Challenges and requirements for whistleblowing systems under the GDPR
Whether it runs via online forms, surveys, telephone or any other channel, a whistleblowing system conflicts with the GDPR in many respects: person A passes information about person B to the reporting office. As a rule, however, person B, the data subject, is not supposed to know about this (especially at the outset), cannot have their data corrected and cannot exercise their right to erasure or to object.
The German Whistleblower Protection Act (HinSchG) does not resolve all of these conflicts. Data subject rights, above all the rights of access, rectification, erasure, restriction of processing and objection, must therefore be handled with particular care:
The legal basis
Here the situation is clearer. There is no longer any need to rely on legitimate interests under Art. 6(1)(f) GDPR. The legal basis is Art. 6(1)(c) GDPR in conjunction with Section 10 HinSchG: reporting offices may process personal data to the extent necessary to perform their tasks, including special categories of personal data under Art. 9 GDPR, provided that appropriate safeguards are in place. This applies to everyone involved: the whistleblower, the person reported and any other people named in the report.
Data protection impact assessment for the online whistleblowing form
Under Art. 35 GDPR, a data protection impact assessment (DPIA) must be carried out if the processing is likely to result in a high risk to the rights and freedoms of natural persons. This is usually the case with a whistleblowing system. We therefore strongly recommend carrying out an impact assessment in advance.
Duty to inform
The duty to inform creates a conflict. Under the GDPR, the data subject would have to be informed before their data is processed about the purpose, the type of data and, above all, the source (the whistleblower!). This is incompatible with reality and with the very purpose of a whistleblowing system. This is why Section 29(1) sentence 1 of the German Federal Data Protection Act (BDSG) applies:
“The obligation to provide information to the data subject … shall not apply … where providing it would disclose information which by its nature must be kept secret, in particular because of the overriding legitimate interests of a third party.”
Art. 14(5)(b) GDPR may also be relevant: it removes the duty to inform where providing the information would make it impossible or seriously impair the achievement of the objectives of the processing.
The right of access (Art. 15 GDPR) is also restricted: under Section 29(1) sentence 2 BDSG, it does not apply where access would disclose information that must be kept secret, such as the whistleblower’s identity. The rights to rectification and erasure, however, remain in place: inaccurate data must be corrected or erased.
But beware! As the case escalates or progresses, the situation must be reassessed regularly. A point is quickly reached at which the interest in confidentiality no longer prevails and the person concerned must be contacted!
Confidentiality, documentation and retention periods
The reporting office must keep the identity of the whistleblower, the people reported and any other people named in the report confidential (Section 8 HinSchG). Only those responsible for receiving and handling reports may have access. All reports must be documented (Section 11 HinSchG). The documentation is deleted three years after the procedure has been concluded (Section 11(5) HinSchG). It may only be kept longer if other legal provisions require it and doing so is proportionate.
Processing by third parties, DPAs and whistleblowing systems
If you appoint a third party as your reporting office (which involves high costs and has its own pros and cons), this will generally count as processing on your behalf, so you would need to conclude a data processing agreement (DPA), for example. In any case, under Section 14(1) HinSchG you remain responsible for putting an end to the breach.
The role of data protection officers in the whistleblowing system
A whistleblowing system is a procedure in which data protection officers must be involved at an early stage.
Data protection in your online reporting form with LamaPoll
For a whistleblowing form created with LamaPoll, this means in practice:
- Only ask for the information needed to handle the report, and make contact details optional (data minimisation, Art. 5(1)(c) GDPR).
- By default, LamaPoll does not process respondents’ IP addresses or metadata. IP address storage can be switched on as an option; keep it switched off for your reporting form.
- Restrict access to the form and its results to the people responsible. Find out how this works in LamaPoll: Using LamaPoll as a whistleblowing system
- Conclude a data processing agreement (DPA) with LamaPoll as your processor (Art. 28 GDPR).
Conclusion
Implementing a whistleblowing system in line with the GDPR presents organisations with challenging tasks in terms of data protection and respecting the rights of the people concerned. It is important to get to grips with the legal requirements and take appropriate measures.
Overall, it is essential that organisations planning to implement a whistleblowing system carefully review the data protection aspects and take measures to safeguard the rights of the people concerned and ensure data protection.
Involve your data protection officer, carry out an impact assessment and bear in mind that the legal bases, interests and therefore obligations can change as the process unfolds (report, review, action, etc.)!
For more information on internal whistleblowing systems and employee data protection, see the guidance issued by Germany’s federal and state data protection authorities: Guidance from the German Data Protection Conference (in German)
With LamaPoll, surveys can be created quickly and easily. The tool offers many options for individual adjustments. The help pages are useful for solving many questions independently. For special requests, competent and easily accessible customer support is available.
What is LamaPoll?
LamaPoll is a survey tool for creating online questionnaires. Our survey tool lets you create, run and analyse online questionnaires quickly and easily. Create your questionnaire in just a few steps, customise it for your organisation and conveniently invite customers or employees by email. An online questionnaire enables you to gather insights quickly and easily to improve customer or employee satisfaction. You can register for the LamaPoll survey tool free of charge and immediately create and run online surveys with up to 50 participants. If you need more responses for your online questionnaire, simply choose one of our plans: billed monthly, cancel any month. You can also choose from our online questionnaire templates and examples.
