The Whistleblower Directive (Directive (EU) 2019/1937) was adopted by the Council of the European Union in October 2019 and entered into force on 16 December 2019. The (minimum) standards must now be implemented in the Member States by no later than 17 December 2021 (the legislative process is still pending in Austria). The Directive makes provision, among other things, for the mandatory introduction of whistleblower systems for larger companies and legal entities governed by public law. It also contains certain protective provisions for persons who in the context of such a whistleblower system draw attention to possible infringements.
Scope of application
The material scope of application of the Directive only covers the reporting of infringements of Union law. In particular, it covers infringements in the fields of financial services, public procurement, public health and privacy, as well as infringements relating to consumer protection, data protection, environmental protection and antitrust. In this context, the Directive merely specifies a minimum scope of application. However, the Austrian Government has thus far not expressed any intention to expand the scope of application.
The introduction of whistleblower systems is mandatory for the purpose of enabling employees to report infringements. The establishment of reporting channels by self-employed persons, shareholders, board members, contractors, suppliers and former employees is voluntary.
Three-tier reporting system
The Directive provides for the establishment of a three-tier reporting system by the respective Member States. In keeping with the approach adopted in the Directive, reports of possible infringements should first be processed within the organisation concerned. The whistleblower system therefore has the decisive advantage that companies are the first to be informed of criminal offences and these offences can subsequently be "cleaned up", to the extent legally possible, before the matter comes to the attention of the authorities or the public (for example, by filing a leniency application under antitrust law). A company that voluntarily take steps to remedy the situation completely and in a timely manner will at most be granted immunity from prosecution, which is why the implementation of the whistleblower system is particularly beneficial to the company concerned.
If no internal reporting channels exist within the company or no "appropriate measures" are subsequently taken, the whistleblower can submit his/her report directly to the competent authorities (second tier). A report can also be submitted directly to the competent authority even if internal reporting channels at the company in question do exist, but the whistleblower was not and could not have been aware of them. It is important therefore that the existence of internal reporting channels is sufficiently communicated. In exceptional cases, the whistleblower may also go public with information about the report he/she filed, namely if after reporting the matter in the proper way there is no response from the first and/or second tier or if the whistleblower feels that the reported infringement directly endangers the "public interest".
Mandatory introduction of internal reporting channels
Companies with more than 50 employees are obliged to introduce internal reporting channels, whereby a later transposition deadline applies to legal entities with between 50 and 249 employees (17 December 2023 instead of 17 December 2021). The Directive refers to "legal persons", so it is unlikely to be necessary to consider the number of employees on a group-wide basis. Companies operating in the financial services sector or in a sector considered by the Union to be vulnerable to money laundering/the financing of terrorism will also have to introduce such channels on a mandatory basis. As a rule, legal entities in the public sector are always obliged to introduce a whistleblower system. Municipalities are only subject to this obligation if the local population is greater than 10,000.
The design of internal reporting channels
The internal reporting channels must make it possible for a report to be made whilst ensuring the identity of the whistleblower remains confidential. The Directive does not contain any formal requirements in this respect. In principle, provision can therefore be made for both the written (e.g. online portal) and oral submission (e.g. whistleblower hotline) of reports. Receipt of the report must be taken by an impartial department or person who must subsequently inform the whistleblower of any investigations initiated or follow-up measures taken within three months.
Protection for whistleblowers
The Directive requires Member States to implement comprehensive protective measures for whistleblowers. In particular, whistleblowers must be protected against reprisals, such as dismissal, demotion or discrimination by or on the part of the employer. The protective measures to be implemented also include legal aid, free counselling and information for whistleblowers as well as various measures aimed at protecting the individual's identity.
The Directive obliges Member States to establish sanctions to be imposed on natural or legal persons who take reprisals against whistleblowers, wilfully seek to take legal proceedings against whistleblowers, fail to protect the identity of whistleblowers adequately or attempt to suppress reports made. However, the Directive does not specify a specific penalty framework.
Affected companies and public institutions are well advised to start planning the establishment of a whistleblowing system as early as possible. In addition to different versions of technical implementation (including the question of an internal or external system), organisational measures (adaptation of HR processes, internal responsibilities, etc.) and other legal requirements (data protection, conclusion of works agreements, etc.) must be taken into account.
CERHA HEMPEL will support you with regard to both planning and implementation.