16 February 2017
The Russian Ministry of Labour announced, on 8 February 2017, the opening of a public consultation (‘the Consultation’) on a Draft Law on Amendments to the Federal Law of 25 December 2008 No. 273-FZ on Combating Corruption (‘the Draft Law’). The Draft Law, which would be the first direct regulation of whistleblowing in Russia, proposes to impose a specific regime on employers to provide whistleblowers with greater protections, and to take steps to safeguard the confidentiality of their information and provide internal reporting procedures.
Vladislav Arkhipov, Of Counsel at Dentons, told DataGuidance, “From a legal perspective, the introduction of the Draft Law may aim to provide an extra layer of legal protection for whistleblowers, which derives from the need to allow a whistleblowing employee to report on corruption offences without fear of receiving any pressure from the employer or the person he or she makes a report about. To ensure this, internal procedures on data protection compliance should include considerations related to whistleblowing. This should be implemented not only on paper, but also in practice.”
The Draft Law is aimed at implementing Article 33 of the United Nations Convention against Corruption 2003, ratified by Russia in 2006. In particular, Article 1(3) of the Draft Law creates obligations to ensure the confidentiality of information both regarding the whistleblower and the content of the whistleblowing report.
Natalia Gulyaeva and Maria Sedykh, Partner and Associate respectively at Hogan Lovells, explained, “To meet the confidentiality obligations, companies would need to establish a so-called regime of ‘commercial secrecy,’ which requires a list of confidential data, list of persons with access to confidential data and confidentiality clauses in agreement with counterparties, in order to impose such obligations on those who would have access to the whistleblower’s personal data and report. Additionally, since whistleblowing procedures entail the collection of personal data, a separate database would need to be kept in Russia pursuant to data localisation requirements.”
Companies would need to develop a mechanism or procedure allowing the reporting of corruption offences with limited access for other employees to such reports
In addition, Article 1(4) of the Draft Law obliges companies to take a variety of steps to support whistleblowing, including to provide information on significant facts of corruption offences and the whereabouts of the person alleged to have committed such an offence, in order to assist prosecutors or law enforcement agencies. Nevertheless, while reporting such issues to law enforcement, employers, state authorities, lawyers and third parties who have become aware of the details in the whistleblowing report, have to take the confidentiality obligations into consideration.
Elena Kukushkina, Georgy Mzhavanadze and Nina Mogutova, Counsel and Associates respectively at Baker & McKenzie LLP, commented, “Companies would need to develop a mechanism or procedure allowing the reporting of corruption offences with limited access for other employees to such reports and particular departments or officers responsible for processing such reports. Additionally, an employer will have to conduct internal investigations after the report, with the involvement of independent parties (e.g. external companies, auditors, etc.) to ensure the impartiality of the investigation and the confidentiality of, and non-retaliation against, the whistleblower.”
As Article 1(5) of the Draft Law deems the information about the whistleblower and the whistleblowing report to be confidential, the unauthorised disclosure of such information will also entail administrative liability under the Federal Law of 27 July 2006 No. 152-FZ on Personal Data.
Ilya Goryachev and Sergey Medvedev, Senior Lawyers at Gorodissky & Partners, explained, “In the specific regime of the Draft Law, the personal data of the whistleblower can be made available to the public only with their consent. Consent cannot be implied in this regard. However, according to Article 1(8) of the Draft Law, the confidentiality protections do not extend to persons reporting knowingly misleading information.”
The consultation on the Draft Law closes on 22 February 2017, after which it may be introduced to the State Duma (Parliament).
Kaveh Lahooti | Privacy Analyst