As Norway is not a Member State of the EU, the answers to the following questions are given in accordance with national legislation.
1) Local Laws
a) Has the country implemented any laws / regulations on whistleblowing (Local Law)?
Yes, the Norwegian Working Environment Act (WEA) includes provisions regarding whistleblowing in chapter 2 A Notification.
In addition, the general provision on freedom of expression is set forth in the Norwegian Constitution section 100.
2) Scope of application
a) What types of wrongdoings are covered by the Local Law? Does it cover breaches of EU law?
According to the WEA, an employee has a right to notify censurable conditions at the employer's undertaking. Censurable conditions mean conditions that are in contravention of legal rules, written ethical guidelines in the undertaking or ethical norms on which there is broad agreement in society; for example, conditions that may involve:
- danger to life or health
- danger to climate and the environment
- corruption or other economic crime
- abuse of authority
- unsatisfactory working environment
- breach of personal data security
The WEA does not include the same specific list as provided in Article 2 of the EU Directive. Further, the WEA does not include reference to EU law.
b) Personal scope
i) Does the Local Law apply to reporting persons working in both the private and public sectors?
The WEA covers employees working in both the private and public sectors.
The WEA generally applies to self-employed people; however, with some exceptions and only in relation to their employing entity. The WEA only applies for board members, shareholders and volunteers if they are considered employees of the undertaking.
The WEA does not apply to job applicants, people whose employment has ended, and those being supervised or directed by a contractor, sub-contractor or supplier.
ii) Does the Local Law apply only to breaches that the reporting person became aware of in a work-related context?
No, the source of the notifier’s information is not relevant to their right to notify about censurable conditions in the undertaking.
iii) Does the Local Law also protect: facilitators; people connected to the whistleblower and who could suffer retaliation in a work-related context; and legal entities the whistleblower owns, works for, or is otherwise connected with?
Not directly. However, as retaliation against an employee who legally notifies about censurable conditions in an undertaking is prohibited, the mentioned parties may have an indirect protection as retaliation includes any unfavorable act, practice or omission that is a consequence of or a reaction to the fact that the employee has notified.
c) Does the Local Law require specific conditions to protect reporting persons?
An employee may notify externally to the media or the public at large if the employee is in non-negligent good faith regarding the content of the notification. The condition does not apply to internal notifications.
3) Reporting channels
a) Does the Local Law allow anonymous reports? How are companies/agencies meant to handle them?
Anonymous reports are not mentioned in the Act, but the employer may provide a channel for anonymous reports.
b) Is there a duty of confidentiality and any derogation from this duty?
The only confidentiality obligation applies to supervisory authorities or other public authorities when they receive an external notification concerning censurable conditions. Any person who performs work or services for the body receiving such notification shall be obliged to prevent other persons from gaining knowledge of employees' names or other information identifying employees.
c) Public disclosures: does the Local Law provide for this possibility?
An employee may notify externally to the media or the public at large if:
- the employee is in non-negligent good faith regarding the content of the notification;
- the notification concerns censurable conditions of general interest; and
- the employee has first notified internally or has reason to believe that internal notification would not be appropriate.
4) Reporting channels: internal
a) Is there an obligation for private and/or public legal entities to establish channels and procedures for internal reporting and follow-ups?
Employers in both the private and public sectors that regularly employ at least five employees are obliged to have procedures for internal notification. Undertakings with fewer employees shall also have such procedures if the conditions at the undertaking so indicate.
b) Do internal reporting channels need to allow reporting in writing, orally or both?
That is not specified in the Act.
c) Procedures for internal reporting and follow-up: does the Local Law require legal entities to adopt internal reporting systems with the following elements?
i) Channels able to ensure the confidentiality of the identity of the reporting person and the protection of third parties mentioned in the report:
Not specified in the Act.
ii) Acknowledgement of receipt of the report to the whistleblower within seven days of receipt:
Not specified in the Act. See iv below.
iii) The designation of an impartial function/team to manage follow-ups on reports and maintain communication with the whistleblower:
Not specified in the Act.
iv) Any other follow-up requirements including those for anonymous complaints:
When notification is made regarding censurable conditions in the undertaking, the employer shall ensure that the notification is adequately investigated within a reasonable time.
v) A reasonable timeframe to provide feedback, not exceeding three months from acknowledgment of receipt or if no acknowledgement was sent, three months from the expiry of the seven-day period after a report is made:
Not specified in the Act. See iv above.
vi) Providing clear and easily accessible information on internal reporting procedures and external reporting procedures to competent authorities and/or EU institutions/bodies:
According to the WEA, the procedures should be easily accessible to all employees at the undertaking.
vii) Should legal entities take any additional measures in order to comply with the above requirements?
The procedures shall be in writing and at least contain:
- an encouragement to notify censurable conditions;
- a procedure for notification; and
- a procedure for the employer's receipt, processing and follow-up of notifications.
5) Reporting channels: external
a) Has the country designated a competent authority to receive and investigate whistleblower disclosure and retaliation complaints?
An employee may always notify externally to a public supervisory authority or other public authority such as the Norwegian Labour Authority, the police and the Data Protection Authority.
b) Is an independent and autonomous external reporting channel already established in the country?
Not in addition to the general public supervisory authorities.
6) Processing of personal data
a) Is personal data concerning the reports processed in compliance with local and EU legislation such as EU Regulation 2018/1725 and local privacy laws?
EU Regulation 2018/1725 as adopted EU legal act is not incorporated in Norway and is considered by the EEA EFTA States not to be relevant for incorporation into the EEA Agreement. However, all processing of personal data in relation to whistleblowing must be done in accordance with GDPR. There are no local law deviations in addition to GDPR as regards records processed. The Norwegian Data Protection Act has, in accordance with GDPR Art. 23, implemented provisions to allow restriction as regards data subjects’ rights according to GDPR Art. 13, 14 and 15. This implies that both the whistleblower and the accused may be restricted from, for example, rights to access and information in the reports to allow proper internal investigations and protect the rights and freedoms of the involved parties (whistleblower, accused and potential third parties). Such exemptions must however be assessed on a case-by-case basis and the data subjects have a right to be informed about the reason for any exemption applied.
7) Record keeping of reports
a) Is there any obligation regarding record keeping of reports as provided for by the EU Directive?
There are no local law deviations in addition to GDPR as regards record keeping. Please also see Q6 regarding exemptions under the Norwegian Data Protection Act.
a) Is there any difference between whistleblower protections in the private and public sectors?
b) Are whistleblowers protected against all forms of retaliation including threats and attempts of retaliation? Which forms of retaliation are expressly indicated?
Yes, retaliation against an employee who notifies pursuant to the WEA is prohibited.
Retaliation means any unfavorable act, practice or omission that is a consequence of or a reaction to the fact that the employee has notified, for example:
- threats, harassment, arbitrary discrimination, social exclusion or other improper conduct;
- warnings, change of duties, relocation or demotion; or
- suspension, dismissal, summary discharge or disciplinary action.
c) Does the Local Law provide for any other measures of support such as those indicated in the EU Directive?
According to the WEA, the employer must ensure that the notifier has a fully satisfactory working environment. If necessary, the employer shall ensure that measures are taken to prevent retaliation.
d) Does the Local Law provide for the necessary measures to prohibit any form of retaliation against whistleblowers?
Yes, see above.
e) Does the Local Law provide for any remedial measures, including interim relief measures?
f) Does the Local Law provide for exemptions from liability for whistleblowers?
g) Does the Local Law provide for sanctions against natural and legal persons that violate whistleblowers’ protection or the duty of maintaining the confidentiality of their identity?
On breach of the prohibition against retaliation, an employee may claim redress and compensation without regard to the fault of the employer or hirer.
h) Does the Local Law provide for sanctions in case of false reports?
9) Other issues
a) Under the Local Law, is adopting a whistleblowing system relevant to assess the adequacy of a compliance program? Does this have any value to mitigate or eliminate criminal liability for legal entities?
b) Does the Local Law or another law in your country provide for whistleblower reward programs?
c) Can companies benefit from any incentives in the case of voluntary self-disclosure of violations they became aware of following an internal report?
Voluntary self-disclosure/transparency regarding violations are in general beneficial for companies, for example:
- Within the field of criminal law, the Norwegian Criminal Act, section 78 letter f) expressly states that the court shall take into account any confession or cooperation in detecting criminal acts.
- With regard to competition law, cooperation and self-disclosure towards the competition authority shall be taken into account when fixing the level of fine if a company has entered into agreements distorting competition, cf. the Norwegian Competition Act, sections 30 and 31.
- In the field of public procurement, certain criminal acts related to a tenderer shall lead to rejection from the tender procedure (such as anti-money laundering, fraud, corruption and human trafficking). However, self-cleaning measures, and transparency thereof, such as cooperation with the relevant authorities and organizational and personnel changes, may upon the assessment of the public contracting authority lead to the tenderer not being rejected.
d) Will implementing the EU Directive create any issues with obligations provided for under other laws / regulations?
The implementation of the Whistleblowing Directive is currently under assessment by the Ministry of Labour and Social Affairs together with the Ministry of Justice and Public Security and the Ministry of Foreign Affairs, hence is it not yet clear to what extent the implementation will lead to any issues affecting adjoining areas.
For a pdf of the full guide please click on the button below.