Whistleblowing is on the Rise

Why is whistleblowing on the rise? And what does it mean for your business?

The increase in whistleblowing cases may be caused by increased awareness of the issues that must be reported to authorities, or because several high-profile cases have kept whistleblowers in the public eye.

Whistleblowing and data breaches

New figures from the Information Commissioners Office (ICO) show a huge increase in the number of employees reporting incidents of poor data handling. In the three months to the end of August 2018, there were 82 reports about potentially undisclosed data breaches, compared to 31 reports in the previous reporting period.

One factor that may be driving this increase is the new data protection rules (GDPR) that came into effect in May. This new, more stringent regulation may have drawn attention to the issues of data privacy and encouraged employees to raise their concerns.

Whistleblowing cases in 2018

There were several high-profile whistleblowing cases in 2018. These headline-grabbing stories may have inspired more employees to report bad practices and lost data at their own companies.

Noteworthy cases include:

International Petroleum

Two directors of a Russian oil company, International Petroleum, were fined £2m for sacking a former CEO who raised suspicions of corruption and bribery surrounding the company’s operations in Niger.

Barclays

Barclays was fined $15m for trying to uncover the identity of a whistleblower, rather than responding to the content of the report.

Marine Scotland

A Marine Scotland employee was tied to a chair and gagged by colleagues after she reported the bullying she had experienced at work for many years. A disturbing photograph of the incident, taken by one of the employee’s tormentors, was splashed across national news outlets.

Vodafone

A whistleblower from a Vodafone call centre contacted a BBC radio programme to report that employees were effectively discouraged from refusing access to customers who could not properly verify their identity. So much pressure was placed on meeting customer satisfaction targets that agents felt obliged to do anything to keep people happy – and earn their bonus. This became a security risk as scammers recognised that they just need to behave like a disgruntled customer to improve their odds of gaining illicit access to someone’s phone account.

What is whistleblowing?

In simple terms, whistleblowing is to report criminal, unethical or dangerous behaviours or practices – either to a regulator, police or the press. In some cases, employees report their concerns to managers.

Whistleblowing policies

While some companies are concerned about addressing whistleblowing directly, perhaps because of fears that it will cultivate problems and cause additional work , the reality is that developing a whistleblowing culture can help a business identify problems and address issues before they develop into a crisis.

Organisations that do not facilitate whistleblowing are more likely to find problems emerging in the press or via trade bodies or regulators, which they must then try to explain. If concerns can be raised internally, organisations have a chance to remedy the problem, and can then organise a disclosure to the relevant authorities. By self-disclosing issues and concerns, organisations can prevent the impression that they are out-of-touch or unaware of what’s happening under their watch.

Whistleblowing is likely to increase further in 2019. The question for charities, businesses and public-sector organisations is: do you want to take control of whistleblowing or do you want to be led by it?

How are you managing your GDPR compliance requirements?

GDPR added a significant compliance burden on DPOs and data processors. Data breaches must be reported to the authorities within 72 hours, each new data processing activity needs to be documented and Data Protection Impact Assessments (DPIA) must be carried out for processing that is likely to result in a high risk to individuals. Penalties for breaching GDPR can reach into the tens of millions of Euros.

GDPR added a significant compliance burden on DPOs and data processors. Data breaches must be reported to the authorities within 72 hours, each new data processing activity needs to be documented and Data Protection Impact Assessments (DPIA) must be carried out for processing that is likely to result in a high risk to individuals. Penalties for breaching GDPR can reach into the tens of millions of Euros.

“In a world older and more complete than ours they move finished and complete, gifted with extensions of the senses we have lost or never attained, living by voices we shall never hear.”

Picture of James

James

VinciWorks CEO, VInciWorks

Spending time looking for your parcel around the neighbourhood is a thing of the past. That’s a promise.

How are you managing your GDPR compliance requirements?

GDPR added a significant compliance burden on DPOs and data processors. Data breaches must be reported to the authorities within 72 hours, each new data processing activity needs to be documented and Data Protection Impact Assessments (DPIA) must be carried out for processing that is likely to result in a high risk to individuals. Penalties for breaching GDPR can reach into the tens of millions of Euros.

GDPR added a significant compliance burden on DPOs and data processors. Data breaches must be reported to the authorities within 72 hours, each new data processing activity needs to be documented and Data Protection Impact Assessments (DPIA) must be carried out for processing that is likely to result in a high risk to individuals. Penalties for breaching GDPR can reach into the tens of millions of Euros.

How are you managing your GDPR compliance requirements?

GDPR added a significant compliance burden on DPOs and data processors. Data breaches must be reported to the authorities within 72 hours, each new data processing activity needs to be documented and Data Protection Impact Assessments (DPIA) must be carried out for processing that is likely to result in a high risk to individuals. Penalties for breaching GDPR can reach into the tens of millions of Euros.

GDPR added a significant compliance burden on DPOs and data processors. Data breaches must be reported to the authorities within 72 hours, each new data processing activity needs to be documented and Data Protection Impact Assessments (DPIA) must be carried out for processing that is likely to result in a high risk to individuals. Penalties for breaching GDPR can reach into the tens of millions of Euros.