Starting as of 17 December 2023, the new (more strict) requirements of the Dutch Whistleblower Protection Act regarding internal reporting procedures for whistleblowers now also apply to midsize employers (those with 50-249 employees).
As a result of these new requirements, employers must have an internal reporting procedure in place for the reporting of suspected wrongdoings that sets out, among other things, how the report is dealt with, what qualifies as a suspected wrongdoing, to whom a report can be made, how a report can be made, and within what time frame a report must be followed up.
With regard to the method of reporting and to whom a report can be made, a new 'Decree on the anonymous reporting of suspected abuses' was recently submitted for online consultation. In the legislative process leading up to the Dutch Whistleblower Protection Act, it was announced that the option to make an anonymous report would be included in the law. The Decree is a further elaboration of this announcement. (As the Decree is currently still up for consultation, it could still change in its final form.) Below, we will discuss the most important aspects.
Lastly, we will discuss another important aspect of the Act which was recently clarified to us by the Dutch Whistleblowers Authority: whether a whistleblower's report can be investigated at the (international) group level.
How to report anonymously
Among other things, the Decree regulates what conditions an anonymous report must meet. The explanatory notes to the Decree specify that the employer is generally free to determine the reporting method for anonymous reports. Employers may, for example, choose to use special software for the receipt of anonymous reports.
If an anonymous report is made, however, this must in any case be done to a specially appointed officer (see below). That officer must then discuss with the reporting person how they wish to communicate during the process (including the requirement to send the reporting person a confirmation of receipt of the report within seven days).
Officer authorised to receive an anonymous report
Who may be an officer
The Decree further regulates the conditions applicable to an officer appointed to receive anonymous reports. At least one officer must be appointed. Multiple officers may be appointed, but in any case at least one officer must not have a managerial position within the employer's organisation or be someone who is primarily involved in recruiting, hiring and firing of employees (e.g. someone in HR). If multiple officers are appointed and an anonymous report is made, the report must initially be assessed in terms of content by the officer who is not in one of these positions.
It is not required that the officer appointed to receive anonymous reports works within the employer's organisation. An external person or body may also be appointed.
Competence requirements
An officer appointed to receive anonymous reports must have the expertise and experience required to perform the role properly. The explanatory notes to the Decree state that this includes being able to properly assess the information provided, as well as knowing how to handle that information and with whom to share it in order to properly follow up on the report. The officer must also be able to inform the reporting person about the risks of a report and to explain to them that for a proper investigation it may sometimes be necessary to disclose their identity (with their consent). The explanatory notes also point to important personal qualities of the officer, such as integrity and good communication skills.
In addition, the Decree specifies that an officer who receives an anonymous report must act in such a way as to ensure the anonymity of the reporting person. The explanatory notes state that, in the event their identity does become known (to a limited extent), the officer must ensure that the identity is not further disclosed to others involved in the processing and investigation. It is also recommended to let the reporting person know in such a case that their identity has become known and how it happened.
Reporting
An officer appointed to receive anonymous reports must report at least once a year to the highest authority within the organisation and to the employee representative body regarding the number of anonymous reports and the nature of the reports. If there is no works council or other form of employee representation, the report should be sent to the employees themselves.
Independence
Finally, an important duty also applies to the employer when appointing an officer: the employer must make it possible for the officer to perform his role properly, function independently within the organisation of the employer, and not be at risk of negative (employment law) consequences. The explanatory notes to the Decree note that officers must be given sufficient time and space to perform the role in a proper and independent manner, and that, for example, they should not be required to report to their manager within the organisation regarding their work as an officer. Furthermore, if the officer indicates a need for certain (digital) resources to be able to perform the role properly, the employer must follow this up as far as reasonable.
Investigating reports at the group level
Since the entry into force of the Whistleblower Protection Act, a number of questions have been raised in practice that could not easily be answered by the letter of the law itself. One of these questions is whether the Act allows for a report of a suspected wrongdoing to be investigated at the parent level within an international group. The law allows private sector employers with 50-249 employees to share resources for receiving reports and conducting investigations into them, but the exact scope of the respective provision was unclear, especially in the international context.
Following a clarification request made by us, the Authority has recently clarified that reports may be investigated at the level of the group, even if the parent company is located in another country, if that parent company is better equipped to investigate a report. According to the Authority, it is important to ensure proper safeguards in this regard, in the sense that this way of investigating the report must not create barriers for the reporting person.
Note, however, that the ultimate responsibility for providing timely follow-up and feedback on the report remains at the level of the (subsidiary) entity where the report was received, if that entity is legally obliged to have its own reporting procedure and reporting point in place.
Takeaway for employers
The online consultation remains open until 11 June 2024.
The content of this article is intended to provide a general guide to the subject matter. Specialist advice should be sought about your specific circumstances.