Rules on the protection of whistleblowers

1. Introduction

These rules are set with reference to paragraph 1. Article 5 law on the protection of whistleblowers no. 40/2020 (hereinafter "the law"). The goal of the law is to promote the disclosure of law violations and other reprehensible behaviour that may occur in the public sector or the general labour market. The rules apply to the procedure for informing Reykjavík University employees.

2. Definitions:

In these rules means.

1. Internal whistleblowing: The employee discloses, in good faith, information or shares data about illegal or other reprehensible behaviour in the workplace to another person within the workplace or to an official authority.
2. External whistleblowing: The employee discloses, in good faith, information or shares data about illegal or other reprehensible conduct in the workplace to parties outside the company, as long as the employee has legitimate reason to believe that it is conduct that may concern a prison sentence. Cf. Article 3 of the law. External whistleblowing is generally not permitted unless internal whistleblowing has first been tried to the end cf. Paragraph 4 Article 1 of the Act and if further conditions specified in paragraph 2 are met. Article 3 of the Act.

3. Good faith: The employee has good reason to believe that the data or information disclosed is correct. It is in the interest of the public to report them, and he has no other option in the situation if the offences or the conduct in question are to be prevented.
4. Reprehensible conduct: Behavior that endangers the public interest, e.g., behaviour that threatens the health or safety of people or the environment, without being an obvious violation of laws or regulations.
5. Employee/staff: The person who has access to information or data about the workplace due to their role, whether or not the person is hired,  appointed, contractor, board member, intern, temporarily employed, or volunteer cf. definition of paragraph 2 Article 1 of the law. An employee is protected according to the provisions of the law mentioned above on the protection of whistleblowers after his role ends.
6. Whistleblower: The person, employee according to the definition above, who in good faith reports information or communicates data about violations of the law or other reprehensible behaviour in the workplace.

3. Objectives and scope

The rules on the protection of whistleblowers are intended to encourage reporting of possible illegal/or other reprehensible behaviour at Reykjavík University. In this way, we also reduce the likelihood of such behaviour and ensure protection for the person who informs or reports such behaviour. The rules apply to all Reykjavík University staff and other entities that fall under the definition of an employee cf. 5. tl. Article 2 of these rules.

A whistleblower is protected from unfair treatment that can be related to the whistleblowing. In order to get such protection, the whistleblowing must be made in good faith and in the manner described in the law and these rules.

4. What is whistleblower protection

Whistleblowing that is covered by the Whistleblower Protection Act provides the following protections:

a) The whistleblower confidentiality

b) Whistleblowing is not considered a breach of confidentiality to which the employee is bound by law or by other means, e.g. employment contract or code of conduct. Reporting does not impose criminal nor indemnity liability on the person concerned and cannot lead to remedies according to labor law. However, the law does not absolve people from possible criminal liability if the information was obtained by criminal means, e.g. through hacking or computer crime or if confidential information is disclosed publicly beyond what is permitted by law.

c) It is not permitted to treat whistleblowers in an unfair matter, e.g. degrade rights, change job duties in a burdensome way, terminate a contract or make anyone who has shared information pay for it in another way.

d) A whistleblower can refer a dispute about unfair treatment to the courts free of charge, unless it can be shown in court that the person was not acting in good faith.

5. Ways to disclose information

a) Internal whistleblowing: Reykjavík University encourages staff to pass on information about possible illegal or objectionable behaviour to their immediate supervisor, lawyer, HR manager or the ethics committee.

b) External whistleblowing: In accordance with the law on the protection of whistleblowers, an employee does not have protection if he publicly communicates information about a possible illegal or objectionable behaviour (e.g. on social media or in the media), unless he has already tried internal whistleblowing, which has not led to an adequate response in the person's opinion and the person has a legitimate reason to believe that the conduct may result in a prison sentence. Such sharing is also permitted in absolute exceptional cases when the sharing is in the interest of urgent public interest that the interests of the workplace or others will be overridden by the interests of sharing information publicly, such as to protect:

1. State security
2. Economically important interests of the state
3. Human health
4. The environment

6. Procedure for reports of possible violations of the law or other reprehensible conduct.

Individuals can notify to the next supervisor, the HR manager, the ethics committee or the university lawyer. The university‘s lawyer is responsible for handling internal whistleblowing. Others who receive notifications must refer the matter to the lawyer or to the rector.

Notifications can be submitted both under a name or anonymously through a form on university‘s webpage. Notifications can also be sent to the email address uppljostrun@ru.is.

The recipient of the information must act to stop the illegal or reprehensible behaviour or act in another way.

Within three months of the reporting, the recipient of the information must inform the employee whether the information has given rise to action and report what action has been taken. This only applies if the person who discloses or reports does so under his name.

The recipient of information must maintain the confidentiality of the personal data of the person who discloses or reports unless the latter gives his unequivocal consent to the lifting of confidentiality.

7. Supervision

The university‘s lawyer must supervise the implementation of these rules and ensure that procedural rules are followed.

8. Entry into force

These rules take effect upon publication. The rules must be revised as often as necessary, at least every three years.

Approved by the Executive Council of RU in October 2024