On 7
October 2019, the so-called Whistleblower Directive (Directive on the
Protection of Persons Reporting on Breaches of Union Law,
“Directive”) was adopted by the European Union. Full implementation by
Member States is required by 15 May 2021. The Directive assigns minimum
requirements for this purpose, so that Member States may introduce or retain
provisions more favorable
to the rights of whistleblowers (Article 19).
The aim of
the Directive is to protect “reporting persons” and thereby create incentives
to disclose insider knowledge regarding malfeasance and misconduct. The term “reporting
person” means a natural or legal person who reports or discloses information on
breaches acquired in the context of his or her work-related activities (Article
3(9) of the Directive). The disclosure of such insider information helps
prevent damage and detect threats or harm to the public interest that may
otherwise remain hidden. Whistleblowers are, however, often discouraged from reporting their concerns
for fear of retaliation. The effective protection, facilitation and
encouragement of whistleblowers is thus considered necessary to enhance the
enforcement of European Union law.
In addition
to employees, the whistleblower protection covers trainees, board members of a company and
employees of suppliers and contractors among others (Article 2 of the
Directive).
The
Directive applies to legal violations in certain policy areas, where breaches
of EU law can cause
serious harm to the public interest, such as in public procurement, cases of money laundering, product, food
and traffic safety, nuclear safety, public health, consumer protection and data
protection (Article 1 Directive).
The
directive protects whistleblowers under two conditions:
Companies
are obligated to set up the internal reporting channels of this first stage
(Article 4 f of the Directive); the Member States are responsible for the
reporting channels of the second stage (regarding authorities) (Article 6 ff of
the Directive).
For whistleblowers
who act in good faith and adhere to this three-stage reporting procedure, the
Directive prohibits any form of retaliatory actions, such as suspension,
dismissal, salary reduction, intimidation, discrimination, etc. (Article 3(12)
and Article 14).
Member
States are required to
take certain measures to ensure this protection, such as (Article 15): that they shall provide comprehensive
and independent information and advice on procedures and remedies available on
protection against retaliation. Reporting persons shall have access to
effective assistance from competent authorities. For judicial proceedings
relating to a detriment suffered by the whistleblower, Member States must
provide a reversal of the burden of proof. Accordingly, once the reporting
person demonstrates prima facie that he/she made a report or disclosure in line
with this Directive and suffered a detriment, the burden of proof should shift
to the person who took the detrimental action (usually the employer), who
should then demonstrate that their the action taken was not linked in any way
to the reporting or the disclosure. Member States must provide adequate remedies
against reprisals, such as injunctions. Whistleblowers who infringe legal or
contractual disclosure restrictions are also exempt from liability.
What is the
action required of
companies as a result of the Directive?
There is an
immediate need for action in the establishment of internal reporting channels
(Article 4 of the Directive). According to the Directive, this applies to all
companies,
Small and
micro enterprises, which do not meet these thresholds, are only covered in the
financial services sector (Article 4(3) of the Directive), in which
whistleblower protection already exists. Member States have the right to
require any other companies to set up reporting channels (Article 4(4) of the
Directive).
Reporting
channels to be set up internally must meet the following requirements (Article
5 of the Directive):
If a
company fails to establish adequate internal reporting channels, whistleblowers
must receive full
protection against retaliation, even if they address authorities and/or the public directly without
consulting internal reporting channels.
In
addition, a company can suffer damage if a whistleblower, due to a lack of
functioning internal reporting channels, goes public immediately. Management
could be held individually
liable for this damage.
Furthermore,
the Directive (Article 17 of the Directive) requires the Member States to lay
down appropriate and dissuasive penalties for all legal and natural persons who
For further information, please contact Bettina Knoetzl or Judith Schacherreiter.
