For various reasons, including cultural attitudes towards whistleblowing, the protection afforded to whistleblowers across Member States is heavily inconsistent and in many jurisdictions applies only to specific industries or disparate groups of employees. The Whistleblowing Directive has been introduced by the EU as a harmonisation process, to ensure rigorous protection is afforded to whistleblowers across all Member States.

However, in its attempt to bring all jurisdictions into line, the EU has included some requirements which may be impossible (or, at least, highly impracticable) for some multinational businesses to implement. The delay in transposing the Whistleblowing Directive into national law in many Member States has further compounded matters, leaving some businesses unsure as to how to proceed.

In this article, we look at some of the key practical issues resulting from the Whistleblowing Directive and consider how businesses can best respond.

Failure to transpose the Whistleblowing Directive

As at the deadline of 17 December 2021, only Denmark, Lithuania, Malta, Portugal, and Sweden had transposed the Whistleblowing Directive into national law. Even at the beginning of April 2022, just eight of the 27 Member States have adopted new whistleblower protection legislation to ensure its transposition.

While delays in implementing EU directives are not uncommon, it does not appear that all Member States are taking whistleblower protection seriously and the European Commission ('the Commission') sent letters of formal notice to 24 Member States in January 2022 due to their failure to transpose the Whistleblowing Directive.

It is not yet possible to classify any Member State as having fully transposed the Whistleblowing Directive.  Adopting a law is only the first step and it is often the case that the law does not enter into force immediately, with further regulations and administrative provisions needing to be implemented. Even though Portugal and Sweden transposed the Whistleblowing Directive by the December 2021 deadline, in February 2022 the Commission confirmed its decision to send them letters of formal notice on account of the fact that the transposition measures they had adopted meant that their national laws would not fully enter into force until later in the year.

In addition, each Member State is required to report on the work done to the Commission, who must then assess whether the national legal framework is in line with the Whistleblowing Directive. Member States who fail to comply with the Whistleblowing Directive's minimum standards will face an infringement procedure and potential financial penalties.

Lack of transparency

While it is important to meet the deadline for transposition, it should not be at the cost of a transparent process. For example, in Greece (where the Whistleblowing Directive is yet to be implemented), the government has refused to share information about the work of the committee in charge of drafting the law, whilst the government in the Netherlands declined to revise its draft bill to reflect recommendations following a public consultation, arguing it was impossible given the tight timeline. The Dutch bill, now before parliament, has been heavily criticised by stakeholders, academia, employers, employees' organisations, the Council of State ,and even several members of Parliament.

Spain has also seen its draft bill attract a lot of criticism, with serious concerns raised about the negative implications that are anticipated on the freedom of information and democratic governance. Xnet, an activist project in Spain working in fields such as digital rights and democracy, freedom of expression, and the free circulation of culture, knowledge and information, has recommended several amendments be made to the draft bill and called for journalists and other civil society organisations to oppose the bill in an effort to ensure those improvements are made.

It is clear that meaningful consultation with a wide range of stakeholders, including practitioners experienced in working with whistleblowers, will help ensure that the national legislation takes into account the challenges and needs of all those affected by the reform. This will help avoid situations further down the line where loopholes are unearthed that undermine the protection of whistleblowers and it becomes clear that the law does not fulfil its objectives.

Malta only managed to meet the deadline by introducing a bill to amend the current whistleblowing legal framework without circulating a draft or consulting with stakeholders, then rushing the bill through just a few weeks later. The lack of consultation when adopting the current whistleblowing legal framework has led to arguments that some provisions will be unworkable. Whilst the Whistleblowing Directive is clear that the burden of proof is on the employer to show any detrimental treatment is not in any way linked to the reporting of wrongdoing, in its domestic legislation Malta has included a qualified exclusion of retaliation where it is justifiable for administrative or organisational reasons. This relatively low threshold for employers means that the Maltese law arguably fails to offer the intended protection afforded by the Whistleblowing Directive.

Subsidiary reporting channels

One of the key provisions of the Whistleblowing Directive is the requirement for every company or public body in the EU that has 250 or more employees to implement its own internal reporting policy for whistleblowing (private sector companies with between 50 and 249 workers have until 17 December 2023 to introduce their internal reporting channels).

Whilst one interpretation of the Whistleblowing Directive arguably allows for companies to have a group-level whistleblowing regime, the EU Commission Expert Group has confirmed that it is interpreting the Whistleblowing Directive as requiring each subsidiary with 250 or more employees to have a separate internal reporting channel at the local level, and to give whistleblowers the option to report at the local or group level. The Commission was responding to various concerns raised by a number of large corporations in Denmark, Germany, and the Netherlands.

Although the EU Commission's interpretation is not binding on national courts, it is expected to influence national legislators. However, in Denmark, leading multinational companies have been working together to seek a change in how the legislation is implemented to allow for a more practical, centralised regime. This successful lobbying has seen the Danish legislator (the first Member State to transpose the Whistleblowing Directive into national law) appear to hedge its bets and allow larger companies to continue with group-wide reporting channels in its primary legislation. The Ministry of Justice has reserved the right to reverse this decision if the Commission's interpretation stands and it becomes clear that the Whistleblowing Directive is being implemented differently in other Member States (in particular, the larger states). Therefore, Denmark is not really the first Member State to transpose the Whistleblowing Directive into national law and, instead, will wait and see how it is implemented across the EU.

Currently, many international companies use joint whistleblowing schemes. As the Commission recognises, the Whistleblowing Directive provides the possibility for this practice to continue, provided that each individual entity with 50 employees or more implements its own whistleblowing system for internal reports.  These internal systems will be able to be shared with other group entities with less than 250 employees. Group entities with 250 or more employees must not share their internal whistleblowing systems with other entities.

Under the Whistleblowing Directive, group-wide solutions can still be offered at parent/group level, provided a local reporting channel is also established. The whistleblower then has a choice whether to report locally or at a group level. The main issue for mid-size subsidiaries (with 50 to 249 workers) will therefore be around the initial reporting mechanism. The 'fix' is potentially easy, whereby they can simply offer an alternate phone number, email, or point of contact in the relevant Member State (subject, of course, to any restriction imposed at national level).

The larger issue will come for subsidiaries with 250 or more workers, as the Whistleblowing Directive makes no provision for them to pool resources. Potentially, these subsidiaries would have to set up an entirely independent reporting and investigatory channel in addition (or as an alternative) to any group-wide system.  This could have a significant impact on the ability of a group to investigate reports centrally, which has been the preferred option for many until now. However, those Member States that have transposed the Whistleblowing Directive so far have not introduced national laws that expressly prohibit the use of group-wide systems. This is resulting in large companies continuing to maintain centrally run channels for as long as possible and it is clear that the matter will need to be revisited as more Member States come into line.

One further layer of difficulty that will apply to all employers, is with regard to the fact that the Whistleblowing Directive defines a 'reporting person' (i.e. a whistleblower) as 'a natural person who reports or publicly discloses information on breaches acquired in the context of his or her work-related activities'. This broad definition will therefore include shareholders, self-employed people, former employees, and job applicants.  While the matter is defined clearly in the Whistleblowing Directive - and therefore applies as a minimum to all national legislation - employers will need to carefully consider how to ensure they keep records of every oral and written report received, and how to reach those whistleblowers who are not existing employees or workers.

Lack of harmonisation

The Whistleblowing Directive (as with all directives) establishes only the minimum requirements that must be adopted. As such, Member States may choose to 'gold plate' the provisions to cover additional areas, and some jurisdictions have derogated and opted for much broader protection. For example, the draft bill in Germany provides that the whistleblower protection regime shall not only apply to breaches of EU law but also to infringements of German law in many areas.

In addition to the option for jurisdictions to extend the provisions, there are also aspects where the Whistleblowing Directive permits countries to determine their own rules, for example:

• whether businesses and competent authorities are required to accept and follow-up on anonymous whistleblowing reports;
• the scope of breaches which can be reported; and
• penalties for retaliation.

The Whistleblowing Directive is also silent on the requirements on facilitation of and rewards for whistleblowing, leading to the majority of Member States not including such provisions in their legislation.  However, under the Lithuanian whistleblowing law, a competent authority may grant compensation for whistleblowing reports, calculated according to the government's procedure which takes into account the proportional damage caused by the reported violation.

Portugal has opted not to phase in the legislation, meaning that it applies to all Portuguese organisations with 50 or more employees from the outset (as opposed to December 2023), an approach which France is also following (albeit the French legislation is still in draft form and not planned to take effect until September 2022).

France has also confirmed it intends to extend its existing whistleblowing legislation by:

• providing legitimate whistleblowers with immunity from criminal and civil liability;
• including additional support measure such as psychological assistance and coverage of legal fees; and
• increasing sanctions and personal liability for retaliation (with fines of up to €60,000 and/or imprisonment of up to three years).

Accordingly, while one of the main aims of the Whistleblowing Directive is harmonisation, it is possible that multinational businesses will have to manage an assortment of new rules depending upon the approach adopted by the different countries in which they are based.

Implications on employment practices/ multinational companies

These variations will make it difficult for multinational employers to implement a global, 'one-size fits all' approach to whistleblowing.

Global employers will need to carefully monitor local country implementation to ensure they have an approach that both works for the business and achieves compliance. Consideration will need to be given on whether any changes will be required (or are simply desirable) based on the scope of the Whistleblowing Directive and any expanded Member State protections.

In addition, employers who adhere to the US Sarbanes-Oxley Act of 2002 will need to revisit their approach to ensure that it satisfies the most extensive protections implemented by each Member State they operate in, while also continuing to meet US requirements.

Multinational businesses are, therefore, left with a number of questions. Should they await the transposition of the Whistleblowing Directive into national law in the remaining Member States before making any changes to their existing approach, or act now based on the minimum requirements of the Whistleblowing Directive?  Should they adopt a 'per jurisdiction' approach, or abide by the strictest law introduced by a Member State and apply that across the EU? Should they go further and maintain a policy that goes beyond the strictest law in the EU? There is no right answer to each of these points but, for many businesses, adopting a consistent global approach is key and, despite the various delays and challenges, they are having to take proactive steps now to implement the Whistleblowing Directive.

Nicholas Thorpe Partner
[email protected]
Richard Branson Senior Associate
[email protected]
Fieldfisher, Manchester