Personal data protection and whistleblowing are two different topics — different regulations with different purposes, scope and requirements. But, in fact, they are closer than they seem, especially for practical reasons.
Both data protection governance and whistleblowing systems are often exercised by the same unit — the compliance department — or even by the same person. This solution offers several advantages, but also some problematic points that need to be highlighted and clarified in advance.
Why is this question topical, especially in the EU?
The answer is clear: The EU Whistleblower Directive that went into effect December 2021 significantly expands the range of organizations obliged to implement a whistleblowing process.
According to the directive, every employer with more than 50 employees and a number of public entities must set up a confidential reporting channel, appoint a person to investigate reports (whistleblowing officer) and protect the whistleblower from retaliation. Retaliation can be dismissal, change of work location, reduction in wages, imposition of any disciplinary measure, discrimination, etc.
What do data protection and whistleblowing have in common?
Whistleblowers can notify possible violations in personal data processing. If they use the whistleblowing channel, their notifications will be thoroughly investigated and the whistleblower will be protected from retaliation. If the suspicions are confirmed, the organization should take corrective action.
We know of similar cases from the past, connected with Big Tech, like Project Nightingale and Google and Frances Haugen and Meta. But we can presume similar cases can occur in companies outside of Big Tech, possibly even through the official whistleblowing channel.
The second point is purely practical. Due to capacity reasons, the data protection officer is often also responsible for setting up the whistleblowing process and for dealing with individual whistleblowing notifications. For financial, personnel and other reasons, this can be a meaningful solution. However, there are several problematic points that threaten the credibility of both roles, especially possible conflicts of interest. Therefore, it is necessary to think about these issues in advance and solve them.
What do DPOs and whistleblowing officers have in common?
Merging DPO and whistleblowing officer roles is not always due to a lack of capacity. Both roles have similar requisites and requirements.
- Independence: For both an efficient whistleblowing system and data privacy program, it is essential that the key person is independent in the performance of their function. They must not require or receive any instructions and must be free to solve individual issues according to their reasoning, knowledge and experience.
- Access to top management: Direct access to top management is an essential part of independence. Whether in the form of submitting regular reports or raising ad hoc issues like serious whistleblowing notifications, data breaches, etc.
- Confidentiality and personal integrity: Without the personal integrity, credibility and confidentiality of the DPO or whistleblowing officer, none of these processes can fully work. If employees do not trust the person responsible for this function, they simply won't work together to solve problems and the problems will grow.
- Capacity and resources: Monitoring an organization's compliance with data protection regulations as well as investigating whistleblowing reports is time consuming. Whether the roles of DPO and whistleblowing officer are combined or separated, employees must be given enough time and resources to perform them properly.
- Know your organization: If the DPO or whistleblowing officer do not have deep knowledge of their organization, the whole process can slip into a formality. Another common point of both roles is, therefore, the necessary knowledge of internal procedures, organization, processes, products and key stakeholders, as well as adequate access to internal information, documents and systems.
Conflicts of interest as the main risk
The roles of DPO and whistleblowing officer have multiple similarities. Merging these two functions into one organizational unit — or directly into one employee — is worth considering. However, this solution contains a possible conflict of interest that can seriously jeopardize the credibility of the person serving both roles and, by extension, confidence in the organization's protection of personal data or whistleblowing process.
A whistleblowing notification may concern the use of personal data, interference with the privacy of clients and employees, or similar situations. If the same person first assesses data processing in the DPO role and finds it to be compliant with the regulation, they can hardly be expected to judge differently as a whistleblowing officer.
Another potential conflict of interest arises when the whistleblowing process itself contains sensitive and risky data processing. Protecting the identity of the whistleblower is one of the key elements of the whole process, especially to protect them from retaliation. If the whistleblower's identity is made available to unauthorized recipients, the matter should also be reviewed by the DPO. However, if the data leaks from the DPO while they are acting as a whistleblowing officer, can they be expected to find fault with their procedure?
Involving another stakeholder
The benefits of merging both roles often outweigh the above-mentioned risks and potential conflicts of interest.
The possible advantages of merging the two roles mainly includes cost reduction. If an organization has an expert who meets the requirements and whose DPO role does not take up their entire work capacity, it may make sense to assign them an additional role in the whistleblowing area.
However, this does not mean that the organization should not deal with the risk.
In practice, a solution can be having another employee or individual identify conflicts of interest and manage those situations instead. Organizations merge the role of DPO and whistleblowing officer should set up a process for complaints or questions on common points, like privacy protection amid whistleblowing investigations, to be handles by someone else. They could be another employee from the compliance unit, an external attorney, a relevant board member, etc. The organization should inform all affected persons about this solution to avoid lack of trust in both systems.
Establishing an additional system for handling data protection in whistleblowing situations may seem contradictory to the cost reduction, but the number of similar common cases will be low in practice. This additional capacity should not put an excessive burden on the organization. Instead, it will bring savings and efficient use of capacities, as well as the trust of the employees and other persons concerned in a functional data privacy and whistleblowing process. And trust is one of the key outputs of both mentioned processes.
