Whistleblowing routine

What whistleblowing is

Whistleblowing (varsling) is when someone at work reports a censurable condition in the organisation. A censurable condition breaks the law, the organisation's written ethical guidelines, or ethical norms with broad support in society: for example danger to life or health, danger to climate or environment, corruption or other economic crime, abuse of authority, an unsafe working environment, or a breach of personal data security. (aml § 2 A-1 (2))

A complaint about your own pay, duties or working conditions alone is not whistleblowing, unless it is also one of those conditions. It still deserves an answer, through the ordinary route. (aml § 2 A-1 (3))

Employees and hired-in workers have the right to report. So do trainees, students, conscripts and people in work schemes who work in the organisation. A report may be oral or written, named or anonymous. (aml § 2 A-1 (1), aml § 1-6 (1), Arbeidstilsynet: Spørsmål og svar om varsling)

Why a routine matters

The law requires one in every organisation that regularly employs at least five people. Beyond the law, a routine tells people that speaking up is wanted, where to go, and what will happen. It tells the receiver what to do on a bad day. It lowers the risk of retaliation, which the employer must prevent and pay for if it happens. (aml § 2 A-6 (1), aml § 2 A-3 (2), aml § 2 A-4, aml § 2 A-5)

Common mistakes

• The only receiver is the manager the report is likely to be about.
• Nobody says what happens when the report concerns the top manager.
• Anonymous reports are accepted, but there is no way to write back.
• The routine tells people to report internally first. It may not limit the right to report, and people may always go to a public authority.
• The routine was written by management alone. It must be made with the employees and their union representatives.
• Reports sit in a mailbox for years, readable by whoever has access.
• The person reported on hears about it last, or never gets to answer.

The legal frame

Arbeidsmiljøloven (the Working Environment Act) chapter 2 A gives the right to report, the procedure, the employer's duty to investigate and to protect the Reporter, the ban on retaliation, compensation, the duty to have routines, and confidentiality at public authorities. (aml § 2 A-1 (1))

The minimum content of a routine is an encouragement to report, the procedure for reporting, and the procedure for the employer's handling of receipt, processing and follow-up. Arbeidstilsynet lists questions a good routine answers; this template covers them. (aml § 2 A-6 (4), Arbeidstilsynet: Virksomheten skal ha rutiner for intern varsling)

GDPR and personopplysningsloven apply to every report. The employer is the data controller; a channel provider or outside investigator is a data processor. Both the Reporter and the person reported on have rights to information and access, with narrow exceptions. (Datatilsynet: Varsling og personopplysningar, Datatilsynet: Rett til informasjon og innsyn)

The EU whistleblowing directive is not part of Norwegian law today. Where this template suggests 7 days and 3 months, that is common good practice, not Norwegian law.