The government proposal for the whistleblower legislation obligates large and medium-sized enterprises as well as public sector actors to establish an internal reporting channel through which, for example, the personnel can report suspected misconduct. The legislation is based on the EU Whistleblowing Directive.
11.10.2022
It is advisable to start preparing a whistleblowing channel now
Eija Warma-Lehtinen & Ville Kukkonen
Related services
As a general rule, the whistleblowing channel must be established in companies that employ at least 50 people
The new whistleblower legislation that is being drafted mainly obligates companies or public sector actors that employ at least 50 people to establish an internal reporting channel. Through the channel, the company’s employees, for example, can report suspected misconduct that concerns the violation of certain legislation, such as consumer protection, environmental protection, data protection or public procurement. When submitting a report, the whistleblower is protected in the manner required by the Act. The Act also provides a period during which the company can exclusively examine the reports.
At the moment, the Act is being discussed by Parliament, and it is to enter into force within three months from its approval. By then, companies that employ at least 250 people will have to adopt an internal whistleblowing channel. The government bill, however, includes a transitional period under which private sector organisations that regularly employ 50–249 people must adopt a whistleblowing channel by 17 December 2023 at the latest.
The whistleblower legislation is based on the EU Whistleblowing Directive, which must be implemented into national legislation by the EU Member States. In Finland, the drafting of the whistleblower legislation has been delayed from the original timetable. In some EU Member States, the Directive has already been implemented into national legislation.
Establishing an internal whistleblowing channel
The main purpose of the new regulation is to protect the whistleblower from retaliation and to provide the organization receiving the report an opportunity to appropriately investigate the suspected misconduct internally. Furthermore, the new legislation will set minimum requirements for the establishment of the whistleblowing channel and for the procedures for processing notifications, such as the processing times and confidentiality. The organisation can largely decide the technical implementation itself, and under certain boundary conditions, it is also possible to outsource the maintenance of the channel to a service provider. According to the proposal, companies that belong to the same group can under certain conditions establish a common reporting channel.
The regulation also creates new obligations to inform for the organisations. Stakeholders that are entitled to report suspected misconduct must, among other things, be informed of the internal whistleblowing channel, the possibility to report through an external reporting channel maintained by the authorities and of the requirements for protecting the whistleblower. In addition, the persons responsible for processing the reports must be appointed and trained in the processing.
Data protection obligations must be taken into account
Requirements based on data protection legislation and, with respect to the personnel, also on the Co-operation Act, must be taken into account so that the reports submitted through the reporting channel and personal data included in them can legally be processed. A whistleblowing channel that meets data protection obligations along with proper data protection documentation are key tools for an organisation to demonstrate that they are in compliance with legislation.
The processing of personal data collected through the whistleblowing channel is subject to the same privacy obligations as the processing of other personal data. For example, the legal basis and purposes for processing personal data as well as how long the data is stored must be defined in accordance with statutory requirements and any unnecessary personal data must be deleted. The individuals whose data is processed must also be informed of the processing, and the organisation must make sure that the statutory data subjects’ rights are respected. It is important to keep in mind that the new legislation sets certain exceptional limits to the rights of the data subjects. In addition, the Finnish data protection authority: Data Protection Ombudsman has ruled that controllers must conduct a data protection impact assessment on data processing relating to whistleblowing channels.
How to prepare for the new obligations?
A whistleblowing channel that meets the requirements of the new legislation protects the company as well as the whistleblower, because a whistleblowing channel makes it possible for the company to uncover misconduct and provides a period during which the company can exclusively process reports. Though the legislation is still being drafted, it is advisable to prepare for the adoption of a channel now. First, it is advisable to make an assessment of the necessary measures.
Latest insights
Article published 3.3.2026 – Employment
The threshold for dismissal is lowered: what should be taken into account in practice?
Article published 6.5.2024 – Employment
Outsourcing company functions – four key points for success
Article published 15.3.2024 – Employment
Five questions concerning industrial actions
Article published 29.11.2023 – Employment
Whistleblowing and data protection – frequently asked questions
Tomi Kemppainen, Kim Parviainen & Eija Warma-Lehtinen
Mikko Hanni & Outi Tähtinen
Eija Warma-Lehtinen & Ville Kukkonen
Latest references
Aurevia and Labquality – Strategic reorganisation
We advised Aurevia Oy, a portfolio company of French private equity sponsor Mérieux Equity Partners, in a strategic reorganisation that involved splitting Aurevia and its parent companies into two independent groups of companies and reorganisation of its existing debt-financing arrangements. Following the reorganisation, the newly formed Aurevia continues as a leading provider of Contract Research Organization (CRO) and Quality Assurance and Regulatory Affairs (QARA) services, while the newly formed Labquality focuses on delivering External Quality Assessment (EQA) services. Aurevia serves operators in the medical devices, in vitro diagnostics and pharmaceutical sectors. Labquality’s customers include clinical laboratories and social and healthcare organisations. The reorganisation positions Aurevia and Labquality to allocate investments more effectively, accelerate growth within their respective customer segments, and respond to evolving market and client needs. The transaction was implemented through multiple parallel demergers and required comprehensive legal and tax structuring across several jurisdictions. Our team supported Aurevia throughout the planning and implementation phases, covering corporate, tax, employment law, and regulatory matters, as well as the optimisation of each group’s financing structure.
Case published 7.4.2026
VR – Supreme Court decision clarifies working time practices
We successfully represented VR Group before the Supreme Court in a case concerning the meal break practice of commuter train drivers. On 6 February 2026, the Supreme Court ruled in VR’s favour (decision KKO:2026:12), confirming that VR had the right to amend the commuter train drivers’ meal break practice in 2021 by rendering the break unpaid in accordance with the applicable collective agreement. This decision clarifies the interpretation of collective agreements and employment legislation as well as the limits of the employer’s right to direct work. Over 250 commuter train drivers challenged the unpaid meal break practice which VR introduced in April 2021. Before the change, meal breaks had a long history of being paid. The change was based on the train drivers’ collective agreement, which allows for meal breaks to be organised either as paid or unpaid time. The Supreme Court ruled that the scheduling and managing of breaks falls within the core area of the employer’s right to direct work. This increases the threshold for an established practice becoming a binding condition for the parties. Merely following a practice consistently and over a long period of time does not make the practice binding; instead, the employer’s intent to commit to the practice must be clearly evident from the employer’s conduct or other circumstances. As both alternatives – paid and unpaid – for organising meal breaks had been retained in the collective agreement despite other amendments over the years, it could not be considered that VR had intended to commit to the paid break practice and waive its right to direct work as regards break scheduling. It was also significant that the employment contracts explicitly referred only to the collective agreement as regards working time. The Supreme Court deemed that the employees’ paid meal break was not an established term of employment and that VR was entitled to change the practice based on the collective agreement. The employer had the right, by virtue of its right to direct work, to unilaterally change the meal break practice by choosing to apply the other arrangement permitted by the collective agreement.
Case published 3.3.2026
Life Finland – Administration of bankruptcy estate
Life Finland Oy, a retailer of natural products, other health-related products and cosmetics, filed for bankruptcy on its own initiative in June 2025, and our attorney, counsel Elina Pesonen was appointed administrator of the bankruptcy estate. Life Finland Oy was part of the international Life Group, and its parent company Life Europe AB was declared bankrupt in Sweden in June 2025. When declared bankrupt, Life Finland Oy had over 30 operational stores and almost 170 employees across Finland. In addition to the premises of the operational stores, the company had several other leased premises, such as retail premises it was vacating as well as office and warehouse spaces. The bankruptcy estate organised clearance sales in all of the company’s stores. The shutdown of the stores and the clearance sales were efficiently carried out in approximately two weeks in cooperation with the company’s country manager, regional managers and sales staff. The clearance sales yielded a significant liquidation result, and consumers bought nearly the entire inventory. The administration of the bankruptcy estate has required expertise in many areas. The proceedings have dealt with specialised issues such as cash pooling arrangements, intellectual property, franchising agreements, employment relationships and consumer creditors. In addition, the proceedings are notably international, as the estate administrator has organised the shutdown of operations and the liquidation of assets in close cooperation with the estate administrators of the Swedish Group companies. The cooperation has included, among other things, exploring opportunities for selling the business, the sale of intangible rights and the coordination of intra-group agreements.
Case published 9.12.2025
Merger of Oomi and Lumme Energia
We are acting as the joint legal advisor to Oomi Oy and Lumme Energia Oy in a transaction whereby Lumme Energia will merge with Oomi. As from the completion of the merger, the combined entity will be the largest electricity retail and service company in the Finnish market. In 2024, Oomi reported a turnover of EUR 373.9 million and had approximately 110 employees. Lumme Energia’s turnover for the same year was approximately EUR 314.6 million and it had approximately 50 employees. The transaction is primarily driven by the recent developments in the electricity market and the strategic goal to develop competitive products and services. Another key objective is to further enhance the customer experience, which is a shared value between the two companies. As a result of the merger, Lumme Energia’s customers will transfer to Oomi, and Lumme Energia will become one of Oomi’s shareholders. The completion of the transaction is subject to an approval by the Finnish Competition and Consumer Authority.
Case published 29.8.2025