing channels. However, it must be borne in mind that recitals (unlike articles) don´t have legally binding effects and more or less serve as interpretational clues.
Provided the confidentiality of the whistleblower´s identity is ensured, it is up to each individual affected organisation to define the kind of internal channel to set up, such as in person, by post, by physical complaint box, by telephone hotline or through an online platform. Moreover, it´s the responsibility of the organisation to appoint the most appropriate persons or departments to be designated as competent to receive and follow up on complaints (further referred to as “designated person”)[14]. Their employer should ensure their independence and the absence of conflicts of interest. However, considering their dependency on the employer, this might be a rather difficult goal to achieve. The designated person might be subject to a reinforced obligation of secrecy, but it wouldn´t guarantee his independence if the whistleblower´s complaint was aimed at members of management (see “Fairness”). The internal whistleblowing channel must be separate from ordinary public complaints systems, must be user-friendly, and must allow for written and oral, as well as electronic and non-electronic reporting[15].
Third parties may also be authorised to receive complaints on behalf of affected private and public organisations, provided they offer appropriate guarantees of respect for independence, confidentiality, data protection and secrecy[16].
As mentioned at the beginning of this article the Art. 18 of the WB Directive says that: “any processing of personal data, including the exchange or transmission of such data, shall comply with the rules established by Regulation (EU) 2016/6791, Directive (EU) 2016/680 and Regulation (EC) 45/20015”. This provision is fortified by Recital 79 of the WB Directive which reiterates the need for compliance with Big GDPR; and particular regard should be taken to the principles relating to the processing of personal data set out in its Art. 5 (1):
a) Lawfulness, fairness and transparency
b) Purpose limitation
c) Data minimisation
f) Integrity and confidentiality.
Ad a) Lawfulness: generally, lawfulness of personal data processing means that you must have a valid lawful basis in order to process personal data. There are six available lawful basis for processing under Big GDPR[17]. Given the sensitive nature of information disposed of within internal whistleblowing channels, the lawful basis of data processing must be very carefully considered. The context of different procedural standings of persons involved in whistleblowing procedure which may have different procedural consequences should be also considered when determining a lawful basis. For that reason and with respect to requirements of fair trial, it´s highly recommended to use a different lawful basis for each person involved in whistleblowing procedure.
The most appropriate lawful basis for processing the personal data whistleblowers seems to be consent. The voluntary act of a whistleblower, making a disclosure and submitting a complaint of wrongdoing, means that consent should not be a problem to obtain because it´s indirectly implicated in such an act. Moreover, if the whistleblower´s personal data is being processed under this lawful basis, he is entitled to withdraw his consent at any time during this process[18]. In this case the designated person should immediately stop using whistleblower´s personal data, which means that upon withdrawal, he would have to stop investigating the complaint. Since it´s the whistleblower who bears the biggest risk of being persecuted and facing retaliation, it seems to be fair to give him such a broad power to stop the procedure when he feels threatened. Although, on the other hand, the employer should also guarantee that the withdrawal is not abused by whistleblowers. Especially in cases when a complaint was of malicious and defamatory nature and the investigation is about to discover the truth. The settings of the internal whistleblowing procedure should be prepared for these eventualities. In these cases the employer should engage other legal possibilities, e.g. disciplinary proceedings, just to show that abuse of the internal whistleblowing channel will not be tolerated.
Bearing in mind different procedural standings of persons involved, the most appropriate lawful basis for processing the personal data of accused persons and third persons[19] should be the legitimate interests of the employer. After all, the existence of a whistleblower´s complaint suggests that there is something wrong inside the organisation and therefore it is in the employer´s interest to find out the truth and take appropriate action – and protect persons who are accused or mentioned in a complaint while investigating. Thus, using this lawful basis means that the employer will take on extra responsibilities and, considering the general rule12, the employer´s legitimate interests should be balanced against the interests, rights and freedoms of accused persons and third persons, e.g. their right to privacy, their right to an effective remedy and especially to a fair trial.
Similar to the special benefit of a whistleblower´s ability to affect the whistleblowing procedure by withdrawing his consent (above), accused persons and third persons are entitled to raise an objection[20]. Such an objection against the processing of their personal data would enable them to protect themselves and affect the procedure in their favour. Upon raising an objection, the employer must stop processing personal data of the accused persons and third persons which means that the designated person has to stop investigating the complaint. Considering the procedural standings of the accused and third persons, the basis of their objections is likely to be linked to the fear of stigmatisation and victimisation at the workplace, and also to medialisation (let alone criminalisation) especially in cases when a complaint is aimed at a member of management. When dealing with the objection the employer must carry out a balancing exercise based on principles of proportionality and fairness[21], and according to Art. 21(1) of the Big GDPR he must “demonstrate compelling legitimate grounds for the processing which override the interests, rights and freedoms of the data subject.”. When demonstrating these legitimate grounds he should also sufficiently dispel the mentioned fears by explaining and assuring the accused and third persons that their personal data is strictly protected against any disclosure. Depending on the outcome of the exercise, the designated person is either allowed to carry on the investigation or has to delete the personal data in question. On the other hand, the settings of the internal whistleblowing procedure should also be prepared for the eventual abuse of this remedy; whether it be by the accused and third person or the employer himself (such as when he might be tempted to influence the investigation in favour of a member of management). In this case, the designated person is entitled to reject the objection when it is manifestly unfounded or excessive (in particular because of its repetitive character)[22]. But this scenario can happen only if the accused and third persons were informed about the fact that a whistleblower´s complaint has been submitted and contains allegations against them.
The rights of a whistleblower and accused or third persons to be provided with all necessary information relating to their status as data subjects are quoted in Art. 12-22 and 34 of the Big GDPR[23]. However, being transparent towards the accused and third persons while also protecting the whistleblower at the same time is the most sensitive issue on the part of the employer. Therefore, the designated person must apply these provisions restrictively, on a case-by-case basis. He must consider the balance between the obligation to provide those involved with necessary information and the obligation to protect the data subject or the rights and freedoms of others (here whistleblower, the accused and third persons). In justified cases, he can refuse to provide particular information in compliance with Art. 23(1)(i) of the Big GDPR and corresponding legislative measure, usually the data protection law of the Member State in question[24].
For example, according to Art. 14(3)(a) of the Big GDPR the designated person should inform the accused and third persons that the whistleblower´s complaint has been submitted “within a reasonable period after obtaining the personal data, but at the latest within one month” and provide them with all relevant information quoted in Art. 14(1-2). Whereas some of this information is already known to them and therefore can be refused by Art. 14(5)(a) as unnecessary, within it also lies the obligation to provide information about the source, i.e. the whistleblower[25]. Disclosing the identity of the whistleblower would directly contravene the most guarded principle that “under no circumstances can the person accused in a whistleblower’s report obtain information about the identity of the whistleblower”. Therefore, the reasonable designated person must refuse to provide this information
by referring to the exemptions in Big GDPR itself; specifically in this context, in Art. 14(5)(b) of the Big GDPR: “when the obligation is likely to render impossible or seriously impair the achievement of the objectives of that processing” or (and) in Art. 14(5)(d) of the Big GDPR containing the reference to “the obligation of secrecy”, and
by referring to the exemptions within the respective “national laws” of Member States, as permitted by Art. 23 (1)(i) of the Big GDPR, including e.g. Art. 44 (4)(a)(e) of the Data Protection Act 2018 (UK) or § 11 and § 6(2) of the Law on Processing of Personal Data (Czech Republic)24.
Referring to the general rule for data protection12 could be also helpful but, as previously explained, the recitals (unlike articles) don´t have legally binding effect and serve more or less as interpretational clues.
Similarly, the designated person should apply this approach to the rest of “the information rights” in Art. 12-22 and Art. 34 of the Big GDPR. Providing the whistleblower with information in Art. 13 (1-2) immediately upon submission of a complaint would be beneficial to him and wouldn´t pose a threat to the rights and freedoms of others or jeopardise due process. The right to raise an SAR (Subject Access Request) in Art. 15 by the accused or third persons represents, however, the direct threat of disclosure of the whistleblower´s identity. Thus, the designated person must treat Art. 15(1)(g)[26] and Art. 15(3) with utmost care and caution and therefore refuse SAR´s. Even though the whistleblower´s identity would be pseudonymised32 by this time and kept separately from the Database of Complaints, indirect identification could still be very likely.
Of course, one may argue, that there is a more fitting lawful basis available under the same Big GDPR provision17, a legal obligation, coming from either already effective but fragmented whistleblowing law in Member States or a law which is going to be transposed by a Member State after WB Directive is adopted. This scenario has several procedural disadvantages, especially that the processing under this legal basis would not allow to recognise different procedural standings of a whistleblower and other person´s involved in whistleblowing procedure. It means, there would not be any right to withdrawal or right to raise objection as previously mentioned but just the application of this lawful basis in general. Thus, the whistleblower, accused and third persons would lose control over their own personal data in form of remedial options – withdrawal of consent and right to raise an objection. Therefore, bearing in mind already mentioned right to fair trial13 it seems that to use different legal basis for each person in whistleblowing procedure (see above) is more fair.
Fairness: to process personal data within internal whistleblowing channel in a fair manner means that an employer must not process the data in a way that is unduly detrimental, unexpected or misleading to the individuals concerned. If we stick to impartiality and objectiveness, it seems that the best way to achieve fairness in this context would be to let it be done by an external body (such as a legal firm, NGO, specialised agency or trained individual). It´s quite hard to imagine e.g. Internal Audit or Human Resources, which are part of employer´s hierarchy, to be completely impartial and objective in order to guarantee confidentiality and security of the channels (see “security principle” below). The details of the relationship between an employer and external organisation would have to be stipulated in a data processing agreement in advance.
Transparency: employers must be transparent and explicit about how they process the personal information within whistleblowing procedures. In order to achieve that they should inform their employees about the existence, purpose and functioning of the internal whistleblowing channel, preferably by posting it on the Intranet[27]. What should be highlighted is the extent of protection of whistleblower´s identity and its confidential treatment throughout the whole process, but also the treatment of malicious and defamatory complaints (emphasizing legal and internal consequences) in order to discourage misuse of internal whistleblowing (e.g. in case of a toxic workplace).
Ad b) Purpose limitation: personal data must be collected only for specified, explicit and legitimate purposes. In order not to narrow the purpose for processing of personal data within internal whistleblowing channel down too much, the purpose in this case should be “ensuring proper corporate governance[28]”. When facts reported through a whistleblowing channel do not relate to this purpose, they should be forwarded to either the more relevant employer´s branch (e.g. ethics officers) or to the Police, the Public Prosecutor´s Office or must be deleted. The employer should communicate the purpose by, preferably, posting it on the Intranet. However, placing the purpose only on the Intranet could be overlooked by employees, therefore the whistleblower, accused and third persons should be informed by the designated person, for example by e-mail (see Lawfulness).
Ad c) Data minimisation: the employer must ensure that the personal data he is processing through internal whistleblowing channels is adequate (with respect to “proper corporate governance”), relevant (with a rational link to that purpose) and limited to what is necessary (he does not hold more than he needs for that purpose). In other words, the data collected and processed through internal whistleblowing channels should be limited to personal data the designated person needs to duly investigate and prove the allegations from the complaint.
Ad d) Accuracy: every employer should take all reasonable steps to ensure the personal data he holds in regard with operation of internal whistleblowing channel is not incorrect or misleading as to any matter of fact and is updated. Otherwise he must take reasonable steps to correct or delete it as soon as possible[29]. However, it should be noted that accuracy of personal data in relation to dealings with whistleblowing complaints will be the natural part of the duties of the designated person who should verify all the personal data he receives when investigating the circumstances of a respective case.
Ad e) Storage limitation: in general, the rule is that personal data should not be kept for any longer than is necessary for the given purpose, i.e. to ensure proper corporate governance. The WB Directive doesn´t specify any period of time, apart from the reference to reasonable timeframe in Art. 5(1)(d), leaving it to Member States to determine this in their national law. More accurate clue is provided by Opinion 1/2006[30] which says that personal data processed within internal whistleblowing channel should be deleted within 2 months of completion of the investigation of the facts alleged in the complaint. Such a period would be different if there are any follow up proceedings or disciplinary measures against the whistleblower or accused and third persons. In such cases, personal data should be kept until the end of these proceedings (including proceedings before an appellate authority).
Ad f) Integrity and confidentiality: undoubtedly, the most important data protection principle from the whistleblower´s perspective. This is also known as “the security principle”. Building trust among employees should begin by providing them with clear and easily accessible information regarding the procedures and information on how and under what conditions complaints can be made, preferably on the Intranet. Essentially, the most effective way to encourage staff to report concerns is to assure them that their identity will be protected. In order to ensure that, the employer must implement appropriate technical (e.g. encryption, pseudonymisation) and organisational measures (e.g. access and log management, reinforced obligation of secrecy etc.) which is the legal obligation coming straight from WB Directive and Big GDPR[31]. However, since there is a risk of stigmatisation, victimisation (and let alone criminalisation) of the accused and third persons, appropriate measures should be applied to their personal data as well. Of course, the protection of a whistleblower´s identity remains the top priority.
For that reason, a whistleblower´s identity should be pseudonymised[32] upon submission of a complaint which means that his identity is automatically replaced by different information (e.g. pseudonym, code) and kept separately from the rest of the complaint (which, together with evidence and other supplementary documents, should be stored in the Database of Complaints) in order to prevent his direct identification. At the same moment, the whistleblower should receive all necessary information[33] from the designated person.
However, the indirect identification of a whistleblower might still be possible because of a multitude of interconnections within the body of the information from the complaint. Indirect identification could be prevented (or at least significantly reduced) by introducing a strict Access Management internal policy (i.e. preventing access to non-authorized staff members)[34], listing only authorised persons who are allowed to have access to the Database of Complaints on a need-to-know basis (naturally designated person and other persons after careful consideration). The Access Management should be guarded and evidenced by another internal policy in the form of Log Management, which registers and saves details of everyone who accessed the Database of Complaints.
What is very important here is that to achieve the maximum level of confidentiality within whistleblowing procedures, the internal whistleblowing channel should be operated separately from not only ordinary public complaints systems but also from organisational filing systems (e.g. document control system AthenA). The access of internal and external auditors to the separate storage of whistleblower´s identities and to the Database of Complaints should be restricted even though there is a special arrangement (e.g. Non-Disclosure Agreement) concluded between the employer and these auditors.
The building of an internal whistleblowing channel in compliance with this security principle is likely to be the most demanding one. Therefore, an engagement of specialised and highly trained employees like a Data Protection Officer[35], who is in charge of internal dealings with personal data and a Cyber Security Manager[36], who is in charge of security of internal IT networks and information systems, is a must or at least highly recommended. Every private or public organisation that is going to be affected by WB Directive should already have these officers prepared at this point.
Whistleblowing in Digital Age
While micro and small companies are mostly exempted[37] from the obligation to establish internal whistleblowing channels, it´s already been recognised by representatives of the business sector that WB Directive is going to bring a lot of controversy and uncertainty to mid-size and larger private organizations[38]. This is in spite of the fact that the costs of implementation of such internal whistleblowing channels are expected not to be significant, and even with the benefits in terms of increasing business performance and reducing distortions to competition appearing to be substantial[39]. Undoubtedly, a similar impact is going to be felt by the affected public sector institutions as well. How can these inevitable controversies and uncertainties, at least those ones relating to data protection, be reduced to a minimum?
Based on what has been said at the beginning of this article about the negative consequences of the lack of supportive information, the safe way out of these difficulties might be not to pioneer new approaches to this agenda but rather to use already existing tools. They exist as guidance for the EU institutions, bodies, offices and agencies (see Little GDPR and EDPS Guidelines) or recommendation for limited group of private companies (see Opinion 1/2006) and if the legal approaches and patterns in them are modified and adapted, they can conveniently serve the purpose of building internal whistleblowing channels in affected organisations on a Members State´s level as well. Especially with regard to the fact that the authors of these tools (EDPB and EDPS and EU Parliament) happen to be the “institutional watchdogs”, overseeing the correct application of more or less the same data protection rules applied to EU institutions and Member States. This approach is capable of bringing about desirable outcomes from WB Directive – to implement functional internal whistleblowing not only in a correct manner but also in compliance with up-to-date personal data protection. Weaving together new requirements for whistleblowing2, data protection1 and also cyber security36 could make internal whistleblowing procedures equally safe, secure and confidential for all parties concerned. This also help to create a well-balanced tool which, if respected, can benefit both sides: employer and employees. And, most importantly, it shall give rise to modern whistleblowing in the digital age.
[2] https://eur-lex.europa.eu/legal-content/EN/TXT/?uri=celex%3A52018PC0218.
[3] According to Art. 4 (3)(6) of the WB Directive these include: “private legal entities with 50 or more employees, private legal entities with an annual business turnover or annual balance sheet total of EUR 10 million or more, private legal entities of any size operating in the area of financial services or vulnerable to money laundering or terrorist financing, and state administration, regional administration and departments, municipalities with more than 10 000 inhabitants and other entities governed by public law.”.
[4] „Detailed explanation of the specific provisions” of the WB Directive, p.11: „it requires that reporting channels guarantee the confidentiality of the identity of the reporting person......it also requires that the person or department competent to receive the report diligently follows it up and informs the reporting person within a reasonable timeframe about such follow up.”.
[5] Primarily Regulation (EC) No 45/2001, recently replaced by the Regulation (EU) 2018/1725 of the European Parliament and of the Council of 23 October 2018 on the protection of natural persons with regard to the processing of personal data by the Union institutions, bodies, offices and agencies and on the free movement of such data, and repealing Regulation (EC) No 45/2001 and Decision No 1247/2002/ECText with EEA relevance.
[6] Council Regulation (EC, Euratom) No 723/200424 amended the Staff Regulations, i.e. to put in place procedures for reporting any fraud, corruption or serious irregularity, and provide protection to EU staff reporting on breaches from adverse consequences.
[7] https://www.ombudsman.europa.eu/en/press-release/en/59135.
[8] https://edps.europa.eu/sites/edp/files/publication/16-07-18_whistleblowing_guidelines_en.pdf.
[9] https://ec.europa.eu/justice/article-29/documentation/opinion-recommendation/files/2006/wp117_en.pdf
[10] Opinion 1/2006, p. 5, “II. Justification for the limited scope of the opinion“.
[11] https://edpb.europa.eu/news/news/2018/memorandum-understanding_en.
[12] Recital 4 of the Big GDPR.
[13] http://www.europarl.europa.eu/charter/pdf/text_en.pdf.
[14] Article 5 (1)(b), 5(2) and 5(3) of the WB Directive.
[15] Article 5 (2)(a-b) and Recitals 42, 45 and 52 of the WB Directive.
[16] Recital 43 of the WB Directive.
[17] Article 6 (1) of the Big GDPR recognises six lawful basis for processing: consent, contract, legal obligation,
vital interests, public task and legitimate interests.
[18] Article 7 (3) of the Big GDPR.
[19] For the use of this article “third persons” include persons who are familiar with the case and are aware of the submission of whistleblower´s complaint and are willing to testify (i.e. witnesses); other persons from inside or outside of the workplace, mentioned in a complaint who may be familiar with the case but are not aware of the submission of whistleblower´s complaint.
[20] Article 21 (1) of the Big GDPR.
[21] https://www.law.kuleuven.be/citip/blog/balancing-in-the-gdpr-legitimate-interests-v-right-to-object/.
[22] Article 12 (5)(b) of the Big GDPR.
[23] Chapter III, Rights of the data subject, Art. 12 (1) of the Big GDPR states that: “The controller shall take appropriate measures to provide any information referred to in Articles 13 and 14 and any communication under Articles 15 to 22 and 34 relating to processing to the data subject in a concise, transparent, intelligible and easily accessible form, using clear and plain language.”.
[24] With careful consideration of Article 3 of the Big GDPR and EDPB Guidelines: https://edpb.europa.eu/sites/edpb/files/consultation/edpb_guidelines_3_2018_territorial_scope_en.pdf
these can encompass e.g. Data Protection Act 2018 (UK) or LOI n° 2018-493 du 20 juin 2018 relative à la protection des données personnelles (France), or Law on Processing of Personal Data (Czech Republic).
[25] Article 14 (2)(f) of the Big GDPR: „information from which source the personal data originate, and if applicable, whether it came from publicly accessible sources.“.
[26] Art. 15 (1)(g) obliges an employer to provide “the access to the personal data concerning him or her and where the personal data are not collected from the data subject, any available information as to their source.“.
[27] Article 5 (1)(e) of the WB Directive, Opinion 1/2006, p. 13(3) and EDPS Guidelines (18).
[28] Opinion 1/2006, p. 12(iv) and EDPS Guidelines (10-12).
[29] EDPS Guidelines (13).
[30] Opinion 1/2006, p. 12(v) and EDPS Guidelines (27-31).
[31] Article 5 (1)(a) of the WB Directive and Article 24 (1-3), Article 25 (1-3), Article 32 (1) of the Big GDPR and EDPS Guidelines (32-34).
[32]Article 4 (5), Article 25 (1), Article 32 (1)(a) and Recitals 26 – 28 of the Big GDPR.
[33] Article 13 (1-2) of the Big GDPR and EDPS Guidelines (18-19).
[34] Article 5 (1)(a) of the WB Directive and EDPS Guidelines (23-25).
[35] Articles 37 - 39 of the Big GDPR.
[36] For example the Czech Law No. 181/2014 Coll., on Cyber Security and general cyber security requirements
Resulting from EU Commission policy https://ec.europa.eu/digital-single-market/en/cyber-security.
[37] Recital 38-39 of the WB Directive.
[38]http://www.mondaq.com/x/767928/Whistleblowing/How+Companies+Can+Prepare+For+New+Directive+Pr
otecting+Whistleblowers.
[39]WB Directive, Proportionality p.6 and Impact Assessment p.8.