Ethical channel
Ethical channel is a tool to report misconduct
It is important to Aalto that its staff, students and stakeholders may act boldly as whistleblowers, exposing any suspected misconduct they perceive. Aalto University’s ethical channel is for notifying about illegalities or misconduct appearing in the operations of Aalto University or of companies in the Aalto University Group.
We encourage people to send notifications of misconduct in their own name; however, the ethical channel may also be used anonymously. Aalto University is committed to ensuring the information security of the reports and to seeing that they are processed with care. All reports submitted in good faith will be investigated and any necessary measures arising from them will be undertaken.
Aalto University’s ethical channel is the internal, confidential reporting channel required by the whistleblowing regulation. A secure WhistleB reporting tool is used to set up the ethical channel in Aalto University. (see below whistleblowing)
What is a misconduct to be reported through the ethical channel?
Misconduct as referred to in the whistleblower act
Examples of activities that may be reported through the ethical channel:
- financial misconduct, such as illegalities in public procurement or financial services, breaches concerning financial support and assistance, breaches of tax law, and fraud and corruption,
- breaches relating to EU competition law and State aid rules,
- suspicion of bribes given or received,
- endangering consumer protection and food safety,
- environmental crimes, such as endangering the safety of chemicals, nuclear safety or radiation protection, and
- serious breaches of information security or data protection.
These kinds of misconduct may be reported when observed in connection with one’s work. The person reporting may receive whistleblower protection as defined in the whistleblower act (see below).
Other irregularities and misconduct than referred to in the whistleblower act
The ethical channel supplements Aalto’s already existing practices for reporting.
In matters related to inappropriate conduct and harassment, research ethics issues and security breaches or data security breaches, we encourage you to use the following reporting methods.
You may also use the ethical channel to report suspected breaches of other Code of Conduct. Inappropriate conduct, harassment and reports related to research ethics or occupational safety will be referred for investigation to the investigatory processes concerned with investigating such matters.
- How to intervene to harassment and inappropriate conduct | Aalto University
-
Research Ethics and Integrity: handling of misconduct at Aalto University | Aalto University
At Aalto University, persons who report breaches of the Code of Conduct in an appropriate manner will encounter no negative repercussions. This means that at the time of reporting they must have reasonable grounds to believe that the information regarding a breach is true.
When the ethical channel is not to be used to report?
For differences of opinion and problems within the university community, we encourage you to first contact your superior or the director or contact person with responsibility for the issue.
The ethical channel is not intended to be used as a tool for feedback or for giving development ideas.
The ethical channel is not intended for reporting security matters or emergencies concerning spaces or for notifying about occupational safety incidents. Acquaint yourself with the following guidelines for such situations:
You can give feedback and development suggestions about Aalto’s services here: Open feedback and initiatives.
Students can give development feedback on teaching in a number of ways. See: Feedback and surveys
Whistleblowing
The ethical channel is an internal reporting channel as referred to in the whistleblower act on the protection of persons who report breaches of Finnish law or European Union law. Whistleblowers, ie. people who report breaches covered by the act, have the right to the protection referred to in the act. More information about the reporting covered and the whistleblower protection offered according to the act is available here:
Whistleblower protection | Chancellor of Justice
Whistleblower protection means primarily that no actions against a whistleblower may be taken in retaliation, for instance, dismissal from employment, worsening of the terms of the employment, discrimination or other negative repercussions. The whistleblower protection may be received by a person who discovered a breach in connection with their work. Whistleblower protection may in some cases mean keeping the whistleblower’s identity confidential. Whistleblower protection does not release the person(s) participating in the breach from responsibility.
In order to be protected under the act, the whistleblower must have legitimate reason to believe at the time of their reporting that the breaches they describe fall under the scope of the act and that the information reported is true.
How may I use the ethical channel to report?
You can submit a report by clicking the link below and following the instructions. When you send your report, you will receive user code and password. Save these in a secure place. You will receive a notification that your report has been received.
Note that the channel does not save any information about you that you do not provide yourself. For example, the system saves neither your IP address nor user account nor email address. Please follow up on your report in the channel for any responses or possible follow-up questions.
How is the report processed?
The channel is an external service maintained by a service provider of the university. Reports are sent securely and can be submitted anonymously. Aalto University employees who have been expressly assigned to the task are responsible for receiving and the further processing of the reports. Should your report lead to follow-up measures, your report will be handled by only the persons who are responsible for processing it.
In matters related to inappropriate conduct and harassment, research ethics issues, occupational safety, security and data security breaches the reports will be handled following the specific Aalto university processes.
What will happen after you have submitted the report?
The person submitting the report will receive a notice of the matter being taken up for processing and a notice when the processing has concluded. The submitter is asked to be prepared to answer any follow-up question about the matter.
However, the submitter will not necessarily receive information about what consequences there were for the person(s) who were reported. As an employer, the university may usually not, for example, disclose warnings or other measures regarding the employment relationship to persons other than the parties.
Code of Conduct and raising your concern
Code of Conduct - Values into practice
The Aalto University Code of Conduct is one way of putting our values and way of working — the foundation of our community culture — into practice
Intervening in the harassment and inappropriate treatment experienced by the personnel
The Code of Conduct is one way of putting our values and way of working - the foundation of our community culture - into practice.
Handling of misconduct, violation of research integrity guidelines, at Aalto University
Guidelines on how research ethics misconduct cases are handled in Aalto
Whistleblower protection, confidentiality, openness and secrecy
Aalto University activities fall under the scope of the Act on the Openness of Government Activities. As a rule, this act therefore also applies to reports and documents residing at or submitted to the university. The university has an obligation to follow the secrecy obligations of the act, but also the openness required by the act. Parties concerned generally have a right to obtain information concerning themselves. The person reported must receive basic information about what claims concerning them have been presented and on what grounds.
The person reporting misconduct must avoid including unnecessary private or confidential information about themself or others in their report or in other materials.
Whistleblower protection for the person reporting may be ensured only when their identity is known by the university.
Reporting channel of the Office of the Chancellor of Justice
If the whistleblower has a legitimate reason to believe that their internal report has not resulted in measures within the time prescribed or that it is ineffective, or if the whistleblower has a legitimate reason to believe that they may face retaliation due to their report, breaches may be reported through the Chancellor of Justice Office’s centralised external reporting channel.
Centralised external reporting channel | Chancellor of Justice
- Why was this channel set up at Aalto?
We want Aalto to be a place where everyone can speak up when something seems off. The new whistleblower act requires that organisations such as Aalto University have an internal channel for reporting on misconduct or suspected misconduct discovered in the course of one’s work. - May any potential misconduct be reported through this channel?
Yes. We encourage reports to be submitted through the ethical channel particularly in the following cases:
- financial misconduct, such as illegalities in public procurement or financial services, breaches concerning financial support and assistance, breaches of tax law, and fraud and corruption,
- breaches relating to EU competition law and State aid rules,
- suspicion of bribes given or received,
- endangering consumer protection and food safety,
- environmental crimes, such as endangering the safety of chemicals, nuclear safety or radiation protection, and
- serious breaches of information security or data protection.
You may also use the ethical channel to report other suspected breaches of Code of Conduct [LINKKI]. Inappropriate conduct, harassment and reports related to research ethics or occupational safety will be referred for investigation to the investigatory processes concerned with investigating such matters. -
Will I be sure to receive a response if I report a suspected case of misconduct?
Yes. You will always receive a response that your report was received. The response may include questions, information or instructions related to your report.
You will also be informed when the handling of the matter has concluded. However, the submitter will not necessarily receive information about what consequences there were for the person(s) who were reported. As an employer, the university may usually not, for example, disclose warnings or other measures regarding the employment relationship to persons other than the parties. - What does whistleblower protection mean?
Whistleblower protection refers to the protection and prohibition against retaliation to persons who report cases or suspected cases of serious misconduct, as defined in the Finnish Whistleblower Act. The identity of the whistleblower may remain confidential in the further handling of the matter, if the legal criteria are met. A prohibition of retaliatory actions against the reporting person will be applied in accordance with the act. The employer may not, for example, weaken the whistleblower´s terms of employment, terminate their employment, or lay them off as a consequence of their report. - What are the conditions for receiving whistleblower protection?
Pursuant to the whistleblower act, three general conditions must be met in order for the reporting person to receive the protection:
1) they must at the time of reporting have reasonable grounds to believe that the information regarding a breach is true,
2) that the breach falls under the scope of the act, and
3) the reported misconduct was perceived by the reporter in a work-related context. - Why may I not receive whistleblower protection for reporting any kind of misconduct?
The whistleblower act has been enacted to provide protection for persons reporting specific kinds of misconduct. Reporting of these kinds of misconduct is important for preventing risks and serious damage to the public interest.
Aalto University has had a Code of Conduct in force since 2017. According to it, persons who report Code of Conduct violations in an appropriate manner will encounter no negative repercussions. This means that at the time of reporting they must have reasonable grounds to believe that the information regarding a breach is true. - Am I taking a risk if I report a matter not covered by whistleblower protection?
No. At Aalto University, persons who report breaches of the Code of Conduct in an appropriate manner will encounter no negative repercussions. This means that at the time of reporting they must have reasonable grounds to believe that the information regarding a breach is true. -
Can I report suspicion of misconduct via the ethical channel anonymously?
We know that raising a concern, even when it’s the right thing to do, can be stressful.
That being said, we encourage you to do so in your own name.
You may always use ethical channel anonymously to report suspicions of misconduct involving:- financial misconduct, such as illegalities in public procurement or financial services, breaches concerning financial support and assistance, breaches of tax law, and fraud and corruption,
- breaches relating to EU competition law and State aid rules,
- suspicion of bribes given or received,
- endangering consumer protection and food safety,
- environmental crimes, such as endangering the safety of chemicals, nuclear safety or radiation protection, and
- serious breaches of information security or data protection.
Only by exception may we investigate anonymous reports of inappropriate conduct, harassment or research ethics matters. - Might workplace bullying be enabled by anonymous reporting of suspected misconduct? How may this be avoided?
According to the whistleblower act, it is punishable to deliberately report false information and it may lead to obligation to compensate for damages. Based on Aalto University values and the Aalto, we trust that every Aalto community member understands that the ethical channel is meant to be used when the reporter at the time of reporting has reasonable grounds to believe the information regarding a breach is true.
Investigations initiated due to a report are performed in line with the Code of Conduct in a way that ensures independency and objectivity. The time to draw conclusions and take any corrective measures comes only after the matter has been investigated. -
May development suggestions be given through the ethical channel?
The ethical channel is not intended as an instrument for giving development ideas nor as a means to resolve disagreements or conflicts arising in the workplace or study community. Aalto University has many channels available for giving feedback and for proposing initiatives. You can find them on our website, for example, at Open feedback and initiatives | Aalto University.
You can find the best channels and guidelines for resolving workplace and study-community disagreements or conflicts here: How to intervene to harassment and inappropriate conduct | Aalto University.
- Who can submit reports through the ethical channel (employees, students, stakeholders, etc.)?
The Aalto University ethical channel may be used by all members of the university community, including staff, visitors, grant researchers, and students. Persons outside our community may also submit reports.
Privacy notice
Read more on processing personal data when using the ethical channel to report a suspicion of misconduct.
Aalto University’s Privacy notice for employees contains information on how the university processes personal data in its role as an employer.
The details below describe how personal data is processed in cases where a report is submitted via the ethical channel WhistleB in order to receive whistleblower protection:
Purpose of processing personal data
You may submit a report through the ethical channel without disclosing information that would reveal your identity.
If you report information or make a report about another person, the processing of the personal data will be done to identify and investigate breaches referred to in the whistleblower act or in conflict with the university’s Code of Conduct, and possibly to refer the matter for a preliminary inquiry by the authorities and follow-up on the stages of the inquiry.
Legal basis for processing personal data
Personal data is processed to be in compliance with legal obligations and on the basis of the legitimate interest of the controller.
The ethical channel is an internal channel consistent with the purpose of the whistleblower act and a means to monitor compliance with the university’s Code of Conduct.
Through the ethical channel, it is possible to obtain essential information about possible breaches and misconduct and react to them in an optimally timely manner.
The processing of personal data may also be based on the public interest on or in the official authority exercised by Aalto University as the controller, as the university carries out the purpose of the whistleblower act and other public functions.
The data subject’s express consent may, on a case-by-case basis, be a basis for the processing of personal data.
Categories and sources of personal data for processing
Aalto University collects and processes only the personal data that is necessary for investigating a reported case.
When the ethical channel is used, no information about the reporting person is saved in the WhistleB system other than that which they submit. The system does not save the IP address of the reporting person or any other identifying data.
When a reporting person does disclose their identity, the personal data for processing consists of the person’s name and other identifying details and contact information, such as their telephone number and email address.
Reports submitted to WhistleB may include other personal data than that regarding the reporting person, for instance, a description of the suspected misconduct, information on the suspected persons and their actions, and persons thought of as able to give additional information about the matter.
The report may also include special categories of personal data.
The data for processing may include information on the person reported, such as their name and position in an enterprise.
The persons authorised to process reports may process the following personal data: name, contact details, and log data on the use of the system.
The data for processing is obtained from the report, from information sources used in the investigation, and from investigation-related hearings and witnesses.
Recipients of the personal data
Personal data used to investigate cases reported at Aalto University is processed in the electronic systems and services.
Aalto University uses external service partners for producing system and support services. Personal data may be transferred to the current service partners to the extent that they participate in implementing the measures that they receive within the framework of the commission.
If a report containing personal data requires closer examination, the data may be disclosed for internal inquiry to the responsible party designated by the organisation. Access to the personal data is limited according to the given tasks.
We disclose data to the authorities insofar as permitted and obligated under existing legislation, for instance, to respond to an information request by the authorities.
Effects of processing of personal data and general description of technical and organisational security measures
We look after ensuring that there is a sufficient level of personal data protection compliant with the legislative requirements. Aalto University has incorporated in its whistleblower protection the processing of personal data to ensure the proportionality of the processing and the effectiveness of the security measures available.
We carefully protect personal data through its entire life cycle, using the appropriate means of data protection and information security. The anonymous reporting channel’s system provider processes personal data in information-secure server spaces.
The WhistleB system, used to implement the ethical channel, does not save IP addresses or other information that could be used to identify the sender of a report. All reports are encrypted and only designated persons can open and encryption. Access to reports is limited and the people who process the reports have an obligation of secrecy.
At Aalto University we protect personal data in accordance with our data protection policy. We regularly train those of our staff who participate in the processing of personal data and we take care of ensuring that the staff of our collaborating partners understand the confidential of per and the significance of secure processing. We carefully choose the subcontractors we use. We continually update our internal procedures and guidelines.
We inform the necessary authorities and data subjects in accordance with the legislative requirements.
Transfer of personal data outside of the EU or the EEA
The university's data protection policy involves particular care when personal data is transferred outside the EU or the European Economic Area (EEA) to countries, which do not offer data protection in accordance with the GDPR. Transferring personal data outside the EU or the EEA is carried out in accordance with the requirements of the GDPR. We ensure a sufficient level of protection for personal data as required in legislation, for instance by using contractual clause templates approved by the European Commission. In principle, we process employees’ personal data within EU or EEA.
Amendments to this notice
Aalto University updates this notice as needed. The privacy notice is not a part of your employment contract or any other contract with the university. When the notice is updated, the date of the most recent update is visible in the notice.
If we make substantive changes to this notice, we may take appropriate measures to inform you in a way that is consistent with respect to the significance of the changes. We encourage you to check this notice often to be aware of how Aalto University protects your data.
Rights of the data subject
Based on your rights under the data protection regulation, you are generally entitled to know which personal data on you is stored in the personnel register. You also have the right to request that we correct your inaccurate and erroneous personal data. With certain exceptions you also have the right to have your personal data deleted. If the processing of your personal data has been based on your consent, you also have the right to withdraw your consent. Please see further information regarding your rights at the link below.
- Published:
- Updated: