Breakthrough for whistleblowers as EU institutions agree on new law to protect them from retaliation

Whistleblowers exposing illegal conduct or abuses of law in their workplace will soon have nothing to fear when revealing the truth, thanks to a new EU Directive to protect whistleblowers from retaliation, which secured a political agreement late last night, thus paving the way for its adoption before the European elections.

Once implemented, the EU law will introduce sanctions for people attempting to retaliate against whistleblowers and will exempt those reporting on breaches of EU law from civil or criminal liability linked to their disclosure of information in the public interest. A summary of who is to be protected, what for, and in what way is included below.

This political agreement comes more than two years after the Greens/EFA Group in the European Parliament drafted its own model EU Directive to protect whistleblowers across the European Union, which was presented to the European Commission in order to prove that an EU-wide legal instrument to protect whistleblowers across the Union was both possible and necessary. Thanks to the high profile revelations by whistleblowers in recent years, including the #luxleaks case and #PanamaPapers, and to the campaigning efforts of NGOs, trade unions and journalists, the final result is an ambitious text that will set minimum standards for how whistleblowers should be protected across the European Union.

Summary of the EU Whistleblower Protection Directive

1. WHO CAN GET PROTECTION, AND FOR WHAT?

To be protected as a whistleblower under this new EU legislation, workers must have reasonable grounds to believe that the information reported was true at the time of reporting and that the information fell within the scope of the Directive.

Who can qualify for whistleblower protection: The protection for whistleblowers covers a wide range of workers in the public and private sector, including civil servants, the self-employed, shareholders and persons belong to management, administrative or supervisory bodies, volunteers and paid or unpaid trainees, people working for contractors, subcontractors and suppliers, people uncovering breaches during a recruitment process and finally, ex-workers.

The Directive also protects third persons such as colleagues or relatives who may suffer retaliation in the work-related context, as well as to legal entities that the reporting person owns, works with or is connected to. Facilitators, understood as a natural person who provides confidential advice to whistleblowers, would also be protected from reprisals.

What Whistleblowers Can Report On: The Directive specifically protects people reporting on breaches of law or abusing the spirit of EU laws in a wide range of important areas such as public procurement, financial services, prevention of money laundering and terrorist financing, product safety, transport safety, protection of the environment, radiation protection and nuclear safety, food and feed safety, animal health and welfare, public health, consumer protection, protection of privacy and personal data and security of network and information systems, protection of the financial interests of the Union, breaches of internal market rules, including competition and State aid rules or tax avoidance issues. Member States can go beyond these minimum standards when transposing the Directive into national law.

However, it fails to address violations of workers’ rights and working conditions, although there is text in the Directive that would oblige the European Commission to consider expanding the scope of the Directive to cover also those areas the next time the Directive is reviewed or updated.

2. HOW CAN WHISTLEBLOWERS REPORT INFORMATION?

After a long-fought battle between the European Parliament and EU governments, whistleblowers would be protected for reporting internally or for reporting directly to regulators and competent authorities. Several European governments wanted to make the reporting process as strict as possible so that whistleblowers would only be protected if they reported internally first, unless they could fulfil one of the unclear exceptions that would “justify” reporting to regulators. Achieving flexibility on this point was crucial for the European Parliament to be able to agree on the final draft of the whistleblower Directive.

When it comes to public reporting, whistleblowers would be protected if they reported directly to regulators or if they reported internally and externally but no appropriate action was taken in response to the report within three months for internal reporting or three to six months in the case of reporting to regulators. They’d also be protected if they had reasonable grounds to believe that there is an imminent or manifest danger for the public interest, such as where there is a situation of emergency or a risk of irreversible damage.

Finally, whistleblowers would also be protected for reporting to the public if, when reporting to regulators, there is a risk of retaliation or there is a low prospect of the breach being effectively addressed, due to the particular circumstances of the case, for example, where evidence may be concealed or destroyed or where an authority is somehow involved in the breach.

Who has to set up channels for whistleblowers to report? Companies with more than 50 employees are obliged to set up channels and procedures for whistleblowers to report safely. Public bodies are also obliged to set up channels, but exceptions can be provided for municipalities with less than 10,000 inhabitants or less than 50 employees. Small municipalities can also pool resources and share channels or procedures for reporting.

3. HOW ARE WHISTLEBLOWERS PROTECTED?

Retaliation against whistleblowers is prohibited and this includes a wide range of different types of retaliation in a non-exhaustive list including suspension, dismissal, demotion, harassment, discrimination, work-related penalties, etc.
Effective, proportionate and dissuasive penalties will need to be put in place against natural or legal persons who attempt to hinder reporting, or who retaliate against whistleblowers, or who bring vexatious proceedings or who reveal the identity of the whistleblower. Any threats or attempts to retaliate against whistleblowers are also prohibited.
Whistleblowers shall not be liable for breaching restrictions regarding the disclosure of information and in judicial proceedings, including for defamation, breach of copyright, breach of secrecy data protection rules, disclosure of trade secrets, they shall not incur liability of any kind if they reported a breach of law in accordance with the Directive.
When it comes to the acquisition of information, whistleblowers will not be liable as long as the acquisition did not constitute a self-standing criminal offence.
In addition, whistleblowers will be able to file for interim relief pending the resolution of legal proceedings.
Whistleblowers, who are in a position of extreme vulnerability compared to the companies they work for, will benefit from a “reverse burden of proof” in order to level the playing field. This means that once it has been established that the whistleblower reported in line with the directive and that they suffered retaliation, the burden of proof would then be on the person who retaliated against the whistleblower to prove that the detriment was not a direct consequence of the report.
Member States shall take the necessary measures to ensure remedies and full compensation for damages suffered by whistleblowers, in accordance with national law.
Member States are obliged to ensure that whistleblowers have access to legal aid as well as to comprehensive and independent information and advice. Member States are also called upon to look into providing financial and psychological support in line with national law.

Next Steps

Now that the political agreement between the three EU institutions has been reached, EU governments and Members of the European Parliament will need to rubber-stamp the agreement within the next few weeks. The Parliament plenary should adopt the final text in April.