Understanding the EU whistle-blowing directive

On 16 December 2019, Directive (EU) 2019/1937 on the protection of persons who report breaches of Union law entered into force. More than two years later, the deadline for implementation has passed – but the so-called whistle-blowing directive is still yet to be transposed into the law of most member states.

However, whether prompted by infringement procedures initiated by the European Commission in January or by the easing of the COVID-19 pandemic, meaningful progress now appears to be being made.

We expect to see increasing numbers of member states passing legislation implementing the directive in the months to come. But what will this mean for businesses operating across Europe?

Executive vice-president of the commission Frans Timmermans stated: 'If we better protect whistle-blowers, we can better detect and prevent harm to the public interest such as fraud, corruption, corporate tax avoidance or damage to people's health and the environment.'

The whistle-blowing directive aims to ensure a legal framework that will protect from retaliatory or recriminatory action those who speak up in the public interest about breaches of EU laws. It also provides common minimum standards of protection across the union to whistle-blowers who raise breaches of union law with their employer.

The importance of whistle-blowers in uncovering corruption and other wrongdoing has arguably become even more critical during the global pandemic, with remote working and lack of oversight leading to a higher risk of corporate governance failings.

Many public- and private-sector organisations want to create an environment in which workers who become aware of misconduct or wrongdoing speak up and are listened to. This would involve creating robust accountability mechanisms, and ensuring proper oversight of decision-making.

A number of member states are engaging in public consultations on draft whistle-blowing legislation, so businesses have an opportunity to contribute to the debate on and development of the new law.

While the directive aims to harmonise minimum standards, some member states have already gone further than the directive requires, and there remains scope for further divergence across regimes.

It creates additional obligations and responsibilities for public and private companies, in particular a requirement to have safe reporting channels – in other words, whistle-blowing hotlines – that protect the identity of those raising concerns. Internal reporting arrangements must also acknowledge receipt of a whistle-blowing report within seven days, and designate an impartial person or department to follow it up.

Companies, public institutions and authorities that receive information on wrongdoing all have a duty to follow up on reports. Applicable companies must provide feedback within three months, while competent national authorities (designated to receive external reports) must respond to reports received through external channels within three months, or six months if the complexity of the case warrants it. Whistle-blowers also have the right to make an external disclosure to a competent national authority, whether or not they have used internal channels first.

Member states must take measures to ensure that whistle-blowers are protected against any form of retaliation from their employers; the list of prohibited retaliatory conduct is extensive and includes demotion or withholding of promotion, negative performance assessment or employment references, reputational harm through social media or loss of business and loss of income.

In any associated litigation it will be presumed that any detriment was made in retaliation unless the employer can show otherwise – if an employee can show that they made a public disclosure and suffered a detriment it shall be presumed that the detriment was made as a result of the public disclosure. States must also ensure there is a competent national authority with specific responsibilities for dealing with whistle-blowing and external channels of reporting for those wanting to raise concerns.

The directive requires national legislation to implement specific means of protection in cases of whistle-blowing about breaches of EU law. However, it does not extend protection to whistle-blowing about breaches of domestic law, and this may lead to confusion in practice as to which procedures apply.

The directive requires that the whistle-blower had 'reasonable grounds' to believe that there were grounds for making a disclosure. There is no requirement for the disclosure to be made in the public interest (as is required in the UK) or for it to be made in good faith.

The definition of whistle-blower includes not just employees but a much wider range of individuals. Protection is given to workers – such as contractors and subcontractors in the construction industry – and to the self-employed. It includes shareholders, volunteers and trainees. The protection also extends to those who help whistle-blowers with the reporting process, such as colleagues.

A draft bill to transpose the directive into national law is being progressed in Germany, while a preliminary draft bill is at the parliamentary stage in Spain, and an enabling act is being approved in Italy.

On 16 February, France definitively adopted legislation to transpose the directive. This is currently being examined by the French Constitutional Council and is expected to come into force on 1 August this year. This was presented by the deputy Sylvain Waserman as being the 'best protection for whistle-blowers in Europe', and in some areas it goes beyond the protections envisaged in the directive.

Specifically, it extends protection to a whistle-blower's entourage – that is, anyone who helps with a disclosure – and puts internal and external reporting channels on an equal footing. It also strengthens protections afforded to whistle-blowers in the directive, prohibits retaliation, and exempts whistle-blowers from civil and criminal liability.

Compared to most other European countries, however, the UK already has comprehensive protection for whistle-blowers making protected disclosures through the Public Interest Disclosure Act 1998, as incorporated into the Employment Rights Act 1996.

To date, the UK government has not made any specific announcement about taking further action in the light of the directive, save to confirm that it remains on the watch list of the EU Scrutiny Committee which assesses the legal and/or political importance of EU documents.

The UK/EU and EAEC Trade and Cooperation Agreement 2021 contains far-reaching provisions, with the aim of ensuring a level playing field for trade and investment, and covers labour and social protections.

Once the directive has been implemented by most member states, therefore, the UK government will need to assess whether its whistle-blower protection could diverge significantly from that in member states and have a material impact on that level playing field. If it does then the EU could trigger appropriate rebalancing measures.

Another private members' bill, the Office of the Whistleblower Bill, seeks to establish just such an independent office. This bill's second reading took place in the House of Lords in June 2021.

Separately, there is an All-Party Parliamentary Group for Whistle-blowing looking at the effectiveness of UK legislation in this area, and how it might be improved.

Finally, charity Protect has launched a new campaign to fix UK whistle-blowing law, which calls for reform to the 1998 Act.

UK companies are not currently under any obligation to change their whistle-blowing practices, so far as they relate to breaches of domestic law. However, with the directive being implemented elsewhere in Europe, it is a good opportunity to take stock of existing arrangements. UK companies that do not already have an anonymous whistle-blowing hotline would be well advised to consider establishing one.

Such a channel could be set up internally or by outsourcing its provision to an external provider. Although this may appear costly and time-consuming in the short term, in the long term fostering a positive and open culture of speaking up is likely to reap greater rewards.

The directive itself will remain relevant, particularly for organisations that operate across Europe, and it may come to be regarded as best practice. We could see firms start to align UK procedures with those required by the directive in any event, to ensure a consistent global corporate policy.