New protection measures for whistleblowers who report breaches of EU Law

The purpose of this proposal for a Directive is to protect whistleblowers in order to encourage them to inform and reveal information on condemnable acts found in a work context. For this purpose, the proposal establishes minimum standards of common protection rules against possible retaliation against those who inform breaches on areas such as: public health, animals’ health and welfare, public procurement, safety of products, consumers’ protection, protection of privacy and personal data or competition of law.

Private and public entities

The proposal applies to both private and public entities. However, it does not apply to small and micro companies (those having less than 50 employees or those having an annual turnover below 10 million Euros), unless they operate in the financial services sector.

Broad definition of reporting person

The proposal defines the reporting person as any person having access to information through his/her work activities regardless of the nature of the working relationship and of whether or not such person receives any kind of salary. Therefore, shareholders, self employed, volunteers, unpaid trainees or job applicants are included.

In order to be protected, persons must have reasonable grounds to believe that, when reporting, the information reported is true.

Internal and external reporting

The proposal sets two channels and procedures for the reception and follow-up of the reports.

There are two types of reporting channels: internal (within the company) or external (before the authorities). Except for specific cases, internal channels must be used before external ones. In any case, the personal data of the informer and of the person affected by the information reported must always be kept confidential.

Regarding internal reporting, the person or department competent to receive the report must diligently give due course to it and provide feedback to the reporting person within a period not exceeding 3 months.

In addition, entities are required to provide understandable and widely accessible information on these procedures as well as on procedures to report externally to the authorities.

Regarding the external reporting, the authorities of Member States must establish independent and autonomous reporting channels, and they must also provide feedback to the reporting person within a period not exceeding 3 months or 6 months in justified cases.

Both channels must guarantee the confidentiality of the identity of the informant.