Whistleblower system centralized or decentralized, what should be considered?

The European Commission published interpretative guidance on the EU Whistleblower Directive in June 2021. According to this, subsidiaries of groups of companies with 250 or more employees must in principle also have their own internal reporting channels and resources available for case processing. We can help you find out what needs to be taken into account.

The most important points at a glance

  • The European Commission published interpretative guidance on the EU Whistleblower Directive in June 2021. According to this, subsidiaries of groups of companies with 250 or more employees must in principle also have their own internal reporting channels and resources for case processing.
  • Flexible solutions are to apply under certain conditions to subsidiaries with 50 to 249 employees.
  • With our Hintbox multi-client capability, parent companies and subsidiaries can meet these requirements by providing their own internal reporting channels for the whistleblowing system. You can also restrict and control employee access rights for case processing.

What were the European Commission's comments about?

The European Commission issued opinions in two letters on June 2, 2021, and June 29, 2021, on the interpretation of whistleblower system structures in corporate groups and entities. The two opinions concerned interpretations of the EU Whistleblower Directive 2019/1937, which must be transposed into national law by December 17, 2021.

According to the EU Commission's letters, several companies from Denmark and other European countries have contacted the Commission or the Commission's Expert Group for the Whistleblower Directive and expressed their concerns about the decentralization of whistleblowing systems in corporate groups. Larger corporations and groups of companies often have a centralized compliance structure. Subsidiaries of corporate groups draw on the personnel competencies and resources of the parent companies.

In its two opinions, the Commission stated that Art. 8(3) of the Whistleblower Directive leaves no room for interpretation. According to this, every legal entity under private law with 50 or more employees must set up internal reporting channels as well as procedures for internal reports and for follow-up measures. According to the Commission's Expert Group, this also applies to legal entities belonging to a group of companies. Any other interpretation would be contra legem.

The Commission concludes that both the parent company and each subsidiary (with 50 or more employees) must implement their own whistleblower system.

Flexible solutions for medium-sized companies

The EU Commission refers to Art. 8 (6) of the EU Whistleblower Directive. According to this, legal entities in the private sector with 50 to 249 employees may share resources for the receipt of reports and for investigations that may be carried out.

Nevertheless, the medium-sized company would still be responsible for reporting back, maintaining confidentiality and implementing follow-up measures. In the Commission's view, it is compatible with the Whistleblower Directive for a subsidiary to use the resources of a central compliance department of a parent company if the subsidiary has 50 to 249 employees and the subsidiary provides its own reporting channels for reports.

In addition, the whistleblower must be informed that the central compliance department (e.g. the Group Compliance Officer) is accessing the report. Furthermore, the whistleblower must have the right to object to central access and may demand that the report be processed exclusively by the subsidiary. The subsidiary must also provide feedback, among other things.

Implementation of a dedicated whistleblower system by major subsidiaries

According to the statement, subsidiaries with more than 249 employees should establish their own internal reporting channels. The same also applies to the corresponding resources for processing reports of compliance violations.

Implement these requirements with multi-client capability as well

Regardless of further developments in national whistleblower protection laws, including the question of a centralized, decentralized or hybrid whistleblowing system within a corporate group, all requirements can be implemented quickly and easily with Hintbox. Via the multi-client capability of our digital whistleblowing system, both the parent company and the subsidiaries can each offer their own internal reporting channels.

Behind the multi-client capability feature is a technical separation and authorization concept. This allows individual access by persons/departments to cases from different companies to be controlled and managed. Only the compliance officers then have access to the cases of their subsidiaries via the Hintbox dashboard.

Furthermore, all requirements of the Commission regarding the information to be provided to the whistleblower can be easily implemented with the Hintbox. All legal texts and the data protection notices can be customized individually and very easily.