Protecting whistleblowers in the private sector has long been nebulous territory. Legislation such as the Sarbanes-Oxley Act (SOX) of 2002 has historically covered publicly traded companies, without definitive provisions for the private sector. However, private companies are increasingly being held to the same standard as their public counterparts, clearly demonstrated in Supreme Court rulings, the Private Sector Whistleblower Protection Streamlining Act of 2012, and most recently, the EU Whistleblower Protection Directive. 

Need a solution to help your company protect whistleblowers? Request a demo today to learn more about OneTrust’s Helpline and Case Management. 

Sarbanes-Oxley: from 2002 until now

The Sarbanes-Oxley Act (SOX) was, in many ways, one of the very first pieces of legislation offering protections for whistleblowers. Passed in 2002 as a response to the Enron and WorldCom scandals, SOX was designed to encourage fraud reporting. Two decades ago, private companies were considered immune to the law.

Then, in 2014, the Supreme Court heard a challenge to SOX and ruled that even though the plaintiffs were not employees of the publicly traded company, the SOX whistleblower statute applied to them. The reason? They suffered retaliation for reporting alleged fraud involving financial reporting of a publicly traded company.

Here’s what SOX says now:

• SOX covers employees of a public company’s private contractors and subcontractors.
• SOX covers privately-owned companies if they provide services for publicly traded ones.

That second point is where things get interesting. After all, this could imply that an employee of a two-person advertising firm working for a publicly traded company could now bring retaliation claims under SOX. Indeed, Justice Sonia Sotomayor, one of the U.S. Supreme Court’s liberal justices, lamented how the ruling dramatically expanded the potential for whistleblower lawsuits in her dissent: “…it would extend whistleblower protections so far as to cover office cleaners, day laborers and even babysitters who work for people employed at public companies.”

The EU Whistleblower Protection Directive for private companies

Effective as of December 17, 2021, the EU Whistleblower Protection Directive was established to provide more rigorous reporting guidelines and greater whistleblower protection for all companies with 50+ employees, who are based in or doing business in the European Union. The Directive intentionally specifies that many of its provisions apply to both public and private corporations.

The Directive specifies that entities with 50+ employees must:

• Maintain records of every report received, compliant with the Directive’s confidentiality requirements
• Provide internal, local reporting channels
• Prevent retaliation against whistleblowers
• Offer an option to anonymize reports

Download our eBook, the Ultimate Guide to the EU Whistleblower Protection Directive, for an in-depth breakdown of the Directive’s requirements

Unlike SOX, the EU Whistleblower Protection Directive can be interpreted and implemented differently in each of the EU Member States. However, since the Directive itself establishes the floor for whistleblower protection in the EU, and Member States may choose to enact more stringent requirements, it is in the best interests of private companies who operate within the EU or employe EU-based workers to establish compliant whistleblower-first reporting protocols.

Private companies are no longer immune to whistleblower risk

Today, privately-owned companies in the U.S. and Europe are potential targets for SOX and EU Directive retaliation lawsuits. Up until now, the full reach of SOX or the Directive has yet to be seen. No company wants to be the one to help define this ruling better through lawsuits and court battles.

For instance, under SOX, it wasn’t clear whether a private company is exposed to risk regardless of the nature and extent of the particular services it provides to a public company. Do all public employees, including cleaners and day laborers, really count?

To combat misinterpretation, the EU Whistleblower Protection Directive specifies that: “Protection should also extend to categories of natural persons, who, whilst not being ‘workers’… can play a key role in exposing breaches of Union law.” Simply put, this means that the Directive can protect self-employed persons, shareholders, personnel of (sub)contractors, former employees, job applicants, and more. Both public and private companies can now become ensnared in new and unexpected ways.

For example, contract employees who allege they were retaliated against for blowing the whistle could file a lawsuit against a company, even if they’re only working a few hours a week. Private employees who happen to do any work for a public company are subject to these whistleblower provisions under SOX, which could have vast and far-reaching implications.

How hotlines lower whistleblower risk for private companies

Whistleblower hotlines give compliance departments the ability to protect whistleblowers at private companies – and get far ahead of any potential lawsuit.

The most forward-looking public companies have known this for years, installing robust and well-functioning hotline and case-management solutions. These centralized tools end up having a powerful ROI for a company by increasing investigation efficiency, reducing risk, and improving case resolution performance.

A good hotline is designed to allow a whistleblower a safe and easy place to make their claim, without fear of retaliation or disciplinary action. Since operational or corporate fraud is more likely to be brought in by a tip, it is in a company’s best interest to prevent whistleblower risk by providing easy-to-use and non-threatening ways for employees – and in some cases contractors – to make anonymous or on-the-record reports.

Employees who spot potential abuse or OSHA violations aren’t running to lawyers and suing first. When the system is set up right, whistleblowers come forward and use the hotline. This works to the company’s advantage by allowing them to investigate and address the claims internally first.

Whistleblower hotlines + good case management = the best protection

Some private companies may not think they need a whistleblower hotline, but now is the best time to invest in one. Federal laws and sentences have demonstrated that if a company has effective reporting channels in place and can provide a record of the report, their investigation, their response, and how they protected the whistleblowers, penalties have been reduced or declined altogether. Beyond that, under the EU Whistleblower Protection Directive, helplines are now imperative for companies with workers in the EU.

Regulators in Europe and the U.S. know that no company can police and be responsible for every employee, but they are no longer willing to let ignorance of wrongdoing insulate senior executives and board members from responsibility.

7 reasons to outsource hotline & case management to more effectively manage whistleblower risk in the private sector

Solid legal protection comes down to visibility and a clear paper trail. Your company’s compliance falls under your watch, and if you know what’s going on and are trying to address it, you’ll be more likely to demonstrate a good faith effort to protect whistleblowers and prevent retaliation. This establishes an affirmative defense in the event of a breakdown.

In an effort to keep costs and information under their control, many companies will set up internal hotlines and case management, rather than use a third-party solution. This could raise numerous problems.

Third-party hotlines provide 7 extra layers of protection against external scrutiny:

• Consistency: There’s a consistent and standardized workflow and audit trail
• Cost: Outsourcing to an expert can cost far less than the internal allocation of human and financial capital
• Effectiveness: A third-party hotline is equipped to meet the local intake requirements of the EU Directive, while segmenting case data and making anonymized data visible at the central or global level
• Experience: Unless hotlines are your business, creating and maintaining an internal solution isn’t likely to be cost-effective in the long run
• No involvement: A third-party provider is not investigating the incident or advocating on behalf of anyone – meaning they have no incentive to protect the company
• Non-retaliation: Employees might be too afraid to report internally for fear of retaliation or might not have confidence that anything will get done if they report in a company-built system
• Objectivity: A third-party system clearly avoids any real or perceived business/personal conflicts of interest

The bottom line about private sector whistleblower protection

Whistleblower protection should be an area of concern for all employers. Today’s smart public and private companies are investing in third-party hotline and case management systems in order to mitigate risk, encourage reporting, and improve compliance.

OneTrust offers comprehensive and integrated compliance management, reporting, and analytics solutions for compliance departments who want to support employees, promote a speak-up culture, and protect whistleblowers.

Remove barriers for reporters, increase helpline awareness, and simplify case management with a comprehensive ethics and compliance solution. Request a demo today to learn more about OneTrust’s solutions for Ethics and Compliance.