2024 WLG Whistleblower Guide: Finland
Is there a law to protect whistleblowers? If so, which law?
Yes, Finland has implemented the EU Whistleblowing Directive (EU) 2019/1937 with the Act on the Protection of Persons Reporting Infringements of European Union and National Law (1171/2022) (in Finnish: Laki Euroopan Unionin ja kansallisen oikeuden rikkomisesta ilmoittavien henkilöiden suojelusta). The Act came into force on January 1, 2023.
Are companies legally obliged to introduce a whistleblowing system?
Yes, the Act requires private and public organizations to introduce a whistleblowing system to report breaches of EU or national law.
If so, which companies must introduce a whistleblowing system (number of employees, turnover, sector)?
Organizations, regardless of the sector or form, which regularly employ more than 49 employees.
What forms can a whistleblowing system take (written, verbal, email, electronic tool)?
The Finnish Act does not stipulate any technical, organizational, and/or similar requirements regarding the operation of a whistleblowing system. The form of a whistleblowing system may be written or oral, and there are no requirements on whether the form is technical.
If an organization offers an option for an oral reporting, the organization must provide the option of reporting by telephone or other voice communication system and, at the request of the whistleblower, within a reasonable time at a physical meeting.
Which reports must be permitted?
Reports considering breaches or omissions of EU or national law in the areas of public procurement, financial services, prevention of money laundering and terrorist financing, product safety and compliance, road safety, environmental protection, radiation, and nuclear safety, food and feed safety and animal health and welfare, public health, consumer protection and protection of privacy and personal data and security of network and information systems, which (i) are punishable, (ii) may result in an administrative fine, or (iii) may seriously jeopardize the achievement of the public interest objectives of the legislation in question.
Must anonymous reporting be guaranteed?
No. Organizations may accept anonymous reports but are not required to do so.
Who must be able to provide information (only employees or also external third parties)?
Persons who are in an employment or service relationship with the organization that established the whistleblowing system. The organization may also allow third parties to report through the system.
Can companies rely on one centralized hotline, or is it necessary to have one hotline for each subsidiary?
The Act restricts the sharing of resources for organizations regularly employing over 249 people. This means that a Finnish organization may not permanently share resources allocated to receiving reports or carrying out investigations with another group company employing over 249 people.
Can a whistleblowing system also be operated by an external body (e.g. consultant)?
Yes, implementing a whistleblowing system can be outsourced to an external party. However, the organization remains responsible for the fulfilment of the obligations laid down in the Act.
Are sanctions imposed for failure to introduce a whistleblowing system?
No. Sanctions are set only if a whistleblower is subject to countermeasures or intentionally reports misinformation.
Yes, Finland has implemented the EU Whistleblowing Directive (EU) 2019/1937 with the Act on the Protection of Persons Reporting Infringements of European Union and National Law (1171/2022) (in Finnish: Laki Euroopan Unionin ja kansallisen oikeuden rikkomisesta ilmoittavien henkilöiden suojelusta). The Act came into force on January 1, 2023. Yes, the Act requires private and public organizations to introduce a whistleblowing system to report breaches of EU or national law. Organizations, regardless of the sector or form, which regularly employ more than 49 employees. The Finnish Act does not stipulate any technical, organizational, and/or similar requirements regarding the operation of a whistleblowing system. The form of a whistleblowing system may be written or oral, and there are no requirements on whether the form is technical. If an organization offers an option for an oral reporting, the organization must provide the option of reporting by telephone or other voice communication system and, at the request of the whistleblower, within a reasonable time at a physical meeting. Reports considering breaches or omissions of EU or national law in the areas of public procurement, financial services, prevention of money laundering and terrorist financing, product safety and compliance, road safety, environmental protection, radiation, and nuclear safety, food and feed safety and animal health and welfare, public health, consumer protection and protection of privacy and personal data and security of network and information systems, which (i) are punishable, (ii) may result in an administrative fine, or (iii) may seriously jeopardize the achievement of the public interest objectives of the legislation in question. No. Organizations may accept anonymous reports but are not required to do so. Persons who are in an employment or service relationship with the organization that established the whistleblowing system. The organization may also allow third parties to report through the system. The Act restricts the sharing of resources for organizations regularly employing over 249 people. This means that a Finnish organization may not permanently share resources allocated to receiving reports or carrying out investigations with another group company employing over 249 people. Yes, implementing a whistleblowing system can be outsourced to an external party. However, the organization remains responsible for the fulfilment of the obligations laid down in the Act. No. Sanctions are set only if a whistleblower is subject to countermeasures or intentionally reports misinformation.Is there a law to protect whistleblowers? If so, which law?
Are companies legally obliged to introduce a whistleblowing system?
If so, which companies must introduce a whistleblowing system (number of employees, turnover, sector)?
What forms can a whistleblowing system take (written, verbal, email, electronic tool)?
Which reports must be permitted?
Must anonymous reporting be guaranteed?
Who must be able to provide information (only employees or also external third parties)?
Can companies rely on one centralized hotline, or is it necessary to have one hotline for each subsidiary?
Can a whistleblowing system also be operated by an external body (e.g. consultant)?
Are sanctions imposed for failure to introduce a whistleblowing system?