Ilmoo2026-09-21
Finlands visselblåsarlag 1171/2022 — vad en intern kanal är till för
Den här sidan är inte juridisk rådgivning.
Finlands visseblåsarskydd genomförs i lag 1171/2022, som genomför direktiv (EU) 2019/1937. Den fullständiga artikeln finns på finska och engelska. Detta är inte juridisk rådgivning.
Fullständig text på finska och engelska.
This article summarises what the public statute and the EU directive actually say about internal reporting channels in Finland. It is general information, not legal advice, and it is not a claim that any named organisation uses Ilmoo.
The Finnish Act and the EU directive
The Act on the Protection of Persons Reporting Infringements of European Union and National Law (1171/2022) entered into force on 1 January 2023. Section 1 states that the Act implements Directive (EU) 2019/1937 of the European Parliament and of the Council. The current Finnish text is published by Finlex; the directive text is published in EUR-Lex.
Section 2 lists the fields in which reports of breaches may fall — including public procurement (with defence and security exceptions), financial services, anti-money-laundering, product safety, transport safety, environmental protection, radiation and nuclear safety, food and feed safety, public health as referred to in TFEU Article 168, consumer protection, and privacy and network security — plus further heads such as EU financial interests, subsidies and State aid, competition, and corporate tax avoidance schemes. Ordinary workplace disputes are not automatically in scope merely because they are workplace disputes.
Who must establish an internal channel
Section 10 requires listed organisations that regularly have at least 50 persons in an employment or public-service relationship to establish an internal channel for reporting breaches and for follow-up. The list includes specified State bodies, wellbeing services counties, municipalities, parishes, and companies and foundations referred to in the section. Supplementary pension institutions must establish a channel regardless of headcount. Smaller organisations may still run a voluntary channel; section 13 then applies the Act’s rules to that channel.
Section 11 allows the organisation to outsource operation of the internal channel to an external service provider. The organisation remains responsible for the duties in the Act even after outsourcing. Ilmoo is software for a written channel; it does not replace counsel, an oral line, or a meeting on request.
Minimum procedures
- Section 14: designate impartial person(s) to handle reports. Only designated persons may process them.
- Section 15: the internal channel must allow written or oral reports. Acknowledgement of receipt within seven days. If oral reporting is offered, it must be possible by phone or another voice-message system, and a face-to-face meeting on request within a reasonable time. The organisation must publish clear information on internal reporting, the Chancellor of Justice’s central channel, procedures, and the conditions of protection.
- Section 16: the designated person must take the measures needed to assess the report and, where needed, address the breach, and must give feedback on measures within three months of the acknowledgement (or within three months of the end of the seven-day acknowledgement period if none was sent).
- Section 17: the organisation may decide to accept anonymous internal reports. Anonymous reports need not receive the acknowledgement or the section 16(2) follow-up measures.
Directive (EU) 2019/1937 Articles 8 and 9 set the Union-level duties to establish internal channels and procedures. The Finnish Act is the binding national implementation for organisations in Finland; read the Act itself for exceptions, shared channels (section 12), and confidentiality (section 32).
The external channel
Section 18 assigns the centralised external channel to the Office of the Chancellor of Justice (Oikeuskanslerinvirasto). The Office forwards reports to the competent authority or, where none exists for certain heads, to the competent ministry; it does not itself investigate the substance. Its public pages describe when an external report may be made (including where there is no internal channel, or a justified reason to believe internal follow-up failed or retaliation is a risk). Those pages, not this article, are the operational instructions for reporters using that channel.
Protection under section 6 requires that, at the time of reporting, the person had reasonable grounds to believe the information was true and within the Act’s scope. Section 5 describes who is protected (including employees, some self-employed persons, shareholders, board members, volunteers, trainees, people in pre-contract talks or after the relationship ended, facilitators, and certain connected third parties). This is not a complete catalogue of remedies or of retaliation rules (section 23).
For binding guidance, use the statute, the directive, the Chancellor of Justice’s pages, and qualified counsel. Ilmoo’s product legal page restates how this software maps onto a written channel only.