Finland

What stage has the legislature reached in implementing the Whistleblowing Directive? If not already implemented, when is it expected or planned that the required legislation will be passed?

In Finland, the national legislation implementing the Whistleblowing Directive entered into force on 1 January 2023.

However, there is a transition period for establishing an internal reporting channel. Private sector entities regularly employing at least 250 employees and public sector entities regularly employing at least 50 employees must set up an internal reporting channel by 1 April 2023. Private sector entities regularly employing at least 50 but less than 250 employees have until 17 December 2023 to establish an internal reporting channel. In addition, if entities with less than 50 employees have established a voluntary internal reporting channel, they have until 17 December 2023 to bring them into compliance with the new legislation.

Status

Legislation passed / Directive implemented.

Reporting topics covered (in addition to those covered by the Directive)

Same as those in the Directive. However, the scope of the reporting topics has been widened to include also breaches of national law with certain limitations regarding public procurement (defence and security procurement is not included) and public health.

Categories of person who may report (in addition to those specified in the Directive)

Same as those in the Directive.

Are there any stipulations as to who may investigate a report?

The organization or, if the whistleblowing channel has been outsourced to an external service provider, the external service provider needs to appoint a person or persons who are responsible for processing reports impartially and independently. Only such designated persons may process reports. It is also possible to appoint experts for investigating the accuracy of reports.

Are entities with fewer than 50 workers exempt?

Yes, entities with fewer than 50 workers are exempt from the obligation to establish internal reporting channels. However, an internal reporting channel must always be established if the entity operates within the scope of the Anti-Money Laundering Act (444/2017).

If an exempt organisation implements a whistleblowing scheme will the Directive / implementing law apply?

Yes.

Are there any specific timescales that apply (e.g. for acknowledgements and responses) (Yes/No)?

Yes, an acknowledgement of receipt must be sent to the whistleblower within seven days of receiving the report and the follow-up measures based on the report must be communicated to the whistleblower within three months following the acknowledgement of receipt.

Can reports be made anonymously?

Organizations may decide to accept anonymous reports as well.

Are private sector entities required to accept and follow up on anonymous reports?

No.

Remedies for retaliation

There are criminal sanctions in place against the perpetrator of retaliation against the reporting person, which depending on the perpetrator can be up to EUR 1,200 for natural persons and EUR 100,000 for legal persons.

Are group-wide reporting channels permitted?

Yes.