New legislation regarding whistleblowing in Sweden and in Norway

This article summarizes the main legislative changes regarding whistleblowing in Sweden. In addition, we will provide a brief overview of the areas where the Directive tightens the requirements for companies' handling of whistleblowing cases in Norway, if implemented.

Whistleblower matters under the new Swedish Act on Whistleblowing

Whistleblowing is when an individual reports or discloses on a severe irregularity or wrongdoing in a business. Under the new Swedish Act on Whistleblowing, a reporting person could be not only an employee, but also a trainee, volunteer, job applicant, consultant or other hired-in staff, and shareholders, or anyone who has previously belonged to any of these categories. The Swedish Act on Whistleblowing applies to reporting in a work-related context of information about misconduct that there is a public interest in coming to light. In addition, the Swedish Act on Whistleblowing applies to reporting in a work-related context of such misconduct that has violated certain EU regulations, such as regulations concerning e.g. public procurement, financial services, product security and transport security. The reporting person, i.e. the whistleblower, should have reasonable cause to believe that the information which the report concerns was true.

The new Swedish Act on Whistleblowing contains a prohibition against retaliation, which means that the whistleblower is protected from actions that have been taken as a result of the reporting, such as e.g. dismissal, or other actions related to the employment such as change of work tasks, degradation or not increasing the salary.

Within seven days from receiving the report, the employer must confirm to the reporting person that the report has been received. Furthermore, the reporting person shall receive feedback to a reasonable extent on the measures that have been taken in the follow-up of the report. The employer must give such feedback within three months from confirming receipt of the report. In addition, the reporting person shall be informed if information by which the reporting person can be identified will be disclosed.

Written reports and documentation of oral reports shall be deleted when the information is no longer necessary, but no later than two years after the follow-up case has been closed. Reports will likely contain personal data. Personal data processed in a follow-up case must be deleted when it is no longer necessary to store it, however, no later than two years after the processing of the data in the case has ended.

Implementing new whistleblower channels and procedures

Under the new Swedish Act on Whistleblowing, private employers with a minimum of 50 employees at the beginning of the calendar year are obliged to have internal reporting channels and procedures for reporting and following up on whistleblower matters. The obligation to have such whistleblower system implemented applies, in relation to private employers with 250 employees or more, from 17 July 2022. For private employers with 50 to 249 employees, the obligation will apply from 17 December 2023.

The Ministry's report proposes to establish a new law to protect whistleblowers who report breaches in addition to the already existing whistleblowing provisions as set out in the Norwegian Working Environment Act (the "WEA"). The proposed new law seeks to meet the minimum standards of the Directive, which is highly prescriptive in certain areas and goes beyond what is currently required under the WEA.

Extended categories of persons may be given status as whistleblowers and may be granted protection against retaliation

Under the WEA, employees have the right to notify censurable conditions at the employer's undertaking. The Directive expands the categories of persons who may be given status as whistleblowers, to include self-employed persons, shareholders, trainees, job applicants, former employees, and suppliers, provided they have acquired the relevant information in a work-related context.

In addition to the whistleblower, a number of other persons connected to the whistleblower may be granted protection from retaliation if the Directive is implemented, e.g., persons who could suffer retaliation in a work-related context, such as colleagues or relatives of the whistleblower, as well as legal entities that the whistleblower owns, works for, or is otherwise connected to in a work-related context.

The Directive requires legal entities in the private sector with more than 50 employees to establish channels and procedures for internal reporting and follow-up. It will thus no longer be sufficient for employers to only have procedures in place pertaining to the handling of whistleblowing notices, as currently prescribed by the WEA.

According to the Directive, legal entities in the private sector with between 50 and 249 employees may share resources regarding whistleblowing reports and any investigations to be conducted. There are also prescriptive rules pertaining to follow-up, e.g., employers must acknowledge receipt of whistleblowing reports within seven days. Furthermore, employers are obliged to provide feedback to whistleblowers within three months from the acknowledgement of receipt, or, if no acknowledgment was sent to the whistleblowers, three months from the expiry of the seven-day period after the reports were made.

Confidentiality

One of the essential provisions of the Directive is that a whistleblower's identity must be treated as confidential. According to the Directive, the whistleblower's identity shall not be disclosed to persons other than those handling the case. With this in mind, the Directive sets stricter requirements than the current legislation in the WEA. Exceptions may only apply when it is proportionate and necessary to safeguard the rights or defence of affected persons. The rationale behind this provision is that the protection of the whistleblower's identity is considered essential to prevent reprisals. 

External reporting channel

It follows from the Directive that all companies must establish an external and independent whistleblowing reporting channel. Both the Norwegian Data Protection Authority and the Norwegian Labour and Welfare Authority have been suggested as potential relevant supervisory authorities. In this regard, the Directive goes beyond what is currently required under the WEA.

The right to compensation

The directive states that Member States must take necessary measures to ensure that all persons mentioned in article 4 have access to legal remedies and full compensation for damages "in accordance with national law".

It already follows from Norwegian law that an employee can claim compensation if the prohibition of retaliation is violated. It is proposed that the right to compensation and restitution is governed by one single provision, designed in accordance with the WEA framework.

Take-aways

Norwegian companies should expect detailed requirements concerning whistleblowing. It may be mandatory to implement an external whistleblowing reporting channel. There may also be stricter requirements as regards the internal whistleblowing reporting channel. Thus, companies should evaluate its internal procedures for handling whistleblowing cases and be prepared to take action within short timeframes.