The pan-European bells and whistles: new EU whistleblower legislation proposed

A recent spate of scandals such as Luxleaks, Panama Papers and Cambridge Analytica have highlighted the importance of having effective mechanisms or 'early warning systems' to expose major corporate wrongdoings. Employees or workers on the frontline are often first to discover potential violations of the law and they are often the most vulnerable in that they could potentially be deprived of their livelihood if their concerns are not well received. The Commission recognises that whistleblower protection is already available in some member states, but considers the approach across the EU to be fragmented and inconsistent. 

What will the proposed Directive cover?

The proposed Directive aims to ensure that all member states have common standards of protection for whistleblowers who expose illegal activities relating to a wide range of EU policy areas, including:

• public procurement
• financial services, anti-money laundering and counter terrorist financing
• product, transport, nuclear and food safety
• environmental protection
• public health
• consumer protection
• protection of privacy and personal data, and security of network and information systems
• competition rules
• corporate tax rules; and
• breaches harming the EU's financial interests

Who will be protected?

Whistleblowers of good faith, who report information within the scope of the proposed Directive, and who have reasonable grounds to believe the information was true at the time of reporting. 

How is the Directive different from the existing whistleblower regime in the UK? 

• Scope – under the UK Public Interest Disclosure Act 1998 (PIDA) 'qualifying disclosures' predominantly relate to criminal offences and failures to comply with legal obligations under UK law whereas the Directive specifically covers breaches of EU law. However, the Commission encourages member states to consider extending the scope of application of the Directive to other areas to ensure a comprehensive and coherent framework at national level. 
• Establishing internal reporting channels and procedures – there is no formal legal requirement for employers to enact a whistleblowing policy or establish reporting channels under PIDA, although most global companies operate whistleblowing hotlines or similar reporting mechanisms for regulatory or corporate governance reasons.  

However, under the proposed Directive, all private companies with more than 50 employees, or with an annual turnover of more than €10 million, will be required to establish internal reporting channels, ensuring the confidentiality of the identity of the whistleblower.

Reporting channels – The Directive proposes a new, three-tier reporting system:

1. Internal reporting – employees should first report information to their employers using available internal reporting channels. Employers must respond within a three or six month timeframe (depending on the complexity of the issue).
2. Reporting to competent authorities – where internal channels do not exist, or where internal reporting channels do not or cannot reasonably be expected to function properly (e.g. where there is a fear of retaliation, concerns about confidentiality, or a fear that evidence might be destroyed), employees (and non-employees) should report to central state authorities and, where relevant, EU bodies. Small or micro companies (below the 50 employee threshold) should take note too – they may not be subject to the formal requirement to establish internal reporting channels, but employees will be entitled to report directly to governmental or EU authorities in the absence of adequate internal reporting channels.
3. Public/media reporting – as a last resort, a whistleblower can disclose information directly to the public via social media, web platforms, or the media where the above channels do not function or cannot reasonably be expected to function properly (e.g. if no appropriate action is taken after reporting through other channels, where collusion with the state authorities is suspected or in case of imminent or clear danger to the public interest).

While PIDA encourages internal disclosure as the primary method of whistleblowing and also recognises that disclosure to third parties may be necessary in certain circumstances, the new Directive provides a clear timeframe within which an employer must respond before an employee is entitled to 'go public' with his/her concerns. It also expressly makes provision to allow individuals to bypass internal reporting channels where they cannot reasonably be expected to function properly.   

Free advice – whistleblowers will be given access to free comprehensive and independent advice on available protections and remedies. Member states will likely be required to set up appropriate governmental functions to assist with this.   

Protection in judicial proceedings – if legal action is taken against whistleblowers (e.g. for defamation, breach of copyright, breach of confidentiality), they will be entitled to rely on the new Directive as a defence. 

So, what's next? And what about Brexit? 

There are a number of steps and legislative procedures which need to be followed before the Directive is enacted; this means that it may only come into effect post-Brexit. However, it is likely that this legislation will form part of fundamental EU standards which must be upheld as part of a trade deal between the UK and the EU, meaning that the Directive will still be relevant and applicable to the UK post-Brexit. 

Nevertheless, many of the principles underpinning the Directive are already embodied within PIDA, and the UK is recognised by the Commission as having one of the most advanced systems of whistleblowing protection in the EU. Accordingly, the Directive is unlikely to lead to any fundamental changes to the UK position, albeit the whistleblowing landscape may become more prescriptive than is presently the case.

What the proposed Directive does do is serve as a reminder that it is helpful to encourage a culture of openness, and that prevention is always better than the cure. Effective internal reporting can result in the early resolution of issues that might otherwise spiral out of control, with the potential for catastrophic damage to reputation. 

Employers should regularly review, refresh and actively promote whistleblowing policies, and ensure their workforce understands the mechanisms and channels which are in place and that victimisation and retaliation for whistleblowing will not be tolerated. There is, of course, a balance to be struck – while there are obviously important policy reasons for thorough whistleblower protection, there is also scope for abuse. For example, it is not unusual to see employees engineering claims to protect themselves, or in the hope of improving a settlement offer in a termination situation. Where an employee presents a shopping list of issues, this might be an indication that the disclosure is not genuinely made in the public interest. 

Whatever the law ultimately looks like, it is clear that public perception is hardening against corporate misdemeanours and whistleblowers will be acquiring more, rather than less, protection in the future. For this reason, when a report or complaint is received, it is important to be analytical in assessing whether that 'disclosure' is likely to qualify as one which is protected under the PIDA (or subsequent legislation) and where the answer is yes, don't shoot the messenger. Listen, investigate and respond, no matter how inconvenient the message may be.