Update Dutch law on whistleblowers: anonymous reporting of suspected wrongdoings & investigation of reports at the level of the (international) group

Since 17 December 2023, the new (more strict) requirements regarding internal reporting procedures for whistleblowers also apply to employers with 50-249 employees. This follows from the Dutch Whistleblower Protection Act (Wet bescherming klokkenluiders). As a result of these new requirements, employers must have an internal reporting procedure in place for the reporting of suspected wrongdoing that sets out, among other things, how the report is dealt with, what qualifies as a suspected wrongdoing, to whom a report can be made, how a report can be made and within what time frame a report is followed up.

With regard to the method of reporting and to whom a report can be made, a new decree was recently submitted for internet consultation: the ‘Decree on the anonymous reporting of suspected abuses’ (hereinafter: ‘the Decree’). In the legislative process leading to the Dutch Whistleblower Protection Act, it was already announced that the possibility to make an anonymous report of a suspected wrongdoing would be included in the law. The Decree is a further elaboration of this announcement. The Decree is currently still up for internet consultation and could therefore still change in its final form. Below, we will mention the most important aspects.

Lastly, we will discuss another important aspect of the Dutch Whistleblower Protection Act which was recently clarified to us by the Dutch Whistleblowers Authority (in Dutch: het Huis voor Klokkenluiders, hereafter ‘’the Authority’’) in response to some questions we posted to them in this regard: the possibility of having a whistleblower’s report investigated at (international) group level.

How to report anonymously?
Among other things, the Decree regulates which conditions an anonymous report must meet. The explanatory notes to the Decree specify that, in principle, the employer is free to determine the reporting method for anonymous reports. Other than for non-anonymous reports, it is thus not obligatory for the employer to make reporting in writing, orally via the telephone or other voice message system and in an on-site meeting possible. The explanatory notes further mention that employers could for example choose to use special software for the receipt of anonymous reports, which is already being offered by several companies.

If an anonymous report is made, however, this must in any case be done to a specially appointed officer, also see below. That officer must then discuss with the reporting person how the reporting person wishes to be approached during the further process (including the requirement to send the reporting person a confirmation of receipt of the report within 7 days).

Officer authorised to receive an anonymous report
Personal details
The Decree further regulates the conditions applicable to an officer appointed to receive anonymous reports. At least one officer in this sense must be appointed, who may not have a managerial position within the employer’s organisation. Nor may it be someone who is primarily involved within the employer in recruiting, hiring and firing of employees (e.g. someone in HR).

Please note: if more than one officer is appointed to receive anonymous reports, it is allowed to appoint someone who is also in a managerial or HR-related position. In that case, however, in addition, there must always be one officer who is not in such a position. If several officers are appointed and an anonymous report is made, the explanatory notes to the Decree furthermore indicate that the report must initially be assessed in terms of content by the officer who is not in one of the aforementioned positions.

It is not required that the officer appointed to receive anonymous reports is working within the employer’s organisation. An external person or body may also be appointed.

Competence requirements
An officer appointed to receive anonymous reports must have such expertise and experience as to be able to perform the role properly. The explanatory notes to the Decree show that this includes being able to properly assess the information provided by the reporting person, as well as how to handle that information and with whom to share it in order to properly follow up on the report. The officer must also be able to inform the reporting person about the risks of a report and to explain to the reporting person that for a proper investigation it may sometimes be necessary that the identity of the reporting person is disclosed (with the reporting person’s consent). The explanatory notes also point to important personal qualities of the officer, such as integrity awareness and good communication skills.

In addition, the Decree specifies that an officer who receives an anonymous report must act in such a way as to ensure the anonymity of the reporting person. The explanatory notes to the Decree state that the officer must ensure that the identity is not further disclosed to others involved in the processing of the report and any investigation into the report, in the event that the identity does become known (to a limited extent). It is also encouraged to let the reporting person know in such a case that their identity has become known and in what manner this happened.

An officer appointed to receive anonymous reports will have to report at least once a year on the number of anonymous reports and the nature of the reports to the highest authority within the organisation and to the employee representative body. If there is no works council or other form of employee representation, the report should be sent to the employees themselves.
Finally, an important duty also applies to the employer when appointing an officer: the employer must make it possible for the officer to perform his role properly, function independently within the organisation of the employer and not be at risk of negative (employment law) consequences. The explanatory notes to the Decree note that the officer must be given sufficient time and space to perform the role in a proper and independent manner, and that, for example, he or she should not have to report to his or her manager within the organisation as far as the work as an officer is concerned. Furthermore, if the officer indicates a need for certain (digital) resources to be able to perform the role properly, the employer must follow this up as far as reasonable.

The Decree: in short
The Decree further elaborates the possibility of making an anonymous report of a suspected wrongdoing and the applicable requirements in this regard, as well as requirements applying to the officer appointed to receive such reports.

We look forward to the reactions to the internet consultation, which is still open until 11 June 2024, and will of course follow developments in this area and share them with you where appropriate.

Lastly: examining reports at group level
Since the entry into force of the Whistleblower Protection Act, a number of questions have been raised in practice that could not easily be answered by the letter of the law itself. One of these questions is whether the Act allows for a report of a suspected wrongdoing to be investigated at parent level within a (international) group. The law allows private sector employers with 50-249 employees to share resources for receiving reports and conducting investigations into them, but the exact scope of the respective provision was unclear, especially in the international context.

We recently posed the following question to the Authority in this regard: In the event a report is received by a Dutch subsidiary (i.e. at the local hotline), may that report be investigated at group level, i.e. by the international parent company, which in many situations is better equipped to investigate that report? Or is this only allowed if the parent company is located in the Netherlands?

In response, in short, the Authority answered that reports may be investigated at the level of the group, even if the parent company is located in another country, if that parent company is better equipped to investigate a report. According to the Authority, it is important to ensure proper safeguards in this regard, in the sense that this way of investigating the report must not create barriers for the reporting person.

This explanation of the Authority thus creates opportunities for (international) groups of companies to have reports investigated at group level. Please note that the ultimate responsibility for providing timely follow-up and feedback on the report remains at the level of the (subsidiary) entity where the report was received, if that entity is legally obliged to have its own reporting procedure and reporting point in place.

If you are an employer and have questions regarding the above, or would like more information on the exact requirements which an internal reporting procedure must meet, please e-mail us, we will be happy to assist.

Ilse Spee

Published On: 24 April 2024

Share this post