Whistleblower Reporting Channels
Reporting channels should ensure that whistleblower’s identity will be kept confidential
Organizations must implement internal reporting channels, which should ensure that whistleblower’s identity will be kept confidential, it is up to each individual legal entity to define the kind of reporting channels they wish to establish. According to the Directive, these reporting channels should enable a person to report in:
- writing,
- submit reports by post in physical complaint boxes or through an online platform,
- internet platforms,
- orally by telephone hotline or voice message system
- physical meetings.
The internal reporting channel needs to provide for anonymous reporting, protects the identity of the reporter and parties mentioned in a report; is not accessible for non-authorized staff members; and provides a dedicated person or department should be appointed to handle incoming reports and follow-up.
Furthermore, organizations must provide potential reporters with clear and accessible information on how to report externally to the competent national authorities. This might lead to the situation in which organizations must provide whistleblowers with assistance in reporting externally to a competent body. This might be a currently non-existing practice in most organizations.
Follow-up on reports
In addition to implementing an internal reporting channel, the Directive requires an acknowledgement of the receipt of a report towards the person reporting within 7 days. Also, further feedback to the reporter must be provided within a reasonable timeframe, at least within 3 months after the receipt of the report.
Organizations are required to register incoming reports in a secure manner. All report-related data must be handled in compliance with data privacy regulations. Registration of orally made reports has even stricter requirements. In many cases this means that organizations will have to step up the administrative aspects of whistleblowing.
Protection
Finally, the Directive sets requirements regarding protective measures concerning the reporter and other individuals involved in the report. The Directive includes a prohibition of retaliation and imposes an obligation to implement measures and safeguards against such retaliation.
