Despite the fact that the deadline for implementing the EU Directive on the protection of persons who report breaches of Union law (“Directive”) is here, only four EU Member States took action to enact national implementing laws as of the morning of the 17th. The others are somewhere between close to finalizing and possibly not even starting yet.
It is therefore fair to say that implementation has not advanced as much as we might have expected when we first reported on the topic in June. With the holidays right around the corner, it seems unlikely that there will be any additional implementation progress made before the end of the year. Not knowing when Member States are likely to finalize their laws makes it difficult for multinational organizations to predict how to structure their compliance efforts in a pragmatic way.
Below we look at some of the key questions that might interest organizations that fall within the scope of the Directive. To find out more about the Directive’s substantive requirements, see this overview article. For additional information about the status of the implementation and latest developments and know-how, visit our MoFo Whistleblowing Resource Center.
As of the morning of December 17, only four EU Member States have adopted their implementing laws: Denmark, Lithuania, Portugal, and Sweden[1]. The biggest change in the national laws pertains to the scope of reportable topics. All Member States have decided to broaden the scope beyond that in the Directive, which is limited to violations of EU law only. For the most part, however, the adopted laws replicate the Directive’s requirements, with some deviations. You can read about notable points and deviations in the adopted implementing laws in our brief Q&As for each Member State.
Most of the above-mentioned Member States include provisions that, to varying degrees, contemplate sharing of resources and centrally run hotlines. Many multinationals consider centrally run hotlines as a practical necessity for the purpose of proper compliance, not only with the Directive but other applicable whistleblowing rules across the world; however, this concept became an issue earlier this year after the European Commission Expert Group (“ECEG”) took the view that multinational organizations must offer local entity level reporting channels alongside their central whistleblowing hotlines. We discuss in this article what the ECEG’s position is, why it may not fulfil the Directive’s objectives in practice, and how it may even undermine whistleblowers’ protection.
This is an area that needs close monitoring. If your organization already maintains or plans to implement a centrally run hotline, you may want to consider sharing your thoughts with relevant authorities and legislators on why the ECEG’s idea of the need for locally run hotlines does not hold water.
Many Member States by now have introduced a draft bill, although a few (such as Hungary, Italy, and Luxembourg) have yet to do so. Furthermore, the Directive is still stated to be “under scrutiny” by the European Economic Area countries (Iceland, Lichtenstein, and Norway); this status has remained unchanged for some time now. Overall, we anticipate that the remaining countries will struggle to adopt national implementing laws before the end of the year. It is also questionable how many will manage to do it in the first half of 2022 or even later.
In part, the delays can be attributed to the COVID-19 pandemic, which every Member State is grappling with; this is serving as a major distraction for every government and its legislative initiatives, apparently resulting in delays across the board. On top of this, several Member States have undergone general elections this year, which either made whistleblowing laws a topic of hot debate (like in Germany) or something to ignore. Either way, whistleblowing has seemed, at times, low on the priority list of many Member States.
You can track the progress of developments in our Whistleblowing Resource Center.
You may not be surprised to hear that this is not the first time Member States either have been slow to respond or have intentionally refused to transpose a directive into national law. Just this year, 23 Member States failed to implement the EU Copyright Directive in time for the June 2021 deadline, which resulted in the EC issuing formal notices, asking the Member States to explain the infringement. The same procedure may need to be followed here, at which point the EC may also choose to refer the case to the Court of Justice of the European Union if it is not reasonably satisfied with a Member State’s reason for delay.
Notably, the Directive does not include any direct obligations on organizations to set up whistleblowing hotlines. It instead mandates Member States to ensure that their national laws impose such obligations on organizations. Furthermore, while individuals may be able to enforce their rights against the state with respect to their own rights and protections (based on the concept of “vertical effect” as established, for example, in Pubblico Ministero v. Ratti (Case 148/78)); they are unlikely to have the standing to enforce directly against organizations in Member States without national implementing laws.
That is the million-dollar question, and there are some key considerations in play.
[1] According to the most current information available to us, Malta’s implementing laws was signed by the President of Malta on December 18, and therefore counts as adopted, but is not yet in force.