The 27 remaining EU member states have until 17 December 2021 to introduce local legislation implementing the new directive on the protection of persons who report breaches of EU law (the Whistleblowing Directive). With less than three months to go, we take a quick look at how the directive is being implemented in certain key EU countries and highlight what companies operating in Europe should be thinking about now to ensure their whistleblowing policies and procedures are compliant.

Key Provisions of the Whistleblowing Directive

  • At the moment, protection for whistleblowers differs greatly across Europe, with only a handful of countries having whistleblowing legislation in place. The aim of the Whistleblowing Directive is to enhance the enforcement of EU law and policies in specific areas by laying down certain minimum standards to protect individuals who report breaches of EU law, such as fraud, corruption, etc.
  • One of the key provisions in the directive is the requirement on EU member states to introduce a statutory obligation on private companies with 50 or more workers to set up suitable secure internal reporting channels that allow individuals to make disclosures, whether orally or in writing. Furthermore, the directive sets out certain minimum time frames within which steps must be taken. For example, a company must acknowledge receipt of a whistleblowing report within seven days of receipt and provide feedback within a reasonable time frame, which must not exceed three months. There are also obligations on employers concerning record-keeping and confidentiality requirements. For legal entities with between 50 and 249 workers, the obligation to establish internal reporting channels does not apply until 17 December 2023.
  • The directive grants protection to a wide variety of individuals when they report information about breaches of EU law acquired in a work-related context, including job applicants, workers, the self-employed, individuals working for contractors, subcontractors and suppliers whether current or former.
  • To gain protection, whistleblowers must have "reasonable grounds" to believe that the information was true at the time of reporting, and that such information fell within the scope of the directive and was reported internally or externally in accordance with the provisions set out in the directive.
  • The directive also requires EU member states to establish external reporting channels to receive, give feedback and follow up on whistleblower reports. Clear and easily accessible information about such channels must be provided to whistleblowers as part of any internal reporting channels. Individuals can also make public disclosures in certain circumstances.
  • As you would expect, whistleblowers must be protected against any forms of retaliation, such as dismissal or demotion, and member states must introduce penalties for non-compliance with these new obligations.

How Is the Directive Being Implemented Across Europe?

Very slowly, seems to be the answer. Individual member states are currently at different stages of implementation, but unless significant progress is made in the next few months, it seems that the vast majority of jurisdictions are likely to find their relevant implementing legislation slipping into 2022.

See below our "at a glance" table showing the current status of implementation in certain key European countries.

As the UK has already left the EU, it will not be required to implement the directive. To the extent UK companies have operations in continental Europe, however, it will, of course, still be relevant and changes to UK whistleblowing policies and procedures may still be necessary if they are part of a European/global framework.

What Should Global Companies Be Doing Now?

Although the implementation date for the directive is likely to slip in a number of EU member states, we recommend that companies take preparatory steps now to comply with the minimum requirements of the directive to ensure they are in a strong position to comply with any national implementing legislation as and when it is finalised. As highlighted in our recent blog, if you thought you could deal with the implementation of the directive into your EU business by changing the headings on your UK policy, you are heading for a fall. While the underlying core of what constitutes a protected disclosure is little different in principle, the EU rules will have much greater breadth and come attached to a great deal of procedural machinery, which will be new to most UK-based businesses.

As the directive only sets out certain minimum standards, businesses with operations in EU member states will have to take into account local implementing legislation when reviewing and updating their whistleblowing policies and procedures to ensure they are compliant.

Key steps to take now include: