Using the EU Whistleblowing Compliance Checker - A Worked Example

To show how our online tool works, we have put together an example result based on a fictional proposed law we’re calling the 2021 Whistleblower Protection Act (WPA). While the WPA would not fully cover international recommendations on whistleblower protection standards, it can nevertheless be considered as a good transposition law. Let’s see why:

The proposed law WPA scores 99% on compliance with requirements set out in the European Directive. That means we rate the WPA as an effective transposition of the Directive *.

For elements recommended by international best practice that go over and above the standards required in the Directive, the WPA scores a B at 51%. That means the WPA contains some, but not all, of the additional elements that a really good whistleblower protection law should have. From the score breakdown, we can see that the WPA’s provisions for support and legal protections score stronger than its review and evaluation elements.

 In the scoring, there are four core parts of the Directive that must be present in order to get a passing score. Without them, regardless of whether the other sections provide enough points to pass, the proposed law fails to meet the standard. These are:

1. Fundamental Protections

   • The Directive says that whistleblower protections must apply where reports concern acts that frustrate the purpose of the law, as well as illegal ones.

2. Reporting Channels

   • Whistleblowers must be able to decide to whom they make their disclosure. Mandatory internal reporting constitutes an obstruction of justice and defeats the purpose of whistleblower protections. The Directive provides options beyond solely mandatory internal reporting, and national law should comply with these.

3. Protection from Retaliation

   • Reversed burdens of proof make a significant difference to whistleblowers’ ability to access the protections they are entitled to in law. A reversed burden of proof in favour of the whistleblower must be present.

4. Tests of Whistleblower motivation

   • Good faith requirements take the focus away from the content of disclosure. They make it difficult for whistleblowers to access support in practice and should not be included. Under the Directive, a person is protected if he or she has reasonable grounds to believe the information reported was true at the time of reporting, and that this information falls within the scope of the Directive.

Let’s look at the WPA’s international best practice standards score in a little more detail. These are the areas where the WPA provisions go further than what is required by the Directive.

Material scope

Lawmakers in this scenario have acknowledged the limited legal mandate of the European Union and chosen to expand the WPA’s material scope to fill in some of those gaps. The result is an almost comprehensive whistleblower protection framework, allowing whistleblowers to report on issues that remain uncovered by the Directive, such as working conditions as well as health and safety at work.

While the definition of breaches remains in line with EU requirements, lawmakers chose to expand the scope of application to cover all national laws, as well as international law. This approach significantly strengthens legal certainty for whistleblowers, who are subsequently relieved of the responsibility to assess whether their claim falls within the remit of the EU legal mandate or not.

Adding to that is a paragraph explicitly allowing to report wrongdoing that happened in another country and establishing clear rules on procedures in this area.

One of the remaining shortcomings of the proposed WPA is that it still doesn’t cover all sectors: Whistleblowers from areas relating to national security, such as policing, intelligence and national defense, are not protected under the WPA. While these areas require special scrutiny in weighing national vs public interests, this approach still accepts a risk of wrongdoings in these areas to remain undisclosed. The Tshwane Principles provide lawmakers with guidance on how to better balance those interests.

Personal scope

Lawmakers of the proposed WPA have decided to also broaden the personal scope of protected individuals: Beyond covering disclosures in (future or past) work relationships, the WPA also protects public service users and their relatives when making disclosures about wrongdoing. Consequently, the law includes specific wording on whistleblowing in work-related and non-work related contexts.

This provision may, for example, benefit care patients or citizens witnessing breaches in the course of administrative proceedings. Here, the legislation’s wording is not specific, practically allowing all members of the general public to report wrongdoing in public institutions. At the same time, lawmakers explicitly refrained from including members of the general public as protected individuals. In practice, this setup may increase legal uncertainty for certain whistleblowers.

In terms of testing whistleblowers’ motives, the law remains within the required standards outlined in the Directive. One of its strong features are the clarifications included regarding whistleblowers breaking the law in order to make their disclosure: The law specifies under which circumstances whistleblowers may not be made criminally liable for breaking the law if doing so was inevitably necessary in order to make a disclosure. It also introduces specifics on what constitutes a self-standing criminal offense in the context of whistleblowing, and specifies that whistleblowers who make disclosures as part of their professional duty (“duty speech”) are entitled to the same protection measures.

Finally, another strength of the WPA analyzed here constitutes its definition of facilitators. In recognition of the important role of both civil society as well as journalists in supporting whistleblowers, the law extends protection to public watchdogs, should they be targeted in retaliation.

Reporting channels

In its regulations on whistleblowing channels and procedures , the WPA also makes a couple of additions to what the EU requires that will significantly strengthen whistleblowers’ positions. Firstly, beyond adding political representatives to the list of competent recipients of external disclosures, it includes the establishment of a dedicated whistleblowing oversight authority. This institution not only serves as the main recipient of external disclosures; it also provides whistleblowers with support and advice (see next section). This approach significantly supports sound uniform procedures in investigations, equal treatment of all whistleblowers and facilitates record keeping mechanisms.

When it comes to setting up mandatory internal channels, WPA sticks close to the Directive’s provisions, excluding smaller businesses from the obligation to set up internal reporting mechanisms. This means it replicates some of the Directive’s omissions. As foreseen in the Directive, the WPA allows smaller businesses to outsource their reporting mechanisms, all the while failing to set up rules that would avoid conflicts of interests for contracting parties.

WPA requirements for both internal as well as external channels go beyond what the EU Directive requires in one very important respect: The WPA introduces an obligation for these internal channels to be accessible electronically and anonymously, thus providing additional security for whistleblowers. There is also an obligation to follow up on anonymous reports, which in many other legislative frameworks constitutes a severe gap.

Public disclosures, however, are handled strictly. The WPA maintains the limitations on public reporting outlined in the Directive, and explicitly stipulates that public disclosures have to be made via a journalist. Thus, public reporting via social media channels is not protected.

Protection and support

The WPA scores particularly high on protection measures for whistleblowers. One of the main reasons for that is that it includes obligations on anonymous reporting. While the Directive only stipulates that whistleblowers who make an anonymous report are also entitled to protection measures, the WPA requires all available reporting channels to include options for anonymous reporting. Furthermore, it explicitly introduces an obligation for investigators to follow-up on anonymous disclosures. With this, lawmakers made sure that no important information gets lost.

Further strengthening of the confidentiality regime lies in specific wording introduced regarding the disclosure of a whistleblower’s identity. The Directive foresees that this act requires whistleblowers’ consent, or circumstances in which revelation of identity is “necessary and proportionate”, on which the WPA introduces specific wording.

In most other protection measures, the WPA stays in line with Directive requirements: The law introduces a reversed burden of proof as well as a waiver of rights and introduces specific penalties for the different potential acts of retaliation outlined in the Directive. There is no consideration of protection from extradition in political whistleblower cases.

Additional protection lies in the handling of penalties for whistleblowers: Besides the explicit wording on what constitutes a self-standing criminal offense in this context, the WPA explicitly states that knowingly false reports are not considered criminal offenses. Protection measures for concerned persons correspond to those required by EU law.

Finally, another strength of the WPA lies in its support measures for whistleblowers: In addition to those set out in the Directive, the WPA introduces a temporary whistleblower status for reporting persons while their case is ongoing, and offers recourse to a dedicated, newly introduced national authority. Additionally, whistleblowers may apply for financial aid where necessary.

Review and evaluation

Here, the WPA makes little change to what is required according to EU law. Responsibilities for record keeping lie with the whistleblowing oversight authority, and in addition to EU rules mainly concern the number of all resulting legal proceedings. Furthermore, the authority makes all data gathered publicly available on an annual basis.

Scenarios

Measured against COVID-19 whistleblower reporting scenarios, it becomes clear that despite its strengths, the WPA could provide stronger protection on the practical level. While compliance with the Directive and the anonymity regime provide protection for whistleblowers in scenarios 1, 4 and 5; scenarios 2 and 3 remain uncovered. This may constitute a challenge for whistleblowers who are unaware of legal details about how the WPA works. Instead whistleblowers who voice concerns in these situations are likely to have to rely on their right to freedom of expression, under other legal instruments.