• In June 2021, the European Commission published interpretative guidance on the EU Whistleblower Directive. According to this, subsidiaries of groups of companies with 250 or more employees must in principle also have their own internal reporting channels and resources for case processing.

  • Flexible solutions are to apply under certain conditions to subsidiaries with 50 to 249 employees.

  • With our multi-mandate capability of Hintbox, parent companies and subsidiaries can meet these requirements by keeping their own internal reporting channels ready for the whistleblowing system. You can also restrict and control person access rights for case processing.

What were the European Commission’s comments about?

The European Commission issued opinions in two letters on June 2, 2021 and June 29, 2021 on the interpretation of whistleblower system structures in groups of companies and corporate groups. The two opinions concerned interpretations of the EU Whistleblower Directive 2019/1937, which must be transposed into national law by December 17, 2021. 

According to the EU Commission’s letters, several companies from Denmark and other European countries have contacted the Commission or the Commission’s Expert Group on the Whistleblower Directive to express their concerns about the decentralization of whistleblowing systems in corporate groups.

Larger corporations and groups of companies often have a centralized compliance structure. Subsidiaries of corporate groups draw on the personnel competencies and resources of the parent companies.

The Commission stated in its two opinions that Art. 8 (3) of the Whistleblower Directive leaves no room for interpretation. According to this, every legal entity under private law with 50 or more employees must establish internal reporting channels as well as procedures for internal reports and for follow-up measures. According to the Commission’s Expert Group, this also applies to legal entities belonging to a group of companies. Any other interpretation would be contra legem.

The Commission concludes that both the parent company and each subsidiary (with 50 or more employees) must implement their own whistleblower system. 

Flexible solutions for medium-sized companies

The EU Commission refers to Art. 8 (6) of the EU Whistleblower Directive. According to this, legal entities in the private sector with 50 to 249 employees can share resources for receiving reports and for investigations that may have to be carried out. Nonetheless, the medium-sized company would still be responsible for providing feedback, maintaining confidentiality and conducting follow-up. In the Commission’s view, it is compatible with the Whistleblower Directive for a subsidiary to use the resources of a central compliance department of a parent company if the subsidiary has 50 to 249 employees and the subsidiary maintains its own reporting channels for reports.

In addition, the whistleblower must be informed that the central compliance department (e.g., the Group Compliance Officer) is accessing the report. Furthermore, the whistleblower must have the right to object to central access and may demand that the report be processed exclusively by the subsidiary. The subsidiary would also have to provide feedback, among other things.  

Implementation of a separate whistleblower system by large subsidiaries

According to the Opinion, subsidiaries with more than 249 employees should establish their own internal whistleblowing channels. The same applies to the corresponding resources for processing reports of compliance violations. 

Compliance incident affects several companies of a group 

If a reported incident affects two or more subsidiaries and the processing of the case requires the involvement of other affected companies, the case may be forwarded to a central compliance department.

However, this requires that the compliance officer informs the whistleblower and that the whistleblower consents to the facts of the case also being shared within the corporate group. If the whistleblower does not give his consent, he must have the opportunity to withdraw his report. 

Implementing multi-client capability to meet these requirements 

Regardless of further developments in national whistleblower protection laws, including the question of a centralized, decentralized or hybrid whistleblowing system within a corporate group, all requirements can be implemented quickly and easily with Hintbox. Via the multi-client capability of our digital whistleblowing system, both parent companies and subsidiaries can each offer their own internal reporting channels. 

Behind the multi-client capability feature is a technical separation and authorization concept. This allows individual access by persons/departments to cases from different companies to be controlled and managed. Via the Hintbox dashboard, only compliance officers can then access the cases of their subsidiaries. 

Furthermore, all Commission requirements regarding whistleblower disclosure notices can also be easily implemented with Hintbox. All legal texts and the data protection notices can be customized individually and very easily.

Arrange a demo today