The introduction of whistleblower systems in the European Union

Whistleblower systems are becoming increasingly popular additions to the codes of conduct of US and European companies. In the European Union, data privacy protection is subject to the EU Directive on Data Privacy and to national legislation. Subjects such as data quality, criteria for processing personal data, access to data and conditions of data export are regulated by the EU Directive. The data protection commissioners of the European Union have developed a guideline concerning data privacy protection requirements for whistleblower systems. This guideline is now regulated by the Article 29 Data Protection Working Party. The Article 29 Group aims to help EU-subsidiaries of US companies to establish whistleblower systems in compliance with the Sarbanes-Oxley Act, as well as to support the embodiment of such systems in compliance with the data privacy protection laws and rules of EC Data Privacy Protection Directive. The EU Directive concludes that data collection is only allowed for specified and lawful purposes.