The Directive at a glance

The Directive aims to enhance the enforcement of EU law and policies by establishing common minimum standards that protect persons who report beaches of the same. Areas of law falling within the Directive's material scope include public procurement, financial services, environmental protection, consumer protection, and the protection of personal data.

Protection under the Directive is granted to 'work-related' reports, i.e. those made by workers, self-employment persons, shareholders, contractors, and suppliers. Such individuals may qualify for protection if they have 'reasonable grounds' to believe that the information in their report is true and if they have made their report in accordance with the Directive.

For legal entities in the private and public sectors, the Directive means putting in place channels and procedures for internal reporting and follow-up. Accordingly, legal entities in the private sector with 250 workers or more must comply by 17 December 2021, while entities with 50 to 249 workers must do the same by 17 December 2023.

What happens if a Member State fails to meet the transposition deadline?

According to Tagliaferri, "Under EU law, directives take effect at national level only following the enactment of national transposition laws by Member States. EU directives impose a deadline for their transposition, which is typically set at two years from the enactment of the directive. Failure to transpose a directive by the deadline may expose the Member State to an infringement proceeding, which may ultimately lead to the imposition of fines.

The Court of Justice of the European Union has held that, in some cases, a directive can exceptionally produce certain effects at the national level in the absence of a transposition law, or where the national law has not correctly transposed the directive. This is the case where the terms of the directive give rights to individuals, are sufficiently clear and precise, and are not subject to conditions. In such cases, individuals may have legal claims against a Member State under the provision of the directive, although they may not rely on the directive to bring claims against other individuals based on a directive that has not been transposed."

What should legal entities do in the meantime?

Tagliaferri further noted, "Many Member States have not yet enacted their national laws transposing the Directive, and in some cases have not even started the legislative process.

Until the national legislation becomes available, the best approach for companies is to assess their current internal reporting channels and procedures vis-à-vis the requirements set out in the Directive. This approach allows companies to promptly identify and revise the policies and procedures requiring immediate enhancement, and then further tailor them as necessary based on any stricter requirements imposed by the applicable national transposition laws.

In this regard, it is worth noting that because the Directive is a minimum harmonisation directive, Member States are only allowed to set higher standards than those imposed in the Directive. However, considering the national transposition laws enacted so far, and the status of the transposition in many Member States, it is expected that most national laws will largely mirror the provisions of the Directive, without deviating from its main requirements or imposing stricter standards."

Member States that have implemented the Directive

Denmark

Denmark became the first Member State to implement the Directive on 24 June 2021, ahead of the transposition deadline. The new law passed by the Danish Parliament enters into force on 17 December 2021 and generally aligns with the provisions of the Directive in terms of scope and obligations.

Notably, while the new law does not explicitly address the possibility of anonymous reporting, it does provide for the establishment of an independent external whistleblower scheme by the Danish data protection authority ('Datatilsynet').

Sweden

On 29 September 2021, the Swedish Parliament approved the Labour Market Committee's proposal to adopt the Government's bill for the implementation of the Directive. As such, Sweden became the second Member State to implement the Directive.

Although the new law enters into force on 17 December 2021, its provisions will only apply to private organisations with 250 workers or more from 17 July 2022, giving such entities an additional six-month grace period.

The new law also provides further detail on aspects under the Directive which have been left at the discretion of Member States, including protective measures against retaliation. Indeed, on 2 November 2021, the Government further adopted and published the Ordinance on the Protection of Persons who Report Malpractice (SFS 2021:950) and the Ordinance on State Subsidies for Information and Advice on the Protection of Persons who Report Malpractice (SFS 2021:950). These Ordinances supplement the new law and contain provisions on, among other things, the national authorities responsible for handling external reporting channels.

Portugal

Following several rounds of revisions, the Portuguese Parliament approved a finalised text on 26 November 2021, thereby implementing the Directive. The new law is expected to be formally published in the Official Gazette shortly and will come into force 180 days after its publication.

Unlike the laws enacted in Denmark and Sweden, the new law in Portugal explicitly protects anonymous whistleblowers, requiring organisations to establish procedures that allow for anonymous reporting. By comparison, the new law also outlines specific administrative sanctions, including fines of up to €250,000 for very serious violations and €125,000 for serious violations.

Lithuania

A day before the transposition deadline, on 16 December 2021, the Lithuanian Parliament adopted a finalised text to transpose the Directive, entering into force on 15 February 2022. The draft law had initially been developed by the Ministry of Justice in March 2021 and had been revised and reintroduced to Parliament a number of times before being adopted.

Similar to Sweden, the new law expands the protection afforded under the Directive to individuals that report on infringements in which there is a public interest. The new law also explicitly provides that the competent authority may require whistleblowers to be compensated up to 50 times the basic social benefit or 'BSI' (approx. €2,000).

Member States with draft laws in progress

Croatia

Whistleblowers are already protected in Croatia by the Act on Whistleblowers' Protection (Official Gazette No. 17/2019). While amendments to the 2019 Act were initially envisaged by the Croatian Government, the Ministry of Justice eventually announced, on 12 November 2021, a new draft law to implement the Directive. If enacted, the draft law would replace the 2019 Act, establishing a new Act for the protection of whistleblowers.

Czech Republic

On 1 February 2021, the Czech Government approved a draft law developed by the Ministry of Justice. Following initial discussions within the Chamber of Deputies, the Committee on Public Administration and Regional Development had recommended that the draft law be discussed and approved as presented.

Although the Czech Republic had made considerable progress in this regard, the Committee on Constitutional and Legal Affairs ultimately failed to discuss the bill before the election of a new Government in early October 2021. The Chamber of Deputies therefore did not proceed to a second round of discussions, resulting in the Czech Republic not being able to meet the transposition deadline.

Estonia

The Ministry of Justice first expressed its intention to develop a draft proposal for transposing the Directive in July 2021. Thereafter, on 11 August 2021, the Ministry announced that it had presented its proposals for public consultation. Taking into account comments received during the consultation, an updated version of the draft law was submitted to the Estonian Government on 3 December 2021.

On 16 December 2021, the Ministry of Justice confirmed that the Estonian Government had approved its proposed draft law. It is expected that the draft law will be presented for consideration by the Estonian Parliament.

Finland

A working group had been set up by the Ministry of Justice in August 2021 to discuss a proposal for the implementation of the Directive. After the working group's deliberations, the Ministry requested public comments on its proposed draft law. On 29 November 2021, the draft law was added to the Finnish Parliament's agenda, with Parliament aiming to discuss it in the eighth week of 2022.

France

A bill to amend the existing whistleblowing laws was introduced to the National Assembly, the first House of Parliament, on 21 July 2021. Separately, an accompanying bill was also submitted with the view of enhancing the power of the Defender of Rights to handle whistleblower reports.

Discussions by the National Assembly were held on 17 and 18 November 2021. On 18 November 2021 in particular, the National Assembly adopted an updated version of the bill at first reading. The bill has now been transferred to the Senate, the second House of Parliament, where the bill will be examined from 19 January 2022. Ahead of the Senate's reading in January, the Committee on Constitutional Laws, Legislation, Universal Suffrage, Rules and General Administration examined the bill and adopted further amendments on 15 December 2021.

Ireland

In June 2020, well before many Member States had even begun the process, the Department of Public Expenditure and Reform launched a public consultation on the transposition of the Directive. Thereafter, on 12 May 2021, the Department published a General Scheme of Protected Disclosures (Amendment) Bill 2021, which, if enacted, would amend the Protected Disclosures Act 2014.

However, the Minister for Public Expenditure and Reform also confirmed in a parliamentary Q&A, on 7 December 2021, that Ireland will miss the implementation deadline; although the bill is expected to be enacted in the first quarter of 2022.

On 16 December 2021, the Joint Committee on Finance, Public Expenditure and Reform, and Taoiseach laid before the Irish Parliament its report on the General Scheme, setting out 60 recommendations for consideration.

Latvia

On 21 September 2021, the Cabinet of Ministers announced the approval of a draft law which maintains a similar approach to the Whistleblowing Law of 11 October 2018, albeit enhanced to align with the Directive. According to the Cabinet, the draft law will now be considered by the Latvian Parliament.

Malta

On 15 November 2021, Bill No. 249 entitled the Protection of the Whistleblower (Amendment) Act, 2021 was published in the Government Gazette to transpose the Directive. The bill is currently being considered by the Maltese Parliament, having been recently read for a third time on 14 December 2021.

Netherlands

A bill was introduced for the transposition of the Directive and for amending the current whistleblowing legislation in July 2020. Subsequently, the Council of State and the Ministry of Interior confirmed that the bill had been submitted to the House of Representatives on 2 June 2021.

On 4 October 2021, following its plenary meeting, the Standing Committee of the Interior under the House of Representatives released its report on the bill. The report outlines several questions to be addressed by the Dutch Government.

The Dutch Government responded to the report on 14 December 2021, providing suggested amendments to the bill and outlining that although the Government agrees with the House on many points, it also advocates for the rapid implementation of the Directive. It is now up to the Standing Committee to assess whether they believe that their questions have been sufficiently answered by the Government, in which case the bill will be put forward for plenary discussion.

Poland

On 18 October 2021, the Ministry of Family and Social Policy published a draft act on the protection of persons who report violations of the law. The draft act aims to ensure the implementation of the Directive and will establish the first comprehensive regulation concerning the protection of whistleblowers. The Ministry had been seeking comments on the draft act until 17 November 2021.

Romania

Earlier in 2021, the Ministry of Justice launched a public consultation on a draft law for the protection of whistleblowers and for the transposition of the Directive. If enacted, the draft law would expand on existing legislation which currently applies to the public sector only.

The draft law was most recently updated on 14 December 2021 which, according to the Ministry, maintains the existing national standard, offering broader and enhanced protection as compared to the minimum standards under the Directive. Such draft law has now been submitted to the Government for adoption.

Slovakia

At present, whistleblower protection is regulated by Act No. 54/2019 Coll. on the Protection of Whistleblower. Indeed, there have been proposals for designating specific government bodies for transposition of EU directives, including the Directive, which entail amending the existing law.

In March 2021 in particular, the Office of the Slovakian Government finalised materials for implementing the Directive, including a draft law, and commenced its interdepartmental consultation procedure on the same. As of 25 November 2021, the Office is considering feedback from the consultation. If enacted, the draft law would become enforceable from 1 May 2022.

Slovenia

The National Assembly passed the Act amending the Integrity and Prevention of Corruption Act No. 158/20 in October 2020 to afford further protection to whistleblowers. However, it is unclear whether these amendments were intended to transpose the Directive.

Separately, on 9 December 2021, the Ministry of Justice published a draft proposal to transpose the Directive. The proposal is currently open for stakeholder feedback until 23 December 2021.

Members States with proposals in place

Austria

There is no publicly available draft bill implementing the Directive. However, the Federal Minister of Labour had indicated, in August 2020, that a bill is currently being worked on, which would be submitted to the Austrian Parliament in autumn 2021. Although Members of Parliament have since sought for an update on the draft bill, the Minister has not yet responded.

Belgium

On 9 January 2021, the Belgian Parliament passed a motion for a resolution on measures to protect whistleblowers and for the implementation of the Directive. The motion confirms Belgium's commitment to transposing the Directive and outlines recommendations for developing a draft framework.

Bulgaria

The Ministry of Justice launched a public consultation on the implementation of the Directive in September 2021, alongside publishing its proposed structure for a draft law. The public consultation closed on 18 October 2021.

Germany

According to a statement from Minister Christine Lambrecht on 20 January 2021, a draft law for the implementation of the Directive has been submitted. However, to date, such draft law has not been made publicly available.

Greece

On 1 June 2020, the Greek Government established a special drafting committee for the preparation of a draft law to transpose the Directive. Since then, there have been calls to the Prime Minister for implementation.

Italy

In January 2021, the Senate announced discussions by the Government delegation on the transposition of the Directive. Subsequently, on 20 April 2021, the Italian Government approved principles and guiding criteria for the implementation of the Directive.

Luxembourg

According to an interview on 4 February 2020 with Samantha Tamson, the Minister of Justice, the transposition of the Directive in Luxembourg is in progress.

Spain

An initial whistleblowing law proposal for transposing the Directive was introduced to Congress on 30 May 2019. On 4 February 2021, questions were submitted to the Spanish Government regarding the transposition of the Directive, and the Government's written response was expected by 10 March 2021. Meanwhile, the Ministry of Justice also launched a public consultation on the transposition of the Directive which ended on 27 January 2021.

Member States that have not started

Cyprus

Cyprus has not yet officially commenced the process of implementing the Directive.

Hungary

Hungary has not yet officially commenced the process of implementing the Directive. However, Hungary does have an existing whistleblowing law in place.

Keeping track of the Directive

It is clear that the Directive will remain at the forefront of 2022, as Member States continue to enact national transposition laws. Notably, according to the Dutch Ministry of the Interior and Kingdom Relations, the European Commission has already issued letters to governments, informing them that it will take all necessary measures to ensure effective implementation of the Directive immediately after 17 December 2021 through, for example, the issuance fines or penalties to Member States.

To continue tracking the Directive and the progress of Member States, please visit the OneTrust DataGuidance Whistleblowing Portal.

Karan Chao Privacy Analyst
[email protected]
Bahar Toto Privacy Analyst
[email protected]