{"id":23625,"date":"2023-03-21T09:33:07","date_gmt":"2023-03-21T08:33:07","guid":{"rendered":"https:\/\/www.whistleblowing.software\/?p=23625"},"modified":"2023-03-21T09:58:27","modified_gmt":"2023-03-21T08:58:27","slug":"e-mail-eu-whistleblowing-directive","status":"publish","type":"post","link":"https:\/\/www.whistleblowing.software\/en\/e-mail-eu-whistleblowing-directive\/","title":{"rendered":"A deep dive into whistleblowing channels: why e-mail is not compliant with the EU Directive 2019\/1937"},"content":{"rendered":"

<\/div>
\"Usage<\/span><\/div>
<\/div>

A deep dive into whistleblowing channels: why e-mail<\/strong> is not compliant<\/strong> with the EU Directive 2019\/1937<\/h1><\/div>

Among the changes introduced by the European Union Whistleblowing Directive, which has now been transposed in the vast majority of Member States, the most important is undoubtedly the obligation for entities and companies to establish “channels for receiving the reports<\/em><\/strong> which are designed, established, and operated in a secure manner that ensures that the confidentiality of the identity of the reporting person<\/strong> and any third party mentioned in the report is protected, and prevents access thereto by non-authorized staff members”<\/em> (Article 9 of Directive (EU) 2019\/1937).<\/p>\n

Therefore, it is crucial to ensure that your system for handling reports has the necessary requirements for confidentiality<\/a><\/strong>, both organizationally and technically.<\/p>\n<\/div>

Whistleblowing systems and email use: Penalties for companies that break the rules<\/h2>\n

Many companies already handle whistleblowing internally through email boxes or online forms<\/b>, if not in person or through paper forms, believing that such a system meets all the requirements.<\/span><\/p>\n

However, these solutions need to be reconsidered in light of the new regulations. Used alone, without the co-presence of compliant software, they do not meet the strict requirements for the protection of sensitive whistleblower data set out in the EU Directive<\/strong>. In this article, we will focus on the critical compliance issues raised by the use of email as a whistleblower channel: let’s look at the key points together.<\/p>\n<\/div><\/div><\/div><\/div><\/div>

<\/i><\/div>

Inadequate encryption and lack of access restrictions on email accounts<\/h3><\/div>
<\/div>
\n

Compared to software such as Legality Whistleblowing<\/a>, which uses cryptographic systems for both the content of the report and any attachments, generic e-mails such as “whistleblowing@” do not provide adequate encryption tools<\/b> to protect the confidentiality of the whistleblower’s identity, which may be accessible even to people outside the whistleblowing management<\/strong>, such as the company’s IT staff.<\/p>\n<\/div><\/div><\/div>

<\/i><\/div>

Operational management and timeliness issues<\/h3><\/div>
<\/div>
\n

The EU Directive set precise deadlines for the handling of whistleblowing<\/strong>, of which the whistleblower must be informed. Daily operational tasks for SBs and Compliance Officers, such as keeping track of deadlines and communicating with whistleblowers, are difficult to perform efficiently via e-mail, as well as assigning different reports to managers with the right skills to handle them and involve employees.<\/p>\n

Another critical issue is the retention of the documentation inherent to the reports<\/strong>: regardless of the channel through which they are received, reports should be kept only for the time necessary to process the report, and in any case no longer than 5 years from the final outcome of the procedure. In addition, data retention and the processing of personal data must always comply with the GDPR (EU Regulation 2016\/679)<\/strong>: any data breach exposes the company to severe penalties<\/strong><\/span>, calculated on the basis of turnover.<\/p>\n<\/div><\/div><\/div>

<\/div><\/div><\/div><\/div>
<\/i><\/div>

Lack of a structured reporting form<\/h3><\/div>
<\/div>
\n

In an email, it is up to the whistleblower to decide what information to disclose and how to disclose it, with the possibility that the template usually provided by the company policy will not be followed and the report may lack details that are essential for case management<\/strong><\/span>. A wizard<\/strong> that classifies the type of whistleblowing at the outset and includes the mandatory fields to be completed speeds up the follow-up<\/strong> and simplifies the work of managers<\/strong>.<\/p>\n<\/div><\/div><\/div>

<\/div><\/div><\/div><\/div>
<\/i><\/div>

Perception of insecurity by whistleblowers<\/h3><\/div>
<\/div>
\n

A perceived unsafe channel actually discourages whistleblowing<\/strong><\/span>: retaliation such as harassment or dismissal is real threat to whistleblowers, who need firm guarantees of identity protection to find the courage to report what is wrong in their work environment. In this sense, a reliable system supports the company’s risk management processes by helping the organization address potential problems before they become more serious.<\/p>\n<\/div><\/div><\/div>

<\/i><\/div>

Lack of inclusiveness<\/h3><\/div>
<\/div>
\n

People with dyslexia or writing difficulties may face obstacles in using e-mail<\/strong><\/span>, while IT platforms such as Legality <\/a>Whistleblowing<\/a> offer the possibility of recording voice messages<\/strong> with voice distortion effects to make them unrecognizable.<\/p>\n<\/div><\/div><\/div>

<\/div><\/div><\/div><\/div>
\"Statistics<\/span><\/div><\/div><\/div><\/div><\/div>

The original text of the EU Directive suggested that member states provide a system of criminal, civil, or administrative sanctions<\/strong> to ensure the effectiveness of whistleblower protection rules, and indeed many national transposition laws have done so. However, penalties for GDPR violations have been in place for years, capped at 4 percent of total turnover or 20 million euros<\/strong>.<\/p>\n<\/div>

Contact us<\/span><\/a><\/div><\/div><\/div><\/div><\/div>

Legality Whistleblowing vs. E-mail: What is the best solution for whistleblowing in the company?<\/h2>\n<\/div><\/div><\/div>

We have seen that using an e-mail box as a whistleblowing channel unfortunately might not offer the necessary guarantees of confidentiality and trust that such a tool should provide to those who decide to “blow the whistle”.<\/p>\n

The Legality Whistleblowing<\/strong> Software is the most secure system for handling whistleblowing in both the public and private sectors:<\/p>\n<\/div>

E-mails<\/strong><\/p>\n

\n<\/div>