Freshfields whistleblowing survey 2023: Spotlight on the EU

This article was originally published on 29 November 2023 on 'Thomson Reuters Regulatory Intelligence' by Thomson Reuters. © Thomson Reuters.

We recently published the results of the Freshfields whistleblowing survey 2023, which gathered the views of over 2,500 individuals across five jurisdictions (the US, the UK, Hong Kong, France and Germany) and a range of industries. The survey gauges attitudes towards whistleblowing and how these attitudes may have changed since our last survey in 2020. 

In recent blog posts, amongst other topics, we have examined the impact of remote and hybrid working on speak-up culture (see here), as well as US and Hong Kong trends emerging from the survey results (see here and here). This blog post looks at whether the 2019 EU Whistleblower Protection Directive (the directive) and its local implementing laws have had any impact on the responses to our survey in France and Germany overall and in the Financial Services (FS) sector. 

The directive, which sets out minimum standards for the protection of whistleblowers, requires companies that meet certain employee thresholds to, amongst other things: 

• establish internal reporting channels for speak-up reports; 
• implement internal whistleblowing procedures;
• comply with a timeline for following up on speak-up reports; and 
• handle reports with confidentiality. 

Limited impact of the directive so far

The 2023 Freshfields survey suggests that the directive has had a limited impact on whistleblowing so far, despite it being the first regional framework regulating whistleblowing and whistleblower protection, and despite the EU Commission’s initial ambition to set a new global standard through the implementation of the directive. We can see this limited impact in the survey data, for example:

• the low involvement in whistleblowing of French (27 per cent) and German (39 per cent) respondents compared to the overall respondent population (43 per cent), which is especially evident in the FS sector where French FS (29 per cent) and German FS (27 per cent) respondents were much less likely to be engaged in whistleblowing compared to the FS sector overall (45 per cent); and
• respondents in France and Germany reporting that they feel that managers in their organisations are not trained to deal with whistleblowing incidents (36 per cent and 53 per cent of respondents, respectively, feel that managers in their organisation are adequately trained, compared to 61 per cent of the overall population). Again, this trend is mirrored in the FS sector, with French FS (30 per cent) and German FS (51 per cent) respondents being more likely to feel that their managers were not properly trained compared to the overall FS sector population (70 percent), though  this may be due to the comparatively higher standards in the industry. 

The fact that most EU member states – including France and Germany – were late in implementing the directive, missing the initial December 2021 deadline by months, if not years, may have played a role in limiting the impact of the directive on respondents’ views. 

It will be interesting to see the survey responses to the same questions in three years’ time, once the directive is properly embedded into organisations’ infrastructures across the EU. It might also be that the next iteration of the survey shows the directive having an impact in non-EU regions, given that it may be used in other jurisdictions as a blueprint, or as the standard to which global businesses may ‘level up’ their whistleblowing frameworks.

Notwithstanding the limited impact so far, the survey results are an interesting read when considering a few key features of the directive; namely, the focus on local internal reporting and confidentiality. 

Slight preference for reporting at local entity level over group level 

The Freshfields survey indicates a slight preference from respondents overall for reporting wrongdoing at the local level instead of doing so through group level reporting arrangements. This is in line with the EU Commission’s approach to the issue. 

The EU Commission has confirmed on various occasions that internal reporting channels as required by the directive cannot be established only at corporate group level. Internal reporting channels must also (or alternatively) be established at local legal entity level. A centralised whistleblowing system within a group can co-exist with legal entity level channels as long as the choice is left to the whistleblower whether to use the local or central channel (see more here).

The overall population of our survey respondents showed a preference for local reporting (39 per cent of respondents) as opposed to reporting at global level (27 per cent of respondents). However, it should be emphasised that the margin by which local reporting was preferred varied significantly by country. The difference was more evident in non-EU countries and less stark in France (where 28 per cent of respondents preferred local reporting compared with 24 per cent who preferred global reporting) and in Germany (where 34 per cent of respondents preferred local reporting compared with 30 per cent who preferred global reporting). 

The preference for local reporting was more distinct in the FS sector (48 per cent of FS respondents overall preferred local reporting compared to 26 per cent of FS respondents preferring to report at the group level) than the overall survey population. Again, however, the difference in preference was more muted for French FS (28 per cent) and German FS (34 per cent) respondents compared to FS survey populations in other jurisdictions, such as the US (57 per cent). 

The survey results suggest that respondents, including those in the FS sector, generally favour proximity – aligned with the EU Commission’s argument for local reporting. For a speak-up culture to be successful, companies need to make it easy for employees and other stakeholders to report breaches and other wrongdoing. Local reporting channels seem to meet this objective because of their proximity to the whistleblower. This may not work in all cases, especially when the wrongdoing involves local management. In such circumstances, the whistleblower might be better served by utilising group level reporting channels. 

A decreasing tendency towards internal reporting?

While our survey suggests that respondents have some preference towards internal reporting, the results also seem to suggest that employees are less keen to report internally than they were in 2020. Only 40 per cent of respondents overall would now report wrongdoing to their line manager, compared with 46 per cent in 2020. This trend is echoed in the FS sector where 36 per cent of FS respondents in 2023 would report wrongdoing to their direct boss, compared with 43 per cent of FS respondents in 2020 who reported the same. The main reasons for this, as identified in the survey, may include: 

• more businesses using a third-party provider to receive/handle reports; 
• whistleblowers continuing to report wrongdoing externally; and 
• an increasing trend of reporting on social media. 

This picture is different from what the directive is trying to achieve in the EU, which is encouraging internal reporting (read more on internal channel requirements in Austria, Belgium, Germany, Italy, Spain), albeit that it also allows whistleblowers to report externally to public authorities and – if certain conditions are met – even to the media.

In France and Germany there is a narrower division between respondents who prefer internal reporting and respondents who would report whistleblowing through other channels. In France, there was a decrease in the number of respondents who would report wrongdoing to their direct boss in the first instance (54 per cent, down from 57 per cent in 2020). This differs from the result in Germany, which has remained the same as in 2020 (40 per cent of respondents would report to their direct boss). In the FS sector, there was a slight decrease in the number of French FS (49 per cent, down from 50 per cent in 2020) and German FS (31 per cent, down from 32 per cent) respondents who would report wrongdoing to their direct boss. 

The German (and Austrian and French) law implementing the directive has followed the approach of the directive, by providing that a whistleblower may generally choose between the internal and external reporting channel. However, internal reporting should be encouraged by employers provided that the violation can be dealt with effectively and the whistleblower does not fear reprisals.  Unlike in the past, whistleblowers in Germany can now turn to designated external reporting bodies before exhausting internal reporting channels. It remains to be seen whether in our next survey whistleblowers based in Germany will continue to prefer internal reporting.

In any case, in Germany and other member states that have taken a similar approach, companies should encourage internal reporting by making it more accessible and attractive to their employees, i.e. by promoting their whistleblowing policy to ensure that all staff members, including newcomers, are aware of it. Our survey indicates a significant jump in the number of respondents overall who felt that a lack of awareness about whistleblowing procedures would prevent a whistleblower from raising concerns internally (36 per cent in 2023, compared with 28 per cent in 2020), a jump that is similar in the FS sector (39 per cent in 2023, compared to 27 per cent in 2020). In the EU this may be associated with the changes imposed by the directive. The directive and its local implementing laws may differ from previous whistleblowing regimes in member states and may therefore require companies to review their whistleblowing policies and awareness-raising procedures. Demystifying the process to blow the whistle for employees can be helpful and important in building confidence. This means not just explaining how to raise concerns, but also what happens next. Organising regular training and setting the tone from the top can help to strengthen the speak-up culture of a company. 

Confidentiality and anonymity

The directive requires confidentiality to be guaranteed for whistleblowers but is silent in respect of anonymity. In some jurisdictions, confidentiality may be compromised by the GDPR information rights of data subjects. For instance, a German regional labour court held in 2018 that an employee may request information from an employer regarding their personal data even if this results in the disclosure of a whistleblower’s identity. As a result, companies should also consider data protection and trade secret laws when drafting their internal speak-up policies.

As far as anonymity is concerned, the directive leaves it up to member states to choose their approach and some of them have addressed this issue. For instance, the Belgian implementing law stipulates that anyone who reports or discloses issues anonymously but is later identified and retaliated against is eligible for the same protection as provided for by the directive. Furthermore, the German implementing law also provides that internal reporting bodies should process anonymous reports. 

When it comes to our survey, 63 per cent of the overall population, 61 per cent of respondents in Germany and 55 per cent of respondents in France believe that it is important for their organisation to know the identity of a whistleblower. The overall figure has increased from our survey in 2020 (up from 50 per cent), and the German figure has slightly dropped from our survey in 2020 (down from 69 per cent), whereas the result in France has remained the same as three years ago. 

Respondents in the FS sector were comparatively more likely hold this view, with 73 per cent of the overall FS respondent population, 61 per cent of FS respondents in Germany and 62 percent of FS respondents in France reporting that they believe it is important to know the identity of whistleblowers. It is key to note, however, that there was significant decrease in the number of German FS respondents who reported this (down from 76 per cent in 2020).

These results seem to be misaligned with the confidentiality requirement of the directive and the anonymity protections in the implementing laws mentioned above. However, the fact that some of these figures have dropped in comparison to 2020 is an indicator that this approach might change in the next three years, considering the expected impact of the directive and its implementing laws.

To access our full whistleblowing survey report, please click here. The Freshfields team would be very happy to discuss any of the themes in the report in more detail.