Important to Know: Silencing Whistleblowers Will Become More Difficult
Starting from September 1st, Estonia has enforced the Whistleblower Protection Act, formally known as the law safeguarding individuals who report breaches of EU law in the workplace. Simplified, this new law mandates that certain state institutions, local government units, and employers with more than 50 employees must establish a whistleblowing channel.
Additionally, a person must be appointed to handle whistleblower reports, including receiving notifications, maintaining contact, providing feedback, and informing about any follow-up measures. Fines for non-compliance with these requirements can be as high as €100,000.
A Channel for Reporting Must Be Created
At least one secure and confidential internal reporting channel must be established, allowing individuals to report violations either in writing or verbally. "This could be, for example, an email address or a web platform. An oral hotline or another voice messaging option is also acceptable. Additionally, reports can be forwarded through the whistleblower's direct supervisor," explains Kai Villemson, sworn advocate at RASK law firm.
The obligation to create an internal whistleblowing channel applies to any legal entity with at least 50 employees, as well as to municipal institutions with at least 50 staff members, or local government units with a population of 10,000 or more. It also applies to certain state institutions and entities under the supervision of the Financial Supervision Authority (such as credit institutions, insurers, and investment funds), regardless of the number of employees.
If desired, the same channel can be used to report breaches of other internal regulations, offering protection to those who report such incidents, but there is no obligation to extend such protections beyond what the law stipulates. Once a reporting channel is established, employees should be informed, for example, via email.
Fines Up to €100,000
Since the law is already in effect, Annika Vait, partner at RASK law firm, notes that obligated parties must comply with all specified requirements. The only longer transition period granted by the legislature applies to legal entities with 50–249 employees, specifically regarding the obligation to set up an internal reporting channel.
Villemson emphasizes the importance of designating a responsible individual or unit to manage the whistleblowing channel, including receiving reports, maintaining communication with whistleblowers, and providing feedback. If necessary, this role also involves requesting additional information and notifying about any follow-up measures. "This person can be internal or external to the organization. In practice, it's often the HR department, but some companies use services offered by law firms," he added.
Organizations must also develop a system with guidelines on how reports are processed and how whistleblower confidentiality is ensured. Companies that hinder whistleblowing, apply pressure tactics against whistleblowers, or violate their confidentiality can face fines of up to €100,000, according to Vait.
"Pressure tactics include terminating employment, reducing salary, demoting, changing job duties, altering work location and/or hours, discriminating, placing the whistleblower in an unfavorable situation, or prematurely terminating or canceling contracts for goods or services," Villemson detailed.
In Some Cases, an External Reporting Channel Is Required
Annika Vait also mentions that laws stipulate penalties for malicious behavior by whistleblowers, such as knowingly making false accusations. If a person falsely accuses someone of a crime, the Penal Code provides for a fine or up to one year of imprisonment. For knowingly submitting false reports covered under the Whistleblower Protection Act, the penalty can be a fine of up to €1,200.
Lawyers stress that, in addition to the aforementioned requirements, certain institutions must also set up an external reporting channel, appoint a competent person or unit to manage it, and publish instructions for processing reports on their website. These institutions include those overseeing compliance with regulations, carrying out administrative or official oversight, or investigating offenses, such as the Rescue Board, the Labor Inspectorate, and the Tax and Customs Board. However, creating these guidelines might be complicated, as no regulation specifying the requirements has been established as of today. Financial Supervision Authority subjects are in a similar situation: their obligations to create guidelines stem from special laws, but the underlying regulation has yet to be issued. These regulations are expected to be finalized soon.