New requirements to set up reporting channels to protect whistleblowers

To implement the new EU directive on the protection of whistleblowers, the Swedish government has introduced a draft bill that will change the current requirements on the protection of whistleblowers.

While there is currently no general obligation for companies to establish internal or external reporting channels, there are industry-specific requirements for reporting channels. Due to the #metoo movement, several companies have also set up reporting channels on a voluntary basis. With the new draft bill, it will be a requirement for many companies to set up internal reporting channels. Furthermore, companies who have already established reporting channels will have new obligations to comply with.

All larger companies must set up internal reporting channels

Pursuant to the draft bill, companies with 50 or more employees must set up internal reporting channels and procedures for reporting and follow-up. Companies must also designate impartial persons or departments for managing the reporting channel and follow-up. Authorized persons can either be employees within the company, or the company can hire another party to be responsible for the channel. However, it is a requirement that authorized persons have a certain degree of independence and autonomy in their position. For example, the person must be qualified to assess the information provided in a report and have mandate to initiate investigations regarding its content.

In accordance with the draft bill, reporting channels must be easily accessible. Employees must have the possibility to report misconduct both in writing and orally. Also, companies must confirm receipt of a report to the whistleblower within seven days. Feedback and follow-up must be conducted within three months from confirmation of receipt or, if no confirmation has been made, within seven days from receiving the report.

The new draft bill has been set to enter into force on 1 December 2021. However, the requirement to set up internal reporting channels will apply from 1 December 2023 for companies who have 50 to 249 employees. For the remaining employers who will be obligated to set up internal reporting channels, the requirement will apply from 1 July 2022.

Don’t forget GDPR

As reports on misconduct often contain sensitive information about both the company and its employees, reporting channels must be able to securely handle the reports. Both written and oral reports must be retained safely so that documentation for example can be used as evidence in subsequent court proceedings. However, reports must be deleted no later than two years after completing a follow-up. During the retention period, only a limited group of people should have access to the reports.

IUNOs opinion

As a positive consequence of the #metoo movement, many companies in Sweden have already established channels for reporting. With the draft bill however, companies should in any case prepare to meet the new and more restrictive requirements.

IUNO therefore recommends that companies review their options for establishing easily accessible systems where all employees can report misconduct at the workplace. Further, companies should evaluate whether there are employees or departments within the company who can be responsible for managing the reporting channel. Alternatively, companies can consider using an external party.

Read more about how IUNO can help your company with all aspects of whistleblower-hotlines here.

[Increased protection for whistleblowers, SOU 2020:38 of 29 June 2020]