Recently, both financial and environmental scandals have been exposed by whistleblowers. They have reported acts they had observed in the course of their work and which were seriously damaging to the public interest. Such reports play a key role in preserving the well-being of society. Yet whistleblowers may be deterred from reporting their suspicions or knowledge for fear of reprisals. A European Directive has been adopted recently with a view to putting an end to reprisals against whistleblowers and guaranteeing them better protection.
At present, the protection of whistleblowers is fragmented between EU Member States and uneven across policy areas. In Belgium, protection for whistleblowers exists in some cases, but it is not uniform across the country. In the federal and Flemish public sector, workers are protected against measures taken against them after they come forward, while no similar measures have been adopted in Wallonia or Brussels. In the private sector, few measures exist for whistleblowers, although some protection is in place in the financial sector.
On 23 October 2019 the European Parliament and the Council of the European Union signed the Directive on the protection of persons reporting on breaches of Union law, which establishes minimum standards common to all EU Member States in order to put an end to reprisals against whistleblowers and guarantee them better protection.
In concrete terms, the Directive obliges Member States to set up effective, confidential and secure reporting channels and to ensure that whistleblowers are effectively protected against reprisals.
Scope of the Directive
The material scope of the Directive is broad and includes in particular:
- Breaches falling within the scope of the Union acts in areas such as public procurement, prevention of money laundering and terrorist financing, protection of the environment, public health and consumer protection. The list of areas falling within the scope of the Directive is set out in Annex 1 to the Directive and is subject to amendment;
- Breaches affecting the financial interests of the Union;
- Breaches related to the internal market.
Regarding the personal scope, the Directive applies "to reporting persons working in the private or public sector who acquired information on breaches in a work-related context" (Article 4).
The Directive thus concerns persons who have worker, self-employed or shareholder status and persons belonging to the administrative, management or supervisory body of an undertaking, including non-executive members, as well as volunteers and paid or unpaid trainees, any persons working under the supervision and direction of contractors, subcontractors and suppliers. The Directive also applies to reporting persons when they report or disclose information acquired in a work-based relationship which has since ended or whose work-based relationship is yet to begin, and also to facilitators, third parties connected with the reporting persons and who may suffer retaliation in a work-related context or legal entities that the reporting persons own or work for.
The different communication channels envisaged by the Directive
The Directive envisages three communication channels for reporting: internal reporting, external reporting and public disclosures.
Member States must encourage the use of internal reporting channels before external reporting, in cases where the breach can be effectively addressed internally and where the reporting person considers that there is no risk of retaliation.
Member States must ensure that internal reporting channels are created, in particular in companies with more than 50 employees or in cities with more than 10,000 inhabitants, and must ensure that the report is diligently followed up. Among other things, the following must be ensured:
- Acknowledgment of receipt of the report to the reporting person within no more than seven days of receipt;
- Designation of an impartial person or department competent for following up on the report;
- A reasonable timeframe for providing feedback to the reporting person about the follow-up of the report, not exceeding three months from acknowledgment of receipt; and
Clear and easily accessible information regarding the conditions and procedures for external reporting.
In addition to the establishment of internal reporting channels, Member States are required to establish independent and autonomous external reporting channels to receive and handle information on violations (taking into account data protection). They have to appoint the authorities competent to receive, give feedback on and follow up on the reports.
Finally, Member States must ensure that a person who makes a public disclosure – by communicating information on violations in the public sphere – is protected if he or she is in one of the following situations:
- He or she first reported internally and externally but no appropriate action was taken in response to the report within the allocated timeframe; or
- He or she had reasonable grounds to believe that the breach may constitute an imminent or manifest danger for the public interest (where there is an emergency situation or a risk of irreversible damage) or if there is a risk of retaliation or if there is a low prospect of the breach being effectively addressed (e.g. if the evidence may be destroyed or if an authority may be involved in the breach).
Protection measures offered to whistleblowers
The Directive provides for several measures to protect whistleblowers, the most important of which are set out below:
- Right of confidentiality: By derogation, the identity of the reporting person may be disclosed only where this is a necessary and proportionate obligation imposed by Union or national law in the context of investigations by national authorities or judicial proceedings, among other things, when the aim is to safeguard the rights of defence of the person concerned.
- Prohibition of retaliation: Member States must take the necessary measures to prohibit any form of retaliation, including threats and attempts of retaliation, and in particular when they take the form of dismissal, demotion or withholding of promotion, transfer of duties, change of location of place of work, reduction in wages, change in working hours, intimidation, harassment, disadvantage or unfair treatment, early termination or cancellation of a contract for goods or services.
- Measures of support: Member States must ensure that whistleblowers have access to support measures, including comprehensive and independent information and advice on the procedures available, their rights and protection, the fact that they have access to effective assistance from the competent authorities before any relevant authority associated with their protection against retaliation, and finally that they have access to legal aid. Member states may provide for financial assistance and support measures, in particular psychological support.
- Measures for protection against retaliation: Reporting persons will not incur liability in respect of the acquisition of or access to the relevant information, provided that such acquisition or access did not constitute a self-standing criminal offence. In that event, the criminal liability remains governed by applicable national law.
- Penalties: Member States must provide for effective, proportionate and dissuasive penalties applicable to natural or legal persons that hinder or attempt to hinder reporting, take retaliatory measures, bring vexatious proceedings or breach the duty of maintaining confidentiality.
Transposition into national law
The Directive was published in the Official Journal of the European Union on 26 November 2019 and will enter into force on the 20th day following its publication, i.e. on 16 December 2019. Member States have two years to bring into force the laws, regulations and administrative provisions necessary to comply with the Directive. Member States must provide the Commission with all relevant information regarding the implementation and application of the Directive. On the basis of the information provided, the Commission must, by two years after transposition, submit a report to the European Parliament and the Council on the implementation and application of the Directive.
Valérie Lefèvre
valerie.lefevre@eubelius.com
