Whistleblowing in the EU – less than six months to go before the directive’s implementation deadline!

2021 is an important year for speak up culture in Europe as member states are due to implement the 2019 EU directive on whistleblower protection ('the Directive') by 17 December.

With less than six months to go, global employers operating in the region would like more visibility on what to expect – especially in countries which to date have had no comprehensive whistleblowing regime - and on the impact which local implementing laws will have on existing policies and systems.

Unfortunately, implementation has been rather slow so far with many countries still in the middle of the process and some yet to publish a draft implementing law.

In a March 2021 blog post, we listed the key issues for global employers to keep in mind ahead of the deadline, which included scope, timing, thresholds, reporting, confidentiality and more. We had the opportunity to discuss some of these issues in more detail during a recent webinar. Below is a summary of the discussion and our views in relation to three specific issues.

What happens if a country misses the implementation deadline? 

As noted above, the implementation process is rather slow. Some countries – including Germany – are likely to miss the December deadline. What will happen then? Will the Directive still have any effect across the EU, irrespective of the fact that it has not been implemented? If so, what is the best approach for global businesses?

Unlike the GDPR, which is a regulation and has full direct effect, the Directive requires transposition into member states’ national laws to produce effect. Also, as such, a directive would not have an immediate effect between companies (unless they are operated by the respective member state) and employees. 

However, a directive may still have limited direct effect (the so-called vertical effect) when its provisions are unconditional, (sufficiently clear and precise, and when the member state has not transposed it by the deadline. Local judges interpreting national laws could potentially have to ensure that such national rules are in accordance with the Directive once the implementation deadline has expired. This is an incentive to global businesses not to wait until the full transposition in each member state before complying with the key provisions of the directive, eg reporting, feedback or protection against retaliation.

Separately, the Commission will follow up on the implementation across the 27 member states and may open an infringement procedure against countries for the lack of or improper implementation.

Legal entity vs. group 

The Directive – and some of the proposed national implementing legislation – refers to 'legal entities' and not 'corporate group'. This leads to questions around how global employers should read the terminology used – for example whether a centralised approach at group level is still allowed for reporting or if an entity-by-entity approach will be required (with potentially distinct reporting channels for each entity of more than 50 workers).

The discussion started in Sweden, which was one of the first countries to consult on the implementation of the Directive and to publish a draft law. Sweden’s reading of the Directive is that each legal entity with 50 workers or more will have to operate an internal reporting channel, potentially forcing corporate groups to restructure existing arrangements.

Other countries like Estonia followed suit, having the same understanding, but some others like Austria, Belgium, France and Germany have not discussed the issue so far.

The Commission has in the meantime clarified that the rule set out in the Directive requires each legal entity with 50 or more workers to have its own reporting channels. This applies also to legal entities which belong to a broader corporate group.

Article 8(3) of the Directive requires each legal entity with 50 or more workers to set up channels and procedures for internal reporting and no exemption is provided for distinct legal entities belonging to the same corporate group. This, says the Commission, means that reporting channels cannot be established only in a centralised manner at group level. However, a centralised whistleblowing system within a group can co-exist with legal entity level channels as long as the choice is left to the whistleblower whether to use the local or central channels.

The Commission’s view is that the Directive offers a number of flexibilities (PDF).

Sanctions 

The Directive doesn’t provide for sanctions, contrary to EU regulations (eg the GDPR). Rather, it requires member states to provide for effective, proportionate and dissuasive penalties, applicable to natural or legal persons that: hinder or attempt to hinder reporting; retaliate against whistleblowers; bring vexatious proceedings against whistleblowers or breach the duty of confidentiality towards whistleblowers.

In addition, member states must provide for effective, proportionate and dissuasive penalties applicable in respect of reporting persons where it is established that they knowingly reported or publicly disclosed false information. Member states shall also provide for measures for compensating damage resulting from such reporting or public disclosures in accordance with national law.

It is thus the member states ’ responsibility to provide for sanctions.

Those member states which already offer protection to whistleblowers may have sanctions in place (direct or indirect, eg through anti-discrimination/termination rules), which employers will need to take into consideration as the Directive cannot be used to justify a reduction in the level of existing protections (and the attached sanctions). Given that some member states are likely to miss the implementation deadline, existing national provisions are even more relevant.

Please contact us should you wish to discuss the Directive’s implementation, and how to update your existing whistleblowing policies and processes in anticipation of the December deadline.