The EU Whistleblowing Directive
The path to implementation
Last updated December 2021
2021 Bird & Bird All Rights Reserved 1
Implementation of the EU Whistleblowing Directive (the "Directive")
2 2021 Bird & Bird All Rights Reserved
Directive (EU) 2019/1937 on the protection of persons who report breaches of Union law (the Directive) must be implemented by all EU Member States by no later than 17 December 2021.
The Directive requires Member States to implement legislation obliging all companies with 50 or more workers to: (i) put in place appropriate reporting channels to enable those workers to report breaches of EU law; and (ii) ensure that those making whistleblowing reports are legally protected against retaliation for having done so.
The Directive requires companies to put in place internal reporting channels, where confidentiality of the whistleblower will be ensured, and requires Member States to put in place external reporting channels. The protections for whistleblowers must cover reports made in relation to breaches of the areas of EU law specified in the Directive (including public procurement; financial services, products and markets, and prevention of money laundering and terrorist financing; protection of the environment; protection of privacy and personal data, and security of network and information systems). However, Member States can if they wish include protections for those who blow the whistle in other areas. One particular concern for larger employers with operations across the EU will be how they ensure compliance with the Directive's requirement that each legal entity with 50 or more workers must have its own reporting channel and procedure. The European Commission has indicated that this will preclude reliance on a central compliance team within a parent company to handle all whistleblower reports (although there is a derogation allowing entities with 50-249 workers to "share resources" between themselves). The Danish legislature has included provision in its implementing law allowing companies to use a centralised reporting and investigation system, pending further clarification on whether or not this approach is compatible with the Directive. By contrast, the draft legislation published in some other jurisdictions simply follows the scheme of the Directive.
There is long-standing guidance from data protection authorities which emphasises the need to balance protection for those who blow the whistle, with the need to ensure that schemes don't encourage the collection of inaccurate and highly damaging data on persons about whom reports are made. This can be a particular risk where hotline schemes encourage anonymous reports. This will need to be taken into account by businesses putting in place systems to comply with the Directive. In addition, whistleblowing policies and procedures will need to be reviewed and updated, and rolled out in a legally compliant way (taking into account local works council / trade union / other staff consultation requirements), so HR and legal teams will need to work closely together to achieve compliance.
With 17 December 2021 now looming, and some countries now providing more clarity on local implementing legislation, international businesses (particularly those with operations in a large number of EU jurisdictions, where the time needed to agree changes to policies and then translate these can be significant) should be:
reviewing their standards of business conduct and reporting arrangements, including whistleblower hotlines, to ensure compliance with the Whistleblowing Directive and continued compliance with GDPR; and
implementing internal whistleblowing policies (or adapting their existing policies to ensure they take account of the new legislation).
Key areas to address will be ensuring that:
reports are handled by the correct people, in accordance with prescribed timescales and with appropriate security and confidentiality;
required information is given to the reporter and to the person investigated;
there is guidance and training in place to ensure non-retaliation; and
there are appropriate retention periods for reports and investigation data.
To enable businesses to plan for a smooth transition, we have produced this tracker, which shows:
progress towards implementation by jurisdiction;
the degree of change to existing law that implementation will entail; and
how some of the key topics covering the in Directive are dealt with in local implementing legislation (where this information is available).
2021 Bird & Bird All Rights Reserved 3
Belgium
Finland
What stage has the legislature reached in implementing the Whistleblowing Directive? If not already implemented, when is it expected or planned that the required legislation will be passed?
The legislative process is currently in the very beginning. A draft bill has been filed by a minority opposition party but this will likely not be passed. It is unclear when the government will produce its own draft.
Status
Implementation not started.
Reporting topics covered
Information not yet available.
Categories of person who may report
Information not yet available.
Is anonymous reporting covered? Information not yet available
Remedies for retaliation
Information not yet available.
Are group-wide reporting channels permitted?
Information not yet available.
What stage has the legislature reached in implementing the Whistleblowing Directive? If not already implemented, when is it expected or planned that the required legislation will be passed?
The Finnish Ministry of Justice set up a working group to evaluate, assess and implement the legal changes caused by the Whistleblowing Directive to the Finnish national legislation in February 2020. The working group's term was extended until 31 May 2021. The working group shall present the initial government proposal, including any necessary amendments to the national legislation and a proposal for the implementation timetable. This suggestion can be in line with the Directive (17 December 2021) or beforehand. The draft government proposal has been subject to a consultation from 2 July 2021 to 27 August 2021. In summary, the implementation process in Finland is still in progress. The estimated week of presentation for the government's proposal is week 49/2021, i.e. the second week of December.
There is no further information regarding the exact implementation schedule.
Status
Implementation in progress.
Reporting topics covered
Same as those in the Directive. However the scope of some of these topics will be widened to include infringements based solely on the national laws for each topic.
Categories of person who may report
Same as those in the Directive.
Is anonymous reporting covered? No, it is at company's sole discretion.
Remedies for retaliation
Compensation.
Are group-wide reporting channels permitted?
Yes. No limitations have been mentioned in a draft government proposal regarding group-wide reporting channels. Group-wide reporting could be used in group companies and also in group-like associations of undertakings (for example chain enterprises) but this could be subject to change.
4 2021 Bird & Bird All Rights Reserved
2021 Bird & Bird All Rights Reserved 5
Denmark
Czech Republic
What stage has the legislature reached in implementing the Whistleblowing Directive? If not already implemented, when is it expected or planned that the required legislation will be passed?
On 24 June 2021 the Danish Parliament passed the Danish Act on the Protection of Whistleblowers. Denmark has in other words implemented the EU Whistleblower Directive (the Directive), and the act will come into force on 17 December 2021. The path to incorporation was, however, not without obstacles.
The Minister of Justice presented the Bill on 14 April 2021, and the Bill was then sent in consultation.
Status
Legislation passed/Directive implemented.
Reporting topics covered
The Directive is a minimum directive allowing member states to (amongst other elements) broaden its application to also include reporting on other types of breaches than the ones listed in the Directive and the annex to the Directive. Denmark has in this connection decided to include "serious offences and other serious matters", and then leave it for the courts to establish the extent of this addition.
Categories of person who may report
Is anonymous reporting covered?
Employees; Self-employed persons; Shareholders and persons belonging to the administrative, management or supervisory body of an undertaking, including non-executive members; Volunteers; Paid or unpaid trainees; Persons working under the supervision and direction of contractors, subcontractors and suppliers; Persons who report or make public information, that the individual acquired in a work-related context, and the work has since ceased; and Reporting persons, whose work-based relationship is yet to begin, in cases where information concerning a breach has been acquired during the recruitment process or other pre-contractual negotiation.
Yes, if the report concerns a topic that falls within the scope of the Act, but protection against retaliation may be dependent on the employer knowing the identity of the whistleblower.
Remedies for retaliation
Compensation (up to one year's salary) Alternatively, re-employment (where the employee was terminated).
Pursuant to the original Bill, different employing entities could not share whistleblower channels and investigation resources which gave rise to a number of objections from several large multinational Danish headquartered companies.
Are group-wide reporting channels permitted?
The end-result is found in section 9, subsection 3 of the Act according to which employers who are obliged under the Act "...may establish group-wide whistleblower schemes. The Minister of Justice may lay down rules that the first sentence shall not apply." In other words, the Parliament placed authority with the Danish Minister of Justice to revoke the possibility to allow shared whistleblower schemes should the conclusion be that shared schemes are not in conformity with the Directive.
What stage has the legislature reached in implementing the Whistleblowing Directive? If not already implemented, when is it expected or planned that the required legislation will be passed?
The draft Act on Whistleblowing was submitted to the Chamber of Deputies on 9 February 2021. Following this, the legislative procedure was terminated due to the Czech general elections and so has to be started again from the beginning (which has not happened yet). The current draft remains for now but the wording may change.
The original bill should have become effective on 17 December 2021. However, since the legislative procedure has not started again yet, we are not able to predict the date for its approval and effective date.
Status
Implementation in progress.
Reporting topics covered
Categories of person who may report
In addition to those covered by the Directive the Czech Republic has included: corporate income tax; competition; protection of internal order and security; protection of the EU's financial interests; and the functioning of the internal market.
Persons engaged in: employment; military service; persons having self-employed status; the performance of the function of a member of the body of a legal entity who is elected, appointed or otherwise called to function (hereinafter referred to as the "elected body"), trust fund management, volunteer activity, internship, traineeship, the exercise of rights and obligations arising from a contract having as its object the provision of supplies, services, works or other similar performance, and also applying for a job or other similar activity.
Is anonymous reporting covered? Yes. Anonymous reporting is permitted.
Remedies for retaliation
Compensation.
Are group-wide reporting channels Yes, listed legal entities (including private employers) with no more than 249 employ-
permitted?
ees may share internal reporting channels.
6 2021 Bird & Bird All Rights Reserved
2021 Bird & Bird All Rights Reserved 7
France
Germany
What stage has the legislature reached in implementing the Whistleblowing Directive? If not already implemented, when is it expected or planned that the required legislation will be passed?
In the context of the transposition of the Directive, the French Ministry of Justice initiated a public consultation, open to any French citizen until 21 March 2021 (see here in French).
A bill was discussed in first reading on 17 November 2021 and adopted by the French National Assembly with modifications. The French Senate now needs to vote on the bill and the date is not known at this stage but is expected in the course of December 2021.
Status
Implementation in progress.
Reporting topics covered
In addition to those in the EUBWD, the draft law includes: crimes or offences; serious and manifest violations of:
o an international commitment duly ratified or approved by France; o a unilateral act of an international organisation taken on the basis of such a commitment; o the law or regulations; a serious threat or harm to the public interest; and violations of European law.
The facts reported may concern "information" on a crime, offence or violations of the law, but also "attempts to conceal" these violations. The violation of the rule will no longer have to be "serious and manifest". One of the key changes introduced by the new French law is the option for the whistleblower to report either internally or directly externally to the authorities (without having first reported internally as was the rule under the previous legislation).
The proposed law adopted on 17 November 2021 defines a whistleblower as follows: "the physical person who reports or discloses, without direct financial compensation and in good faith, information concerning a crime, an offence, a threat or harm to the general interest, a violation or an attempt to conceal a violation of international or European Union law, the law or the regulations."
Categories of person who may report
Is anonymous reporting covered?
Remedies for retaliation
Are group-wide reporting channels permitted?
This updated definition: removes the requirement that the breach of a legal norm be "serious and manifest"; removes the requirement that the whistleblower must have `personal' knowledge of the facts (a requirement which is nevertheless maintained for reportings made outside the professional context). introduces the reference to "information" introduce the notion of "attempted concealment". replaces the notion of "disinterested" by "without direct financial consideration".
The source of the reporting must be identifiable. However, the identity of the whistleblower cannot be disclosed without his/her consent (his/her identity must remain confidential).
Retaliatory actions can be annulled by labour courts, this includes reinstating employees who are dismissed. Perpetrators of retaliation are also subject to criminal sanctions which include imprisonment of up to 3 years and a fine of EUR 45,000. The proposed French bill extends certain protections offered to whistleblowers, in particular protection against retaliation, to individuals and non-profit entities (trade unions and associations) who are in contact with the whistleblower and considered as "facilitators". If the whistleblower fears retaliation, he or she can make the whistleblowing public.
Not confirmed at this stage.
8 2021 Bird & Bird All Rights Reserved
What stage has the legislature reached in implementing the Whistleblowing Directive? If not already implemented, when is it expected or planned that the required legislation will be passed?
The Ministry is currently working on a draft bill. At present, however, there is still a dispute between the Federal Ministry of Justice and the Federal Ministry of Economics regarding the extent to which the Directive should be implemented. While the Federal Ministry of Economics demands a 1:1 implementation, the Federal Ministry of Justice is requesting a more extreme implementation (whereby whistleblowers will be protected regardless of whether they report violations of Union law or national law).
Implementation of the Directive is expected by the end of the deadline (17 December 2021). Earlier implementation is not yet foreseeable.
Status
Implementation in progress.
Reporting topics covered
Information not yet available.
Categories of person who may report
Information not yet available.
Is anonymous reporting covered? Information not yet available.
Remedies for retaliation
Information not yet available.
Are group-wide reporting channels permitted?
Information not yet available.
2021 Bird & Bird All Rights Reserved 9
Hungary
Italy
What stage has the legislature reached in implementing the Whistleblowing Directive? If not already implemented, when is it expected or planned that the required legislation will be passed?
To the best of our knowledge, no steps have yet been taken to implement the Directive. The government has published a statement that they are preparing impact studies on the implementation but no material results are published yet.
Further, we have no information on the timeline of the implementation.
Status
No steps taken to implement Directive.
Reporting topics covered
Information not yet available.
Categories of person who may report
Information not yet available.
Is anonymous reporting covered? Information not yet available.
Remedies for retaliation
Information not yet available.
Are group-wide reporting channels permitted?
Information not yet available.
What stage has the legislature reached in implementing the Whistleblowing Directive? If not already implemented, when is it expected or planned that the required legislation will be passed?
No steps have yet been taken to implement the Directive. We note that whilst Italy will have to amend its legislation, law no. 179/2017 already provides for a whistleblowing procedure pursuant to the recommendations of the EU Commission (e.g. a whistleblowing hotline and prohibition of reprisal).
Further, we have no information on the timeline of the implementation.
Status
No steps taken to implement Directive.
Reporting topics covered
Information not yet available.
Categories of person who may report
Information not yet available.
Is anonymous reporting covered? Information not yet available.
Remedies for retaliation
Information not yet available.
Are group-wide reporting channels permitted?
Information not yet available.
10 2021 Bird & Bird All Rights Reserved
2021 Bird & Bird All Rights Reserved 11
Netherlands
Poland
What stage has the legislature reached in implementing the Whistleblowing Directive? If not already implemented, when is it expected or planned that the required legislation will be passed?
Draft legislation was filed for consultation in July 2020. A designated parliamentary commission is currently reviewing the draft legislation and any input from the consultation.
It is unclear when the implementing legislation will be passed, but the government intends to do this prior to the deadline (17 December 2021).
Status
Implementation in progress.
Reporting topics covered
Information not yet available.
Categories of person who may report
Information not yet available.
Is anonymous reporting covered? Information not yet available.
Remedies for retaliation
Information not yet available.
Are group-wide reporting channels permitted?
Information not yet available.
What stage has the legislature reached in implementing the Whistleblowing Directive? If not already implemented, when is it expected or planned that the required legislation will be passed?
The government has produced a draft bill which is currently at the opinion level of the legislative procedure. We do not have information on the timeline for completing the process.
Status
Implementation in progress.
Reporting topics covered
The topics covered in the Directive. In addition, the draft bill provides the possibility for the employer to regulate reporting other violations as well, including those related to internal regulations or ethical standards applicable at the employer.
Categories of person who may report
Is anonymous reporting covered?
Employees (also ex-employees) Candidates, in cases where information concerning a breach has been acquired during the recruitment process or other pre-contractual negotiations Workers employed on a basis other than an employment relationship, including civil law contracts Entrepreneurs Shareholders Members of the administrative, management or supervisory body of a legal entity Persons working under the supervision and direction of contractors, subcontractors and suppliers, including on the basis of civil law contracts Trainees Volunteers
Yes. However, anonymous reports can only be made where the employer has an internal policy (in the case of a public authority, a procedure) for reporting breaches of the law and this permits anonymous reporting.
Compensation Fine Restriction of liberty Imprisonment for up to 3 years.
Remedies for retaliation
Above remedies are also provided for: (1) obstructing reporting, (2) violating the confidentiality of the whistleblower's identity, or (3) failing to establish an internal procedure.
The Bill also provides a whistleblowers' protection against: (1) civil lawsuits for defamation, (2) damages or (3) infringement of personal interests. Where the reporting person is not employed a unilateral decision to terminate the legal relationship due to whistleblowing is ineffective.
Are group-wide reporting channels permitted?
Yes, but with limitations.. Only Employers in the private sector employing 50 to 249 employees may, by agreement, share resources for receiving and verifying reports and following up, provided that the activities performed comply with the applicable laws.
12 2021 Bird & Bird All Rights Reserved
2021 Bird & Bird All Rights Reserved 13
Spain
Sweden
What stage has the legislature reached in implementing the Whistleblowing Directive? If not already implemented, when is it expected or planned that the required legislation will be passed?
Despite the fact that on the 2nd of June, 2020, the Coding General Commission of the Ministry of Justice announced that they are preparing the draft legislation, which was expected to be approved by 2 December 2020, such draft has not been published yet.
The Directive is expected to be implemented during 2021, but no specific date has been set.
Status
Implementation in progress.
Reporting topics covered
Information not yet available.
Categories of person who may report
Information not yet available.
Is anonymous reporting covered? Information not yet available.
Remedies for retaliation
Information not yet available.
Are group-wide reporting channels permitted?
Information not yet available.
What stage has the legislature reached in implementing the Whistleblowing Directive? If not already implemented, when is it expected or planned that the required legislation will be passed?
In Sweden, legislative protection is already in place - there is a statute against whistleblowing, the Act (2016: 749) on Protection Against Reprisals for employees who report serious misconduct (Sw: Lag (2016:749) om srskilt skydd mot repressalier fr arbetstagare som slr larm om allvarliga missfrhllanden), generally known as the "Whistleblowing Act".
However, to ensure compliance with certain aspects of the Directive, e.g. in relation to internal re-porting systems and the list of those who benefit from protection, new legislation has been suggested to replace the existing Act. The government presented their legislative proposal on 15 April 2021, which suggests (among other things), that the rules should apply in all private and public organizations, and that authorities shall be appointed to establish external reporting channels.
The new act has been passed by the parliament (Sw. Riksdag) and is expected to enter into force on 17 December 2021.
Status
Implementation in progress.
Reporting topics covered
Categories of person who may report
The topics covered in the Directive. In addition, the draft bill provides the possibility for the employer to regulate reporting other violations as well, including those related to internal regulations or ethical standards applicable at the employer.
Employees and job applicants Persons seeking or performing voluntary work Persons seeking or completing internships Persons who are otherwise available to perform, or performs, work under the supervision and management of a business operator Self-employed persons seeking or performing assignments Persons available to be, or who are, part of the administrative, management or supervisory body of an undertaking Shareholders available to be, or who are, active in a limited liability company Persons who have belonged to any of the above categories and have received or obtained the information during the time in the business
Is anonymous reporting covered? Yes.
Remedies for retaliation
Compensation/damages.
Are group-wide reporting channels permitted?
Yes, but only in respect of companies that engage between 50-249 employees. If a company is bound by a collective bargaining agreement ("CBA"), the relevant parties to the applicable CBA may be able to agree to deviate from this rule provided that any such deviation does not entail a breach of any of the individual rights in the Directive.
14 2021 Bird & Bird All Rights Reserved
2021 Bird & Bird All Rights Reserved 15
United Kingdom
Key contacts
What stage has the legislature reached in implementing the Whistleblowing Directive? If not already implemented, when is it expected or planned that the required legislation will be passed?
As a result of the UK's departure from the European Union, the UK government has confirmed that it does not propose to adopt the Directive into UK law. The UK government's EU Scrutiny Committee was still looking at the Directive in February and may recommend amending UK legislation to include some of the protections/requirements in the Directive but this will not be for some time. For now UK legislation will remain in force and unchanged. However, the EU has noted that the UK already has comprehensive legislation in place to protect whistleblowers, namely the Public Interest Disclosure Act 1998.
Status
No steps taken to implement Directive.
Reporting topics covered
N/A
Categories of person who may report
N/A
Is anonymous reporting covered? N/A
Remedies for retaliation
N/A
Are group-wide reporting channels permitted?
N/A
Alison Dixon
Partner, International HR Services Tel.: +44 (0)20 7415 6000 [email protected]
Sren Narv Pedersen
Partner, International HR Services Tel.: +45 22 49 08 14 [email protected]
Ruth Boardman
Partner, Privacy & Data Protection Tel.: +44 (0)20 7415 6000 [email protected]
Michael Gorm Madsen
Partner, Privacy & Data Protection Tel.: +45 25 24 51 30 [email protected]
Click here to view our international HR Services contacts and here to view our Privacy & Data Protection contacts.
16 2021 Bird & Bird All Rights Reserved
The information given in this document concerning technical legal or professional subject matter is for guidance only and does not constitute legal or professional advice. Always consult a suitably qualified lawyer on any specific legal problem or matter. Bird & Bird assumes no responsibility for such information contained in this document and disclaims all liability in respect of such information. This document is confidential. Bird & Bird is, unless otherwise stated, the owner of copyright of this document and its contents. No part of this document may be published, distributed, extracted, re-utilised, or reproduced in any material form. Bird & Bird is an international legal practice comprising Bird & Bird LLP and its affiliated and associated businesses. Bird & Bird LLP is a limited liability partnership, registered in England and Wales with registered number OC340318 and is authorised and regulated by the Solicitors Regulation Authority. Its registered office and principal place of business is at 12 New Fetter Lane, London EC4A 1JP. A list of members of Bird & Bird LLP and of any non-members who are designated as partners, and of their respective professional qualifications, is open to inspection at that address.
Abu Dhabi & Amsterdam & Beijing & Bratislava & Brussels & Budapest & Copenhagen & Dubai & Dusseldorf & Frankfurt & The Hague & Hamburg & Helsinki & Hong Kong & London & Luxembourg & Lyon & Madrid & Milan & Munich & Paris & Prague & Rome & San Francisco & Shanghai & Singapore & Stockholm & Sydney & Warsaw & Satellite Office: Casablanca
2021 Bird & Bird All Rights Reserved 17
