Europe's new Whistleblowing Directive - what you need to know

As the EU Whistleblower Directive passes in a plenary vote of the European Parliament on 16 April 2019, the Voices of Justice coalition – made up of FIBGAR, Riparte el Futuro and Blueprint for Free Speech – explains what to look out for in the new legislation.

The Directive in a nutshell

With the introduction of a Directive providing minimum standards of whistleblower protection to be enacted in all Member States, the European institutions have made an important step into the right direction. By legally strengthening the position of whistleblowers and protecting them from retaliation, the EU recognizes the importance of reporting corruption, negligence and other wrongdoing in the public interest.

The Directive of the European Parliament and the Council on the protection of persons reporting breaches of Union law acknowledges the high personal costs that result when whistleblowers lack proper legal protections: among them the loss of employment and damage to physical and mental health. On a larger scale, the European Directive paves the way for further cultural change asserting democratic values and rule of law, by empowering those who defend these values rather than abandoning them to their fate.

The Directive on the protection of persons reporting on breaches of Union law will improve the legal position for whistleblowers across the European Union, in both the public and private sectors. In fact there is currently significant divergence in how whistleblowers are treated across the EU, thus this Directive will certainly improve whistleblowers’ conditions across all Member States.  

The provisions of the Directive require public authorities, regulators and private enterprises to take proactive steps in order to ensure that reports can be made safety, and that the issues raised are investigated. Businesses employing 50 people or more will be obliged to set up internal reporting channels with specific standards for confidentiality, record keeping and investigation.

We welcome the Directive. However, we have concerns about several issues that EU member states should attend to at the transposition stage which are briefly commented below.

Background

After years of pressure from civil society and major disclosures such as LuxLeaks and the Panama Papers, the European Commission concluded that the protection of whistleblowers is necessary for the proper functioning of the Single Market. A public consultation on whistleblower protection in Spring 2017 was followed by the publication of a draft Directive a year later. In November 2018, the European Parliament’s Legal Affairs Committee adopted a series of amendments that strengthened many provisions from the Commission’s draft. At the end of January 2019, the European Council adopted its own, more conservative negotiating position.

Over the course of trilogue negotiations in February and early March, pressure from over 80 civil society organisations, 2 UN Special Rapporteurs and over 280,000 European citizens signing up two petitions helped secure a final text that does not require whistleblowers to exhaust internal channels before being able to go to a regulator. One of these two petitions has been launched by Riparte il futuro in 2014 and relaunched by our three organisations in October 2018. These petitions, and the campaigning work conducted by over 80 civil society organisations under the lead of European union Eurocadres, significantly impacted the negotiation process within the European institutions: in fact the thousands of citizens’ signatures collected and delivered to the decision-makers have been quoted in Parliament as signatures MEPs needed to be accountable to.

The content of the Directive

• Areas covered

The Directive protects individuals who make reports relating to the financial interests of the EU, the operation of the single market and breaches of EU law. This includes many areas covered by the EU treaties, such as food safety, financial services, personal data protection, public procurement, products and markets and prevention of money laundering and terrorist financing, product safety, transport safety, protection of the environment, radiation protection and nuclear safety animal health and welfare; public health; consumer protection; and security of network and information systems, and breaches related to the internal market.

• Subjects covered

The Directive provides protection to an extensive range of work-related relationships where people “acquired information on breaches in a work-related context” in both the public and private sectors. This includes employees, contract workers, freelancers and suppliers – but also shareholders, former employees, paid or unpaid trainees, volunteers and individuals involved in a recruitment process. With this approach, the European Union has ensured equality for employees across all sectors.

There is no test of motive in order to qualify for protection. A whistleblower only needs to have reasonable grounds to believe that their report is truthful and that it is covered by the Directive.

While the directive says Member States “shall encourage the use of internal channels before external reporting”, whistleblowers are able to decide for themselves whether to make their report through an internal channel or to a regulator. This non-hierarchy between reporting channels has been a major victory obtained by the coalition of civil society organisations mentioned above.

Companies employing more than 50 people are obliged to set up internal channels. These include electronic channels and phone hotlines as well as designated persons for physical meetings and oral reports. Reporting channels must be designed to protect confidentiality of the report and the person making it, and enable the proper storage of information for further investigation. Corporate procedures need to include also minimum standards for investigation and follow up within a three-month timeframe.  

Similar standards are provided for regulators and other external authorities who are empowered to receive whistleblowers’ reports. They are also expected to publish full information about what protections they offer whistleblowers online and to review their procedures every three years.

• Acts covered

Whistleblowers may also directly disclose information publicly where they have a reasonable belief to suspect they would be retaliated against if they made a report to public authorities. Public disclosures are also protected when reports were previously made internally or to competent authorities and no appropriate action was taken.

Whistleblowers may go directly to the media if they have reasonable grounds to believe that the subject matter of their report “may constitute an imminent or manifest danger”; if there is a risk of retaliation or whether it is unlikely a report could be adequately addressed by other means, “due to the particular circumstances of the case.”

EU member states are asked to introduce measures to prohibit acts of retaliation against whistleblowers. If such cases come to court, a reverse burden of proof applies: it will be for the employer to demonstrate that any measures taken were justified. This represents the core legal protection of whistleblowers in the workplace. Retaliation acts include, but are not limited to, suspension, the withholding of opportunities for professional development, discrimination, coercion, reputational or financial loss, and psychiatric or medical referrals. Sanctions for retaliation acts are also provided.

Persons who are implicated in reports are entitled to confidentiality while investigations are ongoing, just as those making reports are.

The Directive does not override existing provisions in national law where these offer a higher standard of protection. Member states are invited to introduce provisions that are more favourable to whistleblowers than those in the Directive.

Main criticisms

We have no doubt that the Directive will improve the life of many people in Europe. However, there are some open points which the Directive could have tackled better.

We refer, for example, to the restrictions on the ability of whistleblowers to go to the media: it is not often easy for whistleblowers, who have a limited viewpoint of a situation, to evaluate and assess the legal requirement necessary to enjoy protection when disclosing to media.

Whistleblowers do not incur in legal liability for their acquisition of or access to information “provided that such acquisition or access did not constitute a self-standing criminal offence”: this is a dangerous provision, because whistleblowers often need to acquire documents to substantiate their disclosure and they might need to look for documents they are not entitled to acquire. However, restricting them from acquiring these documents, if this prevents a wrongdoing from happening or continuing, appears quite unfair to us.

An additional point regards anonymity. There is no obligation for Member States to provide for channels allowing for anonymous disclosures. Additionally, Member States may decide in transposition whether anonymous reports will be accepted and/or investigated or not.

Lastly, an open issue is represented by the lack of coverage in areas not covered by the EU mandate, such as national security and more broadly the defense sector. We suggest that this definition of reportable wrongdoing shall be extended when legislation is enacted on the national level, to ensure a horizontal approach benefitting also those whistleblowers working in areas that fall outside of EU competences.

Transposition

The Directive will set the responsibility to put whistleblower protection into place. All member states will have to comply with this Directive 2 years, after the adoption.The transposition of this Directive shall under no circumstances provide grounds for reducing the level of protection already afforded to reporting persons under national law in the areas to which it applies. After 2 years of transposition, the European Commission commits to report on the implementation status.