I. Introduction: Added Value of Whistleblower Protection

Unlawful activities may occur in any organisation, whether private or public, large or small. People who work for an organisation are often the first to know about such occurrences and are, therefore, in a privileged position to inform those who can address the problem. Recent scandals, such as Dieselgate, Luxleaks, the Panama Papers, Cambridge Analytica, or Danske Bank, came to light thanks to whistleblowers who “raised the alarm” about unlawful activities harming the environment, public health, data protection, and national or EU public finances. In fact, alongside complaints and audits, whistleblower reports are an important means of providing national and EU enforcement systems with information leading to effective detection, investigation, and prosecution of breaches of EU rules.

Yet, whistleblowers often risk their careers and livelihoods and, in some cases, suffer severe and long-lasting financial, health, reputational, and personal repercussions. Fear of retaliation dissuades people from coming forward with their concerns. For example, according to the 2017 Special Eurobarometer on Corruption¹ around one in three of all Europeans (29 %) think that people may not report corruption because there is no protection for those reporting it. The effective protection of whistleblowers against retaliation is therefore essential in order to safeguard the public interest, to protect freedom of expression and media freedom (as whistleblowers are vital sources for investigative journalism), and to promote transparency, accountability and democratic governance in general.

II. Need for Action at the EU Level

Currently, the protection afforded to whistleblowers across the EU is fragmented and insufficient. Some Member States have comprehensive legislation in place, but most offer only sectoral protection, e.g. in the fight against corruption, or only for public servants, whilst some provide no protection at all. At the EU level, whistleblower protection is provided for only in specific sectors, such as financial services, transport safety, and environmental protection, and only to varying degrees. This lack of effective protection across the EU can undermine the level-playing field needed for the internal market to function properly and for business to operate in a healthy competitive environment. It can result in unsafe products being placed on the internal market, in pollution of the environment, or in other risks to public health and transport safety, which go beyond national borders. It can make it more difficult to detect, prevent, and deter fraud, corruption, and other illegal activities affecting the financial interests of the EU.

III. Common Minimum Standards of Protection Proposed by the European Commission

On 23 April 2018, the European Commission published a proposal for a Directive on whistleblower protection,² precisely to strengthen the enforcement of EU rules in areas where violations can seriously harm the public interest. It draws upon the European Court of Human Rights case law on the right to freedom of expression and the Council of Europe 2014 Recommendation on Protection of Whistleblowers.³

1. Personal and material scope

The proposed Directive aims at ensuring that all Member States have common high standards of protection for whistleblowers who unveil illegal activities relating to a wide range of EU policy areas, namely:

• Public procurement;

• Financial services, anti-money laundering, and counter-terrorist financing;

• Product safety;

• Transport safety;

• Environmental protection;

• Nuclear safety;

• Public health;

• Food and feed safety, animal health and welfare;

• Consumer protection;

• Protection of privacy and personal data, and security of network and information systems.

The proposal also applies to the reporting of breaches relating to Union competition rules, to breaches harming the EU’s financial interests, and – in view of their negative impact on the proper functioning of the internal market – to breaches or abuses of corporate tax rules.

The proposed Directive protects from retaliation whistleblowers who acted in good faith, i.e., those who had reasonable grounds to believe the information reported was true at the time of reporting and that this information fell within the scope of the Directive.

It provides protection to the broadest possible range of persons, who, by virtue of work-related activities (irrespective of the nature of these activities and whether they are paid or not), have privileged access to information about violations of EU rules that can cause serious harm to the public interest and who may suffer retaliation if they report them. The proposal thus protects not only employees, but also self-employed service providers, contractors, suppliers, shareholders, volunteers, unpaid trainees, and job applicants.

2. Reporting channels and information

Potential whistleblowers should have clear, user-friendly reporting channels available to them to report both internally (within an organisation) and externally (to an outside authority). Member States should thus ensure that legal entities in both the private and the public sectors establish appropriate internal reporting channels and procedures for receiving and following up on reports. As a rule, all private companies with more than 50 employees or with an annual turnover of more than €10 million and all State and regional administrations, as well as local municipalities of over 10,000 inhabitants, are obliged to set up internal reporting channels ensuring confidentiality of the identity of the whistleblower.

In addition, Member States must identify the authorities that will be tasked with receiving and following up on reports. These authorities should put in place specific channels to allow for reporting and, follow-up on the reports received. Both in the context of internal and external channels it is necessary that the whistleblower receives, within a reasonable timeframe, feedback about the follow up to the report. This is crucial to build trust in the effectiveness of the overall system of whistleblower protection and reduces the likelihood of further unnecessary reports or public disclosures. Accordingly, it is provided that such feedback should be given to the whistlebower within three months (for competent authorities, this can be extended up to six months in complex cases). 

One of the main factors that has a dissuasive effect on potential whistleblowers is the lack of knowledge of how and where to report and what protection is available. For this reason, the proposal aims to ensure that potential whistleblowers can easily access all the information they need with a view to making an informed decision about reporting.

• Firstly, all the private and public entities obliged to have in place internal reporting channels are also obliged to provide clear and easily accessible information on the procedures for reporting, but also on how and under what conditions reports can be made externally to competent authorities.

• Secondly, all competent authorities have to publish on their websites information, amongst others, on: the contact details for the reporting channels and the applicable procedures and confidentiality regime; the nature of the follow up to be given to reports; the conditions for protection; the remedies available in case of retaliation and the possibilities to receive confidential advice. All information regarding reports should be transparent, easily understandable and reliable, in order to promote and not deter reporting.

• Thirdly, Member States should ensure that the general public has access to comprehensive and independent information and advice − free of charge − on available procedures and remedies. For example, such advice should be available on whether the information is covered by the applicable rules on whistleblower protection, which reporting channel may best be used, and which alternative procedures are available in case the information is not covered by the applicable rules. Access to such advice is crucial to ensuring that reports are made through the appropriate channels in a responsible manner and to ensuring that breaches and wrongdoings are detected in a timely manner or even prevented.

3. Reporting conditions

In general, a whistleblower should first report information to his/her employer using internal reporting channels. This is necessary in order to ensure that information on violations of EU rules swiftly reaches those closest to the source of the problem and most capable of addressing it. This also helps prevent unjustified reputational damages. However, a whistleblower can also go directly to the competent state authorities and, where relevant, to EU bodies, if:

• Internal channels do not exist (e.g., in small and micro companies);

• The use of internal channels is not mandatory (e.g., in case of non-employees);

• Internal channels were used but did not function properly or they could not reasonably be expected to function properly;

• The latter may apply, for instance, in cases of fear of retaliation, concerns about confidentiality, the possible implication of upper management in the violation, fear that evidence might be concealed or destroyed or if urgent action is required because of an imminent, substantial danger to the life, health, and safety of persons or to the environment.

In addition, EU law already allows whistleblowers to report directly to national authorities or EU bodies concerning cases of fraud against the EU budget, the prevention and detection of money laundering and terrorist financing, and in the area of financial services.

The proposed Directive also provides protection to those whistleblowers who publicly disclose information (e.g., via social media, to the media, to elected officials, to civil society organisations, etc.) as a means of last resort. This is the case where internal and/or external channels:

• Did not function properly (e.g., the reported violation was not properly investigated or remained unaddressed) or

• Could not reasonably be expected to function properly (e.g., in cases when it is reasonable to suspect a collusion between the perpetrator of the crime and the state authorities responsible for prosecuting them, or in cases of urgent or grave danger for the public interest or risk of irreversible damage, such as harm to physical integrity).

4. Protection against retaliation

Where retaliation remains undeterred and unpunished, it has an intimidating effect on potential whistleblowers. This is why the proposal obliges Member States to prohibit any form of retaliation. To further strengthen the dissuasive effect of the prohibition, it requires them to provide for personal liability and effective, proportionate penalties for the perpetrators of retaliation

Effective protection of reporting persons requires a broad definition of retaliation, encompassing any act or omission prompted by the reporting that occurs in a work-related context and causes or may cause unjustified detriment to the reporting person. The proposal sets out a long, indicative list of forms that retaliation may take and that shall be prohibited. These include typical retaliatory measures taken against employees, e.g., dismissal, demotion, reduction in wages, negative performance assessment, intimidation or harassment, discrimination, disadvantage or unfair treatment. They also include forms of retaliation that may be suffered by non-employees, e.g., non-renewal or early termination of a temporary employment contract; damage, including to the person’s reputation, or financial loss, including loss of business and loss of income; blacklisting or early termination or cancellation of a contract for goods or services.

In addition, the proposal provides for protection against both direct and indirect retaliation. This may consist in retaliatory measures against the reporting persons taken by their employer or the customer/recipient of services. This also extends to persons working for or acting on behalf of the latter, including co-workers and managers in the same organisation or in other organisations to which the reporting person has contact in the context of his/her work-related activities − where retaliation is recommended or tolerated by the person concerned.

Protection is to be provided in cases of retaliatory measures taken against the reporting person him/herself but also those measures that may be taken against the legal entity he/she represents. Indirect retaliation also includes actions taken against relatives of the reporting person, who are also in a work-related connection with the latter’s employer or customer/recipient of services, and workers’ representatives who have provided support to the reporting person.

If whistleblowers do suffer retaliation, the proposal provides for a set of measures to protect them. First and foremost, it is also essential that reporting persons who suffer retaliation have access to legal remedies. The type of retaliation suffered determines the appropriate remedy in each case. It may take the form of actions for reinstatement or for restoration of a cancelled contract, compensation for actual/future financial losses or for other economic damage, e.g., legal expenses and cost of medical treatment.

Interim remedies to halt ongoing retaliation, e.g., workplace harassment, or to prevent dismissal are of particular importance for reporting persons, pending the resolution of potentially protracted legal proceedings. Moreover, retaliatory measures are likely to be presented as being justified on grounds other than the reporting. It can be very difficult for whistleblowers to prove the link between the retaliatory measures and the reporting. The perpetrators of retaliation may have greater power and resources to document the action taken and the reasoning behind it. This is why the reversal of the burden of proof in judicial proceedings is an essential protection measure. It means that, once the whistleblower has demonstrated prima facie that he/she made a report or public disclosure and suffered a detriment, it is up to the person who has undertaken the detrimental action to prove that it was not an act of retaliation but instead based exclusively on justified grounds.

Whistleblowers also should not incur any liability for having breached a confidentiality clause or non-disclosure agreement. Individuals’ legal or contractual obligations, such as loyalty clauses in contracts or confidentiality/non-disclosure agreements, cannot preclude employees from reporting, to deny protection, or to penalize employees for having done so. Other measures relate to protection in judicial proceedings: if legal actions are taken against whistleblowers outside the work-related context (such as proceedings for defamation, breach of copyright, or breach of secrecy), whistleblowers will be able to rely on having reported in accordance with the proposed rules as a defense to seek dismissal of the case.

5. Protection of the rights of persons affected by whistleblower reports

The proposal aims at protecting responsible whistleblowing, genuinely intended to safeguard the public interest, while proactively discouraging malicious whistleblowing and preventing unjustified reputational damage. The tiered use of channels − whereby, as a rule, the whistleblower should first report to his/her employer and, only if internal channels do not exist or do not function, to the competent authorities, and then, only as a last resort, to the public − already provides an essential guarantee against such damages. Moreover, persons affected by the reports fully enjoy the presumption of innocence, the right to an effective remedy and to a fair trial, and the rights of defence. Additionally, the proposal also requires Member States to introduce effective, proportionate, and dissuasive penalties for those who make malicious or abusive reports or disclosures.

IV. Conclusion

The Commission proposal sets out a sorely needed legal framework to provide robust protection for whistleblowers across the EU. It follows a very balanced approach, in particular in terms of limiting the burden for national authorities and businesses, particularly small companies and microcompanies. Moreover, it strikes a balance between the need to protect whistleblowers and those who are affected by the reports, in order to avoid reporting abuses.

While in line with the principle of subsidiarity at the EU level, the proposed Directive establishes whistleblower protection measures targeting the enforcement of Union law in specific areas. When transposing the directive, the Commission encourages the Member States to consider extending the application of its rules to other areas and, more generally, to ensure a comprehensive and coherent framework at the national level.

A consistently high level of protection of whistleblowers throughout the EU will encourage people to report wrongdoing that may harm the public interest. It will also enhance openness and accountability in government and corporate workplaces as well as contribute to enabling journalists to perform their fundamental role in European democracies.