Corporate Communications
Tel. +49 (0) 30 - 88 77 444 - 0redaktion@business-keeper.com
BK Newsletter 02/2020
Dear readers,
Welcome to the first Business Keeper Newsletter of the year 2020. We present you once again plenty of interesting compliance news and topics.
Almost two years after GDPR entered into force, an analysis of data leak reports in Europe shows a significant increase to a total of 160,000 reports – led by the Netherlands. The number in Germany has also nearly doubled. The most extensive fines, however, have been imposed in France, Germany, and Austria.
The topic of artificial intelligence remains exciting. The EU Commission wants to increase its investments in this future technology with its digital master plan to make Europe an international leader in this area. Part of the strategy includes the promotion of trustworthy artificial intelligence while also establishing stronger regulation of high-risk AI.
In the area of whistleblower protection, there have been developments in the Czech Republic, where an independent agency is to be created to protect whistleblowers from reprisals. Previously bringing up the rear in this area, the country is taking a first important step in the direction of legal protection for whistleblowers, spurred on in part by the EU whistleblower directive entering into force as of 2021.
We wish you an enjoyable read.
Directors of Business Keeper AG, Kai Leisering and Kenan Tur
News
Data leak reports rising across Europe
Not every company has their data protection house in order – the General Data Protection Regulation continues to make this very clear. An investigation by the international law office DLA Piper has now analysed the number of data leak reports in Europe and identified a clear increase to a total of 160,000 reports. During the first eight months of GDPR, an average of 247 reports were received per day, while in 2019 the rate climbed to 278. The most data leaks were recorded by the authorities in the Netherlands: Companies and organisations here submitted a total of 40,647 reports of data leaks. In Germany, as well, there was a clear increase in reports up to January 2020 from 12,600 to 25,036 reports.
Data leaks are not without consequences: According to information from DLA Piper, fines totalling 114 million euros have so far been imposed within the EU states, with the most fines in France, Germany, and Austria. Compared to the potential maximum penalty, the totals are in fact relatively low; but DLA Piper partner Ross McKean sees this as just the beginning and assumes “that the dynamic will accelerate, and more fines in the amount of several million euros will be imposed in the coming year when the regulatory agencies intensify their enforcement activities.”
EU as global leader in digital transformation? The EU Commission promotes trustworthy artificial intelligence made in Europe
The EU Commission has laid out its roadmap for its future digital policy. High-risk artificial intelligence should be monitored and regulated more heavily, while trustworthy systems are to be promoted. The long-term goal of the agency is to further expand Europe’s position as a global leader in trustworthy artificial intelligence. In order to achieve this and to keep pace with China and the USA, investments in this technology should be increased significantly.
As a technology of the future, artificial intelligence offers tremendous opportunities but also poses a number of risks, especially when used in the areas of recruiting, medicine, transportation, policing and criminal justice. High-risk AI should therefore be tested and certified before entering the single market. A voluntary labelling system could be sufficient for less risky systems. Before the Commission proposes initial laws starting in summer 2020, it would like to solicit views from society and industry on topics such as regulatory scope and facial recognition by means of a public survey.
You'll find more on this topic here.
Consistent investigation of fraud involving EU funds: European Public Prosecutor’s Office expected to begin operations by end of 2020
In the fight against corruption, fraud and money laundering, the EU regulation on the establishment of a first, independent and distributed European Public Prosecutor’s Office entered into force already in November 2017. The German cabinet has now accepted and adopted the draft legislation of the Ministry of Justice, laying the foundation in German law for the European Public Prosecutor’s Office to commence operations, which is now expected to take place at the end of 2020.
What will be the focus of the office’s work? The European Public Prosecutor’s Office will be responsible first and foremost for protecting the financial interests of the EU by enabling more efficient prosecution of crimes such as subsidy fraud and cross-border VAT fraud, which regularly result in significant financial damages. The European Public Prosecutor’s Office will therefore oversee and coordinate investigations and prosecutorial measures in the participating EU countries as a central authority. Minister of Justice Christine Lambrecht sees this as an important step towards “more effective combatting of cross-border financial crime and a clear signal against the misuse of EU funds.”
A total of 22 EU countries have joined together for stronger collaboration through the European Public Prosecutor’s Office.
You'll find more on this topic here.
Swiss National Council committee blocks strengthening of the Money Laundering Act
The Legal Affairs Committee of the Swiss National Council has voted against a strengthening of the Money Laundering Act, rejecting the submission of the Federal Council. The reasons stated by those opposed primarily referenced a fear of disrupting Switzerland’s competitive position as a centre of finance. Those in favour sought to establish legislation oriented around the key recommendations of the Groupe d'action financière (Gafi).
As a consequence of the Panama Papers, the National Council wants due diligence obligations to apply not only to financial intermediaries and brokers but also to legal advisors (generally lawyers and notaries) who offer their services in connection with companies and trusts.
Czech Republic takes whistleblower protection seriously
The Czech Republic has to date lagged behind other nations in terms of whistleblower protection. With the EU’s requirement that all Member States must guarantee protection to whistleblowers, the country has now taken an important step forward by establishing an independent agency intended to better protect whistleblowers from reprisals. The agency will accept and evaluate reports, even attesting to them in serious cases. Moreover, the employees of the agency should raise public awareness of whistleblowing, advising on the protection of whistleblowers from an academic perspective.
The Ministry of Justice has already drafted a new law, still based on the concept of an agency operating under the auspices of the ministry. NGOs, on the other hand, have called for an agency with as much independence from the ministry as possible. The draft law could be an important first step towards offering legal protection to whistleblowers in the Czech Republic. It also sends a message to Czech companies to reflect on their handling of whistleblowers and to integrate the principles of the EU directive on the protection of whistleblowers into their compliance programmes.
You'll find more on this topic here.
Council of Europe group: France must do more to fight corruption
In the view of the Anti-Corruption Group of the Council of Europe (Greco), France does too little to oppose corruption. Particularly in the area of politics, the group advises greater transparency concerning contacts between government members, including the president, and lobbyists. Politicians should regularly report publicly on the topics discussed with lobbyists. Efforts to fight corruption within the police force are also in need of improvement according to Greco. The susceptibility to bribery should be evaluated regularly throughout the course of one’s career, not just at the start. Positions that pose a particularly high risk of corruption should be changed regularly.
You'll find more on this topic here.
French data protection authority CNIL passes new standard for whistleblowing systems
The French data protection authority Commission Nationale de l’Informatique et des Libertés (CNIL) passed a new standard guideline for introducing whistleblowing systems at the end of 2019. This replaces the previous standard AU-004 from 22 June 2017, which is no longer in effect since GDPR entered into force.
The new standard not only provides extensive additions, it also contains significant changes: While the old standard was still binding for organisations and companies, meaning that they had to ensure complete conformity with the requirements of AU-004, the new rules are intended as best practices. This should offer organisations and companies more freedom in the design of their whistleblowing systems, naturally under the assumption that the applicable laws will be complied with and any deviations from the guidelines are justified. International corporations benefit in particular from the new standard since they have often deviated from AU-004 in small points in the past.
The new standard now also provides more efficient support for conducting a “Privacy Impact Assessment” (PIA), as is required before the introduction of a whistleblowing system. The new standard from the CNIL also offers the option of designing hybrid whistleblowing systems that go beyond the legally mandated aspects. For instance, they might also be used in the future to establish company-internal ethical guidelines.
The BKMS® system of Business Keeper AG is used by a large number of renowned French companies and already fully complies with the new directive.
You'll find more on this topic here.
Brexit and data protection – What challenges do companies face?
On 1 February 2020, the United Kingdom of Great Britain and North Ireland left the EU, raising the question of what changes companies can expect from the perspective of data protection law as a result of Brexit. According to the Withdrawal Agreement, a transitional period applies first until 31 December 2020 and can be extended a single time by one or two years by 1 July 2020. After this time, the United Kingdom will count as a non-European third country, meaning that the GDPR would no longer apply. If personal data are transmitted to the United Kingdom after this date, it must be ensured that they are subject to a level of security similar to that under GDPR.
For companies, the so-called adequacy decision would certainly be the best alternative, in which case the European Commission decides whether the security level under the data protection law of a third country is appropriate. If yes, the data may be transmitted. However, the tight timeline until the end of the transition period could pose a problem. It is still unclear at this time what the national data protection law of the United Kingdom will look like. For this reason, companies that wish to transmit data to the United Kingdom in the future should include this in their information on data processing and their privacy statement as data transmission to a third country and should also update their list of processing activities accordingly.
You'll find more on this topic here.
The greatest risk for companies: Cybercrime
The new “risk barometer” of Allianz highlights the dark side of digitalisation: Cybercrime poses an increasing risk for companies and organisations around the world, with potentially expensive consequences.
According to a survey based on responses from roughly 2,700 experts in company risk, risk managers, insurance brokers and insurance experts, cyberattacks hold first place among possible threats. While cybercrime shared first place last year with operating interruptions, the latter risk has now fallen to second place. However, the study notes that a shutdown of an entire company or significant portions is frequently also a consequence of hacker attacks. In particular, extortion represents a very high IT risk according to AGCS manager Jens Krickhahn, especially since cybercriminals are demanding ever higher sums running into the tens of millions.
Companies should therefore be on their guard, especially for espionage software hidden in emails. For example, the dangerous trojan Emotet spies on confidential contact data and can also install other malware.
You'll find more on this topic here.
INTERNAL NEWS
Event review: Business Keeper AG informs church representatives and charitable organisations about whistleblowing systems
Every organisation is responsible for upholding and effectively enforcing ethical principles – their own and those of society. This applies to commercial companies as well as to social, charitable or religious entities. Because Business Keeper AG wishes to support church representatives and their charitable organisations in reporting and investigating any malpractices, they were invited to an informational event at Cologne’s Maternushaus on 29 January 2020 entitled “Whistleblowing systems – burdensome legal obligation or proven protection measures? Practical experiences, questions and answers”. The participants came primarily from the administrative offices of Catholic dioceses as well as managers of Catholic charitable institutions.
After a greeting by Kai Leisering, Director of Business Keeper AG, Dr. Michael Rasche offered insights into the teaching and implementation of ethics, while Heike Uhl, Senior Manager Internal Audit at Christoffel-Blindenmission (Christian Blind Mission), shared her experiences in the introduction and operation of the BKMS® System. Afterwards, the attorneys Dr. Burkhard Fassbach and Dr. Benedikt Schneiders discussed legal aspects of the new EU whistleblower directive and its consequences for (church) organisations. The event concluded with a talk by Kai Leisering, who emphasised the benefits of whistleblowing systems in all areas of the organisation. The conference not only provided participants with valuable information in the form of talks by renowned experts, it also offered the opportunity for fascinating discussions of industry topics in small groups.
imh-Spezialtag “The new EU whistleblowing directive”: a helpful overview for companies and organisations
The new “EU whistleblowing directive on the protection of persons reporting on breaches of Union law” which entered into force in December 2019 poses many questions for organisations and companies: What steps are now required? How does one successfully implement a trustworthy whistleblowing system? And how does one communicate this to employees?
The Institut Manfred Hämmerle (imh) took the new directive as an occasion to meet with practical experts at a conference on 30 January in the Steigenberger Hotel in Vienna to present an overview of the legal conditions and challenges and to offer practical examples of implemented whistleblowing systems. Under the moderation of Dr. Alexander Picker, management board member at Transparency International Austrian Chapter and CEO of BCB4U AG, the event began by discussing the legal aspects. For example, attorney Dr. Katharina Kitzberger presented not only the EU directive itself but also the legal requirements on the implementation of a whistleblowing system. In the practical portion of the event, Rudolf Schwab, Certified Compliance Professional at Telekom Austria AG, addressed the particular challenges for compliance officers, while Svetlana Gandjova, CFE at Deloitte Financial Advisory GmbH, emphasised how important communication by the board is for the success of a whistleblowing system.
Business Keeper AG was represented at the event as a sponsor alongside BDO and Deloitte. Against this backdrop, Kenan Tur, Director and founder of Business Keeper AG, shared in his talk insights into the practical implementation of whistleblowing systems, touching on the requirements for a whistleblowing system as well as the issues surrounding whistleblowers.
The legislation gives companies and organisations two years to integrate the legal requirements for the protection of whistleblowers into their structures. Conferences like the imh-Spezialtag are all the more important for ensuring that people in positions of responsibility receive sufficient information on this topic and assistance with implementation.
You'll find more on this topic here.
Event review: Business Keeper and Stiftung der Deutschen Wirtschaft (sdw) raise awareness of business ethics among students
Raising awareness of business ethics in society and business among the younger generation was the goal of an event hosted jointly by Business Keeper AG and Stiftung der deutschen Wirtschaft (sdw), which brought many interested sdw scholarship holders to Berlin in February. The event was held under the motto “In the fight against business crime: the importance of business ethics in upholding our society – and what every individual can contribute as their civic responsibility.” It offered informative talks covering various areas to show what the implementation of business ethics and compliance can look like in everyday business life. Insights from the perspective of a company were offered by Elke Schaefer, Chief Compliance Officer at airport operator Berlin Brandenburg GmbH, who illustrated on the basis of previous compliance incidents how the internal compliance management system supports prevention and discovery. Thomas Dombek, an experienced criminologist and head of the Central Office for Corruption / Internal Investigations of Lower Saxony, also reported on his exciting work has an investigator, his fight against corruption and business crime and how this has been effectively supported for over 15 years by the successful use of the BKMS® System.
After welcoming of the attendees by sdw General Secretary Dr. Arndt Schnöring, an introduction to the topic was given by Kenan Tur, who has held the voluntary position of sdw Trust Manager for over 10 years. The founder and director of Business Keeper AG also offered the students insights into his path as a founder and his intrinsic motivation to develop the first electronic whistleblowing system.
Jan Kersten, alumnus of sdw and long-time head of customer support at Business Keeper, and Jens Gräßler, responsible for business development, shared with the attendees glimpses of everyday challenges in the area of compliance and business ethics as well as the role played by IT in fighting business crime.
You'll find more on this topic here.
STUDIES
Study “Respecting human rights” shows: German corporations disappoint in compliance with human rights standards
The joint study “Respecting human rights” by the Business & Human Rights Resource Centre and the School of Management and Law reveals that none of the largest Germany companies has so far met all the fundamental requirements on corporate conduct that were defined in the United Nations Guiding Principles on Business and Human Rights (UNGPs) in 2011 by the UN Human Rights Council. According to the study, a basic level of respect for human rights is lacking.
The analysis conducted in spring of 2019 involved an evaluation of publicly accessible information about the companies of interest, such as their website, formal financial and non-financial reporting and other official documents, based on which point values were assigned. The study methodology was oriented around the twelve criteria of the Corporate Human Rights Benchmark (CHRB). These encompass the areas of governance and political obligations, the embedding of respect and due diligence in the area of human rights and mechanisms for legal remedy and lodging complaints.
One particularly sobering result highlighted by the authors involves the area of “human rights due diligence”. Overall, the fewest points were awarded here because, among other reasons, only two of ten companies could prove that they managed their human rights risks and how. The results further indicate that many of the studied companies cannot yet sufficiently verify the rights of workers within the highly complex supply chains or their access to legal remedies. For instance, only ten of the studied companies also allowed employees of suppliers to submit complaints. In this context, 17 companies do fundamentally allow the complaint mechanism to be used by external interest groups; however, only one of these companies was able to sufficiently describe the reporting and complaint process within the supply chains.
German policymakers are now prepared to take additional steps. The intent is for at least 50 percent of German companies with more than 500 employees to introduce effective human rights protection in the year 2020. If this goal is not achieved, a legal obligation to implement human rights due diligence would be introduced, with a call for a similar measure at the European level.
Compliance Risk Study 2019: Increasing compliance demands meet cost pressure
Companies have an increasing need for compliance management, and yet budget are at risk of cuts. This is one of the results of the “Compliance Risk Study 2019” of the international consultancy Accenture. The study is based on a survey of 151 senior compliance managers.
According to the survey, 71 percent stated that cost reductions were planned. At the same time, every third respondent stated that company growth was the most important driver of the development of the compliance function. The results therefore make clear that the field of compliance as well as compliance officers themselves are facing new challenges: They must restructure their compliance activities to fit with new business models while also dealing with high cost and resource pressure. For instance, 50 percent of those surveyed stated that they are confronted with high, unexpected employee fluctuation.
To live up to these and other future challenges in the area of compliance, the authors recommend, amongst other measures, the use of technologies that can identify risks automatically. This would in turn mean hiring compliance officers who are familiar with the newest digital solutions in order to establish a new generation of digitally skilled compliance officers at the company.
Literature
The Business Keeper AG has been supporting various projects of NGOs and aid organisations dedicated to corruption prevention and its causes. In our newsletter we continuously provide you with a selection of recently published and recommendable literature. Should you order these books directly via the enclosed link, advertising costs will be reimbursed through the Amazon.de partner programme, which we will forward directly to Transparency International Germany. We assure you that there will be no costs for the purchaser in addition to the listed price at Amazon.
Accountability, Ethics and Sustainability of Organizations: New Theories, Strategies and Tools for Survival and Growth
Sandro Brunelli, Emiliano Di Carlo (publisher). December 2019. ISBN: 3030311929
Companies today are confronted with many new challenges, such as climate change and an ageing population. In this context, the authors discuss the associated responsibility that arises for companies, pointing out ways in which companies can remain successful despite changing circumstances. They also present a new perspective on companies and highlight opportunities that can arise from the new challenges.
Bribery, Fraud, Cheating: How to Explain and to Avoid Organizational Wrongdoing
Markus Pohlmann, Gerhard Dannecker, Elizangela Valarini (publisher). January 2020. ISBN: 3658290617
In the fight against organisational malpractice and organised crime, international and national regulations have been repeatedly strengthened. Nevertheless, corruption scandals regularly continue to come to light. This publication investigates the phenomenon of business crime from a scientific perspective, including the views of renowned experts. Similarities and differences between recent corruption cases are analysed, with discussion of conventional and alternative prevention measures.
Food Adulteration and Food Fraud
Jonathan Rees. January 2020. ISBN: 178914194X
Cases of fraud in the food industry remain on the rise and can have severe health consequences for the population. Author Jonathan Rees investigates in his book the complex causes and surprising consequences of fraud in the food supply chain. He also examines the phenomenon that the population is often prepared even to ignore small deceptions as long as the food remains inexpensive and easy to obtain.
Do you know about interesting literature which we have not yet introduced? Please let us know: redaktion@business-keeper.com
Events
Fraud, Asset Tracing and Recovery Geneva
5 - 6 March, Geneva
At the beginning of March, specialists in the fields of fraud, risk analysis and asset tracing are meeting at the conference “Fraud, Asset Tracing and Recovery Geneva” to discuss the most recent developments. The participants will be offered interactive debates, expert advice, case reports and many networking opportunities over the course of two days.
12th Advanced Conference on Customs Compliance
24 - 25 March 2020, London
The “Advanced Conference on Customs Compliance” will be held for the twelfth time in London on 24 and 25 March. The conference offers valuable insights and information particularly for anyone interested in compliance with customs regulations relating to the UK. The “Post EU-Exit” situation is addressed, for example, with an explanation of what the handling of goods between Great Britain and the EU may look like in the future. Other key topics at the conference include blockchain, the digitalisation of internal processes and an insider perspective on customs inspections and fines.
6th Women in Compliance Conference
25 - 26 March, London
At the end of March, female managers and decision-makers will meet for the 6th time in London at the “Women in Compliance Conference” to exchange information on the most recent compliance trends. Alongside numerous best practices from various industries, the conference is focused on promoting meaningful exchanges between participants by offering sufficient opportunities for networking and mentoring. Specially for this purpose, a mentor-mentee lunch will once again be held, where managers from the areas of compliance, law, ethics and auditing are brought together with participants who would like to advance in their careers.
THE 2020 ACFE FRAUD CONFERENCE EUROPE
5 - 7 April, Copenhagen
In addition to a roster of renowned speakers, the ACFE Conference Europe offers two parallel sessions on both event days with talks, case studies, best practices and breakout sessions. The main topic for the first day of the conference is cybercrime, featuring talks on CEO fraud and crypto laundering, amongst others. The second day is primarily focused on classic compliance topics such as third party, fraud investigations, whistleblower protection and whistleblowing management.
MEET US HERE
Get to know Business Keeper AG in person at the following events:
DACH Compliance Conference 2020
6 March, Winterthur
The next DACH Compliance Conference of the ZHAW School of Management and Law in Winterthur will be held on 6 March, offering participants a chance to discuss changes in the compliance world brought about by the process of digitalisation. In workshops and talks, experts with extensive practical experience will share insights into their organisations and foster valuable exchanges, including solution approaches.
EY Compliance Lounge Hamburg
17 March, Hamburg
The EU directive is one of the most important topics currently under discussion in the compliance community. The round table of the EY Compliance Lounge Hamburg offers an overview of what companies can expect from the directive, which obligations arise for companies in Germany and what the implementation of a whistleblowing system, which should be an EU standard as of 2021, might look like. Business Keeper Director Kai Leisering will participate in the round table as an expert. The event gives guests the opportunity to obtain a broad overview of the issues and to hold discussions with the speakers and other attendees.
11th DIIR Anti-Fraud Management Conference 2020
19 - 20 March, Düsseldorf
The Anti-Fraud Management Conference of the Deutsches Institut für Interne Revision e.V. will be held in March for the eleventh time. This year, participants can once again look forward to numerous top-notch plenary talks and focus sessions under the motto “Internal investigations – The next level!”. For instance, Senior Public Prosecutor Markus Hartmann will give the keynote on the topic of “Cyber Crime Risks”. The conference will also include fascinating talks on the forensic text analysis of whistleblower writings, money laundering compliance in the non-financial sector and internal investigations under GDPR.
OECD Global Anti-Corruption & Integrity Forum
25 - 26 March, Paris
The OECD Global Anti-Corruption & Integrity Forum in Paris, with over 2000 participants from 120 countries, is considered one of the leading anti-corruption conferences. The focus lies on key questions of how to foster integrity and public trust in government and business. The talks are concerned with a broad range of topics and address all areas of the public and private sector.
C5 Anti-Corruption Switzerland
1 - 2 April, Zurich
Current topics and challenges surrounding the issue of corruption will be discussed at this year’s Anti-Corruption in Zurich. The focus this year lies on the following question: What can industry do to meet the expectations placed on it? The keynote will be delivered by Olivier Bovet from the State Secretariat for Economic Affairs (SECO), who will report on collaboration between the Swiss government and industry in combatting corruption. Workshops, benchmarkings, round tables and sufficient opportunities for networking round out the event.
Data Protection Conference 2020
27 - 29 April, Düsseldorf
The data protection conference in Düsseldorf brings together numerous experts and speakers to discuss current developments, problems and challenges in the field. This year is also focused on the General Data Protection Regulation. For example, Barbara Thiel, Data Protection Officer for Lower Saxony, will open the conference with a look back at the two years since GDPR entered into force. Other topics to be addressed in-depth include the principle of accountability, practical implementation of data erasure, tips and frequent errors in handling the rights of data subjects or how to verify GDPR conformity with the help of blockchain technology.
“True ethics begin where the use of language ends.”
