Whistleblowers: New protection rules within the EU

The recent Panama Papers and LuxLeaks scandals have illustrated the urgent need to establish legislation to protect whistleblowers, as their revelations have raised awareness of the serious breaches of EU law – particularly harmful to the public interest – and of the precariousness of their status.

The entry into force on December 16, 2019 of Directive 2019/1937 of October 23, 2019 on the protection of persons who report breaches of EU Law is a major step forward in encouraging Member States to go beyond the common minimum standards by creating a harmonized framework within the European Union to provide effective protection to whistleblowers.

While in France and in about ten other EU Member States, a comprehensive protective legislation for whistleblowers already exists^[1], the Directive represents a major step forward as it enables the European Union to establish a general framework to protect persons – working in the private or public sector – who have obtained information on breaches of EU law in a professional context. 

The Directive is indeed intended to apply to breaches of EU law concerning in particular the fight against money laundering, product and transport safety, health protection, the environment as well as the protection of consumers, privacy and personal data.

However, to enjoy protection under the Directive, reporting persons must (i) have reasonable grounds to believe, at the time of reporting, that the matters reported by them are true, and (ii) comply with the established procedure.

As such, the Directive provides for the establishment of internal and external “reporting channels”:

• “Internal reporting channels”: Member States shall ensure that legal entities in the private and public sector establish such channels. These channels should enable (i) the secure receipt of information by ensuring the confidentiality of the identity of the reporting person and any third party mentioned in the report, (ii) the acknowledgment of receipt of the report within a period of seven days, and (iii) the designation of an impartial person or department competent for following-up on the reports;

• “External reporting channels” (that may be used by whistleblowers as a complement to, or as a substitute for, internal reporting channels): Member States shall designate independent and autonomous competent authorities that will be responsible for ensuring the completeness, integrity and confidentiality of the information and preventing access thereto by non-authorized persons.

When the oral or written report has been made through one of these channels, the reporting person will benefit from a particularly broad protection during the processing period. In this respect, the Directive specifies that feedback must be provided to the reporting person within a maximum of three months from the acknowledgment of receipt or, if no acknowledgement was sent to the reporting person, three months from the expiry of the seven-day period after the report was made.

The Directive specifies that Member States must not only take all appropriate measures to protect the whistleblower – by ensuring that the identity of the whistleblower is not revealed and by prohibiting any form of retaliation – but also support him/her by providing easily accessible information and advice, effective assistance and legal aid. It is interesting to note that the whistleblower may also benefit from a financial assistance and psychological support.

Finally, the Directive requires Member States to provide for effective, proportionate and dissuasive penalties applicable to natural or legal persons who/that hinder reporting, take retaliation measures or breach the duty of maintaining the confidentiality of the identity of reporting persons. The deadline for transposing the Directive into domestic law has been set on December 17, 2021.

[1] Law n° 2016-1691 of December 9, 2019 on transparency, the fight against corruption and the modernization of the economy, commonly referred to as the “Sapin II Law”.