More whistleblowers turn to the Danish Data Protection Authority

Datatilsynet received 28% more reports of allegations in 2023 compared to 2022.

Datatilsynet, the Danish Data Protection Authority, says its whistleblower scheme received 33 (28%) more reports of allegations in 2023. In total, 149 reports were sent in, covering the mental and psychological working environment, harassment, financial fraud and surveillance.

The National Whistleblower Scheme, which started just over two years ago, investigates allegations such as:

  • breaches of certain types of EU-law;
  • serious breaches of the law and other serious offences; and
  • harassment and sexual harassment.

The increase is not surprising says Karina Kok Sanderhoff, head of the National Whistleblower Scheme. She points to a campaign that was launched in mid-2023 to draw attention to the scheme, adding that it is important for people to know that the scheme exists. “[Whistleblowers] who for one reason or another do not want to use their workplace’s internal arrangements, have somewhere to go – and therefore it is important to us that they know we exist and are ready to talk to them.”

147 reports processed

Karina Kok Sanderhoff
Karina Kok Sanderhoff.
Photo: Datatilsynet

During the year, 147 reports were processed, with the majority recieved from 2023, but also a few from late 2022. Of the 147 processed reports, 102 (69%) concerned relationships with private companies or private individuals, and 45 (31%) related to public authorities.

Datatilsynet found grounds in 48 cases (33%) to take further action with relevant authorities, including two cases that were handed to the police. That is an increase from 2022 where 26% of the reports were taken further or passed on to other authorities.

When the scheme started, it was called the Whistleblower Scheme in the Danish Data Protection Authority, and two out of three reports were connected to matters relating to data protection. The scheme then changed its name to the National Whistleblower Scheme to signal broader coverage, and the data protection matters dropped to 35% in the second year.

“It is important to us that they know we exist and are ready to talk to them.”

Karina Kok Sanderhoff, head of the National Whistleblower Scheme

As required within section 20 of Datatilsynet’s Whistleblower Act, feedback to the whistleblower must be done within three months from confirmation of sending the report, or six months in duly justified cases. The average processing time in 2023 was 23 days.

The Danish Financial Supervisory Authority (Finanstilsynet) also has a whistleblower scheme, which covers reports of potential market abuse including insider trading, unlawful disclosure of internal knowledge and market manipulation in accordance with the Market Abuse Ordinance.