Institutional arrangements for whistleblowing: Challenges and best practices

Page created by Bob Nunez
Transparency International Anti-Corruption Helpdesk Answer

Institutional arrangements for
whistleblowing: Challenges and best
Author(s): Miloš Resimić,
Reviewer(s): Marie Terracol, Transparency International
Date: 30 April 2021

Robust legislation is essential to protect whistleblowers against retaliation and other injustices,
and to ensure their reports are addressed. But once adopted, such legislation needs to be
effectively implemented and enforced. National authorities often have a key role to play in
implementation and enforcement, from receiving and addressing whistleblowing reports about
wrongdoing, advising and protecting whistleblowers, raising awareness and monitoring
implementation by stakeholders.
Institutional arrangements for whistleblower protection vary considerably across countries, from
centralised models, with one authority in charge of whistleblowing related matters, to highly
decentralised models, where over a hundred authorities have whistleblowing related
responsibilities. Literature about the existing institutional arrangements, their challenges and
potentially emerging best practices is rather scarce.
All institutional arrangements presented in this paper have their own challenges – gaps,
overlaps, poor implementation, unclear procedures, insufficient resources and weak protection
mechanisms for whistleblowers – and some lessons have already emerged regarding the cause
of these challenges and potential solutions. This includes the need for adequate resources and
powers to allow authorities to fulfil their responsibilities, clear information for whistleblowers
and the need for a central agency to oversee implementation and to provide protection to

© 2021 Transparency International. All rights reserved.
Supported by a grant from the Open Society Policy Center in cooperation with the Open Society Initiative of Europe (OSIFE), part of the Open Society Foundation.This
document should not be considered as representative of Transparency International’s official position. Neither Transparency International nor the Open Society
Foundation is responsible for the use which might be made of the following information.
What institutional arrangements ensure effective implementation and enforcement of
whistleblowing legislation? What are the challenges and lessons learned?

1. Introduction                                                                        Main points
2. Overview of possible institutional
                                                                                       — There are many possible institutional
3. Examples of institutional arrangements                                                    arrangements for whistleblowing, from
4. Challenges and lessons learned                                                            rather centralised models, where one
5. Conclusion                                                                                authority plays a key role, to
                                                                                             decentralised models, without an
Introduction                                                                                 authority responsible for whistleblowing.

Whistleblowers play an essential role in                                               — A specialised authority can be
uncovering corruption and other wrongdoing that
                                                                                             established, or whistleblowing roles and
threaten the rule of law, public health and
                                                                                             responsibilities can be given to one or
democracy in general (Terracol 2018). Having
effective protection in place for whistleblowers is                                          several authorities.
essential for encouraging a speak-up culture which
can lead to uncovering illegal practices and
                                                                                       — Main challenges: lack of resource and
behaviour (OECD 2011).                                                                       capacity to fulfil tasks; weak monitoring
                                                                                             and oversight of competent authorities;
Whistleblowing refers to “the disclosure of                                                  expectation gap with regard to
information related to corrupt, illegal, fraudulent or
                                                                                             whistleblowing authorities’ responsibilities
hazardous activities being committed in or by
                                                                                             and powers; inadequate protection for
public or private sector organisations – which are
of concern to or threaten the public interest – to                                           whistleblowers; a general lack of legal,
individuals or entities believed to be able to effect                                        financial and psychological support.
action” (Transparency International 2013).
                                                                                       — Lessons: adequate resources and powers
A robust institutional framework is a key element in                                         is key; clear information and guidance for
effective whistleblowing protection. Failures to                                             whistleblowers; need a central agency for
adequately respond to whistleblowers’ disclosures
                                                                                             oversight of implementation and to
and to provide them necessary protection are key
                                                                                             provide protection to whistleblowers.
challenges that prevent whistleblowers from
coming forward with their disclosure (Savage and
Hyde 2015).

© 2021 Transparency International. All rights reserved.
Supported by a grant from the Open Society Policy Center in cooperation with the Open Society Initiative of Europe (OSIFE), part of the Open Society Foundation.This
document should not be considered as representative of Transparency International’s official position. Neither Transparency International nor the Open Society
Foundation is responsible for the use which might be made of the following information.
While there is a decent body of comparative work            receiving and addressing external whistleblowing
on whistleblowing legislation as well as numerous           reports are distinct from those responsible for
international standards (Brown et al. 2014;                 oversight and enforcement. For this reason,
Transparency International 2013; OECD 2011),                institutional arrangements for both roles will be
much less is known about the institutional                  looked at separately. However, in some countries,
framework needed to ensure effective                        the same authority is responsible for both roles,
implementation and enforcement of this legislation.         notably in Australia and Israel (for the public
                                                            sector) and the Netherlands.
This is an especially important and timely topic to
address considering that more and more countries            The role, responsibilities and powers of the
are adopting whistleblowing legislation. In the EU,         authorities involved vary a lot, both across
the 27 member states have until December 2021 to            countries and across authorities within countries.
implement the 2019 EU Directive on the Protection           Some authorities’ responsibilities extend to both
of Persons Reporting on Breaches of Union     Law.1         the public and private sector, while others are only
When adopting whistleblowing legislation,                   responsible for public sector whistleblowing, or for
policymakers need to consider the institutional             a particular area (for example, health and
arrangement needed for implementation and                   banking). Some authorities have large
enforcement. This Helpdesk answer offers a review           investigative powers, can take binding decisions
of several existing institutional arrangements and          and can pronounce sanctions. Others can only
provides insights into the key challenges and               make non-binding recommendations.
lessons of existing models.
                                                            Institutional arrangements for dealing
Overview of possible                                        with external whistleblowing reports
institutional arrangements                                  Most whistleblowing legislation foresees the
                                                            possibility for whistleblowers to report wrongdoing
According to international standards and best
                                                            to the authorities, either after having first made a
practice, whistleblowing legislation should foresee
                                                            report internally to their organisation or directly.
two main roles for national authorities: i)
                                                            One or several authorities should thus be
participating in implementation by receiving and
                                                            competent for receiving and addressing these
addressing external whistleblowing reports; and ii)
                                                            external whistleblowing reports.
ensuring oversight and enforcement of
whistleblowing legislation (Transparency                    In the context of receiving and addressing
International 2013).                                        whistleblowing reports, this paper looks at the role
                                                            of authorities regarding external whistleblowing
Institutional arrangements for whistleblowing
                                                            only. Many authorities also have to address
legislation vary a lot across countries. In many
                                                            internal whistleblowing with regards to alleged
countries with an established whistleblowing
                                                            wrongdoing within the authority itself, but this is not
institutional framework, the authorities in charge or


Transparency International Anti-Corruption Helpdesk
Institutional arrangements for whistleblower protection: Main challenges and best practices
the focus of this query, and different mechanisms           either directly (in the Republic of Korea) or by
often apply in these cases.                                 advising the whistleblower (in France). In the
                                                            Netherlands, the Whistleblowers Authority can
Existing institutional arrangements to receive and          both direct whistleblowers to other competent
address external whistleblowing reports can be              authorities and receive and investigate external
grouped under three categories: centralised                 whistleblowing reports itself.
models, decentralised models and mixed models.
                                                            In countries where a central authority is involved,
The centralised approach is characterised by one            either directly or indirectly, with external
authority – a specialised whistleblowing agency or          whistleblowing reports, this authority also has
an existing body which is assigned this role – in           tasks related to oversight and enforcement of
charge of receiving and addressing external                 whistleblowing legislation.
whistleblowing disclosures. This is the case, for
example, in Australia and Israel, but only for the          Institutional arrangements for
public sector.                                              oversight and enforcement of
                                                            whistleblowing legislation
Many countries have adopted a decentralised
                                                            According to international standards, one or
institutional framework for receiving and
                                                            several independent agencies should be
addressing external whistleblowing reports,
                                                            responsible for the oversight and enforcement of
meaning that several authorities are competent to
                                                            whistleblowing legislation (McDevitt and Terracol
do so, usually within the remit of their area or work.
                                                            2020; Transparency International 2013; Loyens
They often include regulatory authorities and law
                                                            and Vandekerckhove 2018a, 2018b). This entails:
enforcement or investigative agencies. In a few
countries, whistleblowing legislation specifically
                                                                   providing individual confidential advice to
foresees the designation of the authorities
                                                                    whistleblowers, free of charge
competent to receive and address external
                                                                   providing support to whistleblowers (e.g.
whistleblowing reports under the whistleblower
                                                                    legal, financial and psychological)
protection legislation – this is the case of the
                                                                   receiving, investigating and addressing
“prescribed persons” model of the UK and Ireland.
                                                                    whistleblowers’ complaints of retaliation
In other countries, the whistleblowing legislation
                                                                    (which may include ordering of protective
refers to competent authorities in general terms,
                                                                    measures, such as freezing employment
without providing further details about how they will
be identified.
                                                                   dealing with complaints about improper
                                                                    investigation of whistleblowing reports by
In mixed approaches, several authorities are
                                                                    public and private organisations and
competent for receiving and addressing external
                                                                    competent authorities
whistleblowing reports, as in decentralised models,
                                                                   providing guidance and advice to
but a central whistleblowing authority also plays a
                                                                    employers and competent authorities on
role; for example, it can be responsible for
                                                                    how to set up effective whistleblowing
directing disclosures to the appropriate recipient,

Transparency International Anti-Corruption Helpdesk
Institutional arrangements for whistleblower protection: Main challenges and best practices
    controlling implementation by employers            Dealing with whistleblowers’ complaints of
         and competent authorities (and imposing            retaliation are often solely (for example, in
         sanctions if they fail to fulfil their             Australia, Ireland and the UK) or partly handled by
         obligations)                                       the courts, even in countries with designated
        monitoring and reviewing the functioning of        whistleblowing authorities (such as France).
         whistleblowing laws and frameworks
         including by regularly collecting and              Examples of institutional
         publishing data                                    arrangements
        raising public awareness about
         whistleblowing and whistleblower                   The country examples presented below were
         protection                                         selected because they illustrate different
                                                            institutional arrangement options and have been
The Netherlands is the only country with one                functioning long enough to give rise to
single agency covering both the public and private          assessments of their functioning.
sectors which is responsible for most of the tasks
involved in oversight and enforcement of                    Institutional arrangement in Australia
whistleblowing legislation. In Australia and Israel,        (for the public sector)
the whistleblowing authorities only deal with the           In Australia, legislation on whistleblower protection
public sector.                                              covering federal level public sector
                                                            (Commonwealth public sector) – the Public
In several countries, such as Ireland and the UK,
                                                            Interest Disclosure Act (PID)2 – was adopted in
no authority was designated to oversee and
                                                            2013. It designates the Commonwealth
enforce whistleblowing legislation. Some tasks,
                                                            Ombudsman,3 which is accountable to the
such as providing advice and support to
                                                            parliament, as responsible for receiving and
whistleblowers, are carried out by civil society
                                                            addressing whistleblowers’ external disclosures
organisations (CSOs).
                                                            and gives it a key role in oversight and
Slovakia moved from a rather decentralised model
(both at the national and local levels) toward a very       Dealing with external whistleblowing reports
centralised approach to oversight and
enforcement. In France, two authorities are                 The role of the Commonwealth Ombudsman in
assigned oversight and enforcement                          receiving and addressing external whistleblowing
responsibilities.                                           reports is rather limited. First, it only concerns

2 Public Interest Disclosure Act of 2013,
3 Commonwealth Ombudsman webpage,


Transparency International Anti-Corruption Helpdesk
Institutional arrangements for whistleblower protection: Main challenges and best practices
disclosures about wrongdoing within federal public                 providing general information to
bodies.                                                             whistleblowers with regards to where and
                                                                    how they can make a disclosure and public
Second, the Commonwealth Ombudsman can                              agencies
directly receive whistleblowing reports about                      providing advice to relevant public
wrongdoing but only if it is not appropriate to make                agencies on implementing whistleblowing
an internal disclosure (when there is a conflict of                 processes
interest, confidentiality or a retaliation issue the               overseeing and reporting on the operation
agency cannot manage).4 In most cases, the                          of the PID Scheme, including through
Commonwealth Ombudsman will work with the                           collection of data from public agencies and
whistleblower and the agency to return the issue to                 the publication of an annual report
the relevant agency for investigation (Annakin                      (Terracol 2018)
2011; Loyens and Vandekerckhove 2018a).                            promoting awareness and understanding
                                                                    of the PID Act.6
In the limited cases where the Commonwealth
Ombudsman investigates a whistleblowing report              The Commonwealth Ombudsman does not
about wrongdoing, it has the authority to hear              provide individual advice to whistleblowers, nor
witnesses, visit premises of relevant agencies and          does it investigate retaliation. In case of complaint
require documents from either persons or                    of retaliation, whistleblowers are directed back to
agencies (Loyens and Vandekerckhove 2018b:                  the agency that was dealing with their disclosure,
72).                                                        which can then do an investigation. Once the case
                                                            of retaliation is referred to the agency, the
Third, the Commonwealth Ombudsman can also
                                                            Commonwealth Ombudsman has no jurisdiction to
receive whistleblowers’ complaints about the
                                                            monitor the investigation of retaliation. Another
outcome of an agency’s handing of a disclosure.
                                                            option at whistleblowers’ disposal in cases of
However, in that case, it only reviews whether the
                                                            retaliation are the courts (Loyens and
agency’s handling of the report and decision was
                                                            Vandekerckhove 2018b). However, the court
lawful, reasonable and fair. It does not re-
                                                            process is costly for whistleblowers, creating a
investigate the matter.5
                                                            power imbalance in terms of resources available to
Oversight and enforcement of                                a public sector agency on the one hand and to the
whistleblowing legislation                                  whistleblower on the other (Parliamentary Joint
                                                            Committee 2017).
The Commonwealth Ombudsman is responsible
for:                                                        Transparency International Australia and a 2017
                                                            parliamentary inquiry highlighted the need for a

4 See:
5 See:

6 See:


Transparency International Anti-Corruption Helpdesk
Institutional arrangements for whistleblower protection: Main challenges and best practices
whistleblower protection authority to assist                of failures to comply with its recommendations, the
whistleblowers, investigative agencies and                  ombudsman has no enforcement mechanism,
regulators with advice, case support, enforcement           other than notifying the relevant minister or the
action and remedies for retaliation. Several draft          State Audit Affairs Committee about the matter.
laws have proposed the creation of a national               For criminal matters, the ombudsman must alert
whistleblower protection commissioner with such             the attorney general, who will notify the state
powers and responsibilities. (TI Australia and              comptroller within six months about the matter
Griffith University 2020).                                  (Loyens and Vandekerckhove 2018b).

Institutional arrangement in Israel (for                    The Office of the Ombudsman has regional offices
the public sector)                                          whose aim is to increase the accessibility
                                                            throughout the country and to make the
In Israel, the State Comptroller and Ombudsman is
                                                            investigation more efficient in cases when
responsible for receiving and addressing
                                                            investigators deal with complaints against regional
whistleblowers’ external disclosures and plays a
                                                            bodies (State of Israel, the Ombudsman 2009: 17).
key role in oversight and enforcement of
whistleblower protection through the Office of the          Oversight and enforcement of
National Ombudsman8 (State of Israel, the                   whistleblowing legislation
Ombudsman 2009). The Office of the Ombudsman
is a special unit within the Office of the State            The ombudsman is responsible for many of the
Comptroller and Ombudsman. The institution is               tasks involved in oversight and enforcement of
responsible to the parliament (the Knesset).                whistleblowing legislation, but only regarding the
                                                            public sector.
Dealing with external whistleblowing reports
                                                            It has extensive powers when it comes to
The State Comptroller and Ombudsman                         whistleblower protection. It can investigate
investigates whistleblowers’ disclosures about              whistleblowers’ complaints of retaliation and issue
wrongdoings in public bodies which are subject to           temporary protective orders for whistleblowers,
its audit. It has wide investigative powers which           until the end of the investigation or until the
include full access to relevant materials,                  ombudsman makes another decision, which is
information, documents, as well as the power to             binding (State of Israel, the Ombudsman 2009:
subpoena witnesses.9 In case the ombudsman                  30). The breach of the protective order may be a
finds a whistleblower’s disclosure about                    criminal or a disciplinary offence (Office of the
wrongdoing justified, it may make                           State Comptroller and Ombudsman of Israel no
recommendations to rectify the issue and the                date).
public institution must inform the ombudsman of
the steps taken in that regard. However, in cases

7                                                           8
 See for example the Australian Federal Integrity             See:
Commission Bill 2019-2020:                        
                                                            9 See:

Transparency International Anti-Corruption Helpdesk
Institutional arrangements for whistleblower protection: Main challenges and best practices
If a complaint is filed by a whistleblower who was          Institutional arrangement in the UK
dismissed, remedies include enforcement of                  and Ireland
employment which existed prior to submitting the
                                                            In the UK, the Public Interest Disclosure Act
complaint, a compensation to the whistleblower
                                                            (PIDA) was adopted in 1998. Ireland adopted the
(financial or other), or the transfer of the
                                                            Protected Disclosures Act (PDA) in 2014. Both
whistleblower to another position within their
                                                            countries have similar institutional arrangements,
workplace (State of Israel, the Ombudsman 2009).
                                                            with a decentralised approach to handling external
The decision on the appropriate remedy depends
                                                            whistleblowing reports and the absence of
on the ombudsman’s assessment of the situation.
                                                            designated authorities to ensure oversight and
The ombudsman also encourages parties involved
                                                            enforcement of whistleblowing legislation.
to come to an agreement through mediation or
negotiation (Office of the State Comptroller and            Dealing with external whistleblowing reports
Ombudsman of Israel no date).
                                                            The UK relies on “prescribed persons” to receive
Officially, the State Comptroller and the                   and investigate external whistleblowing disclosures
Ombudsman do not provide advice to potential                about alleged wrongdoings (PIDA section 43F). “A
whistleblowers but they do respond to their                 prescribed person is someone who is independent
inquiries with respect to procedures and risks              of the employee’s organisation, but usually has an
(Loyens and Vandekerckhove 2018b). Recent                   authoritative relationship with the organisation,
developments in Israel show a trend towards                 such as a regulatory or legislative body” (National
enabling more support to whistleblowers,                    Audit Office (NAO) 2015: 4).
specifically to provide psychological support for
whistleblowers and their family members, as well            The prescribed person is not under statutory

as to provide legal aid (Loyens and                         obligation to act on the submitted disclosure, but

Vandekerckhove 2018b; Office of the State                   they decide, based on the submitted information,

Comptroller and Ombudsman of Israel no date). In            whether they will act on it (Savage and Hyde 2015;

case whistleblowers receive threats to their safety         UK Government no date). They can recommend

or suffer actual harm, the ombudsman can refer              rectification for any issues they find with regards to
them to the Israel Witness Protection Authority             the employer’s whistleblowing policies and

(Office of the State Comptroller and Ombudsman              procedures, or with regards to the substance of

of Israel no date).                                         disclosure (NAO 2015; BIS 2017: 6). So far as the
                                                            statutory functions of prescribed persons beyond
The regional offices of the ombudsman engage in             whistleblowing legislation allow, some may also be
raising public awareness by circulating information         able to take enforcement actions (BIS 2017: 6).
about the ombudsman’s authority and the ways to
submit a complaint in several languages in                  Ireland adopted a similar institutional arrangement.

newspapers several times a year and through                 The PDA of 2014 provides that the persons

flyers (State of Israel, the Ombudsman 2009).               competent to receive and address external
                                                            disclosures about alleged wrongdoings are
                                                            “prescribed” by Minister Order (PDA, Section7).


Transparency International Anti-Corruption Helpdesk
Institutional arrangements for whistleblower protection: Main challenges and best practices
Oversight and enforcement of                                 training and supporting a network of Freedom to
whistleblowing legislation
                                                             Speak up Guardians in England. It provides

In the UK and Ireland, no authority was given                awareness raising and training courses to

responsibility for the oversight and enforcement of          encourage a speak-up culture (Loyens and

whistleblowing legislation, with the exception, to           Vandekerckhove 2018b). It also does case reviews

some extent, of the National Guardian, a sectoral            of organisations when speaking up has not been

whistleblowing agency specifically for health sector         handled in accordance with best practices. The

in the UK. Prescribed persons in Ireland and the             body does not have a regulatory or investigative

UK do not provide advice or protection to                    role and it cannot provide remedies. Rather, when

whistleblowers or oversee implementation of the              it identifies cases where best practices are not

law by employers. Whistleblowers need to turn to             followed, it formulates recommendations for

the courts in cases of retaliation.                          improvement.12

General information and guidance for                         Institutional arrangement in France
whistleblowers, public and private organisations, as         In France, the legislative framework which
well as prescribed persons are available on                  provides whistleblower protection in both public
government websites. However, individual support             and private sectors was adopted in 2016 under the
and advice is provided by specialised CSOs, such             so called Sapin II Law. The institutional
as   Protect10   in the UK and TI Ireland, filling the gap   arrangement is mixed when it comes to handling
in the institutional framework. They operate advice          external whistleblowing reports. Oversight and
lines for whistleblowers, free of    charge.11               enforcement of the whistleblowing law is the
Transparency International provides legal                    responsibility of two authorities.
assistance as well through its Transparency Legal
                                                             Dealing with external whistleblowing reports
Advice Centre. In addition, both CSOs provide
direct support to employers to set up internal
                                                             An external disclosure can be made to several
whistleblowing mechanisms through membership
                                                             types of competent authorities:
packages, training, consultancy and bespoke
options. Protect supports over 3,000 whistleblowers                    competent administrative authorities, which
and hundreds of organisations every year, which                         may include those authorities that have
tends to indicate a need for such support.                              supervision over the whistleblowers’
This need is further illustrated by the establishment
                                                                       a competent professional order, such as
in the UK in 2016 of the National Guardian, a
                                                                        the order of lawyers, notaries and others
sectoral whistleblowing agency specifically for the
                                                                       a competent judge (Défenseur des Droits
National Health Service (NHS), to address the fact
                                                                        2017: 15).
that the health sector was particularly plagued by
whistleblowing scandals. This office engages in

10                                                           12
   Former Public Concern at Work.                                 See:
11 See: and

Transparency International Anti-Corruption Helpdesk
Institutional arrangements for whistleblower protection: Main challenges and best practices
Unlike the prescribed persons approaches, the law            publish a special report, in which the name of the
does not foresee to “prescribe” specific bodies. To          accused person is revealed. It can also apply to a
help whistleblowers identify the appropriate                 disciplinary body with power to take proceedings
recipient for their external report, the Defender of         against a defaulting officer or professional. When
Rights (French Ombudsman), an independent                    legal action has been taken, the Defender of
government authority, was assigned the                       Rights can make observations to the court.13
responsibility to receive whistleblowers’
disclosures and direct the whistleblower to the              Originally, there was another mission planned for
appropriate authority or organisation for making             the Defender of Rights – providing financial aid to
their report. The ombudsman does not investigate             whistleblowers to help them take legal action. This
whistleblowers’ disclosures about alleged                    provision was rejected by the constitutional
wrongdoings itself (Défenseur des Droits 2017;               council, which, however, did acknowledge that
Stolowy, Paugam and Londero 2019).                           financial support for whistleblowers may turn out to
                                                             be necessary in the future (Stolowy, Paugam and
Oversight and enforcement of                                 Londero 2019; Loyens and Vandekerckhove
whistleblowing legislation
                                                             2018b). Legal, financial and psychological support

In addition to guiding whistleblowers, the Defender          is currently offered by the House for

of Rights is responsible for protecting their rights         Whistleblowers, a CSO.14

and freedoms. The Defender of Rights has wide
                                                             In addition to handling individual situations, the
powers to investigate whistleblowers’ complaints of
                                                             Defender of Rights works to improve
retaliation, from simple requests for explanations
                                                             whistleblowers’ rights and freedoms generally. It
and documents to more restrictive means, such as
                                                             has the power to put forward proposed
summoning the accused person to a hearing or
                                                             amendments to laws or regulations and to give its
carrying out an "on-site verification" (under the
                                                             opinion on draft or proposed laws relating to
supervision of the judge). Refusing to respond to a
                                                             whistleblower protection, which it has done on
request of the Defender of Rights is a criminal
                                                             several occasions (Défenseur des Droits 2019).
                                                             The French Anti-Corruption Agency (AFA) plays a
The Defender of Rights can facilitate a negotiated
                                                             role in ensuring that public and private
settlement and make a recommendation, which is
                                                             organisations set up adequate internal
an official request that the issue be resolved
                                                             whistleblowing mechanisms. In France, all public
and/or that a measure be taken by a specific
                                                             and private organisations with more than 50
deadline. While the Defender of Rights does not
                                                             employees are obliged to establish internal
have a direct power of sanction, the person
                                                             whistleblowing mechanisms (Stolowy, Paugam
implicated is required to report on the follow-up
                                                             and Londero 2019). The AFA is responsible for
given in its recommendations. In the absence of a
                                                             providing them with advice in that regard, including
response, the Defender of Rights can decide to

13                                                           14
 See:                                                          See:   dalerte/

Transparency International Anti-Corruption Helpdesk
Institutional arrangements for whistleblower protection: Main challenges and best practices
through the dissemination of information and good           Dealing with external whistleblowing reports
                                                            External whistleblowing reports are addressed by
The AFA also has a mission to control the quality           a number of competent authorities. The ACRC
and effectiveness of the procedures in place in             receives external whistleblowing reports and
public entities and large companies (with more              allocates them to the relevant competent
than 5,000 employees), but only in so far as they           authorities for investigation. It does not investigate
relate to anti-corruption. In cases of non-                 external whistleblowing reports itself. Once the
compliance by a large company, the AFA can                  investigation is concluded, the competent authority
issue a warning or pronounce sanctions, including           informs the ACRC about the outcomes of the
an injunction to adapt their procedures according           investigation, and then the ACRC informs the
to its recommendations, impose financial penalty            whistleblower about the outcome.18
of up to €200,000 for natural persons and up to
                                                            The ACRC does not merely serve to forward the
€1 million for legal persons and order the
                                                            disclosure to the appropriate body but retains the
publication, dissemination or display of its
                                                            oversight of the investigation (UNODC 2015: 37).
decision.15 This sanctioning power does not extend
                                                            An agency has 60 days from receiving the report
to public entities.16
                                                            to complete its investigation. This deadline can be
Institutional arrangement in the                            extended for justifiable reasons, and the ACRC
Republic of Korea                                           has to be notified. Reasons are often found to
                                                            prolong these deadlines, which leads to poorer
The Korea Independent Commission Against
                                                            implementation and a lack of efficiency (Loyens
Corruption (KICAC), established in 2002, was
                                                            and Vandekerckhove 2018b).
tasked with receiving disclosures as well as
protecting and rewarding whistleblowers.17 In               Oversight and enforcement of
2008, it was combined with the ombudsman and                whistleblowing legislation
the Administrative Appeals Commission and
                                                            The ACRC provides information and consultation,
became the Anti-Corruption and Civil Rights
                                                            protects and rewards whistleblowers, formulates
Commission (ACRC). The ACRC deals with both
                                                            recommendations, does follow ups, and engages
public and private sector whistleblowing. Housed
                                                            in various preventive and awareness raising
under the prime minister, it is mandated to receive
                                                            activities19 (Loyens and Vandekerckhove 2018b).
external whistleblowing reports and play a key role
in oversight and enforcement.                               The ACRC is responsible for investigating
                                                            whistleblowers’ complaints of retaliation. It may
                                                            request people (whistleblower, employer, relevant

15                                                          18
   See: https://www.agence-francaise-                          See:
16 See: https://www.agence-francaise-                       l&method=searchList&menuId=0203160605.
                                                            19 See:
17 See:                                           

Transparency International Anti-Corruption Helpdesk
Institutional arrangements for whistleblower protection: Main challenges and best practices
institutions) to appear before the ACRC and                 Institutional arrangement in the
request documents (Act on ACRC Article 62-2).               Netherlands
The ACRC can order protective measures to
                                                            In the Netherlands, the law on whistleblower
remedy retaliation and ensure continued
                                                            protection adopted in 2016 – the Whistleblower
employment of whistleblowers, such as
                                                            Authority Act – established the Whistleblowers
reinstatement to their original position, their
                                                            Authority.22 The Netherlands is the only country
transfer to another post, and cancellation of any
                                                            with one single agency covering both the public
disadvantageous measures against them. It can
                                                            and private sectors which is responsible for most
impose fines in cases of non-compliance with
                                                            of the tasks involved in implementation, oversight
protected measures and is even mandated to
                                                            and enforcement of whistleblowing legislation,
check whether these measures were implemented
                                                            namely: advice, psychosocial support,
and whether the whistleblower faced any further
                                                            investigation of alleged wrongdoing, investigation
retaliation (Terracol, 2018). As an additional
                                                            of alleged retaliation and prevention (Loyens and
protective measure, ACRC may request the police
                                                            Vandekerckhove 2018b).
to take steps to protect whistleblowers and their
family members in cases of danger to their lives            The Dutch Whistleblowers Authority is an
(Act on ACRC Article 64-2).                                 independent governing body, accountable to the
                                                            parliament. It responds to the Ministry of Interior
The ACRC is responsible for rewarding
                                                            and Kingdom Relations for its budget, but the
whistleblowers if their report has contributed
                                                            ministry cannot determine the authority’s policy,
directly to recovering or increasing revenues or
                                                            nor can it reverse decisions made by the board.23
reducing expenditures for public agencies or has
served the public interest.20                               Dealing with external whistleblowing reports

With regards to raising public awareness, the Anti-         When it comes to receiving and addressing
Corruption Training Institute (ACTI), which was             external whistleblowing reports, the Netherlands
established under ACRC in 2012, works on                    adopted a mixed approach as the Dutch
changing the attitudes to integrity and improving           Whistleblowers Authority is not the only authority in
ethical standards of public officials.21                    the Netherlands competent to receive and address
                                                            external whistleblowing reports. Other
The ACRC does not provide free legal aid or                 administrative authorities or agencies are also
financial aid to whistleblowers. This gap is in part        competent to do so under other laws and
filled by CSOs (Loyens and Vandekerckhove                   regulations, such as the police, the public
2018b).                                                     prosecution services, inspection services,
                                                            regulators and other supervisory authorities.

20                                                          21
  See:                                                         See:
hod=searchList&menuId=02031607.                             hod=searchList&menuId=02031604.
                                                            22 See:
                                                            23 See:


Transparency International Anti-Corruption Helpdesk
Institutional arrangements for whistleblower protection: Main challenges and best practices
The investigation department of the                         Seemingly going further than the law’s
Whistleblowers Authority deals both with external           requirements, the Whistleblowers Authority
whistleblowing reports about alleged wrongdoing             indicates on its website that whistleblowers should
and whistleblowers’ complaints of retaliation. The          report first both internally within their organisation
investigation of whistleblowers’ disclosures about          and to an appropriate external authority before
alleged wrongdoings includes a desktop research             submitting a report of wrongdoing to the
and conducting interviews with witnesses.                   Whistleblowers Authority.24 It appears that, when it
Employer and the employees of the concerned                 comes to receiving and addressing whistleblowing
organisation are obliged to cooperate in the                reports of wrongdoing, the Dutch Whistleblower
investigation. Each party involved has the chance           Authority consider itself responsible to address
to provide their views, after which the final report is     improper investigation of external whistleblowing
written and published on the Whistleblowing                 reports by other authorities, rather than an
Authority’s website (Whistleblowers Authority               authority competent to receive and address
2018: 10). The report provides conclusions and              external whistleblowing reports directly.
recommendations to prevent repeating the
                                                            Oversight and enforcement of
wrongdoing in question. The Dutch Whistleblowers
                                                            whistleblowing legislation
Authority cannot impose penalties in cases of non-
compliance, and its findings and recommendations            The Whistleblowers Authority in the Netherlands
are not binding, and thus cannot be legally                 has the authority to provide advice and
enforced (TI Netherlands 2020: 6). However, the             psychosocial support to whistleblowers,
organisation concerned is obliged to inform the             investigating whistleblowers’ complaints of
House of how they are following up on the                   retaliation and promoting integrity in organisations.
recommendations.                                            It does not seem to conduct public awareness
                                                            raising campaigns.
The Whistleblowers Authority’s advisory
department is responsible for referring                     As previous explained, the investigation
whistleblowers to other competent authorities to            department of the Whistleblowers Authority deals
make their external report (section 3a of the act),         with both whistleblowing reports about wrongdoing
and the investigative department of the                     and whistleblowers’ complaints about retaliation,
Whistleblowers Authority can refuse to initiate an          following the same procedure. The Whistleblowers
investigation if it determines that another                 Authority does not have the authority to order
competent authority is dealing with or has dealt            protective measures, such as freezing an
properly with the report of wrongdoing (section 6 of        employment situation.
the Act).
                                                            As for investigations into wrongdoing, the findings
                                                            and opinion contained in the investigation report


Transparency International Anti-Corruption Helpdesk
Institutional arrangements for whistleblower protection: Main challenges and best practices
are not binding. The authority can formulate                      Institutional arrangement in Slovakia
recommendations to the employer with regards to
                                                                  In Slovakia, the first law on whistleblowing came
improving the way they treat employees who
                                                                  into force in 2015. It was replaced by a new law
report wrongdoing, but does not provide opinions
                                                                  which came into force in March 2019, which
with regards to any civil law liability
                                                                  modified the institutional arrangement, especially
(Whistleblowers Authority 2018). Whistleblowers
                                                                  regarding oversight and enforcement, by creating
can submit the report in potential legal
                                                                  a new independent whistleblowing authority, the
proceedings but it is up to the judge whether it will
                                                                  Whistleblower Protection Office.26
be included in the    judgment.25
                                                                  Dealing with external whistleblowing reports
The advisory department provides individual, free
and confidential advice to potential whistleblowers               Until 2019, Slovakia had a decentralised model
on how to make a report and explains what risks                   regarding external whistleblowing reports.
there may be and how the law protects them after                  Whistleblowers were to make disclosures about
they report. Since 2019, the Whistleblowing                       criminal and administrative offences to the police,
Authority can also provide a letter confirming that               the prosecutor’s office or another relevant
the reporting person fits the legal criteria of a                 regulatory body (Tholtová and Nechala 2016)
whistleblower, which can be presented to the
employer so that the matter is taken seriously and                With the new whistleblowing legislation, the
                                                                  institutional arrangement became mixed as reports
to prevent retaliation. They also can ask an
organisation about the status of an internal                      can now also be addressed to the Whistleblower
                                                                  Protection Office, which will then forward them to
whistleblowing report. In certain cases, with the
                                                                  the relevant criminal or administrative authority
consent of the whistleblower, the Whistleblower
Authority can facilitate a discussion with the                    (Kinstellar no date)

employer to find a solution. Finally, the advisory                Oversight and enforcement of
department can refer whistleblowers to legal                      whistleblowing legislation
experts and provide psychosocial support (Huis
Voor Klokkenluiders 2021).                                        Until 2019, oversight and enforcement of
                                                                  whistleblower protection legislation was
The knowledge and prevention department                           decentralised at the national and local levels. The
promotes integrity in public, semi-public and                     regional labour inspectorates, working under the
private organisations, which include informing                    national labour inspectorate (Tholtová and
employers and preparing materials about integrity                 Nechala 2016) were in charge of overseeing the
management and to conduct research on different                   implementation of the law, including whether
aspects of whistleblowing (Loyens and                             employers introduced internal whistleblowing
Vandekerckhove 2018b).

25              of certain other acts (hereafter: Whistleblower Act),
misstand                                                          available at:
26 Act on the protection of whistleblowers notifying activities   content/uploads/2021/03/Slovak-Act-on-Whistleblowing-
undermining the functioning of society and the amendment          2019-1.pdf.

Transparency International Anti-Corruption Helpdesk
Institutional arrangements for whistleblower protection: Main challenges and best practices
mechanisms. They could impose fines in cases of             any lessons learned from this new, more
non-compliance.                                             centralised model of whistleblower protection in
Regarding whistleblower protection, they were
responsible for preventing retaliation by reviewing         Challenges and lessons
requests from employers to take any employment
action against a whistleblower, giving their
approval only if the employer could demonstrate             Some of the challenges identified are common to
the absence of causal relationship between the              authorities receiving and addressing external
action and the whistleblowing (Terracol 2018).              whistleblowing reports and to those in charge of
They were also in charge of dealing with                    oversight and enforcement. Other challenges and
whistleblowers’ complaints of retaliation and were          lessons learned are specific to these two roles.
authorised to suspend retaliatory employment
actions against whistleblowers. Finally, they could         Common challenge: Lack of
offer protection to whistleblowers who made                 awareness and capacities within the
external disclosures to relevant authorities                authorities
(Dančíková, Nechala and Skácal 2015).                       In countries where existing authorities were given
                                                            whistleblowing related responsibilities in addition to
Another body, the Slovak National Centre for
                                                            their existing ones, issues regarding awareness
Human Rights was responsible for evaluating the
                                                            and staff capacity emerged.
implementation of the whistleblowing law by
collecting data and publishing relevant information         A study in the UK found that the staff working in
on a regular basis (Tholtová and Nechala 2016).             the prescribed persons system were often
                                                            unaware of their role and responsibilities regarding
With the newly established Whistleblower
                                                            whistleblowing. Almost half of surveyed staff (47
Protection Office, Slovakia is moving to a
                                                            per cent) who were at high risk of receiving
centralised approach to oversight and enforcement
                                                            whistleblowing reports said they did not know what
of whistleblowing legislation. The Whistleblower
                                                            was meant by prescribed person (NAO 2015: 16).
Protection Office will take over the responsibilities
of regional labour inspectorates and, it seems, the         A study in Slovakia involving a mystery shopping
Slovak National Centre for Human Rights. It also            exercise found that none of the eight regional
received several new responsibilities, such as              labour inspectorates who were then responsible
raising public awareness, providing training                for whistleblower protection managed to reply to a
courses to persons responsible for receiving and            request for information in time for a potential
addressing whistleblowing disclosures, providing            whistleblower to file a protection request. Five out
expert opinions and advice on the application of            eight inspectorates did not even recognise that
the law (Štarha and Černaj 2019, The Slovak                 incoming queries were related to whistleblowing
Spectator 2021). Although the office was                    and as a result did not provide adequate
established in 2019, it got its head of office only in      information on how to proceed to obtain protection
February 2021. Thus, it is still early to talk about        (Dančíková, Nechala and Skácal 2015).


Transparency International Anti-Corruption Helpdesk
Institutional arrangements for whistleblower protection: Main challenges and best practices
In both situations, this lack of awareness highlights       whistleblowers (they provide an example of the
a need for proper staff training. The Transparency          health sector which is regulated by a multitude of
International chapter in Slovakia, pointed out the          bodies) (NAO 2015).
fact that the regional labour inspectorates did not
receive any additional financial resources to               Placing a list of all prescribed persons or
increase their capacities when they were entrusted          competent authorities in one place (for example, a
with their new whistleblowing related missions              government website), with a clear description of
(Tholtová and Nechala 2016).                                their area of competence and their contact
                                                            information, would help whistleblowers select the
Similarly, in the Netherlands, the very challenging         appropriate recipient for their external disclosure.
debuts of the Whistleblowers Authority – in its first       Ireland applied this lesson from the UK27 and
the years, the authority concluded only two                 published such list on a government website in
investigations – were in part attributed to a lack of       2020.28
staff capacity and resources (The Minister of the
Interior and Kingdom Relations 2019).                       Research in Ireland also pointed to the need for a
                                                            regular updating of such a list as there were
Institutional arrangements for dealing                      situations in the past where some of the
with external whistleblowing reports                        designated authorities ceased to exist, while the
                                                            list was not updated. (Kierans 2019: 138).
Some of the challenges identified are inherent to
approach chosen – centralised versus
                                                            Having an independent body tasked to direct
decentralised institutional arrangements – but
                                                            whistleblowers to the appropriate authority, such
most apply to both approaches. The mixed
                                                            as in France and Korea, goes a step further in
approach is sometimes presented as a solution to
                                                            addressing difficulties to identify the appropriate
some of the issues identified in centralised and
                                                            competent authority. However, even in countries
decentralised models.
                                                            where such a body exists, having a list of
Difficulties to identify the appropriate                    competent authorities is considered good practice,
competent authority                                         as illustrated by the recommendation of the French
                                                            Defender of Rights to create such a list (Défenseur
The first challenge for potential whistleblowers is to      des Droits 2020: 8).
identify the correct recipient (prescribed person or
competent authority) for their disclosure, which can        The French Defender of Rights further
discourage them from speaking out (Phillips and             recommended to be enabled to directly allocate
Lewis 2013). For example, in the UK, a study                external whistleblowing disclosures that it receives
showed that there is sometimes a multitude of               to responsible authorities, as is done by the ACRC
potentially relevant bodies regulating a particular         in Korea (Défenseur des Droits 2020: 8). This is
sector, which can be a source of confusion for              also a solution to the issue of a lack of information

27                                                          28
   See:                                                  disclosures-whistleblowing-list-of-prescribed-persons/

Transparency International Anti-Corruption Helpdesk
Institutional arrangements for whistleblower protection: Main challenges and best practices
on the procedure to follow to make a disclosure             Additionally, clearly explaining how confidentiality
once the appropriate competent authority has                and anonymity can be achieved with regards to
been identified.                                            making a disclosure and providing feedback to
                                                            whistleblowers can further help in building trust in
In Serbia, if an authority receives a whistleblowing        the system (BIS 2017: 7).
report outside of its competence, it has the
obligation to refer the disclosure to the appropriate       Evidence from Ireland suggests a low level of
authorised body (Stojanović, Matović and                    compliance of prescribed persons with regards to
Radomirović 2015). This obligation is also found in         providing information on their roles and
the EU directive on whistleblower protection. While         responsibilities (Kierans 2019). Thus, one
referral systems can indeed ensure that a                   suggestion is that making this information publicly
disclosure reaches the appropriate recipient,               available should be a statutory obligation for
Transparency International recommends that such             prescribed persons, with potential sanctions
referrals require the explicit consent of the               imposed on bodies who do not comply (Van
whistleblower (Transparency International 2019).            Portfliet et al. 2020: 14).

Lack of information on the competent                        The EU directive on whistleblower protection
authorities’ procedures and powers
                                                            integrated some of these lessons and includes a

The available empirical evidence suggests that              rather detailed list of the type of information that

there is often a lack of clarity about the procedure        competent authorities must publish on their

of making an external whistleblowing report,                websites regarding the receipt of reports and their
                                                            follow-up, “in a separate and easily identifiable and
especially in a decentralised model. This lack of
clarity can discourage whistleblowers from using            accessible section” (Article 13).

channels that are otherwise available to them               Gaps in the list of competent authorities
(NAO 2014).
                                                            In Ireland, institutions that appear essential for a
In addition, there can be a gap between                     particular type of disclosure have been omitted
whistleblowers’ expectations and what an authority          from the list of prescribed persons. To address
can and will do to address a report. This issue was         this, a clear criteria for including authorities on the
identified in decentralised models, such as in the          list would ensure consistency (Kierans 2019: 138).
UK and Ireland, as authorities’ powers can vary a
lot (BIS 2017; Van Portfliet et al. 2020), but also in      Another suggestion is to allow an independent
centralised models, such as in Australia                    body to designate an authority which is not on the
(Parliamentary Joint Committee 2017).                       list to address a particular report (Défenseur des
                                                            Droits 2020).
To address this issue, authorities should provide
clear information on their own website about their          Weak oversight in the handling of external
                                                            whistleblowing reports
policies and procedures for receiving and handling
external whistleblowing reports, as well as a clear         The absence of oversight of the competent
explanation of their statutory powers.                      authorities’ handling of external whistleblowing

Transparency International Anti-Corruption Helpdesk
Institutional arrangements for whistleblower protection: Main challenges and best practices
reports is common to many existing institutional            Regarding oversight and enforcement
arrangements, whether centralised or                        of whistleblowing legislation
decentralised. There is often a lack of information
                                                            Many of the challenges highlighted below relate to
in that regard.
                                                            gaps in the institutional framework. The lessons
                                                            and proposed solutions tend to confirm the
In 2017, the UK introduced an obligation for each
                                                            recommended best practice identified by
prescribed person to publish an annual report
                                                            international standards (and described in second
which would address the number of employees’
                                                            section above).
disclosures that they had received in the previous
year, the number of disclosures where further
                                                            In Ireland, where whistleblowing legislation has
action was taken, a summary of the action taken
                                                            been in effect since 2014, the Transparency
and the impact of disclosed information on the
                                                            International chapter recommended establishing a
prescribed persons’ ability to fulfil their functions
                                                            statutory authority to oversee implementation of
and meet their objectives (BIS 2017: 9). The report
                                                            whistleblowing legislation by both prescribed
must also provide a summary of the action taken in
                                                            persons and public organisations. Such an
each case, including information about contact
                                                            authority would be in charge of monitoring and
with the employer, the investigation and its
                                                            reporting on the effectiveness of prescribed
findings, if applicable, and the outcomes in case
                                                            persons, of receiving and addressing
enforcement actions were taken (BIS 2017).
                                                            whistleblower’s complaints about retaliation, about
                                                            organisations’ improper investigations of
TI Ireland recommends the introduction of a similar
                                                            whistleblowing reports, and covering wrongdoing
legal obligation for prescribed persons in Ireland to
                                                            and failures to comply with whistleblowing
submit yearly reports, using a set template to
                                                            legislation. Such an authority could have powers to
ensure uniformity in reporting and easier analysis
                                                            investigate and set administrative fines
(2020: 6).
                                                            (Transparency International Ireland 2020: 6). A
Regarding oversight on individual cases, a solution         similar recommendation was made for Australia
could come from the Korean model, as suggested              (see above).
by the Defender of Rights’ recommendation to be
                                                            Weak oversight on implementation by
given an oversight role similar to the ACRC’s to            employers and competent authorities
follow up on the competent authorities’
investigation and to ensure that responses are              In the previous section, many of the proposed
provided to whistleblowers in a timely fashion              solutions to challenges relating to proper
(Défenseur des Droits 2020: 8).                             implementation of whistleblowing legislation by
                                                            competent authorities involved devolving to a
In the Netherlands, the Whistleblowers Authority            distinct authority the responsibility to oversee and
does not have such oversight power, but it can              support them (Van Portfliet et al. 2020; Défenseur
receive and address whistleblowing reports that             des Droits 2020) .
other competent authorities have not dealt with
properly.                                                   This solution was also proposed to improve
                                                            implementation of whistleblowing legislation by

Transparency International Anti-Corruption Helpdesk
Institutional arrangements for whistleblower protection: Main challenges and best practices
You can also read