In a press release published on March 12, 2019, the European Parliament and its member states reached a provisional agreement on new rules that will guarantee a high level of protection for whistleblowers who report breaches of EU law. The draft establishes a three-tier reporting system (that potentially allows the whistleblower to inform publicly or through media the information) and robust measures against potential retaliation.

Persons Concerned

The European Commission defines a whistleblower as “someone reporting or disclosing information on violations of EU law which they observe in their work-related activities.” That means it covers employees but also self-employed people, freelancers, consultants, contractors, suppliers, volunteers, unpaid trainees and job applicants. This definition is less restrictive than the one provided in Article 6 of the French “Sapin 2” Law, which requires a “clear and serious” violation to be reported.

To avoid penalising people who act in good faith, whistleblowers also qualify for protection, if they had reasonable grounds to believe that the information reported was true at the time of reporting, or if they have serious suspicions that they observed an illegal activity

Areas Covered

This regulation was proposed in April 2018 by the European Commission and constitutes important provisions in favor of whistleblowers. The draft regulation grants protection in numerous areas of EU regulation:

• Public procurement
• Financial services
• Money laundering and terrorist financing
• Product safety
• Transport safety
• Environmental protection
• Nuclear safety
• Food and feed safety
• Animal health and welfare
• Public health
• Consumer protection
• Privacy
• Data protection and security of network and information systems

It also applies to breaches of EU competition rules, violations and abuse of corporate tax rules and damage to the EU’s financial interests. Moreover, member states are free to extend these rules to other areas.

Establishment of a Three-tier Reporting System

Obligation for Public and Private Sector to Establish Internal Channels and Procedures

All companies with more than 50 employees or with an annual turnover of over €10 million will have to set up an internal procedure to handle whistleblowers’ reports. All states, regional administrations and municipalities with more than 10,000 inhabitants will also be covered by the new law. SMEs are exempted from this obligation, with the exception of the companies operating in the field of financial services or vulnerable to anti-money laundering or counter terrorist financing. These requirements are quite the same as those provided in Article 8 of the French Sapin 2 Law.

They also need to designate a person or a department responsible for receiving and following up on the reports and to provide clear and accessible information about those procedures and the conditions under which reports can be made externally to national or EU competent authorities. After the whistleblower has submitted a report, the designated person/department must follow up on the report within three months and provide feedback to the reporting person about this follow up. In France, the Sapin 2 Law does not require any deadline before seizing competent national authorities but only a “reasonable period.”

Obligation for Competent National Authorities to Establish External Reporting Channels

The whistleblower can report information to a national authority if internal channels do not work or could not reasonably be expected to work (for example, where the use of internal channels could jeopardise the effectiveness of investigative actions by the authorities responsible).

Member states must identify the authorities who will be charged with receiving and following-up on reports about breaches under the new law. These authorities will be under obligation to follow-up on the reports received, and, within three months (extendable to six months in case of complex cases), give feedback to the reporting persons about the follow-up. In France, Article 8 of the Sapin 2 Law entrusts the “Rights Defender” to take in charge the whistleblower.

Public Reporting

In cases where internal and/or external channels do not function or could not reasonably be expected to function properly whistleblowers may make a public disclosure including to the media. For instance, when it is reasonable to suspect a collusion between the perpetrator of the crime and the state authorities responsible for prosecuting them, or in cases of urgent or grave danger for the public interest, or risk of irreversible damage. This will protect whistleblowers when they act as sources for investigative journalism.

Prevention of Retaliation and Effective Protection

All forms of retaliation are forbidden and should be sanctioned. If a whistleblower suffers retaliation (harassment, demotion, dismissal, etc…), they should have access to free advice and adequate remedies. The burden of proof will be reversed in such cases, so that the person or organization must prove that they are not acting in retaliation against the whistleblower. Whistleblowers will also be protected in judicial proceedings; in particular, through an exemption from liability for disclosing the information

Past and Future of the Directive

After the Assange and Snowden revelations in 2010 and 2013, European stakeholders understood the importance of protecting whistleblowers who endanger themselves by publicly exposing occult abuses from public authorities or private companies. This led to a 2014 Council of Europe Recommendation on the Protection of whistleblowers. This document proposed guidelines, which were later developed, on April 23, by the European Commission in a draft Directive.

The latter will now have to be formally approved by both the European Parliament and the Council.