EU Whistleblowing Directive Legislation

EU Whistleblowing Directive: Comprehensive Overview

Introduction to the EU Whistleblowing Directive

The EU Whistleblowing Directive (Directive 2019/1937) has been in effect from 16th December 2019.

It was established to improve the protection of whistleblowers across the European Union and supports the creation of a safer environment for employees, volunteers and supply chain workers to report misconduct and breaches of EU law without fear of retaliation.

Key Objectives of the Directive

The primary goals of the EU Whistleblowing Directive are:

• Detection and Prevention: To identify and prevent misconduct and breaches of laws and regulations.
• Improved Law Enforcement: Establishing effective, confidential, and secure whistleblowing reporting channels.
• Protection of Whistleblowers: Ensuring whistleblowers can raise concerns with confidence and anonymously, without fear of retaliation.

Scope of Protection

The directive extends protection not only to employees but also to job applicants, former employees, supporters of the whistleblower, and journalists. These individuals are safeguarded against dismissal, degradation, and other forms of discrimination when reporting wrongdoing related to EU law, such as:

• Tax fraud
• Money laundering
• Public procurement offences
• Product and road safety
• Environmental protection
• Public health
• Consumer and data protection

Reporting Channels

Whistleblowers have the option to report concerns internally within their organisation or directly to the competent supervisory authority. If no action is taken, or if the whistleblower believes it is in the public interest, they can also report directly to the public. Protection is ensured in both cases.

Obligations for Organisations

Organisations with more than 50 employees, public sector institutions, authorities, and municipalities with 10,000 or more inhabitants are required to establish suitable internal reporting channels. Compliance timelines are as follows:

• Companies with 250 or more employees: Expected to comply within two years of adoption.
• Companies with 50 to 250 employees: Granted an additional two years after transposition to comply.

Reporting Methods

Whistleblowers should be able to submit reports through various methods, including:

• Written Reports: Via an online system, mailbox, or post.
• Oral Reports: Through a telephone hotline. The phrase ‘answering machine system’ is also used, but experience shows that this reporting channel cannot be guaranteed one-hundred percent anonymous, and statistics show that whistleblowers are unlikely to use this reporting method for serious reports of misconduct.

EU Directive Obligations on Businesses

Data Protection

All personal data, including that of the whistleblower and individuals involved in the report, must be managed in strict compliance with the GDPR to safeguard sensitive information.

Roles and Responsibilities

Businesses must assign a suitable individual internally to receive and address reports. This could be a Compliance Officer, Head of HR, Legal Counsel, CFO, Executive Board Member, or another management representative. Alternatively, companies may opt to delegate this task to an external ombudsman.

Processing Timelines

Upon report receipt, the company must promptly acknowledge it within seven days to the whistleblower. Additionally, the whistleblower should be updated on any actions taken within three months, detailing the status and results of the internal investigation.

Obligation to Inform

Companies are obligated to provide clear and accessible information about internal reporting processes and channels to relevant authorities. This information should be easily comprehensible and accessible not only to employees but also suppliers, service providers, and business associates.

Data Retention

All reports need to be securely stored for potential evidentiary purposes as part of maintaining information integrity and confidentiality.

Special Cases

Companies with staff ranging from 50 to 250 employees may utilize a shared reporting channel if they meet all directive requirements. This facilitates efficient handling of reports while ensuring directive compliance.

Sanctions

The EU directive specifies penalties for companies impeding report submissions or breaching whistleblower confidentiality. Sanctions also extend to retaliatory actions against whistleblowers, with national legislators tasked with determining their severity.

Advantages for Businesses

While primarily focused on safeguarding whistleblowers’ interests, the Directive also offers substantial benefits for organizations. By establishing effective whistleblowing mechanisms, companies promote internal concerns disclosure among employees and stakeholders. This proactive approach aids in early risk identification and management, thereby reducing potential financial and reputational harm.

By upholding these requirements, businesses not only adhere to the EU Directive but also cultivate transparency and accountability culture leading to a safer and more ethical work environment.

Several years after its implementation, the EU Whistleblowing Directive has significantly influenced best practices in the workplace. Employers are advised to proactively prepare for whistleblowing compliance by:

• Monitoring Directive Implementation: Keeping track of the progress in each EU country where the company operates.
• Reviewing Whistleblowing Arrangements: Establishing clear reporting channels and ensuring they cover external reporting, broad reportable matters, and extended reporter categories.
• Consolidating Reporting Systems: Considering the consolidation of multiple hotlines into a central clearing house for comprehensive reporting data.
• Configuring Hotlines: Ensuring telephone/automated hotlines meet jurisdictional requirements and language considerations.
• Maintaining Records: Continuously monitoring and maintaining records of relationships with individuals who make reports, even after resolving their matters.
• Streamlining Processes: Facilitating metrics tracking and process consistency globally, with minor variations.

Transposition Status

As of mid-2024, the transposition status across EU Member States remains varied, with some countries fully compliant, others partially compliant, and a few still lagging behind. This uneven implementation has led to a complex and fragmented legal landscape.

Fully Compliant States

Malta stands out as the only Member State that had already adopted comprehensive whistleblowing legislation before the Directive was introduced. Malta’s existing law, enacted in 2013, was amended to align with the Directive’s requirements and came into force on December 24, 20211. Other countries that have successfully transposed the Directive include Cyprus, Denmark, France, Latvia, Lithuania, Portugal, and Sweden. However, even among these states, there have been criticisms regarding the extent and timing of their transpositions1.

Partially Compliant States

Several Member States have made significant progress but have not fully met the Directive’s requirements. For instance, Denmark has been criticized for allowing shared internal reporting channels for legal entities with 250 workers or more, which does not fully comply with the Directive’s provisions1. Similarly, Portugal and Sweden faced criticism for delaying the application of their national provisions until after the transposition deadline1.

Lagging States

A number of Member States have struggled to meet the transposition deadline due to various reasons, including political changes and ongoing debates over the standards to be implemented. Countries like Finland, Luxembourg, and Slovakia have been working on draft bills and amendments to their existing laws, with expected implementation dates extending into 2022 and beyond ^[1].

Challenges and Infringement Procedures

The European Commission has been proactive in addressing the delays and inconsistencies in transposition. In January 2022, 24 Member States were formally notified for failing to adopt the Directive. Portugal and Sweden received additional formal notices in February 2022 due to the delayed entry into force of their national provisions1. The Commission’s actions highlight the ongoing challenges in achieving uniform protection for whistleblowers across the EU.