C M S‘Hasche Sigle Rechtsanwalte Steuerberater

1. Problems of implementation: Fundamental differences between

Europe and the US

The Code of Conduct is becoming increasingly popular amongst US and European com-

panies. This requires the companies to draw up a framework of the company’s own ideas

of legally and ethically responsible conduct, and can range from accounting rules to rules

concerning social conduct. These rules venture into the domain of employee privacy,

which in Europe has been a cause for concern in relation to Data Protection laws, as some

companies have gone as far as to say what employees may or may not do in their spare

time.

Especially, the implementation of “whistleblowing” schemes as a part of the Codes of Con-

duct will more often than not require the processing of personal data (that is, the collection,

registration, storage, disclosure and destruction of data relating to an identifiable person),

such that Data Protection rules will come into force. The broad law is governed under the

European Directive of 95/46/EC on the protection of individuals with regard to the

processing of personal data and on the free movement of such data. The three conditions

that need to be met in order to justify the processing of personal data are transparency,

legitimate purpose and proportionality.

There has thus been a clash between the US perspective (The US have now one com-

pany in eight with such a Code of Conduct) and European ideas regarding co-

determination and personality rights through enforcing these codes. Indeed the Sarbanes-

Oxley Act, that was introduced in the US after the various financial scandals surrounding

Enron, requires that companies failing to comply with their “whistleblowing” requirements

will face hefty sanctions, and therefore an EU committee set up for the purpose of examin-

ing the implementation of Data Protection law (the so-called Working Party) has investi-

gated the problems of the US rules clashing with Data Protection rules in Europe. Without

a resolution to this cross border dispute over implementation of Codes of Conduct, com-

panies may face heavy sanctions in both Europe and the States.

There have been cases in both France and Germany showing a reluctance in European

courts to enforce the Codes of Conduct. This reluctance stems from two concerns: the

failure to consult the employees representatives (co-determination rights), the invasion of

2

224

asche Sigle Rechtsanwaite Steuerberater

personality rights protected constitutionally in both Germany and France and the subse-

quent data protection issues.

I I . The German Case

A well known decision on whistleblowing via a hotline to date in Germany is the decision

known as the ”Wal-Mart judgment” by the Wuppertal Labor Court and the subsequent a p

plication for review of a point of law filed with the Diisseldorf Regional Labor Court. Wal-

Mart unilaterally and without the involvement of the works council implemented in its sub-

sidiaries located in Germany a so-called code of ethics which included the provision that

violations of the code of ethics be reported anonymously via a hotline especially estab-

lished for this purpose.

The German Works Council acting as the Plaintiff in this case, complained as to the “seri-

ous incursions into personality rights” and “a culture of denunciation.” The Works Council

under the German Works Constitution Act needs to give its approval if the employer

wishes to introduce rules that directly affect the behaviour of an employee within his

sphere of work at the company. Therefore the following were held by the court to be sub-

ject to co-determination with the Works Council:

Code of ethics violations to be reported through an anonymous hotline

Prohibiting, demanding, requesting or receiving gifts or special payments

The rule that no statements were to be given to the press without consent

from the company communications department

Rules on harassment

Company inspection rights

Rules concerning romantic relationships

Rules on drug and alcohol abuse

Ban on the display of posters advertising the disallowance of accepting of

gifts and reporting of violations through a hotline.

The Court of Appeal even went further by holding the “no dating rule” invalid because of

the breach of general personality rights of the individual employees.

3

225

c MI S‘Hasche Sigle Rechtsanwalte Steuerberater

Regarding the legality of the telephone hotline outside the scope of the codetermination

rights of the works council the courts did not make any statement, in particular, with regard

to its compliance with the Data Privacy Protection Act.

111. The French cases

In France, however, courts have rendered a number of decisions on the admissibility of

telephone hotlines with respect to data privacy protection laws. Having a cultural back-

ground similar to Germany, France does not have a particularly favorable attitude towards

whistleblowing either. Prior to collecting and using employee data automatically, an em-

ployer in France has to seek the approval of CNIL (Commission nationale de I’informafique

et des libertes - hereinafter CNIL) pursuant to the French Data Privacy Protection Act. On

26 May 2005, CNIL declared the whistleblowing hotlines at McDonald’s and CEAC (Com- pagnie Europeenne d’Accumulateurs), implemented to comply with the Sarbanes-Oxley

Act, unlawful owing to data privacy protection laws.’ According to these decisions,

anonymous reports include a risk that employees could be wrongly accused and that ex-

oneration would be difficult for them owing to their lack of knowledge of the investigation.

Such a hotline does not comply with the French Data Privacy Protection Act2 since the

suspected employees are not sufficiently informed.

On 15 September 2005, the Libourne Labor Court decided that a notice displayed at the

workplace requesting the employees to report each case of fraud and embezzlement via

an ethics hotline was to be immediately removed. In their opinion, the obligation to report

all breaches without limitation to the financial area, for example, went too far. Regardless

of the type of data collection and processing, an anonymous report involves the risk that

the accused employee could be exposed to internal investigations and possibly to further

sanctions without being able to exercise hidher right to conduct hidher own defense.

Moreover, the court considered the type of hotline and the risk of a slanderous denuncia-

tion disproportionate and unlikely to prevent misappropriation and embezzlement. Further,

the court found that the personal freedoms of an accused employee were endangered.

’ CNIL decision 3005-1 I O 0 1 26 May 2005 (McDonald’s group frmce); CNIL decision 2005-1 1 1 of 26 May 2005 (Exide Technologic\)

Articles 6 and 7 of E rench I‘iw no 78-17 of 6 January 1978.

4

226

C M Shasche Sigle Rechtsanwalte Steuerberater

French companies are thus facing the problem of how it could be possible to establish a

hotline in accordance with the provisions of the Sarbanes-Oxley Act without violating the

relevant data privacy protection laws.

In the light of these difficulties, CNIL, after consulting the French Ministry of Labor, issued

a directive on the implementation of whistleblowing systems andlor hotlines on 10 Novem-

ber 2005~.~ This directive comprises among other regards the above mentioned risks and

problems. This direction gives French companies intending to establish a whistleblowing

system detailed guidelines, providing legal certainty and thus minimizing the risk of viola-

tions of the Data Privacy Protection Act.

IV. Whistleblowing under German Data Privacy Act

The information communicated via the hotlines usually refers to the personal conduct of

the employees and is thus personal data in terms of the German Federal Data Privacy

Protection Act.

If the employer, as is usually the case, itself establishes and operates a call centre which

collects and processes the personal data, the processing of an employee's personal data

is admissible under the German Federal Data Privacy Protection Act if it serves a purpose

relating to the contractual relationship or relationships of trust similar to a contractual rela-

tionship.

Accordingly, it is decisive whether the employees' data is collected, used or communicated

for the purpose of fulfilling an obligation arising from the employment agreement or for the

purpose of exercising rights under such agreement. If no express provisions on the use of

data collected via a whistleblowing hotline are included in the employment agreement, it

has to be determined by way of interpretation whether the manner and scope of the use of

the data is possibly covered by the secondary obligations arising from the employment

agreement. Reference is made, for example, to a use of data for the purpose of prevent-

ing the contractual purpose from becoming endangered by breach of a secondary contrac-

tual obligation.

Availablc under. http://ww\~ .cnil.ti. ' t i leadmini~~~cumentsiuk/CN1 L-recommandation\-~~ histlehlo\.;.ina-VA.pdf.

5

227

C'M S Hasche Sigle Rechtsanwalte Steuerberater

In most cases, however, the purpose of the use of data will go beyond the contractual pur-

poses. As a rule, hotlines are established in the framework of codes of ethics. Unlike

codes of conduct which are established for employment purposes, meaning for the pur-

pose of an orderly and economically successful value-creation process, codes of ethics

generally contain principles referring to the "correct" or even ethical conduct. If these

codes require specific conduct which is not clearly employment-related, such data proc-

essing is no longer justifiable under the Federal Data Privacy Protection Act.

However, the implementation of a whistleblowing system can be admissible if the imple-

menting company has a legitimate interest in doing so, unless the data subject's legitimate

interests outweigh the legitimate interest of the company.

Recently, a group of European data protection commissioners led by the German data

protection commissioner Peter Schaar defined the conditions for a legitimate interest of the

employer in establishing hotlines and drew up recommendations.

a) Recommendations of the Article 29 Data Protection Working Party

The Article 29 Data Protection Working Party (the Article 29 group) consists of the data

protection commissioners of the 25 member states of the European Union; on February 1,

2006, they issued a statement on data privacy protection requirements for whistleblowing

system^.^

The recommendations of the Article 29 group aim at making it easier for companies re-

quired to implement whistleblowing systems due to the Sarbanes-Oxley Act, to structure

such systems in compliance with the data privacy protection laws and thus to meet the

requirements of the EC Data Privacy Protection Dire~tive.~ In conclusion, the Article 29

group considers whistleblowing systems to be admissible, but places their admissibility

under strict prerequisites.

A prerequisite of Directive 95/46/EC is that either the collection of the data is necessary in

order to comply with a legal obligation to which the data collecting party is subject or the

processing is necessary for the realization of a legitimate interest safeguarded either by

the data collecting party or the third party.

See ~~'curol?a.eu.int;i.otnm/iListice home!Di/~ri\,ac~!di tcs/wpdocs/2006/w~ I 17 en.pdE. ' Directive 95/46/EC = hrtp://byds.iuris.de/bvdsi061 9.9 95-46 EG rahrnen.httn1.

6

228

C M S Hasche Sigle Rechtsanwalle Steuerberater

The Article 29 group assumes that a company could have a legitimate interest in process-

ing data by means of a whistleblowing hotline. The legitimate interest of the company,

however, must outweigh the interest and the fundamental rights of the data subject. The

Article 29 group acknowledges that large international organizations such as the European

Union6 and the OECD7 consider “good” corporate governance an important aspect of a

“well” functioning corporation. The principles established by the EU and the OECD aim at

a maximum level of transparency and stable accounting and finance systems in order to

protect vested interests such as shareholders and market stability in general. In this con-

text, the Article 29 group recognizes the legitimate interest of companies to implement sys-

tems enabling the employees to report irregularities.

Furthermore the group considers the obligation to implement a whistleblowing system aris-

ing from the Sarbanes-Oxley Act to be an opportunity to increase stability of financial mar-

kets and improve protection of shareholders. In this respect, the Article 29 group is of the

opinion that the interest of a company required to implement a whistleblowing system un-

der the Sarbanes Oxley Act is legitimate.

In addition, however, the company’s interest in the data processing has to be weighed

against the rights of the data subject in a review of proportionality. For this purpose, the

Article 29 group established the following guidelines:

Limit on the Number of Persons to Report Through Whistleblowing Systems

Applying the principle of proportionality, the Article 29 group recommends limiting the

number of potential whistleblowers. In this respect, the number of persons who are eligible

can vary according to the sector involved, and it may be necessary to determine in each

individual case whether or not the whistleblower in question is included in the group. The

limitation can, for example, be specified for certain divisions.

Limit on the Number of Persons Who May Be Incriminated Through a Whistleblow-

ing System

European Cornmunit). Commission Recommendation of 15 February 2005 on the role of non-eueciitive or supervisory directors of li\ted companie\ and on the committees of the (supervisory) board (OJ 1, 52. 75 Feb- ruary 2005, p.5 1 )

OIXD. OECD Princrpler of Corporate Governance. 2004. Part One, Section IV.

7

229

C’M SJHasche Sigle Rechtsanwalte Steuerberater

The Article 29 group further recommends assessing whether it might be appropriate to limit

the number of persons who may be reported through a whistleblowing system and, in par-

ticular, to take measures in order to prevent false accusations from launching an investiga-

tion and thus data processing.

Encouraging Identified and Confidential Reports Instead of Anonymous Reports

The Article 29 group attaches particular importance to the question of whether a whistle-

blower should remain anonymous or should be identified, under conditions of confidential-

ity. In the view of the group, the arguments against anonymous whistleblowing include:

-The company will in any case be unable to ensure that the identity of the whistleblower is

not revealed some other way, despite anonymous reports.

- It is more difficult for the company to verify allegations if it is not possible to ask follow-up

questions.

-Anonymous whistleblowing may lead to the development of a culture of (anonymous)

denunciation. The social climate in an organization can deteriorate if employees are

aware that anonymous reports concerning them can be filed at any time.

To ensure the fair practice of data collection, the Article 29 group therefore recommends

that whistleblowing should not be anonymous. Exceptions from this rule are possible in

specific cases.

Companies should thus encourage the employees not to report anonymously via the hot-

line. Of course, this requires security for potential whistleblowers that their reports will be

treated with the utmost discretion and confidentiality. The information must remain confi-

dential throughout the whole process, and must not be passed on to third parties. How-

ever, the company should make it clear that in the event of further investigations the whis-

tleblower’s identity will have to be revealed to the persons involved in the investigation.

Data Processing Only for the Purpose of Processing the Report

Pursuant to the Directive 95/46/EC on the protection of data privacy, personal data may be

collected only for specified and lawful purposes and may not be used in any way that is

incompatible with these purposes.

Given that the purpose of a whistleblowing system is to ensure good corporate govern-

ance, the data collected and processed must be related to this purpose. Therefore, com-

8

230

S Hasche Sigle Rechtsanwalte Steuerberater

panies should limit any reporting via the hotline to certain areas. These can be account-

ing, banking, and financial crime. The data processed in these areas must be limited to

the data strictly and objectively necessary to verify the allegations made.

Compliance With Data Retention Periods

To comply with the principle of proportionality, personal data should be deleted without

undue delay, that is, within two months of completion of the investigation. Only if the com-

pany takes further legal action against the incriminated person or against the whistleblower

in cases of false or slanderous declaration may data be kept for a longer period of time.

Clear hformation About the Whistleblowing System

It is the duty of the company introducing the whistleblowing system to inform the potential

data subjects about the existence and the purpose of such a system, the recipients of the

reports, and the right of access and rectification for reported persons. Furthermore, the

company should notify the employees that the whistleblower's identity will be kept confi-

dential throughout the whole investigation process, but that legal action will be taken

against the whistleblower in the event of abuse of the telephone hotline.

Rights of the Incriminated Person

The Directive requires individuals to be informed when personal data are collected from a

third party and not from them directly. The information must include the identity of the en-

tity responsible for the data processing, the purposes of the processing, the recipients or

categories of recipients of the data and the existence of the right of access to and rectifica-

tion. These provisions of the directive may, however, jeopardize the ability of the company

to gather more information and conduct an efficient investigation. The Article 29 group

therefore allows notification to be delayed as long as the incriminated individual is able to

jeopardize the collection of evidence. The Directive gives the data subject the possibility to

have access to the data registered on him/her at reasonable intervals and without exces-

sive delay in order to check its accuracy and, if necessary, rectify it. The whistleblowing

system must guarantee these rights. The exercise of these rights may be restricted in ex-

ceptional cases in order to protect the rights of others involved. This has to be decided on

a case-by-case basis. Under no circumstances can the person accused in a whistle-

blower's report obtain information about the whistleblower's identity on the basis of the

9

23 1

C M S Hasche Sigle Rechtsanwalte Steuerberater

accused person’s right of access, unless the whistleblower maliciously makes false allega-

tions against a person. The whistleblower’s confidentiality should always be guaranteed.

b) Applicability of Recommendations to Germany

Most of the telephone hotlines implemented in German companies allow employees to

pass on information without restrictions. The Federal Data Privacy Protection Act provides

that, first, the employer must have a legitimate interest in the collection of data and, sec-

ond, that the employee’s interest in preventing the processing or use of the data concern-

ing him does not outweigh the interest of the employer. The opinion of the Article 29 group

provides key points for weighing the interests of the parties involved in consideration of the

need for proportionality. Taking the recommendations of the Article 29 group into account,

and considering the decisions rendered by judges in France, companies should make

sure, when implementing a whistleblowing system, that the report is not made anony-

mously, that the content of the report is restricted to certain areas and therefore to a cer-

tain group of employees, and that the whistleblower’s identity is protected as far as possi-

ble.

It is very likely that national courts and Data Protection agencies will follow the recommen-

dations of the EU Working Party and, therefore, strike down any whistleblowing scheme

that goes beyond the allowed scope.

V. Dismissal of Whistleblowers

German courts have repeatedly ruled that employees reporting illegal activities of their

employer will have to reckon with disciplinary measures that may include dismissal. One

of the reasons for this is certainly rooted in cultural differences between the German legal

system and the Anglo-American common law countries in which whistleblowing, in terms

of meaning, is considered neutral, almost even desirable. In Germany, in contrast, whis-

tleblowing connotes “denunciation” - a connotation that has been shaped by historical ex-

perience during the period of the German Nazi regime and the German Democratic Re-

public. This fundamental attitude helps to explain the position of the courts, which tend to

be negative as far as whistleblowing is concerned.

In several cases concerning conflicting interests of the employer and the employee, courts

have assumed that the employer’s interests with respect to loyalty override the interests of

10

232

C NI S Hasche Si Rechtsanwalte Steuerberater

the employee who reports a violation of law. However, in all these cases the employer did

not introduce a Whistleblowing system with the request to report suspicions of misconduct.

If a company introduces a whistleblowing system by opening a hotline for the purpose of

reporting suspected misconduct, it seems evident that an employee who reports his suspi-

cions of misconduct on the part of his supervisor, employer or colleague cannot be dis-

missed on the grounds of conduct which had previously been requested. Dismissal can

only be considered if the employee, in reporting the misconduct, violates an obligation of

loyalty or confidentiality incumbent on him. The employer may determine the scope of

such obligations. The obligations binding the employee serve to protect the employer, so

that the employer can reduce the employee’s obligations to the employer’s own disadvan-

tage. By implementing a whistleblowing system and instructing the employee to use it in a

certain manner, the employer makes the employee’s duties of conduct more specific. This

means at the same time that the employer alters the obligations of loyalty and confidential-

ity in such a way that the use of the whistleblowing system, in the way previously specified,

is exempt from the obligations of loyalty and confidentiality. Dismissing an employee be-

cause he or she used the whistleblowing system as permitted and requested to do would

contradict the legal principle of “venire contra factum proprium”.’

This does not apply to a case in which a report is made via the hotline in another way than

that prescribed or to an external notification of the violation. If the employee used the

whistleblowing system contrary to the instructions, for example, in order to disturb the

harmony in the workplace by false accusations in areas that are not covered by the whis-

tleblowing system, this can still lead to dismissal. The employer does not alter the duty of

loyalty with regard to every type of use of the whistleblowing system, but only with regard

to its use in the manner precisely specified by the employer. An improper use of the whis-

tleblowing system by the employee can thus constitute an act justifying a warning or even

dismissal.

Even external whistleblowing, for example, by means of a notification given to an authority,

can still be considered a breach of the duty of loyalty or confidentiality.

’ Latin: contradiction of one’s own previous acts

1 1

233

C M S Hasche Sigle Rechtsanwalte Steuerberater

Unless the employee’s interest in external whistleblowing outweighs the employer’s inter-

est in an internal investigation, the employee doing this breaches hidher duty of loyalty

and confidentiality. The employer thus continues to have ways to sanction such acts.

VI. Conclusion

Implementation of a whistleblowing system inevitably alters the duty of loyalty and confi-

dentiality imposed upon the employee. It is no longer possible for the employer to dismiss

a whistleblower acting lawfully, even if the dismissal would have been justified prior to the

implementation of a whistleblowing system. For this reason, companies should provide

their employees with a detailed guideline showing when and how they may report miscon-

duct via the hotline.

To avoid risking a violation of the Federal Data Privacy Protection Act, businesses in Ger-

many should review their existing whistleblowing systems with regard to scope and, follow-

ing the recommendation of the Article 29 group, structure or, if necessary, limit them to

avoid lawsuits relating to data privacy protection. The data should be limited to the areas

specified by the Article 29 group: billing, finance, banking and financial crime. U.S. com-

panies wishing to introduce a whistleblowing system, in particular, should schedule ade-

quate lead time in order to create a global arrangement from the beginning that will be in

line with the requirements of both employment law and data privacy protection law in the

European Union states and still warrants that the obligations resulting from the Sarbanes-

Oxley Act are met. Further reaching reporting obligations will probably no longer be ac-

cepted by work councils, which will usually have a right to be involved in the establishment

of a hotline.

Anke Koerber May 2006

This note provides a general overview of the law only and should not be replied upon in place of specific legal advise

12

234