An Employer's Guide to Implementing EU-Compliant Whistleblowing Hotlines

Under the Sarbanes-Oxley Act, companies listed on U.S. stock exchanges are required to establish a system, often called a "whistleblowing hotline," for employees to internally report concerns over questionable auditing or accounting matters. However, some European Union jurisdictions previously concluded that the EU privacy regime prohibited such hotlines. Over past few years, the EU and its Member States have articulated a framework for how to lawfully implement such a hotline throughout most of the European continent. This newsletter outlines a checklist of basic principles that multinational public company employers can follow to stay within this framework and mitigate the risk of an enforcement action on both sides of the pond.

Introduction

The corporate compliance, or "whistleblowing," hotlines required to fulfill obligations under the Sarbanes-Oxley Act of 2002 (SOX) do not sit easily within the framework of European Union data privacy laws. Regulatory decisions in France cast doubt on the legality of whistleblowing hotlines within the EU, and companies listed on U.S. stock exchanges appear to face a difficult choice between two seemingly contradictory regulatory regimes. This newsletter explains the current compromises enabling companies to satisfy requirements on both sides of the pond, and to meet their obligations under the law.

Background

In 2005 the French data privacy regulator, the CNIL, refused to authorize the creation of a SOX-compliant ethics hotline by McDonald's France on the grounds that to do so would violate French data privacy law. Of particular concern was the possibility that the submission of anonymous complaints could be abused in order to injure the reputation of coworkers, and that the hotline would lead to disproportionate data processing outside the EU of the personal data of French citizens. The decision caused some consternation among employers, to which EU-level and member state regulations have since responded.

The Article 29 Data Protection Working Party

In an attempt to provide a unified European position, the EU's standing working party on data transfer issues, the so-called "Article 29 Data Protection Working Party," produced an opinion in 2006. Although the opinion went some way to harmonizing the stance of data privacy regulators within the Member States, as explained below, multinational companies may still have to engage in extensive background policy introduction work when putting into place measures to comply with SOX.

In the EU, personal data (i.e., data by which an individual can be directly or indirectly...