The EU Whistleblowing Directive: the path to implementation
Written By
The EU Whistleblowing Directive requires all EU Member States to implement legislation obliging all companies with 50 or more workers to: (i) put in place appropriate reporting channels to enable those workers to report breaches of EU law; and (ii) ensure that those making whistleblowing reports are legally protected against retaliation for having done so. Any new domestic legislation that is needed to ensure compliance must, according to the Directive, be in place by no later than 17 December 2021. Many countries have yet to publish draft legislation, with only around two weeks to go until this deadline.
Guidance from data protection authorities emphasises the need to balance protection for those who blow the whistle against the need to ensure that schemes don’t encourage the collection of inaccurate and highly damaging data on persons about whom reports are made. This can be a particular risk where hotline schemes encourage anonymous reports.
Businesses will need to review existing systems or put in place new ones to comply with the Directive. Cross-border businesses will need to assess whether they can use group-wide reporting channels and processes for dealing with reports, or if they must implement these locally. More generally, they will need to review, update and implement whistleblowing policies and procedures, so HR and legal teams will need to work closely together to achieve compliance.
Businesses with operations across the EU need to monitor implementation and understand local requirements as they are introduced, as there will be variations between jurisdictions.
To help you comply and prioritise, we have prepared a tracker, highlighting progress towards implementation in Bird & Bird’s key EU jurisdictions, and some of the key elements of the local implementing legislation (where this information has been made available).
