The global HR strategist: The EU acts to accelerate implementation of the Whistleblowing Directive across Member States

• United Kingdom

• Employment law
• ESG

21-04-2022

The pandemic highlighted the key role of whistleblowing procedures, reflecting a rise in workers speaking up against corruption, unsafe practices and other misconduct. Yet, despite many businesses having whistleblowing programmes and hotlines, some whistleblowers encounter retaliation or are simply ignored, reflecting a potential disconnect between policies and culture in the workplace.

Against this background, the European Union’s Whistleblowing Directive (WBD) aims to strengthen whistleblower protections by imposing new duties on employers to introduce effective and secure reporting channels, reinforced by significant legal safeguards for whistleblowers. The deadline for Member States (MSs) to transpose the WBD into national law was 17 December 2021. However, COVID-19 and other reasons have resulted in many MSs failing to implement the WBD on time. This led to the EU triggering legal action for the delay, including giving written notice to over 24 MSs to remedy their breach of EU law.

As a result, employers should anticipate MSs accelerating their implementation of the WBD. As there are local differences emerging in the way the WBD is transposed by MSs, staying abreast of how each country responds is necessary to ensure that workplace practices are compliant. To support employers in their planning, this briefing summarises key aspects of the WBD, provides an update on how it is being implemented locally across MSs and considers practical steps employers can take.

The EU Whistleblowing Directive (“WBD”)

The WBD protects a broad range of people who acquire information about breaches of EU law in a work-related context and who decide to make a report (to ‘blow the whistle’). It introduces common minimum whistleblowing standards and supplements existing EU sector specific rules, such as in the financial services.

Reporting may be via internal channels to the employer, externally to certain national/EU authorities or publicly, such as to the media, depending on the circumstances. MSs may decide to extend the scope of the WBD beyond breaches of EU law, to include breaches of national law.

Protecting whistleblowers

The WBD extends protection beyond workers and includes former and current workers, the self-employed, shareholders, board members including non-executives, volunteers, trainees, those working for contractors, subcontractors and suppliers and job applicants. To qualify for protection they must have reasonable grounds to believe the information reported was true at the time of reporting and must report in accordance with the internal, external or public channels provided. There is no requirement to report in good faith, nor express public interest pre-condition.

Whistleblowers are protected against all work-related retaliations prompted by the report. In any court proceedings relating to a detriment suffered by the reporting person, the burden of proof is reversed meaning that the employer must prove a justifiable reason. Third parties, as well as the whistleblower, are also protected including those helping them to report at work. Their identities are protected by confidentiality and they have legal immunity in certain circumstances, such as those relating to confidentiality obligations.

Employer obligations

In broad terms, employers must operate internal whistleblowing channels meeting minimum criteria on diligent investigation and response. The requirement to establish internal reporting channels, under the WBD, extends to public sector legal entities and private sector employers of 50+ workers (the 50+ threshold does not apply to small employers covered by sector specific EU rules). MSs may delay this requirement until December 2023 for some private employers with 50-249 workers. These employer internal reporting channels:

a) must be available to the entity’s workers

b) must be secure, maintain confidentiality and comply with GDPR

c) must designate a competent impartial person or department as responsible for diligently following up on reports

d) must allow reporting to be in writing or orally, or both

e) must acknowledge reports within 7 days of receipt and feedback must be provided within 3 months of the acknowledgement

f) may be extended beyond the entity’s workers to others (such as contractors, suppliers, shareholders - identified above)

g) may be operated by third parties, provided safeguards and other requirements, such as maintaining confidentiality, are applied

Sanctions and penalties

MSs must provide, when implementing the WBD, for effective penalties applicable to those: hindering reporting; bringing vexatious proceedings against whistleblowers; retaliating against reporting; and breaching the duty to maintain confidentiality. Interim relief must be made available to whistleblowers (and those assisting) pending resolution of legal proceedings. Penalties must also be applied to those knowingly making false reports. No waiver of rights and remedies in the WBD are permitted.

Internal, external or public whistleblowing?

The WBD contains no requirement to report internally as a first step. It contains general principles only in this respect, for example, that MSs should ‘encourage’ internal before external reporting. Therefore, employers must check national laws implementing the WBD to understand when whistleblowers may skip internal channels when reporting.

The WBD provides for two types of reporting which are outside of the employer: an ‘external’ report to a designated national authority (or EU body), or a ‘public’ report, such as to the media. Public whistleblowing is protected, as follows:

a) a report has been made internally and externally, or directly externally, but no appropriate action has been taken within the prescribed timescale, or

b) the whistleblower has reasonable grounds to believe that a breach constitutes imminent danger to the public interest, or

c) no external report has been made due to reasonable belief in a risk of retaliation or low prospect of breach being effectively addressed

Anonymous reporting

Anonymous whistleblowers are not covered by the WBD unless they are subsequently identified. However, MSs can decide whether employers and national authorities must accept and follow up on anonymous reports. Again, this point needs checking as countries implement the WBD locally.

Member States’ progress on implementing the Whistleblowing Directive – April 2022

Before the WBD, whistleblower protection was fragmented across MSs with only a minority having comprehensive cross-sector legal frameworks. Instead, a patchwork of regulation existed, addressing, for example, whistleblowing in financial service and the public sector. Even countries with general protection in place, such as Ireland and France, have had to amend their legislation to comply with the requirements of the WBD.

In broad terms, the changes being introduced by MSs in order to implement the WBD focus on the following areas:

a) new or strengthened minimum procedures for receiving, handling and processing disclosures

b) extending the scope of those protected and reinforcing their legal protections

c) new or increased sanctions for retaliation against those reporting and for breaches of confidentiality or procedure

Only a minority of MSs have implemented the WBD to date, including France, Sweden, Portugal and Latvia. Other MSs, such as Ireland, are expected to confirm implementation before the summer with the remaining countries expected to act before the end of the year, or possibly early 2023. Given that the EU Commission has already written to 24 MSs to apply pressure, with the threat of formal legal action for non-compliance, it is anticipated that the pace of implementation will accelerate across most countries. The table below summarises the current position across a selection of EU MSs.

No longer an EU member, the UK is not required to implement the WBD and the Government has said that it has no plans to do so. While the UK has extensive whistleblowing legislation already, compliance with the WBD would necessitate some changes. For example, extending protection to the broad category of people who may report under the WBD.

Practical implications for employers responding to the Whistleblowing Directive

Even where MSs have existing and comprehensive whistleblowing protection, national laws are still being amended to reflect the standards set by the WBD. In those MSs without a pre-existing general whistleblowing framework, the WBD is necessitating significant legal change and, despite recent delays, we expect a rush of implementing legislation during 2022. Therefore, even those employers with detailed whistleblowing procedures are advised to check, without delay, whether they need adjusting in the following areas:

a) who may report: the WBD protects a broader range of workers, including contractors, shareholders, others

b) protection beyond the whistleblower: the WBD protects some third parties (facilitators, colleagues, others)

c) anonymous reporting: check whether MSs decide locally to extend the scope of the WBD to anonymous disclosures

d) review any good faith or public interest criteria: the WBD does not require whistleblowers to act in good faith and does not expressly require reports in the public interest

e) a requirement to report first to the employer: the WBD encourages but does not mandate internal reporting in the first instance. Check local implementation to see how MSs approach the balance between internal and external reporting

f) the administration of employer whistleblowing channels: these should be checked to ensure compliance with the confidentiality duty, the duty to respond diligently within set timescales and more. Where they do not currently exist, employers must set them up (unless they are exempt – see above)

g) training: the WBD extends robust legal protection to qualifying whistleblowers and MSs are required to apply effective penalties for non-compliance. Employers should ensure that staff understand the important role of whistleblowing to support corporate governance and good health, and the gravity of hindering those reporting or retaliating in any way

h) compliance: check whether procedures, and any proposed changes, comply with data protection, works council consultation and other legal requirements

i) retaliation: ensure that disciplinary/dismissal and other procedures are alert to the risks of unjustifiably taking action against a potential whistleblower, reflecting the burden of proof falling on the employer

j) spotting whistleblowing: is the organisation confident that managers recognise whistleblowing reports, whether verbal or written, and know how to respond, in what timeframe, the need for confidentiality and more?

In conclusion

In this age of the whistleblower, employers failing to provide easy access to confidential reporting mechanisms, or handling disclosures and disclosers inappropriately, risk problems escalating, reputational damage and, increasingly, significant sanctions for breaching whistleblowing regulation. It is notable that MSs are criminalising non-compliance, some with up to three years’ imprisonment.

The WBD will make it more important than ever for in-scope employers to have set up well-organised and trusted whistleblowing procedures and that they consider opening these channels up to non-employees such as those working for suppliers, contractors, the self-employed and more. Given the significant role of whistleblowing in upholding corporate ESG standards, it is expected that investors and other stakeholders will be paying increased attention as employers respond to changes introduced by MSs, in response to the WBD, and to the presence, or absence, of compliant and effective whistleblower programmes.