On 26 November 2019, the Whistleblower Directive (Directive 2019/1937 on the protection of persons who report breaches of Union law, the ‘Directive’) was published.

The Directive sets out common standards for protecting individuals who report information on breaches of EU law they acquired in a ‘work-related context’. It protects whistleblowers in both the public and private sectors and covers not only workers, but also job applicants, former employees, shareholders, board members, trainees and the self-employed. Family members, and colleagues of whistleblowers and legal entities connected to them are also protected.

Reporting channels

Internal reporting

The following categories of organisation will have an obligation to establish internal reporting:

• Legal entities in the private sector with 50 or more workers.
• All public sector legal entities. Member States can however choose to exempt public sector entities in municipalities with fewer than 10,000 inhabitants or 50 workers, and others with fewer than 50 workers.

Internal reporting must comply with requirements relating to security, confidentiality and impartiality. There are also procedural requirements in the Directive relating to notification, acknowledgement and follow-up of a whistleblowing disclosure.

External reporting

Member States must establish independent and autonomous external reporting channels. These must comply with broadly the same requirements as internal reporting channels.

Protection of whistleblowers

The Directive imposes an obligation to protect whistleblowers against any retaliation, or threatened or attempted retaliation measures. Retaliation includes but is not limited to dismissal, demotion, withholding promotion, transfer of duties, change of place of work, reduced wages, changes in working hours, withholding training, negative performance reviews and disciplinary measures.

Burden of proof

In court or other official proceedings relating to a whistleblowing disclosure, the burden of proof is reversed. This means that if a whistleblower demonstrates that they reported a breach or made a public disclosure and suffered a negative consequence, there will be a presumption that the negative consequence was an act of reprisal. It will be up to the person who took the measure with a negative consequence (i.e. the employer) to demonstrate that it was justified and was not taken in retaliation for the whistleblowing disclosure.

Penalties

Under the Directive, Member States have an obligation to implement effective, proportionate and dissuasive penalties on individuals and legal entities that:

• hinder or attempt to hinder whistleblowing;
• retaliate against anyone protected in the Directive;
• bring legal proceedings against anyone protected in the Directive;
• breach the duty to keep the identity of whistleblowers confidential;

Anyone who knowingly discloses or publicly reports false information is also subject to these penalties and organisations affected must be able to bring damages actions in relation to false disclosures under national law.

Next steps

Member States now have until 17 December 2021 to implement the Directive into national law. Private sector organisations with between 50 and 249 employees have until 17 December 2023 to implement the obligation to establish reporting channels for whistleblowers.