On 26 November 2019, the Whistleblower Directive (Directive 2019/1937 on the protection of persons who report breaches of Union law, the ‘Directive’) was published.
The Directive sets out common standards for protecting individuals who report information on breaches of EU law they acquired in a ‘work-related context’. It protects whistleblowers in both the public and private sectors and covers not only workers, but also job applicants, former employees, shareholders, board members, trainees and the self-employed. Family members, and colleagues of whistleblowers and legal entities connected to them are also protected.
The following categories of organisation will have an obligation to establish internal reporting:
Internal reporting must comply with requirements relating to security, confidentiality and impartiality. There are also procedural requirements in the Directive relating to notification, acknowledgement and follow-up of a whistleblowing disclosure.
Member States must establish independent and autonomous external reporting channels. These must comply with broadly the same requirements as internal reporting channels.
Protection of whistleblowers
The Directive imposes an obligation to protect whistleblowers against any retaliation, or threatened or attempted retaliation measures. Retaliation includes but is not limited to dismissal, demotion, withholding promotion, transfer of duties, change of place of work, reduced wages, changes in working hours, withholding training, negative performance reviews and disciplinary measures.
Burden of proof
In court or other official proceedings relating to a whistleblowing disclosure, the burden of proof is reversed. This means that if a whistleblower demonstrates that they reported a breach or made a public disclosure and suffered a negative consequence, there will be a presumption that the negative consequence was an act of reprisal. It will be up to the person who took the measure with a negative consequence (i.e. the employer) to demonstrate that it was justified and was not taken in retaliation for the whistleblowing disclosure.
Under the Directive, Member States have an obligation to implement effective, proportionate and dissuasive penalties on individuals and legal entities that:
Anyone who knowingly discloses or publicly reports false information is also subject to these penalties and organisations affected must be able to bring damages actions in relation to false disclosures under national law.
Member States now have until 17 December 2021 to implement the Directive into national law. Private sector organisations with between 50 and 249 employees have until 17 December 2023 to implement the obligation to establish reporting channels for whistleblowers.