It is a personal decision when an employee chooses to speak up about any type of wrongdoing. Most of the people who do this are motivated by wanting to do the right thing. However, we all know that although is prohibited employers get revenge after an employee exposes a misconduct, a whistleblower’s career may still suffer. And we also know that it is very hard for a employee fight against that kind of “low profile” bullying. It takes courage to do something like this and expose their own organisation and many times colleagues. That’s why is also needed a protection for those who seek justice.

Many European countries currently only have partial legal protections in place for whistleblowers. But with this Directive that contains broad free speech protections for whistleblowers (public and private sectors) we are definetly hopeful for some changes.

The Directive prohibits direct or indirect retaliation such as dismissals, demotions and other discrimination against current and former employees, applicants, supporters of the whistleblower and journalists. The protection applies only to the reporting of irregularities relating to EU law. (the EU does, however, encourage national legislators to extend this scope in national law).

The whistleblower can choose to report an incident internally or if that does not work, they can also go directly to the public. They are protected in all of these cases.

Member states have until 2021 to transpose this directive into their national laws.

There is two diferente ways of approaching this theme. When whistleblowers began to be a current action, there was one issue that needed to be solved , the need of secrecy for the government versus the public’s right to know.

So basically it is fair to say that in many situations if there is an exposition of national security information, whistleblowing can often be ilegal.

Reporting a misconduct is important to keep high ethic standards and thus maintaining customer and public confidence in an organisation and its operations. By blowing the whistle you can contribute to prevent the possible increase of misconduct.

Whistleblowing has to work through an independent service that provides anonymous communication between the whistleblower and the individuals who receive the messages. The service has to be separated from the organisation’s IT environment and can’t track IP addresses or other data that could identify the person who sent the message. Messages can only be decrypted by authorized individuals. Of course that it’s importante that the device that is used to do the whistleblow has no connection with company’s intranet, to be safer.

According to the EU General Data Protection Regulation, compliance officers are now required to follow very specific procedures when handling personal data, particularly as it pertains to issues of whistleblowing reports and reporters.

The fact is that GDPR had a huge impact on whistleblowing process. According to GDPR, all the companies can’t collect personal data without the data subjects being informed of how their data will be processed. This means that companies are obliged to inform accused persons of whistleblowing reports against them. The problem is that if we take this as “the only real statement”, the accused would also have the right to know the name of the whistleblower which means confidentiality is lost. This idea is not ideal to motivate the whistleblowers, in fact will scare them.

So, to ensure whistleblower identities are kept confidential and keep the “statement real”, the data protection authorities recommend using whistleblowing systems that allow anonymous reports. This is because if a report is anonymous the accused only has to be informed that an (anonymous) report has been received about him or her, the identity of the whistleblower remains protected.

For trustful whistleblowing process, it’s important to include a detailed description, like “what has happened”, “when and where it happened”. It doesn’t require proof of your suspicions, but of course it’s important to submit a report only when you’re sure. 

The message can be sent through the Communication channel (if there is one) or for any public organisation. The web channel has to be device independent, and available for smart phones, tablets and PCs.

The ISO 27001, the latest international information security standard, has to be followed by any company. It is set up to ensure that information security, including personal data management, is considered in all decisions during development and throughout the life. Ensuring the confidentiality, integrity and availability of data.

Whistleblowing services can be an independent whistleblowing service or part of thecompany. In both cases it has always to be an independent and impartial system. They’re made to provide the whistleblower a secure and trusted service. If it is some kind of outsider system it has to be contracted by the company. The whistleblowing service (whether internal or external) allows for anonymous communication between the whistleblower and the organisation’s whistleblowing team.

This question is hard to answer, actually it can be a tricky issue. When we talk about moral values, in this specific case we’ve two main ones: the fairness and loyalty. In one side we think about doing what’s fair and right but that behaviour can easily conflict with loyalty. For someone who works for many years in a certain company to speak up about something that is wrong is like breaking their superiors trust. What happens sometimes is that some individuals give more importance to fairness than to loyalty and prefer to do what’s right over keeping a secret just to be loyal.

Whether a whistleblower is a “hero” or a “traitor” is purely down to their intentions. Of course that sometimes there is financial incentives for whistleblowing or the idea that one can be famous through it and that are extra reasons.

The best option to discourage “unethical” whistleblowing is having an internal and anonymous channel for reporting misconducts. This system will allow the whistleblowers identities to remain a secret which would make it less likely to be reported externally to the press where they could seek to make a name for themselves.