I. Introduction
Forty-six jurisdictions across the globe are estimated to have some form of law on whistleblower protection in place.Footnote 1 Around twenty of these jurisdictions are situated in Europe, both within and outside of the European Union (EU).Footnote 2 Only ten EU Member States are said to have “comprehensive” whistleblower protections in place, in the sense that they cover more than one specific sector, apply to both the public and private sectors and cover a wide range of wrongdoing (eg beyond corruption).Footnote 3 According to Blueprint for Free Speech, only four of the Member States with comprehensive protection regimes currently provide sufficient protection for whistleblowers.Footnote 4
In the context of a patchwork of protection systems across Europe, the European Court of Human Rights has developed case law on the concept of a whistleblower, based on Article 10 of the European Convention on Human Rights, which protects freedom of expression. In so doing, the Court has established a minimum level of ex post protection for whistleblowers, even in the absence of specific legislation.Footnote 5
In the same vein, the Council of Europe adopted in 2014 a recommendation on the protection of whistleblowers,Footnote 6 which was followed up by a report from the European Parliament in 2017.Footnote 7
On 23 October 2019, against the backdrop of numerous scandals involving whistleblowers, the EU enacted a directive protecting whistleblowers across the EU.Footnote 8 The Whistleblower Protection Directive (the “Directive“) aims to establish common minimum standards of whistleblower protection in an effort to pull together the “fragmented” policies applied in different Member States and across different EU policy areas.Footnote 9 The Directive sets ambitious legislative targets for EU Member States, who will have until 17 December 2021 to implement its provisions into national law.Footnote 10
The following sections will focus on the text of the Directive itself, providing contextual elements, details and a brief critical analysis on its scope, its reporting procedures and the protective tools it introduces. The final section will then explore some of the practical considerations raised by the Directive regarding its relationship with national legislation and pre-existing EU legal instruments.
II. The broad scope of application of the Whistleblower Directive
The main objective of the Directive is to ensure improved application of EU law by providing adequate protection for whistleblowers. Worker protection is therefore not the primary objective. The scope of the Directive is in fact much broader, as discussed below, and increased protection is essentially a desirable means of improving the effectiveness of EU law.
The Directive was drafted following extensive evaluation, including numerous consultations,Footnote 11 an external study assessing its repercussions as well as its quantitative and qualitative benefits, in addition to an impact analysis. These studies found that not only will this legislative project bringing about economic, societal and environmental benefits, but it will also have a wider positive effect on the fundamental rights of European citizens.Footnote 12 In quantitative terms, the Commission estimates that revenue loss stemming from fraud and corruption affecting the EU budget is estimated at between €179 and €256 billion per year.Footnote 13 The Directive was designed to help reduce that leakage.
Having established the context, this section will provide a brief overview of the main features of the scope of application of the Directive: its ratione materiae and ratione personae.
1. Ratione materiae
In accordance with the principle of the attribution of competences, and according to Article 2 of the Directive, only “breaches of Union law” are covered by the Directive, specifically breaches that fall within the scope of the legislative acts set out in the Directive: pubic procurement; financial services, products and markets; the prevention of money laundering and terrorist financing; product safety; transport safety; environmental protection; radiation and nuclear safety; food and nutritional safety; animal health and welfare; public health; consumer protection; the protection of privacy and personal data; and the security of networks and information systems.Footnote 14 Equally covered are breaches affecting the financial interests of the Union and those relating to internal market violations.Footnote 15 In addition, the extensive list of matters encompassed by the Directive is non-exhaustive insofar as it provides for the possibility for Member States to “extend protection under national law as regards areas or acts not covered (by the list supra)”.Footnote 16
The notion of a breach is also defined broadly to include both acts and omissions that are either: (1) unlawful and fall within the areas listed in the previous paragraph; or (2) merely “defeat the object or the purpose” of the rules applicable to those areas.Footnote 17
2. Ratione personae
According to Article 4 of the Directive, protection is granted (only) to natural persons who have obtained information in a professional context, either in the private or public sector. Moreover, information obtained in the context of an employment-based relationship that has either ceased/concluded or has yet to begin, as well as during the recruitment process or in pre-contractual negotiations, is equally covered.Footnote 18 The scope of the protection is therefore vast, covering workers, former employees or candidates; officials; the self-employed; volunteers; paid or unpaid trainees; shareholders; members of company managerial bodies, including non-executive members; and contractors, subcontractors and suppliers. The Directive goes further than most existing national legislation by extending the protective measures, if necessary, to natural persons connected to the reporting person. As such, Article 4(4) allows “facilitators” and third parties who are connected with the reporting person and who could suffer retaliation in a work-related context, such as colleagues or relatives, to benefit from protection.Footnote 19
Legal entities can also indirectly benefit from the protections offered by the Directive if the reporting person owns, works for or is otherwise professionally connected with that legal person.Footnote 20 The reasons explaining why protections were not extended to legal entities in their own right are unclear, as are the potential justifications for this approach. As a consequence, a non-governmental organisation (NGO) that is active in environmental protection and that discovers violations of EU environmental law would therefore not benefit from the protection offered by the Directive.
III. Reporting proceduresFootnote 21
The protection granted by the Directive is subject to two cumulative conditions.Footnote 22 On the one hand, the reporting person must demonstrate a reasonable belief that the information provided was not only true at the time of the reporting, but that it also fell within the scope of the Directive. On the other hand, the person must comply with the reporting procedures provided in the Directive. Additionally, it appears that anonymous reporting is only partially protected under Article 6(2). It is up to the Member States to decide whether private or public entities and competent authorities are required to accept and follow up on anonymous reports. However, as stated in Recital 34 of the Directive, “[P]ersons who anonymously reported or who made anonymous public disclosures falling within the scope of this Directive and meet its conditions should enjoy protection under this Directive if they are subsequently identified and suffer retaliation”.
The design of the reporting procedure was one of the main sticking points in the negotiations between the Council and Parliament. The former, supported by countries including France, Germany and Italy, wanted to adopt a strict three-tiered reporting procedure; first, to the organisation’s internal channels; then to designated authorities; and finally – should all else fail – to the public generally. The Parliament, supported by the MEP Virginie Rozière – the Directive’s rapporteur – advocated for a more flexible approach, allowing whistleblowers to make reports through any of these three channels from the outset.Footnote 23
An intermediate position, in line with that of Transparency International France,Footnote 24 was ultimately adopted. The text of the Directive opts for a reporting procedure that allows the whistleblower to make reports either through internal channels or to external agencies in the first instance. Accordingly, the Directive imposes obligations on all public and private legal entities to establish internal channels for employee reporting.Footnote 25 Member States are also required to establish external reporting channels and to follow up on reports.Footnote 26 Public disclosures are generally only permitted if a first report, whether internal or through an external agency, failed to elicit an appropriate response within three months.Footnote 27 However, direct public disclosure is permitted in case of imminent and evident danger to the public interest, where there is a risk of retaliation or a low likelihood of effective handling of the report through the internal or external agency reporting procedure.Footnote 28
IV. Tools of protection
At the heart of the Directive’s mechanism are a series of tools to protect the whistleblower and punish those who do not respect these protections.
1. Protective measures
The toolbox offered by the new Directive includes the prohibition of retaliation, a system of compensation for damages, legal support and confidentiality.
Among the protections granted to whistleblowers, the adopted text prohibits any form of retaliation, including threats and attempts at retaliation, whether direct or indirect. A long and non-exhaustive list of examples is presented in Article 19.Footnote 29 On reading this list, the European legislators’ intention to provide a definition of a “whistleblower” that covers all of its professional dimensions – in such a way as to protect them from all direct and indirect discrimination – is clearly evident. The European legislators have also reversed the burden of proof in retaliation proceedings, as the employer must now prove that the action taken against the whistleblower was not the consequence of their whistleblowing activities.Footnote 30
In complement to the prohibition against retaliation, the Directive obliges Member States to protect reporting persons against reprisals. Whistleblowers are protected from civil and criminal liability so long as they had reasonable grounds to believe that their disclosure was necessary to reveal a relevant infringement.Footnote 31
Moreover, the Directive requires full compensation for damages suffered by the whistleblower, as determined by and in accordance with national law.Footnote 32
According to Article 20, Member States are also required to implement measures in support of whistleblowers, providing access to free and independent information and advice, effective assistance from the authorities and legal assistance in criminal or civil proceedings. In addition, Member States have the possibility to provide financial assistance and psychological support.
The adopted text also guarantees the confidentiality of any person subject to proceedings as long as the investigation is ongoing, as well as the right to an effective remedy.Footnote 33
Evidence from the US experience in designing whistleblower laws suggests that measures strengthening whistleblower protections have a lesser influence on rates of disclosure than measures that increase the likelihood of a financial award for disclosures leading to successful prosecution.Footnote 34 Intuitively, one might be concerned that financial incentives could raise the risk and costs associated with false reports. However, the evidential support for this position appears to be quite limited.Footnote 35 The silence of the text of the Directive on this issue therefore seems to be a missed opportunity.
2. Sanctions
The Directive requires Member States to implement effective, proportionate and dissuasive penalties applicable to natural and legal persons in the event of: obstruction or the attempted obstruction of reporting; retaliation and vexatious proceedings against whistleblowers; as well as breaches of the duty to maintain the confidentiality of the identity of reporting persons.Footnote 36
The Directive also provides for effective, proportionate and dissuasive sanctions against persons knowingly making false reports or false public disclosures, as well as compensation measures in accordance with national law.Footnote 37
It should be noted that the original text proposed by the Commission included a specific penalty for malicious or abusive reports. Nevertheless, in line with the Rapporteur’s position, this particular sanction was removed from the final draft of the Directive without being replaced. As a result, in case of abusive reporting, existing national laws on slander and defamation may apply.
The approach to sanctions under the Directive can be criticised in at least two ways. Foremost, not all obligations under the Directive are in fact subject to sanctions. For instance, certain NGOs criticise the Directive for the lack of sanctions against failures to implement internal reporting procedures, failures to follow up on reports and failures to inform whistleblowers of the steps taken following a report.Footnote 38
Moreover, for those breaches that are covered by the provisions of the Directive, the text of the instrument provides no detail on the nature of the sanctions Member States should apply. It is open to legislators implementing the Directive to choose between sanctions of a civil, criminal or disciplinary nature.
It is particularly regrettable that the Commission has not been able to build in a more complete definition of the types of sanctions Member States should impose against breaches of key provisions of the Directive. The considerable margin of appreciation left to Member States in determining the nature of sanctions is likely to lead to a highly fragmented approach across the EU. This is particularly so given the very different conceptions of whistleblowing in the legal cultures of different Member States. Whilst Member States are bound by the requirement to implement “effective and proportionate“ sanctions, uncertainty as to the precise requirements of this obligation and the corresponding risk of weak sanctions may undermine the objectives of the Directive, leading to or maintaining a chilling effect in certain Member States.
V. Reconciliation with other EU legal texts and Member States’ laws
The Directive prescribes a two-year implementation period, within which Member States will be required to give effect to its provisions in their respective national legal systems. On account of the EU rules on competence, the provisions of the Directive apply exclusively to disclosures relating to breaches of EU law. However, the Directive quite clearly invites Member States to implement similar measures in relation to breaches of national law.Footnote 39
The “harmonious” application of the provisions, in such a way as it would encompass breaches of both EU and national law, as well as other forms of harm, is clearly the “gold standard” in terms of implementation. A single comprehensive system would provide a number of benefits, not least in terms of clarity of the rules applicable to whistleblowers and the protections they may hope to benefit from. In practice, fine distinctions between areas of EU and national competence may not be obvious to the layperson, or indeed to untrained advisors. This uncertainty may also have a chilling effect on disclosures, leading to the possibility of undermining the goals of the Directive.
For those Member States that do not currently have a standalone whistleblower protection regime in place, the Directive offers a solid framework around which a single comprehensive regime could be built. Arguably, this process may be less onerous than one that attempts to amend existing legislation in a manner that conforms to the provisions of the Directive.
In Member States that currently operate whistleblower regimes, the reconciliation between the national and European systems is not straightforward. National legislation will have to be amended to avoid a double standard between national and European systems.
The Directive must also be considered in the context of other relevant EU legislation. The Trade Secrets Directive is particularly relevant in this regard, as it aims to protect businesses against the theft or disclosure of their information by requiring Member States to impose sanctions on persons unlawfully disclosing trade secrets.Footnote 40 Whilst the Trade Secrets Directive includes certain exceptions, these have previously been criticised for their lack of clarity, which could potentially be harmful to, or at the very least discourage, a whistleblower.Footnote 41 The Directive thereby seeks to address this issue by clarifying that a report that meets the requirements contained in the Directive can benefit from the exclusion contained in Article 3(2) of the Trade Secrets Directive, which permits disclosure if “required or allowed by Union or national law”. Therefore, defendants will need to establish that their disclosure fell within the scope of the Directive and complied with the reporting procedure prescribed therein, in order to avail themselves of this defence. In other words, the Directive allows for “a rebalancing between secrecy, security and freedom of information” in favour of the reporting person.Footnote 42
VI. Conclusion
What conclusions can be drawn from this Directive?
On the one hand, in addition to the criticism evoked before regarding the limited scope of its application to juridical persons and the potential lack of uniformity of penalties, it does seem that certain points have been glossed over, or even avoided, during the negotiations over the text. For example, it is regrettable that the Directive does not require the creation of a centralised European authority whose task would be to collect and monitor whistleblowers’ reports.
On the other hand, the text agreed upon by the European institutions is a key step in establishing a minimum threshold for the protection of whistleblowers in the EU. In the numerous EU countries where the current protection is insufficient or non-existent, the Directive will have significant consequences. In others, it will standardise the applicable rule(s) by imposing a higher standard than that developed by those Member States with legislation on the matter. The Directive also represents a successful instance of collaboration between the European institutions and the EU’s citizens. Indeed, the process has bestowed a central role on the European Parliament and encouraged real involvement from civil society, NGOs, federations of journalists and trade unions.Footnote 43
All in all, this new Directive could be assessed as follows: a satisfactory but incomplete system.
