What has happened since the transposition deadline?

Commission infringement procedures begins

On 27 January 2022, the Commission sent letters of formal notice to the following 24 Member States for their failure to transpose the Directive: Austria, Belgium, Bulgaria, Croatia, Cyprus, Czechia, Denmark, Estonia, Finland, France, Germany, Greece, Hungary, Ireland, Italy, Latvia, Lithuania, Luxembourg, the Netherlands, Poland, Romania, Slovakia, Slovenia, and Spain.

Later in February 2022, the Commission also sent formal letters to Portugal and Sweden as a result of their laws having a delayed entry into force. Indeed, despite enacting new whistleblowing laws well before the December 2021 deadline, the Portuguese law will enter into effect on 19 June 2022, while the Swedish law will become fully operational only from 17 July 2022.

Although there have been no updates from the Commission since its announcements, Member States typically have two months to reply, after which the Commission may send a further reasoned opinion with a formal request to comply.

More Member States transpose the Directive

Malta

A day after the transposition deadline, on 18 December 2021, Malta became the fifth Member State to implement the Directive. Following a relatively short period of consideration within the Maltese Parliament, the Protection of the Whistleblower (Amendment) Act (Act No. LXVII of 2021) was enacted to amend the existing Protection of the Whistleblower Act (Cap. 527), and entered into effect on 24 December 2021.

In addition to incorporating the minimum provisions outlined by the Directive, the amended law includes definitions for concepts beyond the Directive, such as 'corrupt' and 'improper' practices, as well as provisions to address whistleblower immunity and to provide for penalties of up to €10,000. Notably, the amended law also provides that anonymous reporting is not considered a protected disclosure, although some protections may still be afforded.

Latvia

On 20 January 2022, the Cabinet of Ministers announced that the Latvian Parliament had approved a new law on 'raising alarms', which was signed into law shortly thereafter and entered into force on 4 February 2022.

While the new law replaces the previous framework established in 2018, it retains many of the existing provisions, such as the State Chancellery's position as the point of contact for all whistleblowers, distinct rules to protect the identity of accused persons, and administrative liability for various offences. As is the case with Denmark, the new law does not explicitly address the possibility of anonymous reporting, notwithstanding the fact that reports must contain certain information about the whistleblower so as to allow the provision of feedback.

Cyprus

Following suit, the House of Representatives in Cyprus voted into law a bill for the implementation of the Directive on 20 January 2022. Published in the Official Gazette on 4 February 2022, the new law does not explicitly clarify its date of operation; however, it does provide for a transitional period for legal entities with 50 to 249 workers until 17 December 2022, as outlined in the Directive.

As the first comprehensive legislation on whistleblowing in the country, the provisions of the new law follow a similar structure to the Directive. Nevertheless, unlike other transposition laws from other Member States, it also establishes criminal offences for both persons who violate its provisions and those who knowingly make false statements, namely of up to three years in prison or €30,000. In relation to anonymous reporting, although the new law acknowledges that anonymous whistleblowers are entitled to protection, it does neither explicitly address procedures for receiving such reports, nor require organisations to accept them.

France

A law aimed at improving the protection of whistleblowers received presidential approval on 21 March 2022, after much anticipation and several rounds of revisions which first began in July 2021. Alongside the new law, an accompanying law was also enacted to enhance the powers of the Defender of Rights.

Entering into effect six months after its promulgation, i.e. on 1 September 2022, the new law primarily includes reforms to Law No. 2016-1691 of 9 December 2016 on Transparency, Corruption, and Modernisation of the Economy ('Sapin II'), and various other labour laws, to align with the Directive. For example, it redefines the term 'whistleblower', removes previous structures and requirements for whistleblowers to report internally before externally, and generally widens conditions for protection. Notably, organisations may now face a fine of €60,000 for any abusive or dilatory court action against a whistleblower.

Croatia

In April 2022, Croatia became the latest Member State to transpose the Directive, replacing its 2019 framework with a new act which incorporates both new and existing provisions. Whereas the new act entered into force eight days after its publication, i.e. on 23 April 2022, certain employers also benefit from a two-to-three-month transition period.

As a result of the new act, the scope of whistleblower protection afforded in Croatia now encompasses the reporting of violations of national law which endanger the public interest. However, compared to the previous act, the new act no longer explicitly refers to a strict obligation of good faith on the whistleblower's part. Instead, whistleblowers are entitled to protection if they have reasonable grounds to believe their information is true, as is established by the Directive. That said, the new act retains existing administrative penalties of up to HRK 30,000 (approx. €3,980).

New draft laws introduced

In addition to the above, progress was also seen in several countries.

For the first time since announcing plans to implement the Directive, Belgium, Germany, Luxembourg, and Spain were among the Member States introducing new draft laws since the transposition deadline.

It is currently unclear whether these draft laws will progress to the next stage and eventually be presented for parliamentary or legislative approval. However, the draft law in Spain, for example, has already received Government approval as of March 2022.

Likewise, Poland has since resumed the development of its draft act after a six-month hiatus, when the Ministry of Family and Social Policy published, in April 2022, a new version of the draft act, based on comments made during its public consultation. Even so, this new version is yet to be submitted to the relevant governmental committees, which will be required before it can be considered in Parliament.

Further legislative progress continues

Other Member States are further along in the legislative progress of implementing the Directive, such as Estonia, Ireland, the Netherlands, and Romania.

In Estonia, for instance, the proposed law passed its first reading in Parliament on 26 January 2022 and is expected to be tabled for a second reading. While a deadline for amendments had been set for 8 February 2022, movement in this has since stalled.

Bills in Ireland and Netherlands have also continued their legislative journeys in Parliament, with the lower house of Parliament in Ireland most recently amending its bill for the second time, before passing and submitting the same to the upper house on 27 April 2022.

Likewise, in Romania, a draft law was presented to the Chamber of Deputies, following its adoption by the Senate on 19 April 2022. The opinions of several committees are currently awaited. The deadline for tabling amendments is 9 May 2022, with the deadline for submitting committee reports set for 18 May 2022.

What's next?

While many Member States may be far from implementing the Directive, further progress is highly anticipated and indeed expected in the coming months.

For example, the Czech Republic had made considerable development prior to its government elections, which had resulted in the proposed bill being abandoned. That said, unofficial reports have suggested that such bill is expected to be reintroduced to the Chamber of Deputies with amendments very shortly.

Bills in countries mentioned above, such as Estonia, Ireland, the Netherlands, and Romania, are also in the later stages of consideration and expected to gain momentum within their respective Parliaments. Finland, similarly, has experienced significant delays, having first introduced proposals in 2018, the consideration of which had been delayed numerous times. Notwithstanding this, the Ministry of Justice has confirmed that its proposals will be presented in the 38th week of 2022, i.e. in September.

Despite its lack of a federal draft law, several provinces and states in Austria, namely the Province of Tyrol and the State of Burgenland, have already enacted their own laws to transpose the Directive. Although these laws relate to the internal organisation of the provincial/state agencies, as well as other public entities subject to provincial/state legislation, a federal law is likely to follow.

Similarly, in Italy, the Ministry of Justice confirmed, on 16 February 2022, that a new legislative delegation to transpose the Directive had been approved by the Chamber of Deputies and is currently awaiting approval by the Senate. Finally, consultation feedback is also expected with regards to the draft laws in Slovakia and Slovenia.

Transposition status at a glance

Keeping track of the Directive

To continue tracking the Directive and the progress of Member States as soon as updates become available, including access to the relevant legislative portals and official texts, please visit the OneTrust DataGuidance Whistleblowing Portal.

Karan Chao Senior Privacy Analyst
[email protected]