Starting with December 2023, Directive (EU) 2019/1937 of the European Parliament and of the Council on the protection of persons who report breaches of Union law will be in effect across all member states, most of which have already adopted internal laws for the transposition of the Directive.

Based on the Directive’s provisions, legal entities with more than 50 employees or an annual turnover of more than 10 million euros are required to implement effective internal reporting channels that ensure the protection of whistleblowers. 

  1. Scope of regulation

Directive (EU) 2019/1937 sets out to guarantee a high level of protection for whistleblowers who report breaches of EU law that they observed in a professional context.

At least the following categories fall under the protection of the new regulation:

  • Employees;
  • Individuals engaged in independent activities;
  • Shareholders and individuals serving on the management, executive, or supervisory bodies of an enterprise, including non-executive members of the board of directors, as well as paid or unpaid volunteers and interns;
  • Any person working under the supervision and direction of a natural or legal person with whom they have entered into a contract, subcontractors, and suppliers thereof;
  • Individuals whose employment relationships have not yet begun and who make reports through internal or external reporting channels or disclose information about legal violations obtained during the recruitment process or other pre-contractual negotiations, or when the employment or service relationship has ended;
  • Persons who report or disclose information about legal violations anonymously.

Correspondingly, the Directive sets out several obligations for public and private legal entities, requiring them to:

  • establish accessible internal reporting channels that ensure the protection of the whistleblower;
  • set out clear reporting and whistleblower protection procedures;
  • hold records related to internal reports filed and their follow-up;
  • provide information/training sessions for their employees.
  1. Aspects subject to reporting

Are subject to reporting all actions or omissions that constitute breaches of the EU/national law applicable in areas such as:

  • Public procurement;
  • Services, products, and financial markets, as well as the prevention of money laundering and terrorist financing;
  • Product safety and compliance;
  • Transportation safety;
  • Environmental protection;
  • Radiological protection and nuclear safety;
  • Food safety and animal feed, animal health, and welfare;
  • Public health;
  • Consumer protection;
  • Protection of private life and personal data, and the security of networks and information systems.

Information regarding legal violations consist of information, including reasonable suspicions, regarding actual or potential legal violations that have occurred or are likely to occur within government authorities, public institutions, or other public legal entities, as well as within private legal entities where the whistleblower works or has worked or has been in contact with through their activities, as well as information regarding attempts to conceal such violations.

  1. Reporting channels

Internal reporting involves the oral or written communication of information regarding legal violations through internal reporting channels established by employers. Internal reporting channels may be operated by a person or department designated for that purpose by the employer or provided externally by a third party contracted by the employer with this specific purpose.

The following private legal entities have the obligation to establish internal reporting channels, as well as to hold records of reporting and follow-up by December 2023:

  • Companies with at least 50 employees must identify or establish internal reporting channels and establish procedures for internal reporting and subsequent actions.
  • Companies with between 50 and 249 employees may group together and share resources for receiving reports regarding legal violations and subsequent actions.
  • Companies operating in the specific sectors expressly and exclusively listed in Parts I.B and II of the Annex to the Directive have the obligation to establish internal reporting channels regardless of the number of employees.

External reporting involves the oral or written communication of information regarding legal violations through external reporting channels organized by the member states.

  • External reporting channels are operated by public authorities and institutions that are appointed by the member states to receive and handle reports regarding legal violations.
  • In the absence of internal reporting channels for private legal entities with fewer than 50 employees, whistleblowers who make reports regarding legal violations may use external channels.
  • The external reporting channels are also available to whistleblowers who have used an internal reporting channel but are not pleased by the outcome of the employer’s actions.

Public disclosure is also recognized as a last resort option for the whistleblower who:

  • has first reported internally and/or externally, but no appropriate action was taken in response to the report;
  • has reasonable grounds to believe that (i) the breach observed may constitute an imminent or manifest danger to the public interest (such as where there is an emergency situation or a risk of irreversible damage) or (ii) there is a risk of retaliation or there is a low prospect of the breach being effectively addressed, due to the particular circumstances of the case.
  1. Protective measures

Whistleblowers are protected by law against all acts of retaliation, as well as threats of retaliation and attempts of retaliation.

Member states should also have in place effective support measures, in particular the following:

  • comprehensive and independent information and advice, which is easily accessible to the public and free of charge, on procedures and remedies available, on protection against retaliation, and on the rights of the person concerned;
  • effective assistance from competent authorities before any relevant authority involved in their protection against retaliation;
  • legal aid in criminal and in cross-border civil proceedings in accordance with Directive (EU) 2016/1919 and Directive 2008/52/EC of the European Parliament and of the Council, and, in accordance with the applicable national law, legal aid in further proceedings and legal counselling or other legal assistance.

To benefit from protective measures, whistleblowers must meet the following conditions cumulatively:

  • be one of the individuals making reports and who has obtained information about legal violations in a professional context;
  • have had reasonable grounds to believe that the information regarding the reported violations was true at the time of reporting;
  • have made an internal report, an external report, or a public disclosure;
  • be subject to reprisals as a direct consequence of reporting a breach of law under the provisions of Directive (EU) 2019/1937.

The protective measures also apply to:

  • facilitators;
  • third persons who are connected with the reporting persons and who could suffer retaliation in a work-related context, such as colleagues or relatives of the reporting persons;
  • legal entities that the reporting persons own, work for or are otherwise connected with, in a work-related context.
  1. Sanctions

Sanctions for whistleblowers:

  • Filing a report in bad faith is sanctionable and the whistleblower in this case might even be held to compensate for the damage resulting from such reporting or public disclosure, in accordance with the applicable national law.

Sanctions are also applicable for employers and individuals involved in internal reporting that:

  • hinder or attempt to hinder reporting;
  • retaliate against the persons for which the Directive imposes protective measures;
  • bring vexatious proceedings against protected persons;
  • breach the duty of maintaining the confidentiality of the identity of reporting persons;

For additional information, please contact us at office@aptiqlegal.com , the APTIQ Legal team is at your disposal.