/>iThe 27 remaining EU member states have until 17 December this year in which to introduce domestic legislation implementing the Whistleblowing Directive from 2019. With scarcely four months to go, how are things going?
Very slowly in most cases, it seems. No doubt Covid has taken parliamentary time and resource away from this issue across the EU, but as matters stand, no countries have actually passed such legislation. Draft bills are under consideration in Germany, Italy, Holland and the Czech Republic, but a number of countries, including Poland and Spain, have yet to get even to the draft stage.
Having left the EU, the UK will not need to implement the Directive. Its whistleblowing laws are already among the more developed within Europe (with unusual bluntness, the Directive itself describes EU implementation of whistleblowing protections as “fragmented and uneven“), and many of the requirements and options offered by the Directive for that domestic legislation reflect those already present in the UK provisions.
However, that does not make the further progress of that implementing legislation around the EU irrelevant here. First, any employer based outside the EU (whether that is in the UK or the US, China or the Far East ) which has operations within it will be caught. Second, while the UK government has wittered on since 2016 about lighting a bonfire of EU red-tape, this is one of those areas like data privacy in which offering a materially lower level of protection to employees than the EU may play badly in terms of international procurement, trading and investment decisions by EU businesses. Whether that was what you thought you had been told about Brexit or not, commercial reality will dictate that UK laws aimed at the protection of workers and the prevention of (among other things) business wrongdoing do not become too far adrift from what is happening in Europe.
So what are we looking at? The Directive is effectively in two parts, being firstly the protections themselves, and second, the reporting channels and rights around them.
Whatever does stop people blowing the whistle in the EU going forwards, it is not going to be any lack of clarity around how to do it. One of the key requirements of the legislation mandated by the Directive is that employers set up secure internal reporting channels for oral or written disclosures. Those disclosures must be acknowledged within seven days and “feedback” (see below) provided within three months at the most. UK law does not require any of this (because it is aimed less at expressly encouraging whistleblowers and more at preventing retaliation as and when it happens), but it is still unquestionably good practice here, as are the intended record-keeping and confidentiality requirements. For businesses of 250 employees upwards, this will bite from (in theory) 17 December, while those with 50 upwards will have a further two years to set up suitable processes. The Directive gives the smallest employers a break on this, although that does not mean that individual member states have to do so.
The Directive’s credentials as a genuinely worthily-intended bit of law-making are confirmed in its reach – not just existing employees and workers, as in the UK, but also job applicants, self-employed contractors, and employees of external contractors and suppliers, in each case whether current or former. The Directive says that implementing legislation should prevent not only direct retaliation against whistle-blowers, but also detriments imposed indirectly via colleagues and relatives, and even to detriments imposed on the whistle-blower’s employer (if it is for example an external contractor or supplier) through the denial of services, blacklisting or boycotting. It is possible to foresee a whole new jurisprudence springing up around the obligations which one company may have to another because or in spite of protected disclosures about wrongdoing at one company by the employee of that other business. The Directive therefore spreads its net across a far greater range of retaliatory wrongdoing than the UK version in the Employment Rights Act.
The recitals to the Directive also rehearse the range of reasons for which a concerted EU approach to and the positive encouragement of discloses is desirable. This is not quite as wide as the UK’s catch-all “breach of a legal obligation”, but is little short of it. As in the UK, the whistleblower must have reasonable grounds to believe the information disclosed to be true. There is no express requirement that it also be believed to be a matter for the public interest, though there is scope if member states want it for an express exclusion of purely internal workplace gripes – recital 22 refers to “interpersonal grievances exclusively affecting the reporting person, namely… conflicts between the reporting person and another worker“. Note the singular there, meaning that the really committed whistleblower will never fall out with just one of his colleagues where there are more available.
In addition, recital 43 excludes “information which is already fully available in the public domain or unsubstantiated rumours and hearsay“, the latter perhaps a reflection of the chain of English law whistleblowing cases which distinguish between information on the one hand, and pure allegation on the other.
As under the UK legislation, the disclosure can cover anticipated breaches as well as those which are past or present. Whether it signifies any raised threshold over the UK position is hard to say, but recital 43 refers in this respect to breaches of law which are very likely, not merely ordinarily likely, as in the UK.
Once the disclosure is made, the Directive also requires some level of feedback. This is a new obligation for employers used to the UK rules, which require only an absence of retaliation. Recital 57 states that feedback to be a crucial part of building up trust in the effectiveness of the system and hence of reducing the need for further unnecessary internal or external disclosures. This will need to be something more than a casual nod of thanks and “it’s all fixed, don’t worry about it”. The recital indicates that the employer’s response should “as far as legally possible and in the most comprehensive way possible” inform the whistleblower of what happened or is to happen in consequence of his report. This could include, says the recital, referring the individual to the grievance procedure, if that is where his complaint is better heard (see above), whether any internal enquiry has taken or is to take place, any remedial measures intended, any reports to public authorities or even any effective closure of the file due to a lack of evidence to support the employee’s disclosure. In that last respect, the recital notes that while you can always ask the whistleblower for further details to assist in your investigation, there is no obligation on him to provide it. In the UK that refusal might be taken as casting doubt over the employee’s belief that disclosure is in the public interest, but that is clearly not going to be a permitted conclusion in the EU. Indeed, recital 32 makes it clear that “the motives of the reporting person… should be irrelevant in deciding whether they should receive protection“, the only exception being in relation to reports which are found to be malicious, abusive or frivolous.
As to remedy, the Directive is clear that the level of compensation must go as far as money can to negate the harm done by the employer’s retaliation. As in the UK, therefore, it is likely to be uncapped. Clearly some scope exists (though it is not put as a requirement) for member states also to introduce a right akin to the UK’s interim relief/contract continuation order remedy where local law does not already provide for it.
The net result of all of that is that if you thought you could deal with the implementation of the Whistleblowing Directive into your EU businesses by changing the headings on your UK policy, you are heading for a fall. While the underlying core of what constitutes a protected disclosure is little different in principle, the EU rules will have much greater breadth and come attached to a van-load of procedural machinery which will be new to most UK-based businesses.
Obviously finalising your policies and practices for your EU operations will have to await sight of the definitive legislation in each country. That said, the Directive and its recitals are actually sufficiently specific as an irreducible minimum that you could usefully start considering how its principles can be put into employee-friendly drafting now, so that you will be in good time to seek to agree it with staff representatives before it goes live. Remember that because of the original December 2021 deadline, the advance notice you get of the specifics of that domestic legislation may be very limited.
