EU Whistleblowing Directive: What You Need to Know

The new EU Whistleblowing Directive is due to be transposed into national law by member states before the end of the year, protecting people who report illegal activity that they uncover in the course of their employment. Businesses and government agencies that are subject to the directive’s requirements must implement a confidential internal reporting system for whistleblowers. They must also take steps to support the reporting persons and ensure there is no risk of retaliation. 

The legislation has been praised for its ambition, with Simon Gerdemann and Ninon Colneric writing in an article for the European Labour Law Journal:

“Based on a Commission proposal of 23 April 2018 and accompanied by an intensive policy debate, the final version of the Directive represents the most far-reaching piece of European Union legislation in the field of whistleblowing law to date, both in terms of depth and scope of regulation.”

Anti-corruption campaign group Transparency International welcomed the directive, stating that there were some areas of its scope that could be strengthened, but that: 

“The directive provides strong common minimum standards for the protection of whistleblowers in Europe. Member States should transpose those provisions in line with the spirit of the directive, which is to provide a high level of protection for whistleblowers.”

The directive covers breaches of EU law in a wide range of areas, from nuclear safety to financial services and public health.

1. Deadlines for transposition into national law

Here are the deadlines pertinent to the EU Whistleblowing Directive:

• Member states are required to transpose the directive into national law by 17 December 2021
• Businesses and government organisations with more than 250 employees and municipalities serving 10,000 or more people must have an internal reporting system in place by 17 December 2021
• Businesses and government organisations with between 50 and 249 staff must have an internal reporting system in place by 17 December 2023

2. What is the current status?

3. Whistleblowing in the UK

The UK has its own whistleblowing legislation, within the Employee Rights Act. However, it applies only to existing workers. The EU Whistleblowing Directive protects a much wider range of reporting persons. The UK law also only deals with retaliation against workers, making no provision for mandatory reporting channels within organisations. 

Although the UK is no longer a member of the EU, businesses with bases within the union will have to adhere to the directive. In addition, any UK businesses wanting to take part in procurement within the EU or seek investment from shareholders in any of the 27 member states would be advised to put in place employee protections that are on par with the EU requirements. 

4. Challenges to transposition

There are a host of challenges to the full transposition of the directive across the union. 

4.1 Political upheaval

Bulgaria has failed to decide on a clear winner at two elections in 2021, with major parties refusing to enter into coalition negotiations with each other. In Germany, there are elections scheduled for September, too. When there are imminent changes in governments, it is difficult to complete the required legislative process for the transposition of the EU Whistleblowing Directive.

4.2 Lack of transparency

Although some EU member states display the progress of the proposed laws on their websites and through regular public statements, there are a number of nations where there is less clarity. For example, there has been no update from the Polish government since December 2020 when the country’s Prime Minister announced the department tasked with creating the law.

4.3 Lack of public consultations

Public consultations have taken place in a number of states, with the first Spanish consultation leading to the proposal being discontinued and a new proposal being put forward. However, jurisdictions such as Austria and Luxembourg have not asked for public input to their process even though the deadline is approaching. 

4.4 The pandemic

Understandably, governments have been busy dealing with the pandemic over the last 18 months. This may have led to delays and deferments to legislative activities unrelated to fighting and recovering from the disruption of COVID-19. 

4.5 Scope of transposition

There is much debate in some countries on whether to expand the scope of their new laws beyond what is expected by the directive. In Germany, one attempt to introduce a law was vetoed by parties that did not want additional requirements placed on top of the mandatory ones. Alternatively, Sweden is promising a law that exceeds the minimum requirements. 

As the directive only covers breaches of EU law in the internal market, campaigners such as Transparency International are lobbying for member states to extend the protection to whistleblowers who uncover breaches of national law, too. 

Although all countries will reach the minimum requirements once they transpose the directive, there will be a discrepancy in whistleblowing laws across the union. Those with high standards might be frustrated by the less stringent legislation in other nations. 

5. Looking forward

It seems unlikely that, given the short time frame, every EU nation will transpose the directive into national law by the deadline. For private sector businesses with 250 or more employees and municipalities with a population of 10,000 or more citizens, the preparations should not change. If you fall in this category, you will still be required to meet the minimum standards laid out in Directive (EU) 2019/1937 whether your national law makes reference to it or not. 

6. What should employers do?

If you meet the above definition, you should prepare now for 17 December. You need to implement internal reporting channels that allow for confidential and secure reporting of illegal activity. You should have systems in place for an impartial person or department to accept reports, acknowledge them within seven days and then investigate them and provide feedback to the reporting person within​​ a reasonable timeframe, capped at three months from the time of reporting. This should detail the appropriate action your company will take. 

Any follow-up should include details of the appropriate action your organisation will take and how to escalate cases where the reporting person is unsatisfied with the result. The whistleblower can use external reporting channels if the issue is not resolved and, if that fails, opt for public disclosure when that is deemed to be in the public interest. 

You also need to instigate training on how to make a report and how to receive a report of wrongdoing. All staff should know that any retaliation against whistleblowers is unacceptable and outlawed by the EU Whistleblowing Directive. Natural persons and legal entities alike need to understand the gravity of the consequences for allowing forms of retaliation to happen. They should also be aware of the penalties for offences against a reporting person such as dismissal without reasonable grounds, demotion, suspension, intimidation and more.

Employers must read the directive fully and understand their obligations and liabilities as well as the intersections with the General Data Protection Regulation (GDPR). They also need to know who can flag up a reportable breach. The directive not only applies to employees, but also to self-employed contractors, subcontractors, affiliates, trainees, executives, shareholders, volunteers, suppliers, prospective workers and anyone else who came across breaches of union law in a work-related context.

Privacy protection must be afforded to the reporting persons, their relatives and any colleagues who helped them make the report. In addition, anyone named in the report and accused of wrongdoing should also be allowed confidentiality as the investigation continues.    

7. Conclusion

Whether your country’s government is ready or not, the new EU Whistleblowing Directive will come into force in December. So, you must be ready in terms of the reporting systems being in place, the workflow created and staff trained. Besides appointing internal stakeholders to manage the whistleblowing process, you also have to ensure the protection of the persons who make reports. 

If you’re looking for an easy way to stay compliant with the EU Whistleblowing Directive,  try IntegrityLog. It’s an internal reporting system that offers confidentiality, GDPR compliance, easy reporting and the ability to track the status of open cases. IntegrityLog can be tailored to the requirements of your specific organisation.

Request a demo or request a 14-day free trial to find out how to create a compliant whistleblower reporting system for your organisation. 

8. References and Further Reading

• Guide to implementing the EU Whistleblowing Directive
• IntergrityLog features
• Examples of workplace whistleblowing
• How to choose an internal reporting system
• Whistleblowing reporting channels
• Full text of the EU Whistleblowing Directive