The European Commission proposed on 23 April a new law to strengthen whistleblower protection across the EU.
Advertisement
What is a whistleblower?
The Commission’s proposal defines a whistleblower as someone reporting or disclosing information on violations of EU law which they observe in their work-related activities. That means it covers employees but also self-employed people, freelancers, consultants, contractors, suppliers, volunteers, unpaid trainees and job applicants.
To avoid penalising people who act in good faith, whistleblowers also qualify for protection, if they had reasonable grounds to believe that the information reported was true at the time of reporting, or if they have serious suspicions that they observed an illegal activity.
Why is the Commission proposing a Directive on the protection of whistleblowers?
Recent scandals, such as the Dieselgate, Luxleaks, Panama Papers, the Fipronil case or Cambridge Analytica, have shown major wrongdoings happening inside companies or organisations, which harmed public interest across the EU. In many cases, these scandals, and the damage done to the environment, public health and safety, and to national or EU public finances, have come to light thanks to people speaking up when they encounter wrongdoing in the context of their work.
Those who work for an organisation or are in contact with it in the context of their work-related activities are often the first to know about threats or harm to the public interest which arise in this context. People speaking up when they encounter wrongdoing in the context of their work play an essential role in revealing violations of EU law which can cause serious harm to the public interest. They can feed national and EU enforcement systems with information leading to effective detection, investigation and prosecution of breaches of Union rules.
Yet, those who “raise the alarm” often risk their career and their livelihood and, in some cases, suffer severe and long-lasting financial, health, reputational and personal repercussions. Fear of retaliation dissuades people from coming forward with their concerns. The effective protection of whistleblowers against retaliation is essential to safeguard the public interest, protect freedom of expression and media freedom (because whistleblowers are essential as sources for investigative journalism) and more generally promote transparency, accountability and democratic governance.
Why does this require action at EU level?
Currently, the protection offered to whistleblowers across the EU is fragmented and insufficient. Some Member States have comprehensive legislation in place, but most offer only sectoral protection, e.g. in the fight against corruption or for the public sector only. Elements of whistleblower protection have already been introduced in specific EU instruments in areas like financial services, transport safety and environmental protection, where there was an urgent need to ensure that EU law is correctly implemented.
Insufficient protection of whistleblowers can have a negative impact not only on the functioning of EU policies in one Member State, but also in other Member States and the EU as a whole.
Uneven protection of whistleblowers across the EU can undermine the level-playing field needed for the internal market to properly function and for business to operate in a healthy competitive environment; it can result in unsafe products placed on the internal market, in pollution of the environment or other risks for public health and transport safety which go beyond national borders; and it means that whistleblowers in cross-border situations can “fall through the cracks” and suffer retaliation for seeking to protect the public interest.
In addition, whistleblower protection can make it easier to detect, prevent and deter fraud, corruption and other illegal activities affecting the financial interests of the Union.
The proposed Directive aims at ensuring that all Member States have common high standards of protection for whistleblowers who unveil illegal activities and abuse of law relating to wide range of EU policy areas.
What type of reporting is protected?
Under the proposed Directive, a whistleblower is granted protection when reporting on breaches of EU rules in the areas of:
- public procurement
- financial services, anti-money laundering and counter terrorist financing
- product safety
- transport safety
- environmental protection
- nuclear safety
- public health
- food and feed safety, animal health and welfare
- consumer protection
- protection of privacy and personal data, and security of network and information systems
It also applies to breaches relating to Union competition rules, breaches harming the EU’s financial interests and, in view of their negative impact on the proper functioning of the internal market, to breaches of corporate tax rules or arrangements whose purpose is to obtain a tax advantage that defeats the object or purpose of the applicable corporate tax law.
To ensure that the scope of the Directive remains up to date, the Commission will consider its future extension when proposing legislation in areas where whistleblower protection would be relevant.
The Directive protects whistleblowers of good faith: a person is protected if he or she has reasonable grounds to believe the information reported was true at the time of reporting, and that this information falls within the scope of the Directive.
While at EU level, in line with the principle of subsidiarity, the Directive establishes whistleblower protection measures targeted to the enforcement of EU law in specific areas, the Commission encourages the Member States, when transposing the Directive, to consider extending its scope of application to other areas, and more generally to ensure a comprehensive and coherent framework at national level.
What are the obligations for public authorities and private companies?
Obligation for public and private sector to establish internal channels and procedures for reporting and follow-up of reports
As a general rule, all private companies of more than 50 employees or with an annual turnover of more than 10 million and all State and regional administrations (including its departmental sub-divisions, such as provinces) and all local municipalities of more than 10,000 inhabitants are obliged to establish internal reporting channels, ensuring the confidentiality of the identity of the whistleblower.
They also need to designate a person or a department responsible for receiving and following up on the reports and to provide clear and accessible information about those procedures and the conditions under which reports can be made externally to national or EU competent authorities.
Small and micro companies are exempted from this obligation, with the exception of the companies operating in the field of financial services or vulnerable to anti-money laundering or counter terrorist financing, due to the high risks arising from the activities of such companies. Employees in such companies can report to designated public authorities.
After the whistleblower has submitted a report, the designated person/department must follow up on the report within 3 months and provide feedback to the reporting person about this follow up.
Obligation for competent national authorities to establish external reporting channels and to follow up on reports
Member States must identify the authorities who will be charged with receiving and following up on reports about breaches under the new law. These authorities should put in place specific, user-friendly channels, separate from their normal public complaints systems, to allow for reporting, and dedicated staff, professionally trained, to handle and follow up on reports.
These authorities will be under obligation to follow-up on the reports received, and, within 3 months (extendable to 6 months in case of complex cases), give feedback to the reporting persons about the follow-up (for instance, closure of the case based on a lack of sufficient evidence, launch of a full investigation and/or measures taken to address the issue raised).
The authorities responsible should also make public easily understandable and accessible information about how whistleblowers can receive protection.
How should a whistleblower report wrongdoing?
In general, a whistleblower should first report information to his/her employer using internal reporting channels. However, a whistleblower can also choose to go directly to the central state authorities responsible and, where relevant, to EU bodies, in cases where:
- the internal channels do not exist (e.g. in small and micro companies) or
- their use is not mandatory (e.g. in case of non-employees) or
- they were used but did not function properly or they could not reasonably be expected to function properly (for example because of a fear of retaliation, concerns about confidentiality, the possible implication of the management in the breach, fear that the breach or the evidence might be concealed or destroyed, or if urgent action is required because of an imminent substantial danger to the life, health and safety of persons, or to the environment)
In addition, EU law already allows whistleblowers to report directly to national authorities or EU bodies for cases of fraud against the EU budget, or as concerns the prevention and detection of money laundering and terrorist financing or in the area of financial services.
Finally, the new law states that if the use of internal and/or external channels did not produce any results and the whistleblower did not receive appropriate feedback within the 3 or 6 month timeframe set by the new law, he/she can choose the last-resort option of publiclydisclosing the information, for instance, directly to the public via web platforms or social media, or to the media, elected officials, civil society organisations etc.
Can a whistleblower disclose information directly to the media?
Yes, in certain circumstances.
If internal and external reporting channels are available, a whistleblower should use these first in order to be guaranteed protection under the new law. This is necessary to ensure that the information gets to the persons who can contribute to the early and effective resolution of risks to the public interest as well as to prevent unjustified reputational damages from public disclosures.
However, in cases where internal and/or external channels do not function or could not reasonably be expected to function properly, (for instance when it is reasonable to suspect a collusion between the perpetrator of the crime and the state authorities responsible for prosecuting them or in cases of urgent or grave danger for the public interest, , or risk of irreversible damage, persons making a public disclosure (including to the media) will also be protected under the new law.
What type of protection is offered to whistleblowers?
The new law obliges Member States to prohibit any form of retaliation and to provide for effective, proportionate and dissuasive penalties against those who take retaliatory measures against whistleblowers.
If whistleblowers do suffer retaliation, the new law provides for a set of measures to protect them, including:
- Legal advice: whistleblowers will be given access to comprehensive and independent information and advice, free of charge, on available procedures and remedies;
- Remedial measures: whistleblowers will be given recourse to appropriate remedial measures against retaliation, such as:
- interim relief to halt ongoing retaliation such as workplace harassment or to prevent dismissal pending the resolution of potentially protracted legal proceedings;
- reversal of the burden of proof, so that it is up to the person taking action against a whistleblower to prove that they are not retaliating against the act of whistleblowing;
- No liability: whistleblowers are not to be considered infringing any restriction on disclosure of information imposed by contract or by law (so-called “gagging” clauses) and will not be held liable for disclosing information;
- Protection in judicial proceedings: If legal actions taken against whistleblowers outside of the work-related context (such as proceedings for defamation, breach of copyright or breach of secrecy) whistleblowers will be able to rely on the new EU law as a defence.
How are the rights of the accused person or organisation protected?
The new law aims at protecting responsible whistleblowing, genuinely intended to safeguard the public interest, while proactively discouraging malicious whistleblowing and preventing unjustified reputational damage.
Persons concerned by the reports fully enjoy the presumption of innocence, the right to an effective remedy and to a fair trial, and the rights of defence. Member States must also introduce effective, proportionate and dissuasive penalties for those who make malicious or abusive reports or disclosures.
How should Member States raise awareness of these rules?
The Directive obliges Member States to ensure that centralised authorities publish on their websites in a separate, easily identifiable and accessible section at least the following information:
- the conditions under which the whistleblowers qualify for protection;
- the existing reporting channels (phone numbers, dedicated postal address or email) for receiving and following-up on the reporting;
- the procedures applicable;
- the confidentiality regime applicable to reports;
- the nature of the follow-up to be given to reports;
- the remedies and procedures available against retaliation and on possibilities to receive confidential advice for persons contemplating making a report;
- a statement clearly explaining that whistleblowers are not be considered infringing any restriction on disclosure of information imposed by contract or by law, and are not to be involved in liability of any kind related to such disclosure.
What can a whistleblower do if “nothing happens”?
A person or a department responsible within a company or a public administration for receiving reports is obliged to follow up diligently on the report and within a reasonable timeframe, not exceeding 3 months following the report, and provide feedback to the reporting person about the follow up.
If there is no feedback and/or no appropriate follow up, the person can report externally to the centralised state authorities responsible.
The authorities responsible have the obligation to follow-up on the reports made by whistleblowers and inform them about the outcome of the investigation. If after a reasonable period of time (not exceeding 3 months or 6 months in duly justified cases), the authorities have not informed the whistleblower about the follow up given or envisaged or there was no appropriate follow up given, the whistleblower can disclose the information to the public, including to the media.
How will the new law support freedom of expression and freedom of the media?
Whistleblowers play a crucial role as sources for investigative journalism. When their concerns remain unaddressed and the only avenue open to them is to alert the public, as well as in other specific cases (see above), whistleblowers may reach out to journalists with the information they possess. Their effective protection against retaliation becomes, alongside protection of the confidentiality of sources, an essential means of safeguarding the watchdog role of investigative journalism in democratic societies.
By providing protection to whistleblowers as journalistic sources, the new law will have a clear positive impact in terms of promoting investigative journalism, and more generally media freedom. It will provide potential whistleblowers with legal certainty about the conditions under which they can go to the press, and will reassure them that they will be protected from retaliation if their identity is exposed.
Would the new law apply to cases like Cambridge Analytica?
The UK has one of the most advanced systems of whistleblowing protection in the EU. However, in the majority of Member States, whistleblowers are only protected in very limited situations.
In the case of Cambridge Analytica, the person who reported the data breach would have been covered by the new law on whistleblower protection since it will apply to reporting on breaches of EU data protection rules, and allow for uncovering data breaches carried out by companies throughout Europe.
Cambridge Analytica may be considered as a typical example of the important role of whistleblowers in unmasking violations of EU law causing serious harm to the public interest and which might otherwise remain hidden.
What are the whistleblowing procedures in the EU institutions? Will the new law apply to them as well?
The new law applies to EU Member States, and is not applicable to the EU institutions.
For the EU institutions, the Staff Regulations of officials and Conditions of Employment of other servants of the European Union include, since 2004, rules on whistleblowing, setting out procedures for reporting any fraud, corruption or serious irregularity, and providing protection to whistleblowers from adverse consequences of this reporting. These rules were complemented in 2012 by Guidelines on Whistleblowing.
Source: European Commission
