Do you work for an organization that does not know what to do with its whistleblowing hotline in Europe? Are you patiently waiting for any news on what is happening with the implementation throughout the European Economic Area (“EEA”) of the new EU’s Directive on the protection of persons who report breaches of European Union law (the “Whistleblowing Directive”), while getting more and more concerned about the lack of information? Well, if it helps at all, you are not alone. Although the implementation deadline of December 17 appears quite far away for now, this is deceptive — especially for multinational organizations that have to start preparing to comply with likely varying local implementation requirements in multiple countries.
We have been monitoring the implementation progress in 30 EEA countries, and the outlook does not look that great. As far as we can tell, not a single country has managed to adopt its implementing law to date, and some countries appear to have not even started yet. The good news is that the majority of countries are in the middle of their implementation process, but whether local legislators will manage to agree on the bills soon enough to have them ready before December 17 is anyone’s guess. As eternal optimists, we hope for the best. But while we wait, we put together a short summary of our findings and thoughts to help provide some context.
For more information on the Whistleblowing Directive and its requirements, please see the article written by Alja Poler De Zwart for the Journal of Investment Compliance.
The Whistleblowing Directive came into force on December 16, 2019. It requires the Member States to create rules for organizations with more than 50 workers and requires such organizations to implement whistleblowing hotlines for reporting a broad range of EU law violations. For that purpose, the Whistleblowing Directive contains minimum standards on how to respond to and handle any concerns raised by whistleblowers.
The Member States need to implement the Whistleblowing Directive into local law by December 17, 2021, although the compliance requirements are staggered depending on the organization’s size:
National implementation inevitably means that there will not be full harmonization, so the whistleblowing rules in the EU will likely differ by the individual Member States. This will, to a certain extent, mean that multinational organizations with operations in various Member States will need to take local differences into account when setting up their whistleblowing processes.
With just over six months to go before the implementation deadline, it is fair to say that the status is mixed across the various Member States. Let’s start with some hard statistics:
The better news, based on publically available information, is that 22 Member States have at least started and are making progress towards implementation: Belgium, Bulgaria, Croatia, Czech Republic, Denmark, Estonia, Finland, France, Germany, Greece, Ireland, Italy, Latvia, Lithuania, Netherlands, Poland, Portugal, Romania, Slovakia, Slovenia, Spain, and Sweden.
Czech Republic, for example, appears to be close to finalizing its draft local law. Looking at its draft bill (available in Czech only), which could still change before it comes into force, Czech Republic seems to have used its right under the Whistleblowing Directive to expand the scope of what can be reported. The draft wording in the bill explicitly permits reporters in Czech Republic to raise concerns relating to any possible offense “that has the characteristics of a crime or misdemeanor” (no matter how serious). This is a much broader scope than detailed in the Whistleblowing Directive, which is limited to actual breaches of EU law. However, there are some concerns that there may be delays in actually passing the finalized draft, due to parliamentary elections scheduled for October 2021. Slovakia is also rumored to be near finalization, given that it has just appointed its first national Director of the Whistleblower Data Protection Office; more information about the Director and the draft bill is not yet available, but we will continue to track this.
The phrase “herding cats” comes to mind when looking at the current legislative landscape in each of the Member States. Now that we are in the summer season, it is likely that developments and implementation efforts will slow down even more as national parliaments go into summer recess. In the meantime, we will continue to monitor each Member States’ progress.
At this stage, it is hard to identify any trends in the draft laws, given that so much is still in flux in each country. From what is available, however, there are some themes emerging in relation to legislative approach. Some countries, such as Ireland, are going through the legislative process in a pretty straightforward manner, with little controversy for now. Other countries are encountering internal debates — which could be politically driven. In Germany, for example, the Christian Democratic Union, which leads the Federal Ministry of Economics, has criticized the current draft as going beyond the Whistleblowing Directive’s requirements; the argument being that the proposed scope creates additional burdens on organizations. (Interestingly, we have seen other countries also raise similar questions over what they should do in terms of scope.) On the other hand, the Germany Federal Ministry of Justice — which is led by the Social Democratic Party — is standing firm on its proposals. Commentators have stated that this deadlock makes it questionable whether Germany can even meet the December 17 deadline.
Taking this to the extreme, if a Member State fails to implement the Whistleblowing Directive before the December 17 deadline, this will raise another headache, not only for organizations with operations in that country, but for the country itself and the EU. The Whistleblowing Directive, as an EU directive, requires local law implementation to be effective (compared to an EU regulation, which is immediately binding without additional input from the Member States). This means if a Member State does not adopt an implementing law, the Whistleblowing Directive will not be effective in that Member State.
By way of comparison, Slovenia has still not managed to implement its GDPR-implementing law; in general, this is not a problem because the GDPR applies directly in Slovenia without needing any national implementing laws. Failing to implement an EU directive, on the other hand, is not only a problem for the affected Member State but also for the European Commission, which would then need to initiate infringement procedures and bring proceedings against the Member State before the Court of Justice of the EU.
For Member States that fail to implement the Whistleblowing Directive in a timely fashion, organizations can at least adopt a whistleblowing hotline consistent with the Whistleblowing Directive itself and any other relevant implementing laws that are available on time, and then modify any internal policies and procedures when additional Member States implement the Whistleblowing Directive.
The slow implementation inevitably means that organizations will have a longer wait than anticipated to get clarity over how to structure their whistleblowing projects. If Member States end up issuing local implementing laws at the last moment, then this will no doubt cause operational delays for organizations. This problem will likely be exacerbated for multi-national organizations with employees across more than one Member State.
The first steps towards compliance can already be done: