Codes of Conduct and Ethics Hotlines of Multinational Companies

C M S‘Hasche Sigle
Rechtsanwalte Steuerberater
1.
Problems of implementation: Fundamental differences between
Europe and the US
The Code of Conduct is becoming increasingly popular amongst US and European companies. This requires the companies to draw up a framework of the company’s own ideas
of legally and ethically responsible conduct, and can range from accounting rules to rules
concerning social conduct. These rules venture into the domain of employee privacy,
which in Europe has been a cause for concern in relation to Data Protection laws, as some
companies have gone as far as to say what employees may or may not do in their spare
time.
Especially, the implementation of “whistleblowing” schemes as a part of the Codes of Conduct will more often than not require the processing of personal data (that is, the collection,
registration, storage, disclosure and destruction of data relating to an identifiable person),
such that Data Protection rules will come into force. The broad law is governed under the
European Directive of 95/46/EC on the protection of individuals with regard to the
processing of personal data and on the free movement of such data. The three conditions
that need to be met in order to justify the processing of personal data are transparency,
legitimate purpose and proportionality.
There has thus been a clash between the US perspective (The US have now one company in eight with such a Code of Conduct) and European ideas regarding codetermination and personality rights through enforcing these codes. Indeed the SarbanesOxley Act, that was introduced in the US after the various financial scandals surrounding
Enron, requires that companies failing to comply with their “whistleblowing” requirements
will face hefty sanctions, and therefore an EU committee set up for the purpose of examining the implementation of Data Protection law (the so-called Working Party) has investigated the problems of the US rules clashing with Data Protection rules in Europe. Without
a resolution to this cross border dispute over implementation of Codes of Conduct, companies may face heavy sanctions in both Europe and the States.
There have been cases in both France and Germany showing a reluctance in European
courts to enforce the Codes of Conduct. This reluctance stems from two concerns: the
failure to consult the employees representatives (co-determination rights), the invasion of
2
224
asche Sigle
Rechtsanwaite Steuerberater
personality rights protected constitutionally in both Germany and France and the subsequent data protection issues.
II.
The German Case
A well known decision on whistleblowing via a hotline to date in Germany is the decision
known as the ”Wal-Mart judgment” by the Wuppertal Labor Court and the subsequent a p
plication for review of a point of law filed with the Diisseldorf Regional Labor Court. WalMart unilaterally and without the involvement of the works council implemented in its subsidiaries located in Germany a so-called code of ethics which included the provision that
violations of the code of ethics be reported anonymously via a hotline especially established for this purpose.
The German Works Council acting as the Plaintiff in this case, complained as to the “serious incursions into personality rights” and “a culture of denunciation.” The Works Council
under the German Works Constitution Act needs to give its approval if the employer
wishes to introduce rules that directly affect the behaviour of an employee within his
sphere of work at the company. Therefore the following were held by the court to be subject to co-determination with the Works Council:
Code of ethics violations to be reported through an anonymous hotline
Prohibiting, demanding, requesting or receiving gifts or special payments
The rule that no statements were to be given to the press without consent
from the company communications department
Rules on harassment
Company inspection rights
Rules concerning romantic relationships
Rules on drug and alcohol abuse
Ban on the display of posters advertising the disallowance of accepting of
gifts and reporting of violations through a hotline.
The Court of Appeal even went further by holding the “no dating rule” invalid because of
the breach of general personality rights of the individual employees.
3
225
c MI S‘Hasche Sigle
Rechtsanwalte Steuerberater
Regarding the legality of the telephone hotline outside the scope of the codetermination
rights of the works council the courts did not make any statement, in particular, with regard
to its compliance with the Data Privacy Protection Act.
111.
The French cases
In France, however, courts have rendered a number of decisions on the admissibility of
telephone hotlines with respect to data privacy protection laws. Having a cultural background similar to Germany, France does not have a particularly favorable attitude towards
whistleblowing either. Prior to collecting and using employee data automatically, an employer in France has to seek the approval of CNIL (Commission nationale de I’informafique
et des libertes - hereinafter CNIL) pursuant to the French Data Privacy Protection Act. On
26 May 2005, CNIL declared the whistleblowing hotlines at McDonald’s and CEAC (Com-
pagnie Europeenne d’Accumulateurs),implemented to comply with the Sarbanes-Oxley
Act, unlawful owing to data privacy protection laws.’ According to these decisions,
anonymous reports include a risk that employees could be wrongly accused and that exoneration would be difficult for them owing to their lack of knowledge of the investigation.
Such a hotline does not comply with the French Data Privacy Protection Act2 since the
suspected employees are not sufficiently informed.
On 15 September 2005, the Libourne Labor Court decided that a notice displayed at the
workplace requesting the employees to report each case of fraud and embezzlement via
an ethics hotline was to be immediately removed. In their opinion, the obligation to report
all breaches without limitation to the financial area, for example, went too far. Regardless
of the type of data collection and processing, an anonymous report involves the risk that
the accused employee could be exposed to internal investigations and possibly to further
sanctions without being able to exercise hidher right to conduct hidher own defense.
Moreover, the court considered the type of hotline and the risk of a slanderous denunciation disproportionateand unlikely to prevent misappropriation and embezzlement. Further,
the court found that the personal freedoms of an accused employee were endangered.
’
CNIL decision 3005-1 I O 0 1 26 May 2005 (McDonald’s group frmce); CNIL decision 2005-1 1 1 of 26 May
2005 (Exide Technologic\)
Articles 6 and 7 of E rench I‘iw no 78-17 of 6 January 1978.
4
226
C M Shasche Sigle
Rechtsanwalte Steuerberater
French companies are thus facing the problem of how it could be possible to establish a
hotline in accordance with the provisions of the Sarbanes-Oxley Act without violating the
relevant data privacy protection laws.
In the light of these difficulties, CNIL, after consulting the French Ministry of Labor, issued
a directive on the implementation of whistleblowing systems andlor hotlines on 10 November 2005~.~
This directive comprises among other regards the above mentioned risks and
problems. This direction gives French companies intending to establish a whistleblowing
system detailed guidelines, providing legal certainty and thus minimizing the risk of violations of the Data Privacy Protection Act.
IV.
Whistleblowing under German Data Privacy Act
The information communicated via the hotlines usually refers to the personal conduct of
the employees and is thus personal data in terms of the German Federal Data Privacy
Protection Act.
If the employer, as is usually the case, itself establishes and operates a call centre which
collects and processes the personal data, the processing of an employee's personal data
is admissible under the German Federal Data Privacy Protection Act if it serves a purpose
relating to the contractual relationship or relationships of trust similar to a contractual relationship.
Accordingly, it is decisive whether the employees' data is collected, used or communicated
for the purpose of fulfilling an obligation arising from the employment agreement or for the
purpose of exercising rights under such agreement. If no express provisions on the use of
data collected via a whistleblowing hotline are included in the employment agreement, it
has to be determined by way of interpretation whether the manner and scope of the use of
the data is possibly covered by the secondary obligations arising from the employment
agreement. Reference is made, for example, to a use of data for the purpose of preventing the contractual purpose from becoming endangered by breach of a secondary contractual obligation.
Availablc under.
http://ww\~.cnil.ti. 'tileadmini~~~cumentsiuk/CN1
L-recommandation\-~~
histlehlo\.;.ina-VA.pdf.
5
227
C'MS Hasche Sigle
Rechtsanwalte Steuerberater
In most cases, however, the purpose of the use of data will go beyond the contractual purposes. As a rule, hotlines are established in the framework of codes of ethics. Unlike
codes of conduct which are established for employment purposes, meaning for the purpose of an orderly and economically successful value-creation process, codes of ethics
generally contain principles referring to the "correct" or even ethical conduct. If these
codes require specific conduct which is not clearly employment-related, such data processing is no longer justifiable under the Federal Data Privacy Protection Act.
However, the implementation of a whistleblowing system can be admissible if the implementing company has a legitimate interest in doing so, unless the data subject's legitimate
interests outweigh the legitimate interest of the company.
Recently, a group of European data protection commissioners led by the German data
protection commissioner Peter Schaar defined the conditions for a legitimate interest of the
employer in establishing hotlines and drew up recommendations.
a) Recommendations of the Article 29 Data Protection Working Party
The Article 29 Data Protection Working Party (the Article 29 group) consists of the data
protection commissioners of the 25 member states of the European Union; on February 1,
2006, they issued a statement on data privacy protection requirements for whistleblowing
system^.^
The recommendations of the Article 29 group aim at making it easier for companies required to implement whistleblowing systems due to the Sarbanes-Oxley Act, to structure
such systems in compliance with the data privacy protection laws and thus to meet the
requirements of the EC Data Privacy Protection Dire~tive.~
In conclusion, the Article 29
group considers whistleblowing systems to be admissible, but places their admissibility
under strict prerequisites.
A prerequisite of Directive 95/46/EC is that either the collection of the data is necessary in
order to comply with a legal obligation to which the data collecting party is subject or the
processing is necessary for the realization of a legitimate interest safeguarded either by
the data collecting party or the third party.
See ~~'curol?a.eu.int;i.otnm/iListicehome!Di/~ri\,ac~!di tcs/wpdocs/2006/w~I 17 en.pdE.
9.9 95-46 EG rahrnen.httn1.
' Directive 95/46/EC = hrtp://byds.iuris.de/bvdsi061
6
228
C M S Hasche Sigle
Rechtsanwalle Steuerberater
The Article 29 group assumes that a company could have a legitimate interest in processing data by means of a whistleblowing hotline. The legitimate interest of the company,
however, must outweigh the interest and the fundamental rights of the data subject. The
Article 29 group acknowledges that large international organizations such as the European
Union6and the OECD7consider “good” corporate governance an important aspect of a
“well” functioning corporation. The principles established by the EU and the OECD aim at
a maximum level of transparency and stable accounting and finance systems in order to
protect vested interests such as shareholders and market stability in general. In this context, the Article 29 group recognizes the legitimate interest of companies to implement systems enabling the employees to report irregularities.
Furthermore the group considers the obligation to implement a whistleblowing system arising from the Sarbanes-Oxley Act to be an opportunity to increase stability of financial markets and improve protection of shareholders. In this respect, the Article 29 group is of the
opinion that the interest of a company required to implement a whistleblowing system under the Sarbanes Oxley Act is legitimate.
In addition, however, the company’s interest in the data processing has to be weighed
against the rights of the data subject in a review of proportionality. For this purpose, the
Article 29 group established the following guidelines:
Limit on the Number of Persons to Report Through Whistleblowing Systems
Applying the principle of proportionality, the Article 29 group recommends limiting the
number of potential whistleblowers. In this respect, the number of persons who are eligible
can vary according to the sector involved, and it may be necessary to determine in each
individual case whether or not the whistleblower in question is included in the group. The
limitation can, for example, be specified for certain divisions.
Limit on the Number of Persons Who May Be Incriminated Through a Whistleblowing System
European Cornmunit). Commission Recommendation of 15 February 2005 on the role of non-eueciitive or
supervisory directors of li\ted companie\ and on the committees of the (supervisory) board (OJ 1, 52. 75 February 2005, p.5 1 )
OIXD. OECD Princrpler of Corporate Governance. 2004. Part One, Section IV.
7
229
C’MSJHascheSigle
Rechtsanwalte Steuerberater
The Article 29 group further recommends assessing whether it might be appropriate to limit
the number of persons who may be reported through a whistleblowing system and, in particular, to take measures in order to prevent false accusations from launching an investigation and thus data processing.
Encouraging Identified and Confidential Reports Instead of Anonymous Reports
The Article 29 group attaches particular importance to the question of whether a whistleblower should remain anonymous or should be identified, under conditions of confidentiality. In the view of the group, the arguments against anonymous whistleblowing include:
-The company will in any case be unable to ensure that the identity of the whistleblower is
not revealed some other way, despite anonymous reports.
- It is more difficult for the company to verify allegations if it is not possible to ask follow-up
questions.
-Anonymous whistleblowing may lead to the development of a culture of (anonymous)
denunciation. The social climate in an organization can deteriorate if employees are
aware that anonymous reports concerning them can be filed at any time.
To ensure the fair practice of data collection, the Article 29 group therefore recommends
that whistleblowing should not be anonymous. Exceptions from this rule are possible in
specific cases.
Companies should thus encourage the employees not to report anonymously via the hotline. Of course, this requires security for potential whistleblowers that their reports will be
treated with the utmost discretion and confidentiality. The information must remain confidential throughout the whole process, and must not be passed on to third parties. However, the company should make it clear that in the event of further investigations the whistleblower’s identity will have to be revealed to the persons involved in the investigation.
Data Processing Only for the Purpose of Processing the Report
Pursuant to the Directive 95/46/EC on the protection of data privacy, personal data may be
collected only for specified and lawful purposes and may not be used in any way that is
incompatible with these purposes.
Given that the purpose of a whistleblowing system is to ensure good corporate governance, the data collected and processed must be related to this purpose. Therefore, com-
8
230
S Hasche Sigle
Rechtsanwalte Steuerberater
panies should limit any reporting via the hotline to certain areas. These can be accounting, banking, and financial crime. The data processed in these areas must be limited to
the data strictly and objectively necessary to verify the allegations made.
Compliance With Data Retention Periods
To comply with the principle of proportionality, personal data should be deleted without
undue delay, that is, within two months of completion of the investigation. Only if the company takes further legal action against the incriminated person or against the whistleblower
in cases of false or slanderous declaration may data be kept for a longer period of time.
Clear hformation About the Whistleblowing System
It is the duty of the company introducing the whistleblowing system to inform the potential
data subjects about the existence and the purpose of such a system, the recipients of the
reports, and the right of access and rectification for reported persons. Furthermore, the
company should notify the employees that the whistleblower's identity will be kept confidential throughout the whole investigation process, but that legal action will be taken
against the whistleblower in the event of abuse of the telephone hotline.
Rights of the Incriminated Person
The Directive requires individuals to be informed when personal data are collected from a
third party and not from them directly. The information must include the identity of the entity responsible for the data processing, the purposes of the processing, the recipients or
categories of recipients of the data and the existence of the right of access to and rectification. These provisions of the directive may, however, jeopardize the ability of the company
to gather more information and conduct an efficient investigation. The Article 29 group
therefore allows notification to be delayed as long as the incriminated individual is able to
jeopardize the collection of evidence. The Directive gives the data subject the possibility to
have access to the data registered on him/her at reasonable intervals and without excessive delay in order to check its accuracy and, if necessary, rectify it. The whistleblowing
system must guarantee these rights. The exercise of these rights may be restricted in exceptional cases in order to protect the rights of others involved. This has to be decided on
a case-by-case basis. Under no circumstances can the person accused in a whistleblower's report obtain information about the whistleblower's identity on the basis of the
9
23 1
C M S Hasche Sigle
Rechtsanwalte Steuerberater
accused person’s right of access, unless the whistleblower maliciously makes false allegations against a person. The whistleblower’s confidentiality should always be guaranteed.
b) Applicability of Recommendations to Germany
Most of the telephone hotlines implemented in German companies allow employees to
pass on information without restrictions. The Federal Data Privacy Protection Act provides
that, first, the employer must have a legitimate interest in the collection of data and, second, that the employee’s interest in preventing the processing or use of the data concerning him does not outweigh the interest of the employer. The opinion of the Article 29 group
provides key points for weighing the interests of the parties involved in consideration of the
need for proportionality. Taking the recommendations of the Article 29 group into account,
and considering the decisions rendered by judges in France, companies should make
sure, when implementing a whistleblowing system, that the report is not made anonymously, that the content of the report is restricted to certain areas and therefore to a certain group of employees, and that the whistleblower’s identity is protected as far as possible.
It is very likely that national courts and Data Protection agencies will follow the recommendations of the EU Working Party and, therefore, strike down any whistleblowing scheme
that goes beyond the allowed scope.
V.
Dismissal of Whistleblowers
German courts have repeatedly ruled that employees reporting illegal activities of their
employer will have to reckon with disciplinary measures that may include dismissal. One
of the reasons for this is certainly rooted in cultural differences between the German legal
system and the Anglo-American common law countries in which whistleblowing, in terms
of meaning, is considered neutral, almost even desirable. In Germany, in contrast, whistleblowing connotes “denunciation” - a connotation that has been shaped by historical experience during the period of the German Nazi regime and the German Democratic Republic. This fundamental attitude helps to explain the position of the courts, which tend to
be negative as far as whistleblowing is concerned.
In several cases concerning conflicting interests of the employer and the employee, courts
have assumed that the employer’s interests with respect to loyalty override the interests of
10
232
C NI S Hasche Si
Rechtsanwalte Steuerberater
the employee who reports a violation of law. However, in all these cases the employer did
not introduce a Whistleblowing system with the request to report suspicions of misconduct.
If a company introduces a whistleblowing system by opening a hotline for the purpose of
reporting suspected misconduct, it seems evident that an employee who reports his suspicions of misconduct on the part of his supervisor, employer or colleague cannot be dismissed on the grounds of conduct which had previously been requested. Dismissal can
only be considered if the employee, in reporting the misconduct, violates an obligation of
loyalty or confidentiality incumbent on him. The employer may determine the scope of
such obligations. The obligations binding the employee serve to protect the employer, so
that the employer can reduce the employee’s obligations to the employer’s own disadvantage. By implementing a whistleblowing system and instructing the employee to use it in a
certain manner, the employer makes the employee’s duties of conduct more specific. This
means at the same time that the employer alters the obligations of loyalty and confidentiality in such a way that the use of the whistleblowing system, in the way previously specified,
is exempt from the obligations of loyalty and confidentiality. Dismissing an employee because he or she used the whistleblowing system as permitted and requested to do would
contradict the legal principle of “venire contra factum proprium”.’
This does not apply to a case in which a report is made via the hotline in another way than
that prescribed or to an external notification of the violation. If the employee used the
whistleblowing system contrary to the instructions, for example, in order to disturb the
harmony in the workplace by false accusations in areas that are not covered by the whistleblowing system, this can still lead to dismissal. The employer does not alter the duty of
loyalty with regard to every type of use of the whistleblowing system, but only with regard
to its use in the manner precisely specified by the employer. An improper use of the whistleblowing system by the employee can thus constitute an act justifying a warning or even
dismissal.
Even external whistleblowing, for example, by means of a notification given to an authority,
can still be considered a breach of the duty of loyalty or confidentiality.
’Latin: contradiction of one’s own previous acts
11
233
C M S Hasche Sigle
Rechtsanwalte Steuerberater
Unless the employee’s interest in external whistleblowing outweighs the employer’s interest in an internal investigation, the employee doing this breaches hidher duty of loyalty
and confidentiality. The employer thus continues to have ways to sanction such acts.
VI.
Conclusion
Implementation of a whistleblowing system inevitably alters the duty of loyalty and confidentiality imposed upon the employee. It is no longer possible for the employer to dismiss
a whistleblower acting lawfully, even if the dismissal would have been justified prior to the
implementation of a whistleblowing system. For this reason, companies should provide
their employees with a detailed guideline showing when and how they may report misconduct via the hotline.
To avoid risking a violation of the Federal Data Privacy Protection Act, businesses in Germany should review their existing whistleblowing systems with regard to scope and, following the recommendation of the Article 29 group, structure or, if necessary, limit them to
avoid lawsuits relating to data privacy protection. The data should be limited to the areas
specified by the Article 29 group: billing, finance, banking and financial crime. U.S. companies wishing to introduce a whistleblowing system, in particular, should schedule adequate lead time in order to create a global arrangement from the beginning that will be in
line with the requirements of both employment law and data privacy protection law in the
European Union states and still warrants that the obligations resulting from the SarbanesOxley Act are met. Further reaching reporting obligations will probably no longer be accepted by work councils, which will usually have a right to be involved in the establishment
of a hotline.
Anke Koerber
May 2006
This note provides a general overview of the law only and should not be replied upon in place of specific legal advise
12
234