1 Purpose and objective of the Directive

On 7 October 2019, the so-called Whistleblower Directive (Directive on the Protection of Persons Reporting on Breaches of Union Law, “Directive”) was adopted by the European Union.  Full implementation by Member States is required by 15 May 2021. The Directive assigns minimum requirements for this purpose, so that Member States may introduce or retain provisions more favorable to the rights of whistleblowers (Article 19).

The aim of the Directive is to protect “reporting persons” and thereby create incentives to disclose insider knowledge regarding malfeasance and misconduct. The term “reporting person” means a natural or legal person who reports or discloses information on breaches acquired in the context of his or her work-related activities (Article 3(9) of the Directive). The disclosure of such insider information helps prevent damage and detect threats or harm to the public interest that may otherwise remain hidden. Whistleblowers are, however, often discouraged from reporting their concerns for fear of retaliation. The effective protection, facilitation and encouragement of whistleblowers is thus considered necessary to enhance the enforcement of European Union law.

In addition to employees, the whistleblower protection covers trainees, board members of a company and employees of suppliers and contractors among others (Article 2 of the Directive).

The Directive applies to legal violations in certain policy areas, where breaches of EU law can cause serious harm to the public interest, such as in public procurement, cases of money laundering, product, food and traffic safety, nuclear safety, public health, consumer protection and data protection (Article 1 Directive).

2 Measures to protect whistleblowers

The directive protects whistleblowers under two conditions:

• First, whistleblowers must act in good faith, meaning they have reasonable grounds to assume their sensitive information to be true (Article 13(1) of the Directive).
• Secondly, before reporting to the public, whistleblowers must make use of internal reporting channels. Should these channels fail, they can report to the competent authorities (to be appointed by the Member States) or, as a last resort, to the public or the media (Article 13(2) of the Directive).

Companies are obligated to set up the internal reporting channels of this first stage (Article 4 f of the Directive); the Member States are responsible for the reporting channels of the second stage (regarding authorities) (Article 6 ff of the Directive).

For whistleblowers who act in good faith and adhere to this three-stage reporting procedure, the Directive prohibits any form of retaliatory actions, such as suspension, dismissal, salary reduction, intimidation, discrimination, etc. (Article 3(12) and Article 14).

Member States are required to take certain measures to ensure this protection, such as (Article 15): that they shall provide comprehensive and independent information and advice on procedures and remedies available on protection against retaliation. Reporting persons shall have access to effective assistance from competent authorities. For judicial proceedings relating to a detriment suffered by the whistleblower, Member States must provide a reversal of the burden of proof. Accordingly, once the reporting person demonstrates prima facie that he/she made a report or disclosure in line with this Directive and suffered a detriment, the burden of proof should shift to the person who took the detrimental action (usually the employer), who should then demonstrate that their the action taken was not linked in any way to the reporting or the disclosure. Member States must provide adequate remedies against reprisals, such as injunctions. Whistleblowers who infringe legal or contractual disclosure restrictions are also exempt from liability.

3 Need for action for companies

What is the action required of companies as a result of the Directive?

There is an immediate need for action in the establishment of internal reporting channels (Article 4 of the Directive). According to the Directive, this applies to all companies,

• that employ more than 50 people or
• with annual turnover in excess of EUR 10 million.

Small and micro enterprises, which do not meet these thresholds, are only covered in the financial services sector (Article 4(3) of the Directive), in which whistleblower protection already exists. Member States have the right to require any other companies to set up reporting channels (Article 4(4) of the Directive).

Reporting channels to be set up internally must meet the following requirements (Article 5 of the Directive):

• A person / department responsible for investigating information must be assigned.
• The identity of the whistleblower must be kept confidential.
• Non-authorized staff must not have access to the reporting channels.
• Careful investigation of information must be ensured.
• Clear and easily accessible information on the reporting system and the whistleblower protection must be made available.
• Reports should be made possible in written and oral form.
• The whistleblower must be informed regarding investigations and follow-up measures within a maximum of three months.

4 Legal consequences and sanctions in the event of infringements

If a company fails to establish adequate internal reporting channels, whistleblowers must receive full protection against retaliation, even if they address authorities and/or the public directly without consulting internal reporting channels.

In addition, a company can suffer damage if a whistleblower, due to a lack of functioning internal reporting channels, goes public immediately. Management could be held individually liable for this damage.

Furthermore, the Directive (Article 17 of the Directive) requires the Member States to lay down appropriate and dissuasive penalties for all legal and natural persons who

• hinder or attempt to hinder reporting,
• take retaliatory measures against whistleblowers,
• bring vexatious proceedings against whistleblowers, or
• breach the duty of maintaining the confidentiality of the identity of reporting persons.

For further information, please contact Bettina Knoetzl or Judith Schacherreiter.