New rules for the protection of whistleblowers of breaches of EU law

On October 7, 2019 the Council of the European Union adopted a new Directive that establishes that from 2021 every EU Member State must have in effect laws that protect individuals who report breaches of EU law in certain areas such as public procurement; products and markets; prevention of money laundering; product and safety compliance; protection of the environment; food safety; public health; animal health; consumer protection; and protection of privacy and personal data.

Whistle-blowing channels and procedures

According to the new Directive, public and private entities of over 50 employees and municipalities of more than 10 000 inhabitants shall have to create and properly operate efficient whistle-blowing channels and procedures for internal reporting of breaches of EU law. Such channels shall be available for use by, at least, workers, public servants, self-employed persons, trainees, shareholders and persons belonging to the administrative, management or supervisory bodies of the entity or municipality in question, but also by any persons working under the supervision and direction of its contractors, subcontractors and suppliers. The whistle-blowing channels may be operated internally or externally by a third party and shall permit reporting in writing, orally or both.

Whistle-blowers shall be encouraged to use internal channels within their organization first, before turning to external channels of public authorities. However, internal reporting procedures shall include clear and easily accessible information regarding how to report breaches to competent authorities and whistle-blowers shall not lose the protections contemplated in the Directive if they chose to use external channels first. Once a report on a breach is received, acknowledgment of its receipt shall have to be provided to the whistle-blower within seven days of its receipt and feedback on the investigation and the measures that have been or will be adopted in connection with the reported breach shall be provided within three months.

Protection of whistle-blowers

All entities affected by the provisions of the Directive shall ensure that, except if required under EU or national law in the context of investigations by national authorities or judicial proceedings, the identity of the reporting persons is not disclosed to anyone that is not a person of the authorized staff members competent to receive or follow-up on reports. Additionally, no whistle-blower that reports a breach in good faith shall suffer any kind of retaliation, including, being suspended, demoted and intimidated. Those assisting whistle-blowers, such as colleagues and relatives, shall be protected as well. The Directive also includes a list of support measures for whistleblowers which shall have to be put in place in all Member States, including effective assistance from competent authorities to whistle-blowers in the event of retaliation.

Furthermore, Member States shall have laws with penalties for persons that hinder reporting, retaliate against whistle-blowers that report in good faith or breach confidentiality of whistle-blowers, and for whistle-blowers who knowingly report or publicly disclose false information.