Article European Union: New Directive on Whistleblower Protection Enters into Force

(Jan. 16, 2020) On December 16, 2019, Directive (EU) 2019/1937 of the European Parliament and of the Council of 23 October 2019 on the Protection of Persons Who Report Breaches of Union Law (Whistleblower Directive) entered into force.

A European Union (EU) directive is binding only as to the result it sets out to achieve; the means are up to the member states. Member states must transpose directives into their national law. (Consolidated Version of the Treaty on the Functioning of the European Union (TFEU) art. 288, para. 3.) The deadline to transpose the Whistleblower Directive is December 17, 2021. (Whistleblower Directive art. 26, para. 1.)


Recent scandals, such as LuxLeaks, the Panama and Paradise Papers, and Cambridge Analytica, that uncovered serious breaches of EU law and their harm to the public interest, were exposed to the public by whistleblowers. In a 2016 communication responding to the Panama Papers scandal, the European Commission (Commission) outlined the importance of improving whistleblower protection in order to increase the detection of tax evasion schemes. In 2017, the Commission acknowledged that whistleblower reports are an important tool for the enforcement of EU law. Another Commission report in 2017 estimated the cost of the lack of EU-wide whistleblower protection to be in the range of €5.8 to €9.6 billion each year (about US$6.4 to $10.7 billion) for the EU, in the area of public procurement alone. The recital of the Whistleblower Directive points out that, until now, the protection granted across member states was very fragmented (recital 4), and the EU-level protection was granted to whistleblowers only in certain areas (recital 7). A 2017 Special Eurobarometer on Corruption provided that this fragmentation and the fear of retaliation were some of the main reasons why very few people reported breaches.

Content of the Directive

Material Scope of the Directive

Article 2 of the Whistleblower Directive lists the areas of reporting that are protected under the Directive. Breaches related to national security and defense matters remain outside the scope of the Directive. (Art. 3.) Member states remain free to extend the minimum standard of protection under the Whistleblower Directive to additional areas. (Art. 2, para. 2, recital 24.) The Whistleblower Directive is not applicable to EU institutions. (Recital 23). For EU institutions, the rules on whistleblowing are regulated in the Staff Regulations and 2012 Guidelines. Administrative investigations are conducted by the European Anti-Fraud Office (OLAF), whereas criminal investigations are conducted by the specialized European Public Prosecutor’s Office (EPPO). If another sector-specific EU act contains specific rules on whistleblower protection, those rules take precedence. (Art. 3, para.1.) Those acts are listed in part II of the Annex.

 Conditions to Receive Protection

 The definition of a whistleblower under article 4 is very broad. For example, besides “workers,” the definition includes “self-employed people, shareholders, trainees and volunteers.” Article 6 stipulates that to receive protection, the reporting person had to have reasonable grounds to believe the information available to him or her at the time was true, and had to report the information through the available reporting channels according to the rules and exceptions established by the Whistleblower Directive.

 Reporting Channels

 The Whistleblower Directive organizes the reporting channels hierarchically, within both private companies and public institutions, and sets the relevant reporting procedures:

  1. Internal reporting channels (chapter 2): The whistleblower is encouraged first to report through internal reporting channels. (Recital 47.) All private companies with at least 50 employees or with an annual turnover or total assets of more than €10 million (about US$11.1 million) are required to set up secure and confidential internal reporting channels. (Art. 8.) A receipt of the report should be provided within seven days and a response within three months. (Art. 9.) The reporting mechanism can be operated internally by a designated person or department or may be outsourced. (Art. 8.) The internal channel can be omitted by the whistleblower if he or she has reasonable grounds to believe that the inner channels do not function properly. (Recital 62 and art. 7.)
  2. External reporting channels (chapter 3): The whistleblowers can report through external reporting channels if they have not received a proper response from the internal reporting channels in the time frame set under article 9, or they can report directly through external reporting channels. (Art. 10.) Member states must designate competent authorities and establish independent and autonomous external reporting channels that would be obligated to provide follow-up to the whistleblowers within three months. (Arts. 11, 13.)
  3. Public disclosure: If the whistleblower has not received any response from the internal and/or external reporting channels within the set time frame and has reasonable grounds to believe the breach constitutes an imminent danger to the public, the whistleblower can disclose the information to the public and still qualify for protections under the Whistleblower Directive. (Art. 15, paras. (a), (b).)

 Forms of Protection Against Retaliation

 The Whistleblower Directive grants the reporting person certain protections against retaliation, including protection against dismissal and demotion by the employer. (Art. 19.) Whistleblowers do not have any liability for acquiring or accessing the reported information unless acquiring it was in itself a criminal offense. (Art. 21, para. 3.) However, the Directive does not protect the whistleblower against acts and omissions unrelated to and unnecessary for the reporting of a breach. Those acts and omissions are subject to applicable national or EU law. (Art. 21, para. 4.) The Whistleblower Directive ensures that whistleblowers have access to free information and advice on available procedures for protection against any legal action taken against them and that they receive free legal aid, as well as financial and psychological support, during any legal proceedings. (Art. 20.)

Further Measures Recommended by the Commission

In a communication paper dated April 23, 2018, the Commission recommended that member states enact wider whistleblower protections than the minimum standards set by the Whistleblower Directive, and take further measures, such as those aimed at raising awareness among the general public about the positive role of whistleblowers.

Prepared by Zeynep Timocin Cantekin, Law Library intern, under the supervision of Jenny Gesley, Foreign Law Specialist.

About this Item


  • European Union: New Directive on Whistleblower Protection Enters into Force

Online Format

  • web page

Rights & Access

Publications of the Library of Congress are works of the United States Government as defined in the United States Code 17 U.S.C. §105 and therefore are not subject to copyright and are free to use and reuse.  The Library of Congress has no objection to the international use and reuse of Library U.S. Government works on These works are also available for worldwide use and reuse under CC0 1.0 Universal. 

More about Copyright and other Restrictions.

For guidance about compiling full citations consult Citing Primary Sources.

Credit Line: Law Library of Congress

Cite This Item

Citations are generated automatically from bibliographic data as a convenience, and may not be complete or accurate.

Chicago citation style:

European Union: New Directive on Whistleblower Protection Enters into Force. 2020. Web Page.

APA citation style:

(2020) European Union: New Directive on Whistleblower Protection Enters into Force. [Web Page] Retrieved from the Library of Congress,

MLA citation style:

European Union: New Directive on Whistleblower Protection Enters into Force. 2020. Web Page. Retrieved from the Library of Congress, <>.