European Council adopts EU-wide whistleblower protection rules

The new directive (131-page / 780 KB PDF) requires EU companies with more than 50 employees to set up internal whistleblowing reporting procedures. It will also apply to all legal entities in the public sector such as regional administrations and municipalities; although member states may choose to exempt municipalities with 10,000 inhabitants or fewer or legal entities in the public sector with 50 employees or fewer when implementing the provisions of the directive into domestic law.

Disclosures in respect of breaches of many areas of EU law including anti-money laundering, data protection, food and product safety, environmental protection, competition law and corporate tax avoidance will be covered. A full list of relevant laws is included as an annex to the directive, although this list is not intended to be exhaustive.

Member states will generally have two years to transpose the requirements of the directive into national law from the date of entry into force, meaning its requirements will be in force by the end of 2021. The UK has confirmed that it does not intend to adopt the directive, as it is due to leave the EU on 31 October 2019.

Munich-based corporate compliance expert Dr Eike Grunert of Pinsent Masons, the law firm behind Out-Law, said: "Businesses and local authorities across the EU will need to establish whistleblower processes to comply with the new requirements. If they already have such processes, e.g. as integral part of their compliance programme, they need to review and adjust these if needed to ensure full adherence to the upcoming standards. This typically requires considerable time and effort, and companies should plan well in advance with the new rules on the horizon".

Companies covered by the new directive will be required to establish a reporting process through internal reporting channels, with guaranteed confidentiality for whistleblowers. Individuals should be able to make protected disclosures internally or to competent authorities through external reporting channels. They should also be able to make protected disclosures to the media where no appropriate action is taken after reporting through the other channels or where this is "imminent or clear danger to the public interest or irreversible damage".

Organisations and authorities which receive protected disclosures will be required to respond and follow-up reports from whistleblowers, with a three-month deadline specified for internal reports. No retaliation against a genuine whistleblower will be permitted. Member states must also ensure that whistleblowers have access to free advice and provide for adequate remedies in the event of retaliation, such as workplace harassment or dismissal. They will also be exempt from liability for disclosing the information in future judicial proceedings.

The directive incorporates safeguards to protect companies, individuals and others against the risk of malicious or abusive reporting and unjustified reputational damage. In particular, those affected by a whistleblower's report will be presumed innocent until after a fair trial has taken place.

The UK government's Department for Business, Energy and Industrial Strategy (BEIS) confirmed this week that it will not be transposing the directive into UK law. The UK has "concerns with the directive and its overall proportionality", but decided to abstain from the European Council's vote on the directive given its impending departure from the EU, according to business minister Kelly Tolhurst.

Tolhurst confirmed the UK's position in a letter to the House of Commons' European Scrutiny Committee (2-page / 154KB PDF). She also said that the UK planned to review its own whistleblowing framework "once the recent reforms have built the necessary evidence of their impact", and would look at the protections available to whistleblowers in other countries as part of that exercise.

In August, a UK all-party parliamentary group (APPG) on whistleblowing completed a review of the domestic law in this area. It concluded that the legal framework in the UK was complicated, overly legalistic, obsolete and fragmented. The APPG recommended a new legal definition of whistleblowing and whistleblower in order to properly reflect current working practices and the need to protect the public; the setting up of a new regulator, the Independent Office for the Whistleblower; and banning non-disclosure agreements (NDAs) in whistleblowing cases.

Anti-corruption law expert Neil McInnes of Pinsent Masons said: "The way that an organisation handles whistleblower reports is one of the yardsticks used to measure the resilience and effectiveness of compliance programmes. Good monitoring of reports received should also sit together with properly resourced internal investigations of concerns that are raised, and be part of the overall continuous improvement of any compliance programme too."

Employment law expert Anthony Convery of Pinsent Masons said: "Employers in the UK will need to wait and see what changes are proposed here. It remains to be seen how any future developments will tie in with the UK government's commitment to address the misuse of non-disclosure agreements in employment".

Editor's note 06/11/19: This story has been updated to correct references to an earlier draft version of the directive.