Services

Q & A

- Global Hotline -

Q1 | Are there any criteria, such as company size, for which companies should introduce a global whistleblowing system?

There is no uniform standard regarding the size of company that should introduce a global whistleblowing system. However, a global whistleblowing system is an effective means of gathering, through an internal reporting system, information about serious misconduct at overseas sites in which local management is suspected of involvement.

Accordingly, a company should strengthen governance over its overseas sites—and should therefore introduce a global whistleblowing system—in situations such as the following: (1) the company has more than 10 overseas sites; (2) the company has large factories overseas, such as in China, Thailand, or Vietnam, that are important sites for the company; (3) the proportion of overseas sales is growing; and (4) the company has made a large-scale overseas acquisition but the head office does not yet have sufficient control over the acquired company.

Q2 | Are there any risks in introducing a global whistleblowing system?

A global whistleblowing system, in and of itself, strengthens the compliance framework and carries no risk.

However, some Japanese companies introduce global whistleblowing systems while disregarding the local laws of each country. In that case, a measure intended to strengthen compliance ends up violating local law. As noted above, compliance is essential primarily with local personal data protection laws such as the GDPR, labor-related laws, and laws regulating whistleblowing systems.

In addition, a major risk arises if, after introducing an internal reporting system, reports are simply left unaddressed once received. It is necessary to build a system for properly examining and responding to each and every report.

Q3 | What points should be kept in mind when selecting the group companies to which the global whistleblowing system will apply?

There is no fixed standard for which group companies the system should apply to, so please select the applicable group companies in accordance with company policy.

That said, if a joint venture in which a partner company holds a majority stake (including cases where, under the joint venture agreement’s division of roles, the partner company is responsible for compliance matters) is to be made subject to the system, it goes without saying that careful explanation must be given to, and consent obtained from, the partner company. In addition, introducing a global whistleblowing system may constitute a matter requiring a board resolution at the joint venture, so the partner company’s support is essential when introducing the system. Furthermore, discussions with the partner company will also be needed regarding the sharing of investigation-related information.

Q4 | What are the advantages and disadvantages of asking a local law firm to serve as the reporting hotline?

1. Advantages

The greatest advantage of asking a local law firm to serve as the reporting hotline is that it can communicate directly with whistleblowers in the local language to confirm the content of reports.

2. Disadvantages

However, for a company operating in many countries and regions, it is practically difficult to engage a local law firm as the whistleblowing hotline separately for each and every site.

In addition, many such local law firms do not handle whistleblowing matters exclusively but rather handle them alongside other work. As a result, they may not always be able to respond appropriately to whistleblower reports, which can arrive at any time. For example, a call from a whistleblower may be missed, a report may be received but left unattended for a while, or the responsible attorney or staff member may have left the firm without the company being aware. In such cases, there is a risk that trust in the global whistleblowing system itself will be undermined. Furthermore, because the Japan head office would need to individually manage its relationship with each local law firm at each site, this inevitably consumes the limited resources of the head office’s legal/compliance department.

For these reasons, we do not recommend asking local law firms to serve as the hotline for a global whistleblowing system. We recommend instead engaging a global vendor that specializes in report reception, such as NAVEX Global, to build a unified reporting system.

Q5 | What is the cost of introducing a global whistleblowing system?

The cost of building a global whistleblowing system varies depending on factors such as: (1) the location of each site; (2) the number of employees at each site; (3) whether reception will be limited to web/email or will also include telephone reception; and (4) whether support will be limited to English, or will also cover local languages.

In addition, costs will also arise for matters such as the review of local laws by Japanese and local attorneys, drafting of internal rules, preparation of explanatory materials for each site, and translation—all of which are needed at the time of implementation.

If you contact our firm, we will be happy to prepare a cost estimate.

Q6 | What are the key points for GDPR compliance in connection with a global whistleblowing system?

When applying a global whistleblowing system to a European subsidiary, measures to ensure GDPR compliance are essential. This is because the system involves collecting highly confidential personal information relating to employee misconduct and transferring it outside the European Economic Area. Fortunately, Japan has received an adequacy decision under Article 45 of the GDPR, but this does not mean "GDPR compliance can be disregarded." That is, measures such as providing an appropriate Privacy Notice to whistleblowers and subjects of reports are still necessary in order for European subsidiaries to comply with the GDPR. In addition, when using a vendor such as NAVEX Global, special measures are needed because NAVEX Global is a U.S. company and the U.S. does not have an adequacy decision under the GDPR. Furthermore, in 2020 the European Court of Justice’s Schrems II decision invalidated the EU-US Privacy Shield, the framework that had previously legitimized the transfer of personal data between Europe and the U.S., so a separate response to this is now required.

Q7 | Is it necessary to comply with the EU Whistleblower Protection Directive*?

*EU Whistleblower Protection Directive: Directive (EU) 2019/1937 of the European Parliament and of the Council of 23 October 2019 on the protection of persons who report breaches of Union law.

The EU Whistleblower Protection Directive (hereinafter, the "EU Directive") requires each EU member state to enact domestic legislation implementing the Directive by December 17, 2021. Its substantive content is limited to the general requirements below and does not necessarily require special measures tailored specifically to those requirements. That said, caution is warranted, as additional special requirements may be added when each EU member state enacts its domestic legislation.

Requirement that companies employing 50 or more people establish an internal whistleblowing hotline for reporting and follow up
Prohibition on retaliation against whistleblowers
Protection of whistleblowers’ personal information
Feedback to whistleblowers within three (3) months

【Status of Domestic Legislation in EU Member States (as of April 5, 2021)】

In Germany, deliberation has already begun on a domestic bill that, in some respects, expands on the EU Directive—for example, by including reports concerning violations of German domestic law within the scope of protection (whereas the EU Directive is limited to violations of EU law), and by providing for fines of up to €100,000 (with possible application to companies as well) against individuals who retaliate against whistleblowers.

In this way, it will be necessary to continue monitoring the progress of domestic legislation in each EU member state going forward.

Q8 | What is the outline of the draft Whistleblower Protection Law in Germany?

*Information as of March 2021

The EU Directive requires each EU country to transpose its provisions into domestic law by December 17, 2021.

Among the various national laws, the German Whistleblower Protection Law offers whistleblowers stronger protection than the EU Directive. Below is an outline.

1. Scope of Persons Protected

The EU Directive protects persons who became aware, "in a work-related context," of a legal violation that should be reported. The German draft law, meanwhile, protects both persons who became aware of such a violation "in a work-related context" and those who became aware of it "in a professional context."

2. Laws Covered by Reports

The EU Directive protects persons who report violations of EU law. The German draft law, meanwhile, protects persons who report violations of either EU law or German law.

3. Content of Protection for Whistleblowers

The EU Directive requires each national law to provide for: (1) a prohibition on retaliatory acts against whistleblowers, such as suspension, layoff, or dismissal; and (2) remedies and compensation for damage suffered by whistleblowers as a result of retaliation. It further requires that, where a retaliatory act is disputed in court, the burden of proof be placed on the company to demonstrate a legitimate reason for the measures taken (a reversal of the burden of proof).

In response, the German draft law provides for (1) and (2) above in accordance with the EU Directive, and, with respect to (2), further provides that a whistleblower who suffers damage as a result of retaliation may claim damages from the company if the facts reported are true, or if the whistleblower had reasonable grounds to believe them to be true. However, this protection does not apply to a whistleblower who reports false information intentionally or with gross negligence.

4. Reporting Channels

Both the EU Directive and the German draft law allow use of either internal reporting (to an internal reporting body) or external reporting (to the responsible administrative authority), and there is no major difference between the two in this respect. Note that, under previous German case law, external reporting was only permitted if internal reporting had first been made; however, this rule has been changed in line with the EU Directive.

5. Obligation to Establish an Internal Reporting System

Both the EU Directive and the German draft law impose an obligation on companies with 50 or more employees to establish an internal reporting system. However, the German draft law imposes the obligation to establish an internal reporting system on certain specific companies, such as financial institutions, regardless of employee count.

6. Obligations of the Recipient of a Report

Both the EU Directive and the German draft law impose obligations such as acknowledging receipt within seven (7) days of receiving a report, conducting an appropriate follow-up such as an internal investigation, and providing feedback within three (3) months of acknowledging receipt, and there is no major difference between the two in this respect.

7. Penalties

The EU Directive requires each national law to establish specific penalties. In response, the German draft law provides for an administrative fine of up to €100,000 against a person who obstructs a report or retaliates against a whistleblower.

8. Whether Anonymous Reporting Is Permitted

The EU Directive leaves it to each country’s discretion whether to accept anonymous reports. In response, the German draft law does not impose an obligation to accept anonymous reports.

That said, as explained in the next Q, the German draft law does not prohibit a company from voluntarily accepting and protecting anonymous reports. Given that many scandals have come to light through anonymous reports, it may be worth deciding, with reference to the next Q, whether to incorporate anonymous reporting into your own internal reporting system.

In summary, the German draft law is, overall, more protective of whistleblowers than the EU Directive—in other words, it sets a stricter standard from the company’s perspective.

For a company operating across EU countries, it is not realistic to investigate the laws of every country and adjust its response according to each country’s regulations. For this reason, we recommend first incorporating German law, as a standard baseline, into your internal reporting system, and then addressing separately only those cases where a given country’s requirements are stricter than German law.

Q9 | Should we accept anonymous reports?

An anonymous report is one in which the whistleblower reports without disclosing their name or other identifying information.

Its advantage is that it promotes greater use of the internal reporting system, since whistleblowers can report with peace of mind, without worrying about retaliation. On the other hand, its disadvantage is that, because the whistleblower is anonymous, it can be difficult to contact them, which may make it impossible to conduct a sufficiently thorough investigation.

Japan’s Whistleblower Protection Act does not limit protection to reports made under one’s real name and also protects anonymous reports (see Q4 of the "Q&A for Whistleblowers and Consultants" published by Japan’s Consumer Affairs Agency). In addition, the Consumer Affairs Agency’s "Guidelines for Private Business Operators on Establishing and Operating Internal Reporting Systems in Light of the Whistleblower Protection Act" also recommends accepting anonymous reports in order to ensure the effectiveness of internal reporting systems.

In the EU, on the other hand, many countries take an unfavorable view of anonymous reporting. One reason cited for this is the dark history of denunciation and informing during the Nazi era and subsequently under the Stasi in former East Germany.

Indeed, the EU Directive leaves it to each national law to decide whether to accept anonymous reports and whether to bring them within the scope of protection. And the German draft law, as of March 2021, does not require the acceptance of anonymous reports and does not necessarily bring them within the scope of protection.

As described above, the treatment of anonymous reporting differs by country, but what is important is that no country prohibits the acceptance of anonymous reports outright. It is advisable to weigh the advantages and disadvantages of anonymous reporting comprehensively and decide whether to incorporate it into your own internal reporting system.

Note that global vendors such as NAVEX Global provide systems that allow communication with the whistleblower even in the case of an anonymous report. Such a system can resolve the disadvantage of anonymous reporting—namely, the difficulty of communicating with the whistleblower.

Q10 | What content should be included in the rules governing global whistleblowing?

The matters that must always be considered are primarily: (1) the scope of matters subject to reporting; (2) the scope of persons eligible to make a report; and (3) whether anonymous reporting will be permitted.

1. Scope of Matters Subject to Reporting

In some countries, local law limits the scope of matters that may be reported, so a prior investigation of local law in this respect is necessary.

2. Scope of Persons Eligible to Report

It is necessary to consider whether to include not only employees and officers, but also outside parties, within the scope of persons eligible to report. There is no fixed standard on this point, so please decide in accordance with company policy.

Allowing reports from outside parties is desirable from the standpoint of improving the compliance framework. However, the possibility cannot be ruled out that a competitor might make a report for the purpose of harassment or business obstruction. This decision should be made after weighing these advantages and disadvantages.

3. Whether Anonymous Reporting Will Be Permitted

Generally speaking, whether to permit anonymous reporting is decided in accordance with company policy, but in some countries local law requires that anonymous reporting be made available, so a prior investigation of local law in this regard is necessary.

Permitting anonymous reporting has the advantage of reducing the psychological barrier to reporting and thereby increasing the number of reports. On the other hand, it also carries the risk of increasing reports made as pranks, and of delaying the initial stage of an investigation because the whistleblower cannot be contacted when an investigation is conducted based on the report.

Q11 | How should we determine who, within the Japan head office, is granted access to reported information?

In determining who is granted access to reported information, it is important to consider the matter from the standpoint of confidentiality in order to prevent retaliation against whistleblowers and to comply with local law.

From this standpoint, one approach is to grant system access rights only to legal/compliance department staff who have entered into a confidentiality agreement with the company.

That said, in our firm’s experience, the content of reports under a global whistleblowing system is in many cases HR-related, such as sexual harassment and power harassment cases, and the HR department is responsible for investigating such cases. Accordingly, it may be necessary to consider granting HR department staff access, in advance, to the system (i.e., to raw report data) as well.

However, where the HR department is not independent from management, access rights should be granted, and information sharing conducted, only with great care.

Q12 | Should the Japan head office, or the local overseas site, conduct the investigation into a reported matter?

For matters that cannot be entrusted to local personnel—such as reports of serious misconduct at an overseas site in which local management is suspected of involvement—the Japan head office should take the lead in conducting the investigation. On the other hand, for relatively minor matters, such as power harassment or sexual harassment, where local management is not suspected of involvement, it will generally be appropriate to conduct the investigation locally, since, among other things, the people concerned can be interviewed directly on site.

In this way, the decision should be made on a case-by-case basis, taking into account factors such as the degree of involvement of local management, the seriousness of the matter, and the practical effectiveness of the investigation.

Q13 | What points should be kept in mind when forwarding the content of a report to local personnel after it has been received?

When a report received at the Japan head office is forwarded to local personnel, this constitutes a cross-border transfer of personal information from Japan to the local jurisdiction, so compliance with the overseas-transfer restrictions under Japan’s Act on the Protection of Personal Information is required.

In addition, it is necessary to confirm in advance that the local personnel to whom the report is being forwarded are not themselves connected to the matter reported, in order to ensure that they do not leak information to the subject of the report or others. On this point, some countries require that a confidentiality agreement be entered into with local reporting personnel, so a prior investigation of local law is also necessary.

Regarding the method of forwarding reports locally and how the information should subsequently be managed, an effective approach is to consolidate and store all report-related information on a single server and grant local personnel appropriately controlled access rights.

Q14 | We introduced a global whistleblowing system, but the number of reports is not growing. What should we do?

The main reasons why the number of reports fails to grow are generally: (1) insufficient awareness-raising; and (2) a lack of trust among local employees.

1. Insufficient Awareness-Raising

The following are methods for publicizing the system. Please consider any of these that have not yet been implemented:

Hold a local briefing session at the time of introduction
Publicize the system alongside every compliance training session
Display awareness-raising posters in prominent locations
Post information on the company intranet
Distribute cards listing the hotline’s contact details

2. Lack of Trust Among Local Employees

For local employees, the Japan head office can feel like a distant entity, and employees often feel anxious, unsure of how their report will be handled, and therefore hesitate to report.

To dispel this anxiety, it is necessary to continuously communicate, even in ordinary times, that the Japan head office’s compliance department acts independently of local management and takes thorough measures such as prohibiting retaliation and protecting privacy.

Q15 | Our number of reports seems low compared to other companies. Is there a benchmark for the appropriate number?

Premise: Our company has more than 100 overseas sites and more than 100,000 employees but receives only 30 reports per year.

The number of reports naturally varies depending on a company’s size, business, number of employees, and workforce composition, so it is not possible to say categorically whether a given number is high or low.

That said, referring to the internal reporting figures published by various companies (note: not limited to global whistleblowing) in Toyo Keizai Inc.’s "CSR Corporate Handbook (ESG Edition) 2021," a commonly cited rule of thumb is roughly one report per year for every 100 employees.

Given your company’s scale, 30 reports per year could be considered low. We recommend enhancing your publicity efforts and strengthening measures to earn the trust of local employees.

Q16 | What was the Ibiden case (Supreme Court, First Petty Bench, Judgment of February 15, 2018)?

(Regarding a report from a subsidiary employee to a group reporting hotline and the parent company’s responsibility)

In a case where a report of sexual harassment was made by an employee of a subsidiary to a group internal reporting hotline established at the parent company, the Supreme Court held that, "depending on the specific circumstances of the report, the parent company may, under the principle of good faith, owe a duty to the person who made the report to respond appropriately, in light of the content of the system it has established to receive such reports and the content of the consultation relating to the report."

This judgment demonstrates, as a case-specific finding, that a parent company that has established a group internal reporting hotline may owe a duty, under the principle of good faith, to respond appropriately to a consultation from a subsidiary’s employee—a finding that is instructive for practical purposes.

However, this judgment does not set out specific criteria for what constitutes an "appropriate response" to a report. Accordingly, in light of this judgment, it remains necessary to examine, case by case, what response is appropriate given the specific facts.

For example, although the parent company’s responsibility was ultimately denied in this case, the following aspects of its handling could well have been found inappropriate: (1) it did not obtain a factual account directly from the victim; and (2) although the victim and the alleged perpetrator belonged to different group companies, the parent company left the investigation to those group companies rather than conducting it itself from an independent, third-party standpoint. Indeed, the High Court, in the appeal, had found the parent company liable.

In light of these case-specific considerations, we recommend providing education and training to whistleblowing hotline personnel, or engaging outside experts for the reporting hotline, in order to ensure an appropriate response to each report based on its specific facts.

Q17 | What is the content of Vietnam’s Personal Data Protection Decree?

In Vietnam, the "Personal Data Protection Decree" (Decree No. 13/2023/NĐ-CP) took effect on July 1, 2023. Because this decree applies not only to organizations, entities, and individuals in Vietnam, but also to foreign organizations, entities, and individuals located in Vietnam, and to foreign organizations, entities, and individuals that directly handle personal data in Vietnam, it also applies to a Japan head office that handles global whistleblowing reports from its Vietnamese local subsidiary or Vietnamese corporate entity.

In light of this decree, when preparing a privacy policy for Vietnam and considering the design of a global whistleblowing system covering a Vietnamese local subsidiary, the following points mainly need to be kept in mind:

1. Regarding information requiring particular care in handling, the decree treats as examples of sensitive personal data requiring careful handling (Vietnamese: dữ liệu cá nhân nhạy cảm)—among personal data, information having a particularly significant impact on an individual’s legal rights and interests—not only information such as race/creed and criminal/disciplinary history, which would also be treated as "special-care-required personal information" under Japan’s Act on the Protection of Personal Information, but also information relating to sex life or sexual orientation, and information relating to bank accounts or transactions.

2. Regarding the method for obtaining an individual’s consent when handling their information, the decree requires that explicit consent be obtained in a manner that is subsequently verifiable. In addition to written consent, the decree gives, as an example, a method such as checking a checkbox.

3. Regarding the cross-border transfer of personal data for purposes of global whistleblowing, the decree requires that an impact assessment document be prepared and submitted to the Ministry of Public Security. That said, because the decree has only recently taken effect, the authorities have not yet issued guidance on the specific format for this assessment document. Future developments from the public security authorities should be monitored.

At present, there are, in principle, no specific penalty provisions for violations of this decree, with the exception that profiting from buying or selling personal data over a computer network is subject to criminal penalties under the Criminal Code. The Vietnamese government reportedly plans to prepare a separate decree in the future regarding administrative penalties for violations of this decree.