Reporting irregularities under the Whistleblowing Act
The Act on protection of persons who report irregularities (Whistleblowing Act), entered into force on 17 December 2021. The Act enables the reporting of irregularities in a work-related context when it is in the public interest that the irregularities come to light.
Remember that deviations from good research practice and research misconduct fall under special rules and that reports of scientific misconduct are covered by special procedures.
As of 17 July 2022, the University has an internal reporting channel for reporting irregularities. Read the information available here before reporting an irregularity.
- Purpose and scope of the Whistleblowing Act
- What the Act entails
- How to report an irregularity at Lund University
- Public access and confidentiality
- Information on Lund University’s personal data processing in the whistleblowing channel
The Whistleblowing Act has two purposes. The Act is to provide protection to individuals who report an irregularity and ensure that public authorities establish internal reporting channels that facilitate reporting and follow-up, for example.
Reporting irregularities in a work-related context is possible when it is in the public interest that the irregularities come to light. Irregularities could pertain to the contravention of laws or wastage of public funds. An irregularity in the public interest means that there is a general interest in the irregularity ceasing. Corruption and misconduct constitute in principle irregularities that are in the public interest.
The Act, in a work-related context, also applies to reporting contravention of EU regulations within several areas such as public procurement, the prevention of money-laundering and funding of terrorism, product safety and product conformity, environmental protection, radiation protection and nuclear safety, food and animal feed safety, animal health and well-being, protection of privacy and personal data, and security in network and information systems.
What the Act does not cover
Remember that irregularities in the form of a conflict between the individual reporting the irregularity and another employee are not covered by the legislation. Situations that solely concern the working or employment conditions of the person making the report are also not covered as a general principle.
Discharge from accountability and protection against reprisals
The Whistleblowing Act entails that individuals covered by the legislation who make a report cannot be held accountable, for example, for breaching a duty of confidentiality (discharge). However, this does not apply to the duty of confidentiality regarding military defence inventions, classified information that is security-protected pursuant to the Protective Security Act or information affecting national security. Neither does discharge from accountability apply to an individual who commits a crime by making a report.
The Whistleblowing Act also stipulates that individuals covered by the legislation who make a report are protected from reprisals from the employer.
To be covered by the protection, the individual making the report does not need to know for certain that the reported irregularity is prohibited. It is sufficient that they have reasonable grounds for suspecting that it is not permitted.
An individual who commits a crime by making a report or procuring information is not protected from reprisals.
You must state your identity
The person making the report must state their identity so that the University can assess whether the person is protected under the Act. Consequently, it is not possible to remain anonymous when reporting an irregularity under the Whistleblowing Act. The identity of the individual making the report is protected by confidentiality as a general principle.
Freedom to communicate information, freedom to procure information, prohibition of investigation and prohibition of reprisal
Note that all public sector employees may provide information to the mass media for publication, without the risk of sanctions. This is supported by their constitutional right relating to the freedom to communicate information regardless of whether the reported information falls under the Whistleblowing Act or not. However, certain exceptions to the freedom to communicate information apply.
The freedom to procure information is a right held by all to procure information with the purpose of making it public or publishing it.
The prohibition of investigation prevents public authorities or other public bodies from investigating who has provided information under the freedom to communicate information.
The prohibition of reprisal prevents a public authority or other public body from sanctioning an individual who has exercised their right to freedom of expression or freedom of the press.
Those working at the University who belong to one of the following categories
- individual who carries out work under another operator’s control and management, for example as a temp, consultant or similar
- self-employed worker
- hourly employee
may report irregularities arising in the University’s operations through the internal reporting channel. In the channel, you can choose to submit your report in writing, ask to be contacted by telephone to make an oral report, or ask to have a face-to-face meeting at which you can submit your report.
Students are not categorised as a reporting person in their capacity as a student but may be included if they are seeking a job, are a contractor, are employed on an hourly basis or have a similar situation at the University.
The University’s internal channel can be accessed through this link:
The description in the report is to be as clear as possible regarding what the irregularity consists of and who is involved.
What happens next?
You will receive confirmation within seven (7) days that the University has received your report. The confirmation includes a registration number that you can use when contacting the University.
The report is received by specially appointed authorised officials who assess whether the report is covered by the Whistleblowing Act. Thereafter, the authorised officials assess the accuracy of what has been reported and, if required, propose that the University take further measures to process what has been reported.
If the investigation requires it and you have submitted your contact details, you may be contacted by an authorised official.
Within three (3) months of the confirmation, you will receive feedback outlining the measures that the University has taken as a consequence of the report.
If what is reported is not covered by the Whistleblowing Act, the University determines how the report will be handled. In this case, your identity as a reporting person is not covered by confidentiality.
If you need advice and support, you can contact your employee organisation.
The information in a report of irregularity may be covered by confidentiality. This applies, for example, to the identity of the person making the report if they are covered by confidentiality as a general principle, but other information may be covered as well.
When someone requests access to documents or information in a whistleblowing case, the University always assesses confidentiality, which may result in information covered by confidentiality not being disclosed. A decision not to disclose public documents can be appealed through legal proceedings by the person making the request for documents or information.
Lund University processes personal information in the whistleblowing channel.
Personal data in conjunction with a report
When a report of irregularity is submitted under the Whistleblowing Act, the University gathers the personal data that the individual making the report was asked to provide in conjunction with making the report.
The personal data pertains to the individual’s name, email address, information on their working relationship with Lund University and possibly their telephone number if they prefer not to be contacted by email.
The University processes other personal data submitted in conjunction with the report being made in the whistleblowing channel. Examples include the name, position and workplace of other individuals who are within the scope of the reported irregularity.
The legal basis for processing personal data pertains to compliance with the legal requirement. In other words, the University is obligated by law to offer the opportunity to report irregularities through an internal whistleblowing channel.
The University only processes the data required to satisfy the provisions in the Whistleblowing Act regarding report processing and follow-up.
Who has access to the data
Those authorised to access the data include individuals appointed by the Vice-Chancellor, individuals at the University who need the data in order to follow up or take a decision on a report or process a follow-up case and those with system administration authorisation.
Under confidentiality, the supplier of the system and their consultants may access the data if support is required.
How long personal data is saved
The data is saved for the amount of time stipulated in the Archives Act (1990:782). Other data is destroyed when processing of the case is complete. You may not request that the data submitted in the whistleblowing channel be retracted.
Your rights according to the General Data Protection Regulation (GDPR)
You have a number of rights under the General Data Protection Regulation when the University processes your personal data.
These include the right to rectification, the right to obtain a copy of the personal data undergoing processing, the right to information, the right to restrict processing, the right to object and the right to data portability. You can contact the University’s data protection office for information on how to exercise your rights, dataskyddsombud [at] lu [dot] se (dataskyddsombud[at]lu[dot]se).
If you would like to lodge a complaint regarding Lund University’s processing of your personal data, contact the University’s data protection officer at dataskyddsombud [at] lu [dot] se (dataskyddsombud[at]lu[dot]se), or the Swedish Authority for Privacy Protection.
Personal data controller
Lund University is the personal data controller for the processing of personal data in the whistleblowing channel.
In the event of questions, contact the University’s data processing officer at dataskyddsombud [at] lu [dot] se (dataskyddsombud[at]lu[dot]se).
Report an irregularity through the University’s internal channel
Read all the information on this page before you report an irregularity.
Report an irregularity by filling out this electronic form: