EU Whistleblower Directive entered into force – What needs to be done?

On December 16, 2019, the Whistleblower Directive (Directive (EU) 2019/1937) entered into force, which will need to be transposed into national law by the EU Member States within 2 years.

Scope of protection of the Whistleblower Directive

The Whistleblower Directive protects reporting persons (whistleblowers) working in the private or public sector who acquire information about breaches of EU law in a work-related context.

The term reporting person is broadly defined. It includes employees, self-employed persons, shareholders, civil servants, and persons belonging to the administrative, management, or supervisory body of a company, but also trainees of a company. The term also includes service providers and suppliers.

It is a material condition for the protection of reporting persons that they had reasonable grounds reason to believe that the information on breaches reported was true at the time of reporting and that such information fell within the scope of the Whistleblower Directive. The whistleblower must therefore act in good faith to benefit from the protection of the Whistleblower Directive. In addition, the Directive stipulates that only reports of breaches of EU law are protected. It remains to be seen, however, whether the national legislator will also include breaches of national law in the scope of protection. This might reduce the risk of incorrect assessments by potential whistleblowers.

Mandatory reporting channels for companies

The Whistleblower Directive aims to create an EU-wide uniform minimum standard of protection for whistleblowers, who are supposed to be encouraged to uncover detected breaches of Union law.

All companies

• having more than 50 workers or
• with annual revenue exceeding EUR 10 million

are obligated to establish an internal reporting system.

Additionally, municipalities with 10,000 inhabitants or more are obligated to establish an internal reporting system.

Legal entities in the public sector, including entities owned or controlled by such legal entities, will also have to establish an internal reporting system.

Important note: Companies having more than 250 workers will have to implement the reporting system by not later than December 17, 2021, while companies having between 50 and 250 workers will have until December 17, 2023 to do so.

Conditions for the specific design of the reporting channels

The Whistleblower Directive introduces clear requirements for the functioning of reporting channels. For example, it must be possible to report either in writing or by phone and, upon the request by the reporting persons, such channels should also enable reporting by means of physical meetings. Consequently, it needs to be ensured that reporting channels are accessed by qualified persons and that reports are processed in a qualified manner. The management of timeframes to provide feedback to a whistleblower also plays an important role. Acknowledgement of receipt of the report must be given within seven days and a whistleblower must be informed within three additional months about the follow-up regarding the investigation’s progress.

Hierarchy of the reporting channels

Whistleblowers are generally required to first use the company’s internal reporting channels prior to resorting to external channels set up by the authorities. According to the Whistleblower Directive, whistleblowers should also be allowed to directly use channels set up externally by Member States. The Whistleblower Directive also protects whistleblowers in these reporting cases. Companies therefore need to provide their employees with easily accessible information on external reporting channels and external offices and agencies. If these external offices and agencies do not respond within the specified period of time, the whistleblower may contact the public directly.

Reporting to the public

When disclosing information to the media, the whistleblower’s protection is subject to conditions. The whistleblower must first have made the report either internally or to the competent offices or agencies. Whistleblowers may only turn to the public when this has remained unsuccessful or where they fear low probability of clarification or even retaliation. This also applies to all cases in which the known breach may represent an immediate or obvious threat or harm to the public interest.

Comprehensive protection of the whistleblower

Established internal or external reporting channels must ensure the confidentiality of the whistleblower’s identity. The Whistleblower Directive requires reporting channels to be designed, established, and operated in such a way that the confidentiality of the identity of the whistleblowers and third parties referred to in the report is protected. It must also be ensured that the reporting channels are protected from unauthorized access.

The Whistleblower Directive leaves it up to the EU Member States whether anonymous reports should be accepted and followed up. If this is the case, anonymous whistleblowers who have been identified and may be subject to retaliation enjoy the protection of the Directive.

Sanctions

The Whistleblower Directive obligates Member States to provide for effective, proportionate, and dissuasive penalties applicable to companies or natural persons that

• hinder or attempt to hinder reporting,
• retaliate against whistleblowers,
• bring vexatious proceedings against whistleblowers, or
• breach the duty of maintaining the confidentiality of the identity of reporting persons.

Outlook

Companies should prepare for the coming regulations by establishing appropriate reporting channels and training their employees. Particularly in view of potential conflicts with the Trade Secret Act, which has been in force since April 26, 2019, and the exception to the prohibited disclosure of trade secrets governed by its Article 5, as well as the associated protection of whistleblowers, it will need to be ensured that functioning and effective internal reporting channels are established for the company’s workers.

In future articles, SKW Schwarz Rechtsanwälte will report in detail on the specific obligations affecting companies.

The experts at SKW Schwarz Rechtsanwälte will be glad to answer any questions you may have about the Whistleblower Directive.