The implementation of the EU Directive on the protection of persons who report breaches of Union law (the “Whistleblowing Directive”) into local EU Member State (“MS”) laws has not been as simple as compliance professionals would have hoped. The Whistleblowing Directive sets new EU-wide minimum standards for protecting whistleblowers and requires MS to establish comprehensive whistleblower protection frameworks.
MS are permitted to expand on the protections granted within the Whistleblowing Directive in a number of areas, for example, by determining what penalties apply for violations and expanding the scope of reportable concerns. For more information, see MoFo’s Whistleblowing Resource Center.
Teams within global organizations tasked with maintaining whistleblowing hotlines have therefore been navigating the new rules imposed under the Whistleblowing Directive while also monitoring how MS continue to deviate from the Whistleblowing Directive in a number of areas.
Even though MS were required to implement the Whistleblowing Directive into their national laws by December 17, 2021, only a handful did so. In December 2022, we reported that just 13 MS had finalized their laws; however, in just three months an additional six MS have adopted the implementing laws—namely Austria, Bulgaria, Finland, Greece, Slovenia, and Spain.
Among the countries still to go, Italy has recently given signs that its implementation will happen soon. In Italy, a final draft was approved by the government last December and is currently being revised prior to presidential assent and publication.
Below, we have summarized the status of the Whistleblowing Directive implementation for each MS as of the date of this article.
Member States | |
Adopted and in force (If applicable, the grace period for organizations with at least 250 workers) |
|
Adopted but not yet in force (If applicable, the grace period for organizations with at least 250 workers) |
|
Bill drafted |
|
The European Commission has continued to maintain pressure on those MS who have yet to adopt their implementing laws. On February 15, 2023, the European Commission decided to refer Czechia, Germany, Estonia, Spain, Italy, Luxembourg, Hungary, and Poland to the Court of Justice of the European Union for failing to transpose the Whistleblowing Directive.
Spain has since adopted its implementing law. (You can find a summary of Spain’s whistleblowing law on our Whistleblowing Resource Center.)
The remaining MS have now all made progress (with some setbacks). For instance, in Germany, the draft law was rejected last February by the Federal Council, and negotiations between stakeholders will have to resume.
To find out more about the updates mentioned above and to stay on top of other upcoming Whistleblowing Directive developments, we invite you to see MoFo’s Whistleblowing Resource Center.
We are grateful to Thiago Cosentino, a privacy analyst in our Brussels office for their contributions to this alert.