(Jan. 16, 2020) On December 16, 2019, Directive (EU) 2019/1937 of the European Parliament and of the Council of 23 October 2019 on the Protection of Persons Who Report Breaches of Union Law (Whistleblower Directive) entered into force.
A European Union (EU) directive is binding only as to the result it sets out to achieve; the means are up to the member states. Member states must transpose directives into their national law. (Consolidated Version of the Treaty on the Functioning of the European Union (TFEU) art. 288, para. 3.) The deadline to transpose the Whistleblower Directive is December 17, 2021. (Whistleblower Directive art. 26, para. 1.)
Recent scandals, such as LuxLeaks, the Panama and Paradise Papers, and Cambridge Analytica, that uncovered serious breaches of EU law and their harm to the public interest, were exposed to the public by whistleblowers. In a 2016 communication responding to the Panama Papers scandal, the European Commission (Commission) outlined the importance of improving whistleblower protection in order to increase the detection of tax evasion schemes. In 2017, the Commission acknowledged that whistleblower reports are an important tool for the enforcement of EU law. Another Commission report in 2017 estimated the cost of the lack of EU-wide whistleblower protection to be in the range of €5.8 to €9.6 billion each year (about US$6.4 to $10.7 billion) for the EU, in the area of public procurement alone. The recital of the Whistleblower Directive points out that, until now, the protection granted across member states was very fragmented (recital 4), and the EU-level protection was granted to whistleblowers only in certain areas (recital 7). A 2017 Special Eurobarometer on Corruption provided that this fragmentation and the fear of retaliation were some of the main reasons why very few people reported breaches.
Content of the Directive
Material Scope of the Directive
Article 2 of the Whistleblower Directive lists the areas of reporting that are protected under the Directive. Breaches related to national security and defense matters remain outside the scope of the Directive. (Art. 3.) Member states remain free to extend the minimum standard of protection under the Whistleblower Directive to additional areas. (Art. 2, para. 2, recital 24.) The Whistleblower Directive is not applicable to EU institutions. (Recital 23). For EU institutions, the rules on whistleblowing are regulated in the Staff Regulations and 2012 Guidelines. Administrative investigations are conducted by the European Anti-Fraud Office (OLAF), whereas criminal investigations are conducted by the specialized European Public Prosecutor’s Office (EPPO). If another sector-specific EU act contains specific rules on whistleblower protection, those rules take precedence. (Art. 3, para.1.) Those acts are listed in part II of the Annex.
Conditions to Receive Protection
The definition of a whistleblower under article 4 is very broad. For example, besides “workers,” the definition includes “self-employed people, shareholders, trainees and volunteers.” Article 6 stipulates that to receive protection, the reporting person had to have reasonable grounds to believe the information available to him or her at the time was true, and had to report the information through the available reporting channels according to the rules and exceptions established by the Whistleblower Directive.
The Whistleblower Directive organizes the reporting channels hierarchically, within both private companies and public institutions, and sets the relevant reporting procedures:
- Internal reporting channels (chapter 2): The whistleblower is encouraged first to report through internal reporting channels. (Recital 47.) All private companies with at least 50 employees or with an annual turnover or total assets of more than €10 million (about US$11.1 million) are required to set up secure and confidential internal reporting channels. (Art. 8.) A receipt of the report should be provided within seven days and a response within three months. (Art. 9.) The reporting mechanism can be operated internally by a designated person or department or may be outsourced. (Art. 8.) The internal channel can be omitted by the whistleblower if he or she has reasonable grounds to believe that the inner channels do not function properly. (Recital 62 and art. 7.)
- External reporting channels (chapter 3): The whistleblowers can report through external reporting channels if they have not received a proper response from the internal reporting channels in the time frame set under article 9, or they can report directly through external reporting channels. (Art. 10.) Member states must designate competent authorities and establish independent and autonomous external reporting channels that would be obligated to provide follow-up to the whistleblowers within three months. (Arts. 11, 13.)
- Public disclosure: If the whistleblower has not received any response from the internal and/or external reporting channels within the set time frame and has reasonable grounds to believe the breach constitutes an imminent danger to the public, the whistleblower can disclose the information to the public and still qualify for protections under the Whistleblower Directive. (Art. 15, paras. (a), (b).)
Forms of Protection Against Retaliation
The Whistleblower Directive grants the reporting person certain protections against retaliation, including protection against dismissal and demotion by the employer. (Art. 19.) Whistleblowers do not have any liability for acquiring or accessing the reported information unless acquiring it was in itself a criminal offense. (Art. 21, para. 3.) However, the Directive does not protect the whistleblower against acts and omissions unrelated to and unnecessary for the reporting of a breach. Those acts and omissions are subject to applicable national or EU law. (Art. 21, para. 4.) The Whistleblower Directive ensures that whistleblowers have access to free information and advice on available procedures for protection against any legal action taken against them and that they receive free legal aid, as well as financial and psychological support, during any legal proceedings. (Art. 20.)
Further Measures Recommended by the Commission
In a communication paper dated April 23, 2018, the Commission recommended that member states enact wider whistleblower protections than the minimum standards set by the Whistleblower Directive, and take further measures, such as those aimed at raising awareness among the general public about the positive role of whistleblowers.
Prepared by Zeynep Timocin Cantekin, Law Library intern, under the supervision of Jenny Gesley, Foreign Law Specialist.