On December 17, 2021, when the deadline for implementing the EU Whistleblowing Directive expires – or, at the latest, when corresponding national whistleblower protection laws come into force – member states of the European Union will be facing significant changes in whistleblower protection. Companies should start preparing now for these changes, if they have not already done so.

1. When do the changes come into force and what is the implementation status across the EU?

The Directive and the changes stipulated therein — including minimum standards and, most importantly, the obligation to set up internal reporting channels (see more in our earlier Littler Insight) — were supposed to be implemented and transposed into national law by EU member states by December 17, 2021 at the latest.

As set out in the attached map, Denmark and Sweden are currently the only member states that have adopted their own national whistleblowing laws by implementing the rules of the Directive. In addition, there are some countries where draft bills for implementation already exist, which will be probably passed (shortly) after the deadline. Some countries, however, have not even worked out a corresponding draft bill and the deadline is, therefore, missed.

In order to ensure compliance, employers should therefore keep a close eye on any related legislative developments in those countries where they do business and have operations.

2. What happens if any of the member states do not implement the Directive in time?

Even before a national law is passed, the Directive and its rules could be applied in the EU member states. There are legitimate arguments that the Directive applies immediately, at least vis-à-vis public employers. Accordingly, an employee retaliated by the employer in the public sector in connection with whistleblowing activities is protected by the Directive from today on.

Furthermore, employers must be aware that even without a national law, labor courts could also consider a protection standard similar to the Directive by interpreting local law accordingly.

It is therefore not only advisable for employers to get familiar with the Directive, but to ensure compliance even at this initial stage.

3. Which employers need to implement protective measures and from when?

The Directive applies to all employers under private and public law. However, only employers with usually at least 50 employees (or more) are obliged to set up internal reporting channels. Whereas employers with 250 employees or more are obliged to set up these systems by December 17, 2021, employers with generally 50 to 249 employees have until December 17, 2023 to set up internal reporting units.

Public employers are, as explained, subject to the Directive already as of today. Private employers with 250+ employees will be bound by the Directive’s minimum standards and, potentially, even stricter rules once the local law is enacted.

4. Is it possible to put in place a global whistleblower policy? Can I use the whistleblowing channels already set-up?

Following several questions as to whether it would be considered sufficient to establish one central (e.g., global) reporting channel for all entities, the European Commission has stated that the Directive requires employers to offer reporting channels on a local entity level. This requirement would apply even within multinational employers and organizations that already have established and run central whistleblowing hotlines.

It remains to be seen whether the European Court of Justice will share this legal opinion of the European Commission. In addition, local laws of the member states might also include such stricter rules. In the meantime, the comments of the European Commission should be taken into consideration when evaluating compliance with legal whistleblowing protection standards.

A practical workaround could be for employers to have one global reporting channel and policy that is employee-facing with any country differences flagged (e.g., in an appendix) and incorporated locally. With regards to the reporting channel, employers can work with third-party service providers to establish a user-friendly technical solution and meet the requirements laid out above.

Within Littler, we have partnered with WhistleB and set up our own system: Littler | Whistle Protect, which enables companies to set up various local channels under a central case management.

5. What steps should employers with EU operations take now, even if no national laws have been passed in their countries of operation?

Multinational employers should consider taking proactive steps, such as those noted below, to prepare for and ensure EU whistleblowing compliance:

• Understand legal requirements and identify requirements relevant for the company;
• Select an appropriate reporting system;
• Design reporting channel(s) and case handling processes;
• Consider operational co-determination obligations of employee representative bodies (e.g., works councils);
• Prepare communications; and
• Understand the consequences of the failure to adopt measures on time or in compliance with the Directive.

We prepared initial guidance with everything employers need to know and consider in a useful checklist. Please contact Deike Helmig at d.helmig@vangard.de to obtain a complimentary copy of this resource.

Selected national highlights to know:

• Belgium, France, Ireland and the Netherlands all have whistleblowing policies in place that only (slightly) need to be adapted to cover the scope of the Directive
    
• The draft bill in Poland suggests penalties for non-compliance including fines, restrictions of freedom or imprisonment for up to three years
    
• Germany’s former draft bill, which – in comparison to the Directive – included a much broader scope of areas of law to be included, was not passed before recent federal elections in September 2021
    
• The Spanish draft bill suggests sanctions ranging from Euro 10,000 to Euro 300,000 for infringements in relation to whistleblowing regulation
   

Download graphic