A new era of European whistleblowing begins on 17 December 2021, the date by which the so-called Whistleblowing Directive (EU) 2019/1937 must be transposed into national laws of all EU member states. Passed in December 2019, the directive creates an all-new legal framework for whistleblowers, employers, and state authorities.
Probably the most remarkable provision of the directive is that whistleblowers no longer need to contact their employer if they have discovered a violation of the law, but may directly reach out to the competent authorities. At least, employers “shall” create incentives for whistleblowers to first contact established in-house reporting offices. We thus expect employers to be dealing with whistleblower premiums all too soon.
Under current German employment law, to avoid being sanctioned employees must first report discovered breaches of the law internally before they are allowed to turn to the authorities. Exceptions only apply if the matter involves a criminal offence of the employer, if the whistleblower could be liable to prosecution themselves, or if a particularly important public interest is affected. By enacting the national law to implement the directive (there is already a draft circulating), the current German whistleblower practice is thus about to be turned upside down.
Even under the directive, however, employees may only turn to the public (press, social networks), if either no response has been received to an external report within the relevant period or if an expressly defined exception applies (e.g. immediate endangerment of public interests). As these exceptions are subject to interpretation, it is needless to say that turning to the public involves a significant risk for the whistleblower from an employment sanction perspective.
While under the directive only infringements of certain EU law may be reported – in particular public procurement, financial markets, combating money laundering and terrorist financing, product safety, road safety, environmental protection, radiation protection, food safety, animal welfare, public health, consumer protection, and data protection – the directive at the same time allows EU member states to extent the reportable catalogue at their discretion. Accordingly, the German draft particularly includes any violations of the law that are subject to criminal penalties or fines. This makes violations of an indefinite number of laws from all possible areas reportable.
The directive provides that employers with generally at least 50 employees must set up internal reporting offices to which employees can turn to report violations. For certain companies, such as securities trading companies or credit institutions, the minimum threshold does not apply. If employers generally have no more than 249 employees, the internal reporting offices do only have to be established by 17 December 2023.
The internal reporting office can either be set up by the employer itself or be outsourced to an external contractor. We believe that especially smaller companies that just exceed the threshold of 249 employees (or 50 employees as of 17 December 2023), as well as German subsidiaries of international groups, will take the outsourcing route. For this very purpose, Littler partnered up with market-leading whistleblowing experts from WhistleB and created Littler | Whistle Protect, a tailor-made solution for companies to be relieved from establishing their own internal reporting offices.
Neither the directive nor the German draft law stipulate any kind of sanctions for employers who fail to set up internal reporting offices. Apparently, it should be incentive enough that establishing internal reporting offices presumably makes it less likely for whistleblowers to reach out to external reporting offices. Accordingly, exempting small companies from the obligation to set up internal reporting offices is a fig leaf; because if it is true that whistleblowers are more likely to be deterred from turning to external reporting offices if there is an internal reporting office, many small companies will at least voluntarily set up internal reporting channels.
The directive applies to employees and civil servants, but also to members of executive bodies and trainees. When acting as whistleblowers, they are protected against any form of reprisals as long as they only had reasonable grounds to believe that the information reported or disclosed was true and the (allegedly) breached law be covered by the directive (or by the corresponding national law). Prohibited reprisals include everything from reprimands over omission of salary increases to termination of employment. The burden of proof is reversed, so any disadvantage is for a start considered a reprisal if it only occurs after a whistleblowing event.
If the 17 December 2021 deadline is missed, there are indicators for immediate applicability of the directive, at least vis-à-vis public employers. However, employment law sanctions by private employers are also likely to be inadmissible due to the fact that fundamental rights of the Union are affected (Art. 11 CFR - freedom of expression).
Littler will be hosting its “The EU Whistleblowing Directive - The Road to Compliance” webinar on 18 May at 4pm CEST to discuss current legislation and the benefits of implementing a whistleblowing system