Adoption of the EU directive on the Protection of Whistleblowers
On October 7, 2019, the European Council adopted the directive on the protection of persons who report breaches of Union law (“Whistleblower Directive”; hereinafter referred to as the EU Whistleblower Directive). In the next step, the legal act will be formally signed and published in the Official Journal (Amtsblatt). The Member States now have two years until December 2021 to implement the provisions.
Executive Summary
- EU directive on the protection of whistleblowers formally adopted.
- To be implemented in national law by December 2021.
- The minimum level of protection is intended to provide comprehensive protection for potential whistleblowers in the future, especially in relation to the confidentiality of their identity and against retaliation, thereby encouraging them to report.
- Companies are obliged to establish internal reporting channels.
Introduction
After the European Parliament formally adopted the EU Whistleblower Directive on 16 April 2019, the European Council followed suit on 7 October 2019. The declared aim of the EU Whistleblower Directive is to create an EU-wide uniform minimum standard for the protection of whistleblowers, which has not yet existed in this form. Germany, for example, has not been one of the ten member states that have already established sufficient legal protection for whistleblowers. This will now change. From December 2021, new legal requirements will apply. According to these, companies must essentially prepare themselves for new developments with regard to the implementation of internal reporting channels, for differentiated requirements with regard to their concrete form and for various requirements to ensure the protection of whistleblowers.
Material scope of application
In principle, the EU Whistleblower Directive is dedicated to the protection of persons who report breaches of Union law (for example, breaches in the areas of public procurement, financial services, money laundering, terrorist financing, etc.). It is to be assumed – and probably advisable – that the German legislator, when implementing the directive, will make use of the possibility of extending the material scope of application to reports of breaches of domestic law. The whistleblower would hardly be able to be expected to examine whether Union law or, if so, only German law is actually affected in the individual case in advance of a report.
Establishment of internal reporting channels
Companies with more than 50 employees are required to implement internal reporting channels. The company can either establish and operate an internal reporting channel itself, such as an Internet-based whistleblower tool, or have a reporting channel provided and operated by an external third party. The latter would come close to the common practice in Germany of engaging external lawyers as ombudsmen.
Clear guidelines for the concrete functionality of the reporting channels
The EU Whistleblower Directive stipulates clear requirements for the functionality of reporting channels. According to this, it must be possible to provide information either in writing or by telephone or, if desired, in person. It must be ensured that the channels are serviced by qualified persons and that reports are processed in an appropriately qualified manner. Clear deadlines have been set for the necessary feedback to a whistleblower. In addition to a simple confirmation of receipt within seven days, a whistleblower must be informed of the status of the relevant follow-up measures from the investigation process within a further three months.
Choice and hierarchy of reporting channels
Although whistleblowers are recommended to make use of established internal reporting channels of the company, in the end they should have freedom of choice. According to the rules of the EU Whistleblower Directive, whistleblowers should also be able to turn directly to (autonomous and independent) external channels established by the member states. The directive also protects whistleblowers in this case. Companies must even provide their employees with easily accessible information on alternative, external reporting channels and the relevant authorities. If the latter do not react within the specified period, the whistleblower should be allowed to address the public directly.
Comprehensive protection of whistleblowers
Established reporting channels must preserve the confidentiality of the identity of whistleblowers. According to the directive, reporting channels must be designed, established and operated in a secure manner that maintains the confidentiality of the whistleblowers’ and third parties’ identities mentioned in the report and denies unauthorized employees’ access to those channels. Anonymous reporting should also be possible, but the directive leaves it to the Member States to decide whether anonymous reporting should be accepted and followed up. Where this is the case, then the anonymous whistleblower who has been identified and suffers reprisals should also enjoy the protection of the directive.
In future, whistleblowers who report in good faith should be actively and comprehensively protected from retaliation of any kind, whether by dismissal, suspension or any other form of downgrading and/or discrimination. It will be advisable for companies to clearly and establish such binding commitments throughout the company in future, either in a dedicated Whistleblower Policy or at least in the Code of Conduct.
Outlook/Conclusions
The German legislator now has two years to implement the requirements and recommendations of the EU Whistleblower Directive. Companies that already have effective whistleblower systems as part of a good compliance organization will probably not be exposed to considerable implementation effort. Under certain circumstances, however, it may be advisable to review existing, in particular internal processes with regard to future statutory requirements and – if necessary – to adjust them. Any differences in implementation by the individual EU Member States must be taken into account. Small and medium-sized enterprises in particular, which according to the directive will have a total of four years to implement the legal requirements with between 50 and 249 employees, may be faced with more extensive implementation tasks. The time required to set up effective, possibly IT tool-based reporting channels should not be underestimated.
We will keep an eye on the implementation by the German legislator for you and report accordingly.
Furthermore, we would be pleased to help you establish an effective internal reporting system or to check and certify the appropriateness and effectiveness of your existing whistleblower system. Even without the EU Whistleblower Directive, an effective whistleblower system is a “must” for any compliance management program – so don’t wait, contact us!
Further links
Directive of the European Parliament and of the Council on the protection of persons reporting breaches of Union law (2018/0106 COD).
European Council press release of 7 October 2019.
Blog post “EU rules to protect whistleblowers”, March 18, 2019.
Our info flyer “Whistleblowing systems” for download.