With World Whistleblower Day on Wednesday 23 June 2021 and less than six months until the deadline for EU Member States to put the EU Whistleblowing Directive into national legislation, are EU Member States ready to comply with their legal obligations?
And how might this affect the UK?
The scope and effect of the EU Whistleblowing Directive
Directive (EU) 2019/1937 on the protection of persons who report breaches of Union law (the "EU Whistleblowing Directive") entered into force on 16 December 2019.
It is broad in scope, including the range of organisations to which it applies, the individuals it protects, the policy areas to which is relates, the measures it requires, and the forms of retaliation that it protects against.
Perhaps the most substantial development for organisations caught by the Directive is the requirement to establish internal reporting channels and provide information about these to individuals within their organisations. Organisations have an obligation to keep the whistleblower's identity confidential, confirm receipt of a whistleblower's report within seven days, and provide a response within a reasonable period which should generally not exceed three months.
The Directive sets out three levels of reports that can be made in relation to breaches of EU law. The first is an internal report within the organisation; the second is an external report to a competent authority established by an EU Member State; and the third is a disclosure to the public directly.
Individuals are encouraged to report internally in the first instance before exploring other options, and protection will only be afforded to individuals who make a public disclosure where certain conditions have been satisfied.
Who does the Directive apply to and when must it be implemented by?
The Directive must be transposed into national legislation by all EU Member States by 17 December 2021. It applies to:
- private legal entities with 50+ workers (as defined broadly within EU legislation);
- all public entities (however Member States have discretion to restrict the Directive's reach to public organisations that have 50+ workers); and
- municipalities consisting of 10,000+ individuals.
The dates by which public and private entities must comply with the Directive vary depending on their size. For those with 50 – 249 workers, the relevant date is 17 December 2023. For those with 250+ workers, it is 17 December 2021.
Who does the Directive protect?
The Directive protects an extensive list of individuals all within a work-related context. This includes: employees; workers; civil servants; the self-employed; shareholders; volunteers; paid or unpaid trainees; people working under the direction or supervision of contractors, subcontractors and suppliers; facilitators, colleagues or relatives of the whistleblower; and legal entities that the whistleblower owns, works for, or is otherwise connected with in a work-related context.
Importantly, the Directive protects individuals before work has commenced, during the work relationship and after it has ended.
What is required for protection to arise?
Individuals will be protected where
- they have reasonable grounds to believe that the information they report is true at the time they report it and such information falls within the scope of the Directive; and
- they report it either internally, externally, or by making a public disclosure.
Lastly, what are whistleblowers protected from?
Individuals are protected from 'retaliation'. This means any direct or indirect act or omission which occurs in a work-related context, is prompted by internal or external reporting or by public disclosure, and which causes or may cause unjustified detriment to the individual who made the report or disclosure. This covers dismissal and detriments short of dismissal.
The application of the Directive to the UK
Following Brexit, the Directive has no legal effect in the UK. That said, there are already calls in the UK for measures such as mandatory internal reporting channels and extending the categories of people who are protected by the legislation. So the UK legislation might be amended to keep pace with the Directive. Even if it is not, there are reasons UK companies might nevertheless choose to comply.
Where a UK company is part of a group of companies that has a presence in EU Member States, it may want to achieve consistency across its operations by complying with the EU requirements. Another reason might be because the protections under the Directive are consistent with a company's culture, ethos or environmental, social and governance initiatives.
Conclusion
The 27 EU Member States have taken a significant unifying step towards creating an environment where whistleblowers are empowered and protected. It is not yet clear if the UK will follow suit or chart its own course.
The content of this article is intended to provide a general guide to the subject matter. Specialist advice should be sought about your specific circumstances.
