by Sharon Oded and Jessie Steinebach

Organizations operating multinationally often tend to establish a central whistleblowing system at headquarters level, allowing employees and third parties to raise their concerns regardless of their physical location around the world. Once a report is made, the whistleblowing team would normally triage the report, assess its nature, severity, urgency, and possible adverse impact and determine next steps in handling the report. Directive (EU) 2019/1937 (“Directive”), adopted on 23 October 2019, obliges organizations operating in the EU to change this approach.

In an article we published recently in the Compliance, Ethics and Sustainability Journal,[1] we discuss a key aspect of the implementation of the Directive which many multinational organizations appear to grapple with – should multinational organizations establish local whistleblowing channels for each separate subsidiary or can they rely on a central whistleblowing channel operated at headquarters level. In our article, we present a practical design of a hybrid whistleblowing system, compromised of a central and multiple local whistleblowing channels, which may be the most optimal way forward for multinationals wanting to comply with the Directive.

1. Does the Directive oblige multinationals to set up local whistleblowing channels?

The Directive was enacted as a response to insufficient and fragmented protection of whistleblowers across the EU. It came into force on 16 December 2019 and Member States were required to implement it into their national laws by 17 December 2021.

Chapter II of the Directive sets out key obligations for multinational organizations including establishing internal whistleblowing channels, setting up procedures for following-up on internal reports, and providing clear information on external whistleblowing channels. The obligation to establish internal whistleblowing channels applies to entities in the private sector with more than 50 full-time employees (FTEs).

A controversial aspect of the Directive is whether it obliges multinationals to establish local whistleblowing channels for each separate subsidiary in their relevant jurisdictions of operation. The Directive, and in particular Article 8(1) and (3), do not expressly call for the establishment of local channels which suggests that having only a central whistleblowing channel could satisfy the requirements of the Directive.

In a response to a request for clarification made by multiple Danish companies, the European Commission explained that to satisfy the Directive, each entity of a group company employing more than 50 FTEs should set up its own local whistleblowing channel.[2] The central group-level whistleblowing channel may exist along with multiple local whistleblowing channels but having only a centrally run whistleblowing channel is not sufficient.

At least 9 Member States followed the interpretation of the European Commission when implementing the Directive and require local whistleblowing channels.[3] Other Member States followed a more literal interpretation of the Directive and allow for having only a central whistleblowing channel. As of August 2023, the European Commission has not initiated any infringement proceedings against Member States for implementing the Directive improperly. However, it is crucial to follow developments on that front. The table below depicts varying approaches adopted across the EU Member States regarding central and local whistleblowing reporting channels.

2. The hybrid whistleblowing model – a most optimal way forward?

Each organization will have to take its unique characteristics into account when designing a well-functioning whistleblowing system. Organizations such as group companies composed of subsidiaries operating in completely distinct and unrelated industries commonly favour a decentralised compliance program. They may prefer whistleblowing systems which rely more heavily on local whistleblowing channels. Conversely, organizations such as group companies composed of subsidiaries operating in similar industries which provide similar or related lines of products and services, may prefer to design whistleblowing systems which rely more heavily on a central whistleblowing channel.

Following the European Commission’s interpretation of the Whistleblower Directive, even companies preferring a more centralized design are required to establish local whistleblowing channels. For many multinational organizations, a hybrid approach may present the most sensible design.

A hybrid model is composed of a combination of a central whistleblowing channel and multiple local whistleblowing channels. Such a system may, for instance, rely on a single online whistleblowing platform, allowing reporters to share their reports through the platform, regardless of their physical location or affiliation. Yet, to meet the requirement of a local channel, the whistleblowing channel would require local tailoring. For instance, depending on the IP address of the reporter, the whistleblowing channel gives an option of switching to a local language and provides information on local external reporting possibilities.

The hybrid model we propose still gives the organization the ability to influence a reporter’s choice to use either a central or a local channel. The whistleblowing system may explicitly encourage or implicitly nudge a reporter towards one or the other channel. An explicit encouragement could be, for instance, to list circumstances in which reporting through the central channel or local channel is preferable. Implicit nudging would rely on subtle changes in the online whistleblowing platform. For example, setting the preferred channel – central or local – as a default reporting option and relying on people’s tendency to stick to default options. Importantly, when using nudging in a hybrid whistleblowing model, one must maintain ethical standards and avoid misleading or manipulating reporters into decisions which contradict their genuine will.

Conclusion

Many multinational organizations prefer following a unified approach to whistleblowing throughout the organization. In that respect, the Whistleblower Directive and the way it is being implemented in different Member States across Europe may have wider impact well beyond Europe.

The Directive requires multinational organizations operating in the EU to adapt their whistleblowing system. In particular, it seems that, at least according to the interpretation of the European Commission and some Member States, multinationals will be required to set up local whistleblowing channels. For many multinational organizations a hybrid whistleblowing model, combining central and local whistleblowing channels appear to be the most attractive. Under such a model an organization will still retain the ability to influence the reporter’s choice through information-sharing and nudging.

Footnotes

[1] Sharon Oded and Jessie Steinebach, ‘Central vs. local whistleblowing channels: Towards an Effective Implementation of the EU Whistleblower Directive in Multinational Organisations’ (2023) 4 Compliance, Ethics & Sustainability 169.

[2] European Commission, ‘Your joint letter regarding the EU Whistleblower Directive (our ref. Ares (2021) 3355262)’ (2 June 2021), available at https://www.cmshs-bloggt.de/wp-content/uploads/2021/08/Stellungname_3939215.pdf 

[3] Belgium, Czech Republic, Estonia, Ireland, Malta, the Netherlands, Poland, Romania, and Slovakia.

Sharon Oded is a Professor of Corporate Compliance and Enforcement at Erasmus University Rotterdam and a Partner at Norton Rose Fulbright LLP.  Jessie Steinebach is an Associate at Norton Rose Fulbright LLP. This post first appeared on the firm’s blog.

The views, opinions and positions expressed within all posts are those of the author(s) alone and do not represent those of the Program on Corporate Compliance and Enforcement (PCCE) or of the New York University School of Law. PCCE makes no representations as to the accuracy, completeness and validity or any statements made on this site and will not be liable any errors, omissions or representations. The copyright or this content belongs to the author(s) and any liability with regards to infringement of intellectual property rights remains with the author(s).