11 November 2011

Whistleblowing in Luxembourg

Whistleblowing is a system more and more used in Europe and in Luxembourg as well.

A whistleblower is a person who tells someone or a specific organisation about alleged dishonest or illegal activities occurring in a government department, a public or private organisation, or a company. Whistleblowers may make their allegations internally (for example, to other people within the accused organization) or externally (to regulators, law enforcement agencies, to the media or to groups concerned with the issues).

The term whistleblower comes from the phrase "blow the whistle” which refers to a whistle being blown by a police officer or a referee to indicate an activity that is illegal or a foul.

On or around July 2002, after the financial problems of Enron, the American Congress adopted a law called “Sarbanes-Oxley” (SOX). According to this law SOX, American companies and their subsidiaries are obliged to implement an ethic code and a system by which their employees may anonymously report any financial frauds in the fields of finance, accounting, banking and the fight against corruption by calling a free of charge phone number or using their internal website or any other equivalent system.

The Group “Article 29”

The Group “Article 29” concerning the data protection in Europe decided to urgently take position concerning the lawfulness of such system. The analysis of the Group “Article 29” dated February 1, 2006 refers only to systems implemented in the fields of finance, accounting, banking and the fight against corruption and states that all implemented systems shall respect the protection of personal data, which means that (i) any implemented system shall prove its specified and legitimate aim and that (ii) the whistleblower shall be protected by keeping his/her identity secret and by prohibiting employers from retaliating against whistleblowers. Employers may not fire, demote, suspend, threaten, harass, or discriminate against a whistleblower.

The Group of Article 29 accepted that specialised companies can collect alarms, even that certain organisations (ex: specialised law firms) carry out part of the investigation on behalf of the company responsible for the device. In these cases, these external people must commit themselves by contract to respect the principles of Luxembourg and European rules of data protection and the contents of the commitments.

Inter alia, these external people must engage:

• to comply with the rules to which the person in charge for Luxemburgish treatment (including that envisaged by the single authorisation is subjected: restricted field, limitation of anonymity, etc);
• not to use the data for different purpose from those for which they were collected;
• to respect strict obligations of confidentiality;
• to communicate the data collected and treated by their skew only with well defined people within the charged organisation, the company, of the management of alarms, the investigation or the catch of measurements of follow-up of the brought back facts;
• to respect the shelf life limited of the data;
• to carry out the destruction or the restitution of all the manual or computerised supports data in personal matter at the end of its service.
   

Rules to observed to implement a whistleblowing policy

In Luxembourg, many companies are willing to implement a whistleblowing policy, This whistleblowing policy shall describes the purpose and aim of such ethic code and the applicable system.

Few other rules have to be strictly observed:

Preliminary, it is important to state that such whistleblowing policy is not unlawful, if some rules are followed. The company has to notify its whistleblowing policy to our national commission on data protection (CNPD), according to articles 12 and 13 of the law dated August 2, 2002 relating to protection on personal data. CNPD recommends four guidelines:

• The need for restricting the device of alarm to the countable, control of the accounts, banking field and of the fight against the corruption;
• The fact of discouraging the anonymous denunciations while ensuring, as far as possible, identification of the authors of alarm;
• The installation of a specific organisation to collect and treat alarms. The people in charge of such collect must be trained and obligations with an subject to obligation of confidentiality relating to data of which they take note;
• The information of the person concerned as soon as the evidence was preserved, in order to allow him/her to exert his/her rights of opposition, access and correction.

Then, such policy has to be a support and not a replacement to an efficient management within the company.

Besides, after a specific notification to the CNPD, the implemented system should respect the new articles L. 271-1 and the followings of the Luxembourg Labour Code, added by a law dated February 13, 2011.

By this new article L. 127-1 of the Luxembourg Labour code, an employee cannot be a victim of reprisals because of his/her protests or refusal opposed to a fact that he/she considers, in good faith, as being constitutive of illegal catch of interests, corruption or influence peddling under articles 245 to 252 and 310-1 of the Penal code, that this fact is committed by his/her employer or any other senior in rank, colleagues, or external people in relation to the employer.

This article states also that any termination of the employment contract because of whistleblowing is null and void. Such principle is also the opinion of the European Court of Human Rights (ECHR) in its sentence dated August 1, 2011.

This principle was also added in the law dated April 16 1979 on general status for public officials in the State of Luxembourg and in the law dated December 24, 1985 on general status for public officials in municipalities.

However, few problems remain

This protection of whistleblowers is limited to specific offenses within the fight against corruption, i.e. illegal catch of interests, corruption or influence peddling under articles 245 to 252 and 310-1 of the Penal code.

Three Trade Unions officially claimed to extend the protection to the relation between banks and their clients. For the time being, no amendment has been made.

By a decision of 14 October 2010 the French data protection authority, the CNIL, modified its “Blanket Authorisation” of December 2005 on whistleblowing/ hotlines in relation to the scope of reporting. Before this decision, to fall within the Blanket Authorisation, a whistle-blowing scheme had to relate either to:

• legal obligations of French law in relation to implementing internal audit procedures in the fields of finance, accounting, banking and the fight against corruption ; or
• legal requirements set out in section 301(4) of the Sarbanes-Oxley Act in the fields of accounting and auditing for companies concerned by this law,

The new decision of the CNIL indicates that the so called “Japanese SOX“ is also covered by the Blanket Authorisation but, and more importantly, it also extends the scope to internal audit on breaches to competition law.

This new scope would may be implemented in Luxembourg within the nearest future.

The other problem concerns the whistleblowing system to be implemented. Most of the time the system is an hotline or specific address email.

Concerning the specific address email, there is practical problem as the whistleblower has just to send an email explaining the facts and the alleged person who should have committed an offense.

Concerning the question of the implementation of an hotline, we have no clear solution in Luxembourg, as up to now and at our knowledge, Luxembourg Labour Courts still never render any sentence regarding this matter. However, a parallel with a French sentence in 2006 whereby the Labour Court checked the validity of a program including an anonymous hotline that provided employees with a means for reporting wrongful acts could be done. First of all, the Labour Court determined that no provision in the French labour code prohibits employers from adopting ethical rules or codes of conduct so long as restrictions on individual rights remain proportionate. Then, the Labour Courts found that the system complied with the CNIL (our Luxembourg CNPD) authorisation because the act of reporting was optional, a condition required in order to respect the employees' freedom. Finally, the French Labour Court ensured that the reporting system maintained the whistleblower's anonymity and that any individuals that were incriminated had access to their personal information and the right to modify their personal data. Hence, this whistleblowing system was deemed to be compliant with French law.