In Finland, the national legislation implementing the Whistleblowing Directive entered into force on 1 January 2023.
However, there is a transition period for establishing an internal reporting channel. Private sector entities regularly employing at least 250 employees and public sector entities regularly employing at least 50 employees must set up an internal reporting channel by 1 April 2023. Private sector entities regularly employing at least 50 but less than 250 employees have until 17 December 2023 to establish an internal reporting channel. In addition, if entities with less than 50 employees have established a voluntary internal reporting channel, they have until 17 December 2023 to bring them into compliance with the new legislation.
Legislation passed / Directive implemented.
Same as those in the Directive. However, the scope of the reporting topics has been widened to include also breaches of national law with certain limitations regarding public procurement (defence and security procurement is not included) and public health.
Same as those in the Directive.
The organization or, if the whistleblowing channel has been outsourced to an external service provider, the external service provider needs to appoint a person or persons who are responsible for processing reports impartially and independently. Only such designated persons may process reports. It is also possible to appoint experts for investigating the accuracy of reports.
Yes, entities with fewer than 50 workers are exempt from the obligation to establish internal reporting channels. However, an internal reporting channel must always be established if the entity operates within the scope of the Anti-Money Laundering Act (444/2017).
Yes.
Yes, an acknowledgement of receipt must be sent to the whistleblower within seven days of receiving the report and the follow-up measures based on the report must be communicated to the whistleblower within three months following the acknowledgement of receipt.
Organizations may decide to accept anonymous reports as well.
No.
There are criminal sanctions in place against the perpetrator of retaliation against the reporting person, which depending on the perpetrator can be up to EUR 1,200 for natural persons and EUR 100,000 for legal persons.
Yes.