New EU directive on whistleblowing protection: little impact in practice?
At the end of November 2019, the European Union published its new Directive on the protection of persons who report breaches of Union law – the so-called whistleblowers. The idea behind the directive is to guarantee the same minimum protection in the entire EU to those who render their concerns on potential violations of legislation public. This is needed because insufficient protection in one Member State negatively impacts the functioning of Union policies, not only in that Member State, but also in other Member States and in the Union as a whole.
Therefore, the EU introduced the directive 2019/1937 to protect whistleblowers against retaliations. The directive applies to persons who are in an economic subordinate relation towards the person considered to potentially commit a violation of legislation. This includes employees, civil servants, freelancers etc.
The choice for a directive implies that member states still have to to implement national legislation before citizens are able to benefit from the protection provided by the directive. The national legislation has to be in place by 17 December 2021. Differences in scope and protection in member states thus remain possible.
Although it is not clear yet how Belgium (and other member states) will implement the directive under national legislation, the analysis of the directive itself may lead to the conclusion that its impact on persons having the intention to express their concerns about potential irregularities will be limited. Indeed, its scope is fairly restrictive. It only applies to whistleblowers who report violations that relate to an exhaustive list of matters, such as public procurement, product safety and privacy and personal data. More in general, it applies to breaches affecting the financial interests of the EU and the internal market (such as competition). As these are rather specific areas, it can be expected that the most common irregularities within companies, such as fraud or theft, fall outside the scope of the directive. Employees willing to report such irregularity will thus not benefit from the protection provided for by the directive unless the national legislation would decide to expand the protection to other matters. The former Belgian privacy commission stated in a recommendation of 2006 that a company whistleblowing report system should be limited to substantial issues that are sufficiently serious to be reported in light of the public interest or good governance of the company. It would therefore not be surprising if the Belgian legislator would opt to limit the Belgian legislation to the scope described the directive.
In such a case, it can be expected that the number of employees that will be able to benefit from the protection provided by the EU is limited. Nevertheless, in many cases companies will be forced to take action and to comply with certain formalities.
After all, the directive imposes the obligation to implement a whistleblowing system to companies with at least 50 employees. Employers should establish channels and procedures for internal reporting and follow-up. Such reporting channels may be operated internally – by a person or department designated for that purpose – or provided externally by a third party. The directive offers the possibility for employers with 50-249 employees to share resources. However, the question arises whether companies are willing to outsource this obligation and to pay a third party if the number of reports will be limited, taking into account the limited scope of application of the directive.
In addition to the internal reporting system, the member states are also obliged to set-up channels for external reporting, i.e. to designate the authorities that can receive and follow-up reports. There is no obligation for the whistleblower to first make use of the internal reporting channel before being allowed to address the external channel.
Finally, a whistleblower will also qualify for the protection offered by the directive if he makes a public disclosure, but only (i) if he first reported internally and externally, or directly externally, but no appropriate action was taken, or (ii) if there are reasonable grounds to believe that the breach he intends to disclose constitutes an imminent or manifest danger to the public interest or if external reporting would lead to a risk of retaliation or a low prospect of the breach being effectively addressed.
Although we still have to await initiatives from the Belgian legislator, the set-up seems comparable to the obligation for Belgian employers related to psychosocial risks at work. After a change in legislation on psychosocial risks at work in 2014, employers were obliged to set up rather specific procedures offering employees the possibility to report issues of (sexual) harassment and violence at work to the prevention counsellor specialised in the matter. In addition to these internal procedures, the health and safety legislation also provides the possibility to address the social inspectorate if the internal procedures would not provide sufficient remedy.
The whistleblower who reported or disclosed a (potential) violation within the framework of the directive, will benefit from a protection against any form of retaliation. This protection also relates to threats and attempts of retaliation and retaliation measures taken towards third parties who are related to the whistleblower. How this will be implemented in practice, is up to the member states. A possibility here may be that the Belgian legislator finds inspiration in the legislation on psychosocial risks at work and discrimination, that provides a protection indemnity corresponding to 6 months’ salary.
In any event, the directive itself already provides for a reversal of the burden of proof in favour of the whistleblower under certain conditions. In such cases, it shall be for the person who has taken the detrimental measure to prove that this measure was based on duly justified and unrelated grounds. This principle is a familiar one for Belgian employers, as a similar principle also applies in the framework of the protection of psychosocial risks at work.
It is still too early to know the full impact of the whistleblowing directive on the Belgian employers, as we still have to await how the national legislator will implement the provisions. Nevertheless, if Belgium would limit its national regulations to the scope determined by the EU, the impact for employees on the work floor will be limited. The employers however will find themselves confronted with the requirement to implement new procedures in this respect.