Whistleblower protection at the Research Council of Finland
The Finnish Whistleblower Act (1171/2022) aims to provide effective protection for whistleblowers who, in the course of their work, detect breaches of European or national laws, such as in public procurement, the protection of privacy and personal data, the security of network and information systems, or the granting or use of EU or national aid or state aid. The Act implements the European Union directive on the protection of whistleblowers.
Whistleblower protection allows people to safely report breaches. Not only is their identity protected, but the Whistleblower Act also prohibits retaliation against the whistleblower. For example, an employer cannot weaken the conditions of the whistleblower’s employment, terminate their employment or lay off the whistleblower as a result of the whistleblowing. Protection against retaliatory measures is also provided to the employer of the whistleblower or to legal persons to whom the whistleblower is linked through their work.
The Office of the Chancellor of Justice has established a centralised external whistleblowing channel. Persons outside the Academy of Finland, such as former employees or those employed by the Academy’s partners, may use the external channel to report a breach regarding the activities of the Academy of Finland that they have observed in their work and which falls within the scope of the Whistleblower Act. The Office of the Chancellor of Justice forwards the reports to the competent authority, for example the Academy.
The Academy of Finland has set up an internal whistleblowing channel for Academy staff. Only persons employed by the Academy have access to the channel.
The reports are processed by independent and impartial handlers appointed separately by the Academy. They are bound by the obligation of professional secrecy with regard to the personal data of the whistleblower and the subject of the report. The accuracy of the reports will be checked and, if necessary, measures will be taken to address the breach. The whistleblower will be informed of the measures taken based on the report within three months, or in the case of the external reporting channel for justified reasons within six months, of the receipt of the report.
The conditions for whistleblower protection are described in the Whistleblower Act. A condition is that, at the time of the report, the whistleblower has reasonable grounds to believe that the information on the breach is accurate and that such information falls within the scope of the Act. The whistleblower must have received information on the breach in their work or in connection with it in the following situations:
- during their employment relationship
- as a self-employed person
- as a shareholder
- as a member or managing director of the board or governing body of a corporation or foundation
- as a volunteer
- as a trainee.
The whistleblower is also protected in cases where they have received the information on the breach during negotiations prior to their work or during work that since then has ended.
The protection also extends to the following persons:
- a person who assists the whistleblower in the reporting and who, because of their work, is in a position to be subject to retaliatory measures because of the report
- a person who is affiliated with the whistleblower and who may be subject to retaliatory measures because of their work
- a legal person owned by the whistleblower, by whom the whistleblower is employed, or with whom the whistleblower is otherwise affiliated through their work, and who may be subject to retaliatory measures because of their work.
Deliberately reporting false information is a criminal offence and may result in liability for damage caused to the subject of the report.
The protection extends to cases where the report concerns a breach in the areas referred to in the Whistleblower Act:
- public procurement, with the exception of defence and security procurement
- financial services, financial products and financial markets
- prevention of money laundering and terrorist financing
- product safety and compliance with requirements
- transport safety
- environmental protection
- radiation and nuclear safety
- food and feed safety, animal health and animal welfare
- public health within the meaning of Article 168 of the Treaty on the Functioning of the European Union (NB: section 2 of the Whistleblower Act provides for certain exceptions)
- consumer protection
- protection of privacy and personal data, security of network and information systems.
In these areas, the Whistleblower Act applies to reports of acts or omissions
- that are punishable
- that may result in an administrative sanction of a penal nature
- that may seriously jeopardise the achievement of objectives of general interest as referred to in the legislation.
Whistleblower protection also extends to the following persons:
- persons reporting a breach of EU legislation or regulations on financial management, implementation of expenditure or collection of EU revenue or funds
- persons reporting a breach of legislation or conditions concerning the granting, use or recovery of EU or national grants or state aid
- persons reporting a breach of EU or national competition rules
- persons reporting a breach or an arrangement of EU or national legislation on the taxation of companies and entities with a view to obtaining a tax advantage contrary to the objective or purpose of the legislation
- persons reporting a breach of other EU or national legislation laid down to protect consumers.
The Whistleblower Act is not applied in the following cases:
- reporting classified documents or classified information
- reporting information covered by the secrecy obligation of healthcare personnel or the secrecy obligation of attorneys and legal counsels
- reporting information on defence and security procurements to which Article 346 of the Treaty on the Functioning of the European Union applies
- reporting information concerning the confidentiality of a court’s decision-making, if specific provisions on it have been made
- reporting cases where a person has given their informed consent to be defined as a source of information or registered as such in databases maintained by law enforcement authorities.
Detailed information on these exceptions can be found in section 4 of the Whistleblower Act.
The processing of personal data is described in a separate privacy policy statement, which is available on this website under Data protection.
