The European Commission Expert Group’s Requirement for Local Hotlines May Undermine Whistleblower Protection

The European Commission Expert Group (ECEG) has stated that the Directive on the protection of persons who report breaches of Union law (the “Directive”) requires multinational organizations to offer local entity level reporting channels alongside their central whistleblowing hotlines. The statement has been causing quite a stir given that most multinational organizations currently operate centrally run hotlines. The ECEG’s position appears to be based on the belief that local hotlines will be more accessible and impartial. However, that is not necessarily the case because:

a) Not only can centrally run hotlines be just as accessible as locally run hotlines but in most cases they already function as local hotlines; and

b) The ECEG’s interpretation imposes new requirements that go beyond the Directive, which can actually increase the chances of concerns not being investigated properly and whistleblowers fearing and experiencing retaliation.

Background

There is just over a month to go until the December 17, 2021 deadline for EU Member States to implement the Directive. As multinationals grapple with compliance, the ECEG opined in the minutes of the fifth meeting of the ECEG on the Directive on June 14, 2021 that it would be “an incorrect transposition of the Directive” if Member States were to allow corporate groups to rely solely on centralized whistleblowing reporting channels at group level. If this opinion is adopted into Member State law, it will impose an unnecessary burden on multinational organizations that is also contrary to the Directive.

Denmark and Sweden are currently the only countries to have adopted their own implementing whistleblowing laws. In contrast to the ECEG’s opinion, they have each legislated for centrally run hotlines. The Danish legislators have included a caveat that this provision may be repealed if the Danish interpretation is incompatible with the EU’s and Member States’ positions. The European Commission may bring infringement proceedings against Member States if it believes that the Directive has not been properly implemented. However, if proceedings occur, it will be up to the Court of Justice of the European Union to have the final say. Draft laws in other countries currently paint a patchwork of approaches. You can follow the developments in our Whistleblowing Resource Center.

How do hotlines actually work?

Effective whistleblowing hotlines generally consist of an online platform and telephone-based reporting channels that are made available to the entire group. These hotlines are often outsourced to a third-party service provider.

Once a hotline receives a report, it is normally escalated to a designated contact within the organization who is sufficiently independent from the issue at hand to investigate whistleblowers’ concerns and take appropriate actions (e.g., the group’s dedicated compliance department).

Centrally run channels can then triage reports and decide at the central level whether the report may be investigated at the local level without a risk of retaliation or conflict of interest, or if third parties or another affiliate should be involved instead.

Four reasons why the ECEG’s arguments for local hotlines do not hold water

Below we explain why the ECEG’s interpretation of the Directive should not be adopted by Member States:

1. Centrally run hotlines are just as accessible as and already are local hotlines

The ECEG’s interpretation of Article 8(3) of the Directive is that it requires each legal entity in the private sector (with 50 or more workers) to establish channels and procedures for internal reporting and there is no exemption for legal entities belonging to the same corporate group. The ECEG further argues that hotlines are required to be set up at the local entity level (in addition to any centrally run hotlines), to ensure that they are accessible to all whistleblowers (whether internal or external). The ECEG concedes that the Directive does not include any provision stating that centrally run hotlines must be shut down where they exist; however, the ECEG does insist that local hotlines are required in addition to any centrally run channels. The ECEG does not elaborate on what the “local” hotlines should look like.

We note that centrally run hotlines can be just as accessible to whistleblowers as locally run hotlines. Due to the widespread use of third-party service providers to operate hotlines, a local hotline will likely be indistinguishable to users from a centrally run hotline. Third-party service providers offer access to 24/7 local phone lines as well as other communication channels in multiple languages, run by trained personnel, and covering all of the local entities where the group operates. In our view, this means that these centrally run hotlines are already local.

In any event, the Directive does not require that organizations need to maintain a segregated local hotline for each legal entity employing 50 or more employees, and the ECEG does not provide any rationale for this interpretation besides stating, “where to report must remain a judgment call of the whistleblowers.” Maintaining duplicative hotlines at the local and group levels may well result in unnecessary administrative, organizational, and financial burdens on organizations, with no tangible benefit to internal or external whistleblowers. Furthermore, there is an unhelpful lack of detail in the minutes as to how organizations are expected to comply, in practice, with the ECEG reading of the Directive.

It is of real concern that, if organizations are now required to set up locally run hotlines, some may well choose to no longer maintain their centrally run hotline channels. This may ultimately prove detrimental to protection of workers in the EU, as centrally run hotlines are, as a rule, made available to all group entities, therefore also to those with fewer than 50 workers (that are exempted under the Directive).

2. Centrally run hotlines are impartial and free of conflicts of interest

The ECEG also argues that local hotlines must be made available to whistleblowers because “an impartial person or department must be designated in the legal entity with which the whistleblower has a work-related relationship to follow up on the report, give feedback and maintain communication with the whistleblower.”

It is not clear whether “work-related relationship” is intended to refer to a direct employment/engagement relationship at local level or something broader. The Directive does not mention this requirement, and we cannot think of any overriding benefits to mandating it. On the contrary – we see disadvantages.

Issues raised through hotlines are often more appropriately investigated elsewhere (such as at the parent level), where additional resources can be made available and impartial investigators dispatched to work either remotely or onsite, or however the situation requires. There is often less risk of actual or perceived retaliation than if the matter is managed at the local entity level. Centrally run hotlines offer this flexibility, and this would be much harder to achieve if separate hotlines were to be managed and run locally. The minutes note that one Member State made this argument, but it seems that the ECEG was not convinced.

3. Legal entities in a corporate group should be able to benefit from shared group resources and share information about reports that impact multiple group entities

Article 8(6) of the Directive expressly allows legal entities with 50–249 workers to share resources for receiving and investigating reports. This provision was drafted to resolve a specific concern raised by Belgium that the threshold for legal entities to set up a hotline should be raised to 250 workers instead of 50 workers. The Directive is unfortunately silent on resource sharing for larger entities and we cannot say whether this was an oversight or whether there was another reason for the chosen language. It is unclear from the trilogue process as to whether or why entities of 250 and more workers should be excluded from the provisions on resource sharing.

The ECEG, however, argues that Article 8(6) permits an affiliate to benefit from the resources of its parent company if, among other conditions: (i) hotlines are also available at the local entity level and (ii) all follow-up measures are taken at the local entity level. This interpretation goes beyond the language of Article 8(6), which explicitly allows sharing of resources for entities with 50–249 workers and does not impose any such conditions on the sharing.

Considering how currently operating centrally run hotlines are set up (with local phone lines available as well as other communication channels in multiple languages, easily accessible by potential whistleblowers in all relevant jurisdictions, and run by well-trained and impartial personnel), we argue that centrally run hotlines already are local hotlines.

The ECEG finally states that when “structural problems” affect more than one legal entity in a group (and the local entity cannot effectively address the problem), information about the report may only be shared with other affiliates with the consent of the whistleblower. If the whistleblower does not consent, the whistleblower may withdraw their report and issue a report to a Member State authority. Not only is this requirement not included in the Directive, there is a real danger that this would prevent serious reports that affect multiple entities in a corporate group from being investigated effectively (for example, if the Member State authority concluded the issue was minor).

4. Centrally run hotlines can easily cater to differences across Member States

Because the Directive may be implemented in different ways across Member States, the ECEG opines that centrally run hotlines will not be feasible. However, for many global organizations, hotlines dealing with a myriad of local requirements are nothing new. Global organizations have successfully been operating centrally run hotlines since the adoption of the U.S. Sarbanes-Oxley Act of 2002, in ways that generally maintain impartiality and confidentiality, and cover their affiliates around the globe (without the need for separate local hotlines).

In conclusion, we do not recommend that Member States implement the ECEG position into their national laws. By mandating locally managed hotlines, multinational organizations would effectively be prevented from sharing resources and addressing issues that impact their organization across borders. This dual hotline approach would also result in unnecessary financial burdens on organizations without any clear additional benefits. Requiring segregated local hotlines may compromise the impartiality and confidentiality of investigations, and increase the risk of actual and perceived threats of retaliation at the local level.