Until now, there has been no baseline regime for the protection of whistleblowers in the European Union (“EU”). Member state legislation in this area is largely fragmented and, in many cases, does not provide much (if any) protection for whistleblowers. Presently, only 10 out of the 28 member states have comprehensive legislation protecting whistleblowers, while the remaining 18 member states only offer limited protection within specific sectors.[1] The notion of introducing a uniform regime has been on the cards for some years, but in the wake of recent scandals such as the Panama Papers, Luxleaks, and Cambridge Analytica, all of which were brought to the world’s attention by whistleblowers, this has moved to the top of the agenda. The European Parliament and the European Council have now formally adopted and ratified the Whistleblowing Directive (“the Directive”) with effect from October 7, 2019.
In this Commentary, we provide an overview of the Directive, briefly compare the Directive to the current legal position in Germany and the UK, and explain how its implementation will impact organizations with employees in the European Union.
What Is a “Directive”?
A directive is a legal instrument approved by the EU legislature, which, in general, requires implementation into local law by individual EU member states before it becomes effective. Directives often carry an overarching objective and allow member states to select the means by which they achieve the objective. This means that the local laws implementing a directive will differ between member states.
The Directive: General Overview
As noted, the Directive lays the foundation for EU-wide protection of whistleblowers at work and sets EU-wide standards for both public and private companies to (i) respond to concerns raised by whistleblowers and (ii) ensure adequate protection against retaliation. The Directive is likely to be published in the EU’s Official Journal in November 2019, meaning that EU member states will have to implement local laws giving effect to the Directive by no later than November 2021. If a member state fails to implement the Directive by the imposed deadline, then the European Commission may ask the court to impose fines on the infringing member state.
Who will be protected under the Directive?
The Directive protects whistleblowers working in the private or public sector who acquired information on breaches of EU law in a work-related context (“Whistleblowers”). The term “work-related” is, however, broadly defined and refers to current and former employees, as well as to shareholders, interns, job applicants, paid or unpaid trainees, and employees of contractors and subcontractors.
In order to be protected under the Directive, the individual must simply have reasonable grounds to believe that the information reported is accurate. Other concerns, such as the individual’s motive or the public interest, are irrelevant in deciding whether the individual receives protection under the Directive.
What types of breaches can Whistleblowers report?
The Directive’s scope of application is currently limited to reports relating to breaches and abuse of EU law. However, member states can broaden this scope, and, in any event, for member states that do not currently have sufficient whistleblower protection laws (e.g., Germany), the Directive will still enhance the level of protection afforded to Whistleblowers.
How do Whistleblowers make a report under the Directive?
The Directive stipulates three possible stages for reporting to a breach:
- Stage 1 – Internal Reporting: The Directive encourages member states to require individuals to raise concerns to their employers internally, before using other channels of reporting. The Directive also requires that the employer must acknowledge receipt of the complaint within seven days, and must then respond substantively to the complaint within three months of receipt.
- Stage 2 – Reporting to National or EU Authorities: While Whistleblowers should be encouraged to follow internal reporting procedures in the first instance, Whistleblowers may bypass Stage 1 and report directly to national or EU authorities. For example, if (in breach of the Directive) an employer does not have an internal reporting mechanism or if the Whistleblower believes that internal reporting may endanger or jeopardize future investigations, then the employee has the right to report any issues directly to a “competent authority,” either nationally or at EU level. (It is not clear under the Directive what would amount to a “competent authority.”)[2]
- Stage 3 – Public Disclosure: If both Stage 1 and Stage 2 do not “function properly,” [3] or if the Whistleblower has reasonable grounds to believe that there is an “imminent danger to the public interest,” then the employee has the right to disclose the issue directly to the public via any media channels.
Organizations must provide a mechanism for Whistleblowers to be able to raise concerns. This could be through either a written or oral report, and organizations must allow Whistleblowers an opportunity for an in-person meeting with a “responsible person” within the organization to discuss their concerns. Organizations are also required to designate a person or a department responsible for following up on reports and establishing procedures and guidelines on the follow-up process and must publicize these procedures to the workforce.
How will Whistleblowers be protected under the Directive?
The Directive increases the burden on employers and strengthens the protections afforded to Whistleblowers. It does so by:
(a) requiring organizations with 50 or more workers to introduce internal channels and procedures for whistleblowing (see “How do Whistleblowers make a report under the Directive?”);
(b) expanding the scope of individuals protected by whistleblowing laws (see “Who will be protected under the Directive?”);
(c) protecting Whistleblowers from civil liability (for example, claims for breach of confidence or defamation), provided the Whistleblower can demonstrate that they have “reasonable grounds” for their actions;
(d) introducing legal aid for Whistleblowers in certain circumstances;
(e) banning all forms of retaliation in the workplace against a Whistleblower, which would include suspension, dismissal, demotion, harassment, and/or discrimination; and
(f) requiring member states to ensure that Whistleblowers have access to free advice in the event that they suffer retaliation.
However, it is worth noting that, unlike the position in the United States, the Directive does not provide for the offer of financial incentives for Whistleblowers.
What are the consequences of failing to comply with the requirements set out in the Directive?
The Directive requires member states to establish “effective, proportionate and dissuasive penalties”[4] against any organizations that attempt to hinder reporting or to take retaliatory measures against Whistleblowers. Aside from these financial penalties, failing to implement the correct procedures or taking retaliation against a Whistleblower will likely have a negative impact on the organization’s reputation.
The Directive and Existing German Law
In Germany, no comprehensive legal framework on the protection of Whistleblowers, reporting mechanisms, and protection against retaliation currently exist. While limited whistleblower protection exists for workers within the financial services industry and for employees raising health and safety concerns at work, the Directive will mark a significant change to current domestic law – and the protection of whistleblowers – in Germany.
The Directive and Existing UK Law
Unlike in Germany, the UK has, through the Public Interest Disclosure Act 1998, implemented wide-ranging protections for Whistleblowers in the workplace, many of which mirror the requirements of the Directive. Currently, dismissing an employee for making a “protected disclosure” amounts to automatic unfair dismissal, and workers are protected from suffering a “detriment” as a result of making a protected disclosure. Additionally, employers found to have subjected a Whistleblower to a detriment face potentially uncapped damages.
Nonetheless, the Directive will (if implemented in the UK), enhance protections currently afforded to Whistleblowers, particularly in relation to the requirement to establish internal channels and procedures for whistleblowing and the introduction of legal aid in certain circumstances. (See “How will Whistleblowers be protected under the Directive?”)
Will the UK Incorporate the Directive into Domestic Law?
Given the general uncertainty surrounding Brexit at the time of writing, it is unclear whether the UK will incorporate the Directive into domestic law. The government has not yet confirmed that it plans to bring the Directive into domestic law if a “no deal” Brexit occurs. That said, prominent charities aimed at promoting and protecting Whistleblowers in the UK, such as “Protect,” have lobbied the government to adopt the Directive irrespective of the type of Brexit that may occur, so it is possible that something akin to the Directive might be introduced into UK legislation after Brexit. In the words of Protect, if the UK leaves the EU, the Directive “may prove to be the first test as to whether the UK keeps up with the EU’s levels of protection, or allows its workers to fall behind.”[5]
Conclusion – What to do now?
During the next two years, member states will start implementing the Directive into national law, and companies employing 250 or more workers should be in compliance with these laws by November 2021. However, medium-sized companies, which employ more than 50 but less than 250 workers, should comply by November 2023. Nevertheless, all companies should monitor the lawmakers in those member states where they have offices and employees and should slowly begin their implementation of the requirements under the Directive. If a whistleblowing system already exists, companies should review, adjust, and update these procedures accordingly. If not, they must implement reporting channels and procedures that fulfill the requirements under the Directive.
Morrison & Foerster trainee solicitor Tom Macintosh Zheng has contributed to the writing of this post.
[1] Strengthening whistleblower protection at EU level: European Economic and Social Committee
[2] Article 11(1) Directive on the protection of persons who report breaches of Union law
[3] (62) Directive on the protection of persons who report breaches of Union law
[4] Article 23(1) Directive on the protection of persons who report breaches of Union law
[5] EU Directive on Whistleblowing: Protect - https://protect-advice.org.uk/eu-directive-on-whistleblowing/