It has now been three years since the EU whistleblower protection directive (“Directive”) entered into force. The Directive’s minimum standards are certainly no great mystery at this point – entities meeting the fifty-worker threshold must establish internal reporting channels and procedures for the receipt of whistleblower reports and protection of the whistleblower against retaliation.
What remains a challenging unknown, however, is the extent to which each member state’s transposition of the Directive meets or exceeds the Directive’s minimum standards. This is because of the staggered cadence of legislative enactments by EU member states and the failure of many member states to enact legislation at all. Now one year overdue, as of this writing, there remain 13 member states that have yet to transpose the Directive into national law. Multi-national organizations tasked with developing a harmonized approach to whistleblower reporting across the EU must do so with an incomplete picture of the legislative landscape.
But as we move into 2023, there is hope that this picture will be filled in. The majority of the 13 member states yet to transpose have published draft bills that are at various stages of the legislative process. The proposed bills provide a look at how these nations may codify the Directive’s minimum standards. While the timelines of the enactments may differ among these nations, perhaps there exists some shared urgency as a result of the European Commission’s commencement of infringement proceedings against these member states (as well as some that have transposed, though only partially or untimely, as the European Commission tells it).
Despite the delayed progress across the EU, there are lessons to be taken from the Directive itself and the national laws that have been enacted in the past year.
Shared resources
One of the most impactful requirements of the Directive is for entities with 50 or more workers to establish internal reporting channels and designate an impartial person or department to perform the follow-up, which includes any resulting investigation. The Directive makes allowance, however, for entities with 50 to 249 workers to “share resources as regards the receipt of reports and any investigation to be carried out.” This ability to share resources was included in the Directive specifically because the Commission was “mindful of the more limited resources of medium-sized companies . . . and with a view to helping them meet their obligations under the Directive.”
Thus far, we have seen nations that have transposed likewise be mindful of the potential resource strain in this regard and have incorporated this resource-sharing carve out in favor of medium-sized entities. For example, the national laws of Cyprus, Denmark, Ireland and Portugal all include express allowance for medium-sized entities to share resources in this limited respect. Spain’s draft law legislation also includes this allowance in its present state. As more nations transpose, we can expect to see further adoption of this resource-sharing carve out for medium-sized entities.
Initial assessments and additional communications to whistleblower
The Directive describes two distinct points in time when the receiving entity must communicate with the whistleblower. First, there must be an acknowledgement of receipt of the report sent to the whistleblower within seven days of report receipt. Second, the entity must provide “feedback” to the whistleblower within “a reasonable timeframe . . . not exceeding three months from the acknowledgment of receipt.” This general framework – written acknowledgement followed by feedback – is apparent in the transpositions thus far.
There have also been additional steps required at the national level, including an initial assessment of the report and further communications to the reporter. For example, Ireland and Latvia both establish an obligation for the receiving entity to perform an initial assessment of the report and to communicate the results of that assessment to the reporter.
In the case of Ireland, the assessment should consider “whether there is prima facie evidence that a relevant wrongdoing may have occurred.” Under the Latvian transposition, the assessment is to include a decision whether to recognize the report as a whistleblower report. Under both laws, the assessment is to be communicated to the reporter. Ireland also introduced a continuing obligation to communicate status updates to the reporter, if requested. These further communications are to occur “at intervals of three months.”
These examples highlight the need to monitor each member states’ draft and enacted legislation. As more member states transpose the Directive into national law, we may see additional nuances introduced that affect how organizations perform report intake and assessment and communicate with reporters.
Effective, proportionate and dissuasive penalties take shape
The Directive addresses at least one topic merely by describing the desired outcome, rather than through prescriptive rules defined by rigid timelines or worker counts: Penalties.
No specific punishments or monetary sanctions are set forth in the Directive. Rather, the Directive mandates member states “provide for effective, proportionate and dissuasive penalties applicable to natural or legal persons” for hindering reporting, retaliation, bringing vexatious proceedings, and breaching the duty of confidentiality, and, in the case of reporters, for knowingly reporting false information.
This aspect of the transposition process has been keenly watched by industry observers to see what level of personal and entity liability is established. To date, the national laws have responded to this mandate in a few ways.
Some member states have established ranges of monetary fines that correspond to different violations. Portugal, for example, grouped violations into two tiers: serious offenses and very serious offenses. The latter, unsurprisingly, paired with the higher ranges of potential fines (i.e., €1,000 to €5,000 for natural persons and €2,000 to €50,000 for legal persons).
However, financial penalties against individuals are just one possible penalty under the Irish law. It provides – at least technically – for imprisonment of up to two years. One would have to think that imprisonment for violation of the duty of confidentiality would be a punishment reserved for the most malicious of intentional disclosures, but on the face of it, there is no element of scienter. In any event, consider this author dissuaded.
The Irish law also creates two private rights of action. A reporter may bring an action in tort against an individual who discloses the reporter’s identity to someone unauthorized to know it. Likewise, an individual may bring a tort action against a reporter who knowingly reports false information about the individual.
These penalties likely suggest more of what is to come when the remaining member states transpose the Directive. It seems safe to assume that financial penalties will be available in future transpositions against both individuals and entities when there is retaliation or a breach of confidentiality in which the reporter’s identity is made known beyond those authorized to know it.
2023 prediction
The coming year will continue to present challenges for organizations working to harmonize internal whistleblower programs across multiple EU members states, where some have transposed the Directive into national law and others have not. Organizations may wish to design or modify their programs to conform to the most protective of the national laws and, in any event, should ensure their programs are responsive to the Directive’s minimum standards. We can reasonably expect more member states will transpose the Directive in 2023, but whether it is all delinquent member states or just some remains an open question.
For the complete Top 10 Trends in Risk and Compliance eBook
