Implementation of the Newly Introduced Whistleblowing Law: GDPR Considerations

The Whistleblowing Law requires public institutions and undertakings with more than 50 employees to set up an internal whistleblowing system to process relevant notifications. Any notification made through the whistleblowing system involves processing of the personal data and therefore necessitates compliance with the corresponding provisions of the General Data Protection Regulation (GDPR). Although anonymous notifications are allowed for consideration, it is strongly recommended to ensure strict GDPR compliance of the system to encourage identification of the whistleblowers thus facilitating effectiveness of the subsequent investigations. Therefore, it is critically important to supplement the whistleblowing system with the integrated GDPR instruments ensuring transparency of the personal data processing, such as designated whistleblowing system policy providing data subjects with a detailed description of the information processed via the system, definition of the lawful basis and purpose for processing of the personal data, identification of the recipients and data transfer options, as well as an articulation of the rights of the data subjects mentioned in the notification. Despite being recognised as data subjects within the meaning of GDPR, the rights of the potential violators referred to in the submitted notifications shall be limited to avoid hindering the main purpose of the ongoing processing itself. Thus, the potential violators shall remain uninformed on the submitted notification, details of the notification, identity of the whistleblower, etc.