Whistleblowing Directive

Introduction

Directive (EU) 2019/1937, commonly known as the EU Whistleblowing Directive, is a landmark piece of legislation designed to unify and enhance the protection of persons who report breaches of Union law. Adopted in October 2019, it establishes a minimum standard of protection across all EU Member States, ensuring that individuals (whistleblowers) can report illegal activities without fear of retaliation. The Directive aims to improve the enforcement of EU law and policies in specific areas by detecting, investigating, and prosecuting breaches.

Main Goal

The primary objective is to encourage the reporting of wrongdoing by providing legal certainty and robust protection against dismissal, demotion, and other forms of retaliation for whistleblowers in both the public and private sectors.

Who It Applies To

The Directive applies to:

• Private Sector: Legal entities with 50 or more workers.
• Public Sector: All legal entities in the public sector, including any entity owned or controlled by such entities (with potential exemptions for small municipalities).
• Specific Sectors: Entities working in financial services, products and markets, prevention of money laundering, transport safety, and protection of the environment, regardless of the number of employees.
• Individuals protected: Workers, self-employed persons, shareholders, volunteers, unpaid trainees, and contractors/subcontractors.

Key Dates

• Entry into force: 16 December 2019.
• Transposition Deadline (General): 17 December 2021.
• Derogation for Medium-sized Companies (50-249 workers): Member States could delay the obligation to establish internal reporting channels until 17 December 2023.

Key Provisions

• Three-Tier Reporting System:
  1. Internal Reporting: Reporting within the legal entity.
  2. External Reporting: Reporting to competent national authorities.
  3. Public Disclosure: Disclosing to the public/media (protected under specific strict conditions).
• Confidentiality: The identity of the reporting person must be protected and not disclosed without explicit consent.
• Record Keeping: Entities must keep records of every report received.

Obligations & Requirements

Organisations falling within the scope must:

• Establish Internal Channels: Secure channels for receiving reports (written or oral) that ensure confidentiality.
• Designate Impartial Persons: Appoint a person or department to follow up on reports.
• Acknowledgment: Acknowledge receipt of the report to the whistleblower within 7 days.
• Diligent Follow-up: Investigate the breach and take appropriate action.
• Feedback: Provide feedback to the whistleblower within a reasonable timeframe, not exceeding 3 months from the acknowledgment of receipt.
• Prohibition of Retaliation: Ensure no detrimental action (dismissal, suspension, negative performance reviews, etc.) is taken against the whistleblower.

Affected Areas

The material scope covers breaches in areas including:

• Public procurement
• Financial services and AML
• Product safety and compliance
• Transport safety
• Protection of the environment
• Nuclear safety
• Food and feed safety
• Public health
• Consumer protection
• Privacy, personal data, and network security

Penalties

Member States are required to provide for effective, proportionate, and dissuasive penalties applicable to natural or legal persons that:

• Hinder or attempt to hinder reporting.
• Retaliate against reporting persons.
• Bring vexatious proceedings against reporting persons.
• Breach the duty of confidentiality.