Whistleblowing in the EU: more questions arise from the 2019 Directive as we reach the implementation deadline

As we approach the December deadline by which EU member states are due to implement the 2019 Directive on the protection of whistleblowers, global businesses are left struggling with significant operational challenges and sometimes conflicting views on what exactly the Directive means to their existing whistleblowing system. 

Most EU member states are late with their implementation and only a few implementing laws have been published so far. In the meantime, the Commission has opted for a strict interpretation of the Directive when it comes to internal reporting, which has caused concern about the impact on existing, centralised whistleblowing reporting routes.

We previously reported on a number of issues arising from the Directive (see our July and March posts). This new post focuses on internal reporting within corporate groups, and then examines a few other related issues, including the two-year deferral period for smaller entities to implement an internal reporting system.

Impact of the Directive on corporate groups’ whistleblowing systems 

Article 8, paragraph 1 of the Directive provides for the following: 

'Member States shall ensure that legal entities in the private and public sector establish channels and procedures for internal reporting and for follow-up, following consultation and in agreement with the social partners where provided for by national law'. 

According to paragraph 3 of the same article, the requirement to establish an internal reporting system shall apply to 'legal entities in the private sector with 50 or more workers'. As per paragraph 4, this 50-employee threshold is disapplied in respect of most financial services firms.

As reported in our July blog post, the reference to 'legal entities' in the Directive (and in some of the proposed implementing legislation) leads to questions around how international corporate groups should read the terminology used. For example, is a centralised approach at group level still allowed for reporting or is an entity-by-entity approach required (with potentially distinct reporting channels for each legal entity exceeding the above threshold)?

The Commission’s view, which was confirmed on various occasions before the summer break (including during the June EU Expert Group meeting) is that internal reporting channels cannot be established only in a centralised manner at group level. However, a centralised whistleblowing system within a group can co-exist with legal-entity-level channels as long as the choice is left to the whistleblower whether to use the local or central channel. The rationale for such an interpretation is proximity: to facilitate reporting, channels must be easily accessible to the whistleblower, hence the requirement to make such channels available at the legal entity level, in addition to any corporate group level channel.

BusinessEurope and EuropeIssuers, two of the largest pan-European business associations, have issued a joint statement in which they share the concerns of many employers that are currently operating a centralised whistleblowing system through one of their legal entities (generally the entity running group-wide functions such as compliance, HR and legal). The statement lists the benefits of a centralised approach, including consistency, efficiency, synergies, confidentiality and professionalism in dealing with reports. It also refers to compliance expectations in countries such as the US, where a centralised approached is favoured over a decentralised one.

To our knowledge, the Commission’s position remains unchanged at this stage. But businesses may find some comfort in the fact the Commission has made it clear that group-level reporting channels may remain in place and may continue to be actively promoted by employers. The only novelty the Directive introduces is the requirement to have legal-entity-level channels, in addition to any group arrangements. The choice is with the whistleblower to either report locally at the legal-entity level or globally using the group-level system. One thing businesses may want to focus on from now on is internal comms and promotion of the group level arrangements. 

In addition, the Commission continues to highlight that there are a number of flexibilities provided for by the Directive, including the possibility for legal entities with between 50 and 249 workers to pool resources (which appears to be viewed by the Commission as distinct from reliance upon a centralised arrangement) or the possibility of outsourcing the operation of the reporting channel to third parties. Please click here for more information on these flexibilities.

Sweden was one of the first countries to discuss this issue and the authorities said they were bound by the Directive’s use of ‘legal entity’ as the reference. In Denmark, the final version of its implementing law allows for group arrangements to continue (without the need for additional channels at legal-entity level), with the caveat that this will only be possible if the Danish interpretation is compatible with the EU's and other member states’ position. 

In other countries, it seems that the issue went unnoticed as the draft implementing laws that are currently available simply use the ‘legal entity’ reference without discussion.

What happens to a corporate group’s branches? 

As we know, some corporate groups, especially in the financial services industry, operate through branches in a number of jurisdictions. As things stand – and unless a specific local law provides otherwise – EU-based branches of a non-EU group appear to be out of scope of the Directive. The French branch of a US bank would not be caught, for example. The same could be true of a French branch of a German legal entity, looking at precedents (German case law relating to employee thresholds seems to indicate that only Germany-based employees would be in scope). Equally, a German legal entity with 300 employees could be out of scope if less than 50 of these are based in Germany and the rest in foreign branches across the EU. 

This outcome seems unlikely to be what the authors of the Directive intended, nor is it a good thing for the protection of whistleblowers and the efficiency and proximity the Commission is aiming to achieve. Of course, many employers will already have a global reporting channel in place capturing all workers, whether they sit in a branch or a subsidiary, and which would be capable in any event of capturing employees who otherwise fall out of scope of the Directive. And local implementing laws may address the issue and ensure that all workers are in scope (especially if the implementation happens by updating existing whistleblowing legislation that already has a broader scope). Nevertheless, it seems branches were left out of the Directive and this omission may have unintended consequences.

The VAT question 

There is another question linked to the Directive’s scope. Recital 48 states that:

'For legal entities in the private sector, the obligation to establish internal reporting channels should be commensurate with their size and the level of risk their activities pose to the public interest. All enterprises having 50 or more workers should be subject to the obligation to establish internal reporting channels, irrespective of the nature of their activities, based on their obligation to collect VAT. Following an appropriate risk assessment, Member States could also require other enterprises to establish internal reporting channels in specific cases, for instance due to the significant risks that may result from their activities'.

In a number of EU countries, most of the financial services industry is exempt from the obligation to collect VAT, as are healthcare and culture businesses. A question is whether recital 48 could be used to exempt some of these industries? We await with interest the approach that member states choose to take on this point.

Two more years

Corporate groups will pay attention to the way member states are making use of the 'deferral' option provided for by the final provisions of the Directive: legal entities in the private sector with 50 to 249 workers may benefit from an additional period of two years to comply with the requirement to establish internal reporting channels.

Assuming the Commission’s views on the group vs legal entity issue remain the same and are endorsed by member states, the possibility of deferral will come as good news to corporate groups, allowing them to phase the establishing of legal-entity-level reporting channels, focusing on the large entities first (those with 250-plus workers) and looking at small and medium size ones from 2023. 

As with many of the Directive’s provisions, the following question arises: what happens to industries for which the 50 workers threshold is disapplied, such as financial services? Will the two-year deferral period apply to all entities between 0 and 249 workers as long as they are in scope (eg financial institutions)? Or will member states conclude that because the industries for which the 50 workers threshold is disapplied have a high-risk profile, they should comply with the internal reporting channel requirements from day one?

Next steps 

What can you do as a global business? Many international corporate groups are already involved in discussions with their relevant local business associations and local governments. This should continue and the message to local authorities should be to speed up the implementation process and take a detailed look at all provisions (and consider their practical consequences) rather than simply implementing the Directive word for word. 

The other important point is, as stated above, around internal communication for organisations wishing to continue to promote and encourage use of their centralised reporting channels.

Please reach out to any of us at Freshfields should you wish to discuss the above.