By Ole Kristian Olsby, Matthias Pallentin, and Veslemøy Lode

Protection of whistleblowers has been on the EU’s agenda for quite some time. Four years ago the EU issued the EU Whistleblowing Directive throughout its Member States. While the initial December 17, 2021 deadline for Member States to incorporate the Directive into their national legislation was missed by a large number of Member States, the second deadline set out in the Directive is now drawing closer: By December 17, 2023, all Member States are required to bring into force laws corresponding to the Directive, including its requirement that employers with less than 250 (and more than 50) employees set up internal reporting channels.

In the meantime, almost all EU Member States, as well as other European countries, have implemented the minimum standards set out in the Directive. There are a few countries, such as Norway and other members of the European Economic Area (EEA), that have not yet implemented it. However, even in some of these countries, implementing legislation is in the pipeline. In the UK, too, it is expected that many companies will comply with these new whistleblowing rules and procedures, although the concept and requirement to set up internal reporting channels introduces some new aspects to long-established whistleblowing regulations. As such, the EU Whistleblower Directive will potentially set a standard for all European companies.

As can be seen, almost all EU Member States have established the key requirements in a uniform manner by transposing them into local law. However, other elements such as penalties, scope and specific follow-up requirements vary among Member States. To help employers navigate the different legislation across the EU and Europe, we have prepared an overview of some key findings and issues based on the feedback we have gathered with the much appreciated help of our European colleagues.

Internal Reporting Channel

Most importantly, the Directive requires employers to set up internal reporting channels. Furthermore, there is an obligation for the Member States to establish external reporting channels. In addition, the Directive establishes a fundamental freedom of choice for whistleblowers, who do not need to contact the employer in advance if they have discovered a breach of rules (so-called internal reporting) but may directly involve the competent authority (so-called external reporting).

However, the Directive requires Member States to encourage the use of internal reporting channels. This is also considered to be in the employer’s best interest because, by providing an attractive internal channel, they can significantly reduce the risk that employees will go directly to the authorities with their observations or even consider going public. In this respect, the risk of potential reputational damage and the leakage of internal company information and possibly trade secrets should not be underestimated.

Sharing of Central Channels within a Group

The Directive includes simplifications for employers with generally no more than 249 employees and allows these groups of employers to share whistleblower channels in the same country, where they can operate a joint internal reporting office or jointly contract with an external third party. The vast majority of European countries have implemented this in their local laws. However, there are also some countries (e.g., including the Netherlands) that do not allow such sharing at all.

Meanwhile, a small number of countries (e.g., Austria, Denmark, Germany and Spain) go beyond these minimum standards, as their transposition laws explicitly aim to allow companies to use or pool centralized resources already available at group level. However, this view is not shared by the EU Commission, which considers that a group-wide whistleblowing system does not meet the requirements of the Directive and cannot exempt subsidiaries from the obligation to maintain their own internal channels. Given these differing views of local legislators and the EU body, we recommend that possible alternatives to such implementation be explored, even if there is easy access to existing resources within the group. Unfortunately, a (likely judicial) clarification of this issue of interpretation of the Directive’s provisions remains to be seen.

Finally, in this context it is important to note that the obligation to take measures to remedy the violation and the obligation to report back to the whistleblower remains with the individual employer in any event.

Within Littler, we have partnered with Navex WhistleB and set up our own system: Littler | Whistle Protect, which enables companies to set up various local channels under a central case management.

Material Scope of Application

Some Member States, although only a few (e.g., including Germany, Spain, and Sweden), have extended the material scope of application and gone beyond the Directive’s minimum standard by introducing a more exhaustive list of reportable matters, covering more than just specific breaches of EU law.

Securing Whistleblower Protection

Of significant importance, the Directive mandates comprehensive protection of the whistleblower—in particular, against all forms of reprisals. Reprisals are acts or omissions in connection with their professional activity that are a reaction to a report or disclosure, and as a result the whistleblower suffers or may suffer an unjustified disadvantage. This can include actions such as, among others, a transfer, an omission from a salary increase, a warning, as well as the termination of employment.

Anonymous Reporting

The Directive also leaves it to the Member States to decide whether employers are required to accept and follow up on anonymous reports. While 12 European countries explicitly allow anonymous reporting, five countries have made it optional for the employer to investigate anonymous reports, too.

As taking into account anonymous internal reports can increase the acceptance of and trust in the internal whistleblowing systems, this step should at least be considered—provided that the respective local laws have implemented the option of anonymous reporting to such an extent.

Sanctions

Finally, a large number of the European countries have introduced fines for breaches of the whistleblowing provisions, even though the Directive did not contain any specifications in this respect. Fines can be substantial in some cases and countries. Again, compliance with the Directive and the relevant local implementing legislation should not be taken lightly.