How to protect personal data in whistleblowing processes?

Reporting irregularities in organizations or so-called "whistleblowing," opens up many questions with respect to the processing of personal data, including in particular whistleblowers, those affected by the whistleblowing, and witnesses.

Effective protection of information disclosed during the whistleblowing process is an important part of intra-organizational compliance procedures. Data privacy rights play a key role in the design of whistleblowing procedures, and organizations will need to be even more careful after the introduction of the General Data Protection Regulation (GDPR), especially given the high penalties for violating data privacy rights.

The EU Whistleblower Directive

From 17 December 2021, Directive 2019/1937 of the European Parliament and of the Council of 23 October 2019 on the protection of persons who report breaches of Union law (the EU Whistleblower Directive) came into force. Even though its provisions have not been implemented in the Polish national legal system, the identity of people reporting violations (like fraud, corruption or serious infringements in companies) is protected from that date. This prevents retaliatory actions (dismissals, changes in employment conditions to less favourable ones and any form of mobbing and discrimination), which would be a form of reprisal for reporting irregularities. Secure channels that allow whistleblowers to remain anonymous during the reporting as well as the handling of the reported violation is a new challenge for private companies and public entities, especially those with at least 50 employees.

Personal data in the whistleblowing process

There is no doubt that personal data will be processed during proceedings resulting from whistleblower reports. This will include not only the whistleblower's data, but also that of witnesses, the reported person and other persons whose data will be disclosed in the course of such proceedings. The employer, who will in principle be the controller of such data within the meaning of the GDPR, in order to comply with the Whistleblower Directive, need to prioritize confidentiality and protection of both the whistleblower’s identity and the contents of the disclosure, and balance this with continued adherence to their GDPR obligations. Indeed, the Whistleblower Directive explicitly contains a reminder that any processing of personal data carried out pursuant to the Whistleblower Directive must be made in accordance with the GDPR. Violations of the privacy principles may result in financial sanctions based on a percentage of the company's annual turnover.

Right to information

The employer has the obligation to inform all whistleblowers about the processing activities in connection with the reporting and the subsequent investigation process and about the protection of their data in accordance with Article 13 GDPR. Preferably, the information should be included in the established reporting channel. The right to information and the effectiveness of the investigation of breaches are seemingly at battlegrounds, especially as the personal data contained in the report may not only relate to the whistleblower and therefore result in a right to information for the accused person. Providing information to such a person early in the investigation of a report may threaten the investigation. However, in such cases, a documented and reasoned decision to postpone providing the accused with certain information may be necessary.

Data Subject Access Request

Some of the GDPR data subject rights may, however, potentially conflict with the public interest in protecting whistleblowers against the risk of retaliation for making a protected disclosure. For example, if one employee discloses information about the other employee to the employer, and later, the other employee makes a data subject access request, he/she has a right of access to their personal data, including “where personal data are not collected from the data subject, any information as to their source” which would reveal the identity of the whistleblower. The European Data Protection Board advises that if access is granted to a concerned individual, all the personal data of the whistleblower and any third parties should be redacted from those documents. Where this is not practicable, it may be possible to withhold the disclosure of an individual’s personal data on the basis that this would interfere with the rights and freedoms of another individual. This needs of course a case-by-case and country-by-country basis assessment.

Personal data principles incorporated within the whistleblowing procedure

To comply with data protection obligations, employers must therefore ensure they adhere to strict internal procedures when handling whistleblowing cases. The use of encryption technology, comprehensive data management and measures to ensure the anonymity of the reporter are integral requirements of such a system. The principles under Article 5 GDPR are of substantial importance in its enactment. Purpose limitation and data minimization will be achieved by collecting only relevant information at the initial screening stage while respecting Privacy by design and Privacy by default rules. Violation reporting channels should collect relevant data in a plain and uncluttered manner. Companies should also place a time limit on the retention of the data gathered through the hotline. An appropriately designed reporting channel with the functionality to delete data could satisfy the so-called 'right to be forgotten'. Secure data processing in line with the Whistleblower Directive and GDPR should be based on appropriate contractual provisions. These should indicate that all necessary entities, including third parties - such as infrastructure providers operating the reporting channels - must be entitled to process whistleblower data. They should guarantee the implementation of appropriate technical and organizational measures - importantly, documented for the sake of accountability, also as regards the international data transfers ensuring that any necessary data transfers are lawful (such as using standard contractual clauses).

Summary

During the protracted implementation process, businesses and organizations should not remain passive. This is the proper opportunity to design internal reporting channels that comply with complex legal requirements. The earlier the whistleblower procedure is implemented, the more it will be present in the awareness of those interested in using effective procedures to support trust building. Considering the Polish implementation announced for the first quarter of 2022, as well as a short vacatio legis period of 14 days presented in the draft, one should start the actual in-house implementation at earliest convenience. Rather than being seen as a deterrent, data protection principles should create a framework within which organisations should put in place strict guidelines with handling whistleblowing requests and assist them with ensuring individuals have the best available platform to raise concerns in their organisations.

If your organization needs assistance in developing and implementing a whistleblower procedure contact our team: privacy.warsaw@dentons.com.