Background

The Whistleblowing Directive aims to protect persons who report or publicly disclose breaches of EU law which they have detected or suspect in their work environment. The Whistleblower Protection Act has been published in the Official Gazette of the Netherlands on 3 February 2023¹ and entered into force on 18 February 2023, providing for a transition period for some provisions.

Scope of application and protection of whistleblowers

The scope of the Whistleblower Protection Act is broader than the scope of the Whistleblowing Directive. The following explains the material and personal scope of the Whistleblower Protection Act, taking into account the Whistleblowing Directive and the House for Whistleblowers Act, and describes the protection of whistleblowers.

Extension of protected reports

Under the House for Whistleblowers Act, reports of (suspected) abuses are protected in so far as a public interest is at stake due to a:

• breach of statutory law;

• threat to public health;
• threat to public safety;
• threat to the environment; or
• threat to the proper functioning of the public service or an undertaking due to an improper act or omission.

The Whistleblower Protection Act adds to the above that a report is also protected when the (suspected) abuse involves:

• a breach, or risk of a breach, of EU law that falls within the material scope set out under Article 2 of the Whistleblowing Directive, regarding the areas of public procurement, financial services, products and markets, product safety and compliance, transport safety, protection of the environment, radiation protection and nuclear safety, food and feed safety and animal health and welfare, public health, consumer protection and protection of privacy and personal data, and security of network and information systems; or
• when a public interest is at stake due to a breach, or a risk of a breach, of internal rules that constitute a concrete obligation and that have been established by an employer on the basis of a statutory provision.

Extension of the circle of protected persons

The Whistleblower Protection Act provides protection to all persons who report or disclose a suspected abuse in the context of a work-related activity, regardless of the basis on which they perform those activities. Whilst the House for Whistleblowers Act protects only (former) employees and civil servants, protection now extends to, for example, suppliers, consultants, freelance workers, interns, and job applicants, but also to people assisting the whistleblower and internal investigators.

Protection measures for whistleblowers

Under the House for Whistleblowers Act, it is prohibited to place a whistleblower, during or after the report, at a 'disadvantage' in their legal position, such as through dismissal or wage reduction. This prohibition is extended under the Whistleblower Protection Act to any form of disadvantage to a whistleblower, including for example a negative assessment, exclusion, change of work location, defamation, or premature termination of a contract for the supply of goods or services.

Another protection measure under the Whistleblower Protection Act provides that a causal link between a report and a disadvantage of the whistleblower will be assumed in the event the whistleblower demonstrates the presence of both, and the burden of proof is shifted to the employer. Further, whistleblowers cannot be held liable for, for example, violation of confidentiality, defamation, or copyright infringement that took place in the context of the report, provided that the whistleblower has had reasonable grounds to believe that the reporting was necessary to reveal the abuse and such reporting is done in accordance with the Whistleblower Protection Act. In legal proceedings in which the reporter is held liable for offences by the employer, the burden of proof lies with the employer.

Whistleblowers receive the protection irrespective of whether they report internally or externally, as the Whistleblower Protection Act removes the requirement of reporting internally first.

Reporting procedure to be setup by employers

The Whistleblower Protection Act maintains the existing requirement for employers with more than 50 employees to have an internal reporting procedure. The threshold of 50 employees does, however, not apply to entities falling within the scope of Union acts referred to in Parts I(B) and II of the Annex to the Whistleblowing Directive, which must have an internal reporting procedure irrespective of their size. Among others, the following should be taken into account by employers:

• the internal reporting procedure must be extended to regulate the report of a breach of EU law, following the implementation of the Whistleblowing Directive;
• the internal reporting procedure should, among others:
  • provide how to handle an internal report;
  • describe when it concerns an abuse as meant under the House for Whistleblowers Act (and now the Whistleblower Protection Act);
  • outline how and to whom a report can be made, whereby the new requirements provide that the procedure should set out how a report can be made anonymously and that the whistleblower must be informed of receipt of the report within seven days, as well as about follow-up steps that are taken within three months;
• employees must be informed about the procedure, how a regulated abuse can be reported externally, and what legal protection employees receive in case they file a report;
• reports must be registered and stored in a register set up for this purpose;
• the identity of the reporter may not be disclosed without their consent;
• confidential information in context of the report must kept secret within the organisation, except when reporting certain information is legally obliged; and
• private sector employers with 50 to 249 employees may share resources for receiving a report, as well as for conducting investigations thereof.

Enforcement and sanctions

The Whistleblower Protection Act lists the authorities that are competent to receive and investigate a report, such as the Dutch House for Whistleblowers and sector specific authorities, such as the Netherlands Authority for Consumers and Markets ('ACM'), the Dutch Authority for the Financial Markets ('AFM'), and the Dutch data protection authority ('AP').

According to the Whistleblowing Directive, Member States must have penalties in place for acts, such as hindering the reporter, as well as for knowingly reporting false information. According to the explanatory memorandum to the Whistleblower Protection Act, Dutch law already complies with this obligation through criminal law and civil law. Further, the Whistleblower Protection Act provides the House for Whistleblowers with the power to impose administrative fines on employers, the range of which to be determined by an order in council.

Next steps

Whilst sector specific rules may apply, generally:

• companies with more than 250 employees must comply with their internal reporting procedure obligations under the Whistleblower Protection Act upon entry into force; and
• companies with 50 to 249 employees must establish or update their internal reporting procedure to meet the requirements of the new Whistleblower Protection Act by the end of the transition period on 17 December 2023; volunteers and trainees who are remunerated will also count towards determining the number of 50 people.

Fenneke Buskermolen Associate
[email protected]
Hogan Lovells, Amsterdam

1. Available at: https://zoek.officielebekendmakingen.nl/stb-2023-29.html (only available in Dutch)