Whistleblowers against authority: the Whistleblower Act, protection and how to do it right

This guide is informational. Always verify how the rules apply to your specific case.

OversightDocumentationEvidenceWhistleblowingCorruptionConflict of interest

Becoming a whistleblower against an authority is a big step. This can be corruption, fraud, procurement fraud, illegal record-keeping, systematic errors in cases or other public exercise of power that someone is trying to silence. At the same time, it is easy to make mistakes: sending too much, using the wrong channel, confusing personal conflict with public interest, or providing data in a way that creates unnecessary risks

This guide explains whistleblower law in practice. The focus is on those who work in, have worked in or through assignments come into contact with an authority, municipality, region or public company and are considering reporting misconduct.

What the Whistleblower Act protects

The

Law (2021:890) on the Protection of Persons Reporting Misconduct applies when someone reports information about misconduct in a work-related context and there is public interest in the information coming to light. It also applies to certain infringements of EU law and national rules supplementing

EU law.

Protection may become relevant if you report on, for example:

corruption, bribery or improper benefits;
vices, corruption of friendships or decision makers who do not step aside,
procurements where requirements have been written to favour a particular supplier;
unlawful registration or misuse of personal data;
serious deficiencies in supervision, care, care, school or social services,
systematic cover-up, incorrect record keeping or destroyed documents;
risk to life, health, safety, the environment or the rule of law.

Who can be a whistleblower?

You don't have to be a permanent employee. Protection may include workers, jobseekers, former employees, trainees, volunteers, consultants, hired staff, self-employed and others who received the information through a work-related context. The Swedish Work Environment Authority describes the protected circle as

broad.

It does matter how you got the information. If you have received it through work, assignment, internship, consultancy role or contact with the authority through your work, the Whistleblowers Act is more relevant than if you are just a private individual who is unhappy with a

decision.

Public interest: why the issue must be bigger than your own conflict

A common pitfall is that anything that feels wrong is called whistleblowing. The law is tighter than that. There should be a public interest. The Swedish Work Environment Authority describes that it typically involves serious misconduct, such as those involving a circle that can be described as the general public and situations where there is a legitimate

interest in the disclosure of the data.

A personal conflict over working hours, pay, bad boss or internal criticism is not usually covered simply because it is difficult. However, if the same conflict arises because you tried to raise the alarm about corruption, fraud, security risks or violations of the law, the issue can also concern whistleblower protection and retaliation.

Internal reporting

Public and private employers with at least 50 employees shall have internal whistleblowing channels. The Swedish Work Environment Authority states that the requirement applied to public employers with at least 50 employees since 17 July 2022 and private employers with at least 50 employees since 17 December 2023. The channels should be able to receive reports and provide feedback. The function should be independent and autonomous.

Internal reporting can be appropriate when the problem can be investigated without alerting those responsible, when the whistleblower function acts independently, and when you want to give the organization the opportunity to correct the misconduct first.

Always ask for or save confirmation that the report has been received. According to the law, reporting can be made in writing and orally, and the reporting person should normally receive confirmation within seven days and feedback within three months

External reporting

External reporting means that you report to a competent authority's external whistleblower channel. The Swedish Work Environment Authority publishes a list of authorities responsible for whistleblowing. It states, for example, that the Swedish Competition Authority is responsible for certain matters relating to public procurement and competition, while the Privacy Protection Authority is responsible for certain matters relating to the protection of privacy and

personal data.

External reporting may be right if internal reporting risks reprisals, if management or the whistleblower function itself may be involved, if evidence can be destroyed, or if internal reporting is unlikely to lead to effective action. In the case of procurement, fraud and corruption, this is a concrete risk, since the same people who handled the transaction often check documents, certificates and internal information.

Freedom of communication and whistleblowing are not the same

In certain situations, public servants enjoy constitutionally protected freedom of information and whistleblower protection when data is submitted for publication in constitutionally protected media. The Whistleblower Act does not curtail that protection. But the rules have different purposes

The Whistleblowers Act concerns reporting of malpractice in work-related contexts and protection against obstructionist measures and reprisals.
Freedom of communication concerns the right to provide information for publication in certain media.
Privacy can still create limits, especially for documents, security protections and sensitive data.

If you are considering giving information to the media, you should first distinguish between providing oral information, providing documents and providing confidential material. The level of risk can be completely different

What the employer is not allowed to do

An employer or other operator may not obstruct reporting or take reprisals on the basis of reporting. Retaliation may include dismissal, reassignment, inferior duties, non-promotion, threats, harassment, ostracism, blackpainting, or other measures that effectively punish

whistleblowing.

If you suspect reprisals, document right away. Save dates, emails, meeting calls, new instructions, schedule changes, manager comments, and names of witnesses. The important thing is the connection in time: when did you report, when did the employer find out and what happened next?

How to document before you report

Your report will be stronger if it is built as a controllable timeline. Avoid long emotional descriptions. Rather, write short, precise points.

Summarize the problem. Write what you report: suspected fraud, lack of procurement, misuse of records, tampered documentation or anything else
Explain the public interest. Link to tax money, the exercise of public authority, personal data, legal certainty, security, environment or health.
Make Timeline. Dates, meetings, decisions, emails, invoices, changed requirements, alerts, who attended.
List actions. Diary numbers, agreements, protocols, decision documents, logs, invoices, versions
Separate facts and suspicions. Write what you know, what you've seen, and what you conclude.
Describe the risk of reprisals. If you go external, state why internal reporting is not appropriate

Examples: procurement and procurement

A weak report says: “It is corruption in procurement.” A strong report says: “On 12 March, the reference project requirement changed from three equivalent missions to an exact system requirement that only Vendor A met. The agent who proposed the change has previously worked for Supplier A. Supplier A received the contract on April 30. I attach requirements version 2 and 3, meeting note and assignment decision.”

It is the kind of concrete structure that allows the recipient to verify the data and that you can show that you had reasonable grounds to assume that the information was true.

Mistakes to avoid

Do not send everything you have without selection. Unnecessary personal data and sensitive material can create new problems
Don't claim more than you can show. Use “suspected”, “may indicate” and “should be checked” when the evidence is not complete
Do not mix legal trails. Whistleblowing, JO notification, police notification, work environment notification and appeal serve different functions
Do not give out documents casually. The law does not provide a free right to disseminate documents and does not protect criminal collection.
Do not wait with reprisals. Document negative actions immediately after reporting

Template: first report

pre> Subject: Whistleblowers' report - suspicious [v/corruption/procandlingslack/register] I report a misconduct that I have become aware of in a work-related context. Summary: [Brief description of what happened.] Public interest: The misconduct concerns [public authorities/tax money/public procurement/personal data/legal security]. Timeline: - [Date]: [event] - [Date]: [event] - [Date]: [event] Substrates: - [Document, diary number, email, invoice, log, protocol] Risk assessment: I judge that [internal/external] reporting is appropriate because [reasons]. I request that the report be received and followed up in accordance with the procedures of the Whistleblowers Act. /pre >

When You Should Take Counseling First

Take legal advice before reporting if the material contains confidentiality, security protections, sensitive personal data, patient data, social services data, police records, trade secrets, or if you yourself risk employment law consequences. This also applies if you are considering the media, if the employer has already threatened you or if several legal tracks need to

be coordinated.

Sources

For those who read under stress

The guide is meant as support when you already have a lot around your head. You don't have to read everything at once: start with the section that matches where you stand today and come back when the next step becomes relevant

Affairs with authorities are rarely made better by the fact that you carry everything alone. Ask for help from a support person, lawyer or family member if you can — especially before decisions that

have a long impact.

Common mistakes that make the case more difficult

Trust only verbal promises without brief written acknowledgement or follow-up emails.
Wait to request documents until the conflict is already locked -- then it will be heavier to show what was said.
Write so long and emotionally driven that the authority stops answering the factual question.
Miss deadlines for reconsideration or appeal because the decision was not read verbatim.

Mini-checklist before leaving the guide

Do I have the date, diary/case number and name of the person handling the case (if you know)?
Do I know what the next step is: reply, request out, recall, appeal or report?
Have I saved emails and attachments in a place where I can find them in a week?