Whistleblowing in Europe has been governed by country-specific regulations, some of which differed widely in terms of content. A number of Member States did not even have a dedicated generally applicable protection system in place. Some countries (e.g., Germany), stipulated sector-and topic-specific regulations (e.g., for the financial sector, anti-money laundering or general trade secret provisions), which, at least, indirectly provided for regulations for whistleblowers and the handling of whistleblower reports. Data protection authorities, in part, even took the standpoint that anonymous reporting was not permissible.
Corresponding to these divergent legal systems, there was also no uniform case law among the European countries. In general, there was (and to some extent still is) no level-playing field in Europe.
Against this background the European Union aimed to ensure a harmonized and improved protection of whistleblowers across Europe by the EU Whistleblower Directive 2019/1937. To ensure better enforcement of EU law, the EU Directive sets out comprehensive requirements for the establishment of reporting channels and a (minimum) protection for whistleblowers; however, national legislators are free to provide protection for whistleblowers that goes beyond the Directive, (e.g., with regard to the scope of application).
It was intended that the Member States would implement the Directive in December 2021. However, many Member States failed to do so on time. The European Commission has now initiated legal proceedings against eight countries (including Italy, Spain, Poland and Germany) for failing to implement the Whistleblower Directive. It is expected that some of these countries will speed up their national law making processes and will pass national regulations in the next few months.
Key aspects of the Directive
- Companies with more than 49 employees are obligated to set up reporting systems or adapt an existing reporting system to meet the new requirements. Companies with up to 249 employees are to be granted a grace period until December 2023.
- Reporting channels must be open to both employees and temporary staff of respective companies and may also be made available to third parties (e.g., suppliers, customers).
- Employees must be informed clearly and transparently about the internal reporting offices. The internal reporting office should also provide a conducive environment in order to create incentives for its use, meaning that inter alia language barriers must be avoided.
- The whistleblowing system must offer the possibility of providing written or oral information on possible non-compliant behavior. According to the Directive, protection refers only to cases in which violations of Union Law, exhaustively listed in the Directive, are reported by the whistleblower. However, a number of national lawmakers have extended this protection. Reports on violations of national law (e.g., anti-bribery laws) are often also covered.
- The Whistleblowing Directive does not impose an obligation to allow anonymous reporting. However, many national laws do so.
- Internal reporting offices must be designed and operated securely enough to ensure the confidentiality of the identity of the whistleblower and persons mentioned.
- Union Member States must establish effective, proportionate and dissuasive sanctions for natural or legal persons who, for example, hinder the reporting of violations or which respond by retaliating against whistleblowers. In some countries compensation for non-material damages is possible.
- The Member States are obligated to prohibit all reprisals, including measures under labor law such as salary cuts, warnings or dismissals, but also bullying by colleagues as a result of the report.
- In labor dispute cases, the Directive provides for a reversal of the burden of proof: In case of doubt, the employer must prove that labor law measures or other disadvantages that a whistleblower experiences are not related to the whistleblowing.
Group-wide whistleblower systems (probably) possible
According to the draft bills of some countries (e.g., Germany), reporting systems and investigations can be centralized group-wide. This is in line with current practice, according to which companies (especially global organizations) have established centralized, group-wide whistleblower systems so that all incoming reports are processed at the group-level. It should be noted, however, that the EU Commission takes the view that group-wide whistleblower systems for companies with 250 and more employees in general do not meet the requirements of the Directive. The EU Member States have not yet adopted a clear, unified position in this respect.
However, the EU Commission has also expressed that it would be possible, for example, to advertise a centralized whistleblowing system in all group companies and encourage employees to use it. A subsidiary could also pass on information about systematic or group-wide misconduct within the group if the whistleblower consented to this.
Thus, there are ways to maintain a centralized system and only expand it accordingly. As set out above, companies are free to refer to the group's central whistleblowing system on the websites of the parent company and the respective group company. Reports can be directed to the parent or local subsidiary according to the whistleblower's preference with little effort. Should a whistleblower wish to have contact with a local contact person, this option should also be ensured. Provided that the national requirements are met, standardized processing of the reports is also possible.
To what extent is action required now?
The requirements of the EU Commission present companies with a solvable task. Companies with well-developed whistleblowing systems can retain their group-wide reporting channels and processing procedures. It is only necessary to modify certain processes and to additionally establish customized local extensions, taking into account country-specific requirements (including GDPR and labor law regulations, e.g., information and/or participation rights of works councils).
Implementing a reporting system or modifying an existing system is just the beginning. The system then needs to be managed in a proper manner, which can mean a great deal of organizational and personnel input for the companies concerned.
White & Case means the international legal practice comprising White & Case LLP, a New York State registered limited liability partnership, White & Case LLP, a limited liability partnership incorporated under English law and all other affiliated partnerships, companies and entities.
This article is prepared for the general information of interested persons. It is not, and does not attempt to be, comprehensive in nature. Due to the general nature of its content, it should not be regarded as legal advice.
© 2023 White & Case LLP
