Dissecting The Directive – Understanding The EU’s Whistleblowing Regime

The EU Whistleblowing Directive 2019/1937 (the Directive) mandates that the remaining 27 EU member states implement whistleblower protection and anti-retaliation laws by 17 December 2021. Despite the UK no longer being an EU member state, the Directive could still have a significant impact on UK businesses, as we have outlined below.

What are the objectives of the EU Whistleblowing Directive?

The Directive describes previous whistleblower protection across EU member states as ‘fragmented’ and ‘uneven’. Therefore, the core purpose of the Directive is to lay ‘common minimum standards providing for a high level of protection of persons reporting breaches of Union law’ according to Article 1.

The European Commission has recognised the UK as a country that gives comprehensive protection to whistleblowers under the Public Interest Disclosure Act 1998 (as incorporated into the Employment Rights Act 1996). Indeed, much of the Directive’s content is already reflected in UK law. There are, however, some key differences which are set out below.

Scope

In general, the Directive goes further than UK law. For instance, whereas the latter protects just employees and workers, the Directive covers self-employed people, shareholders and board members, including non-executive directors, as well as ‘facilitators’, such as colleagues and relatives, and legal entities associated with the whistleblower.

This could mean that a whistleblower’s employer, such as an external supplier, would have legal rights against another company if, for example, the company denied its services or boycotted it because of the actions of the whistleblower.

Disclosures

Protection under the Directive relates to breaches of EU law that fall within certain sectors, such as procurement, financial services, transport and public health. By contrast, protection under UK law focuses on categories of wrongdoing (known as ‘relevant failures’) such as criminal offences, failure to comply with legal obligations and danger to health and safety.

When it comes to whether a particular disclosure is protected, the Directive is largely consistent with UK law. However, while UK law focuses on the subjective belief of the whistleblower, the test under the Directive is more of an objective one focusing on whether the person had ‘reasonable grounds’ to believe there was a basis to make a protected disclosure.

Under UK law, a disclosure must, in the reasonable belief of the worker, be made in the public interest to be protected. By contrast, there is no express public interest requirement set down in the Directive. Recital 22, however, gives member states the scope to exclude ‘reports concerning interpersonal grievances exclusively affecting the reporting person, namely grievances about interpersonal conflicts between the reporting person and another worker’, from the scope of protection.

Reporting

While UK law is focused primarily on preventing the mistreatment of whistleblowers, the Directive sets out a mechanism to facilitate and support the process of whistleblowing in the first place.

The Directive requires private sector organisations with 50 or more employees to create internal reporting channels. For organisations with 250 or more employees, the reporting channels requirement applies from 17 December 2021, whereas those with 50 to 249 employees will have an additional two years to introduce suitable processes.

Save for certain requirements that apply to regulated financial services businesses, there is no general obligation under UK law for employers to establish internal reporting channels or, for that matter, to have a whistleblowing policy in place – although, it is strongly encouraged that an employer does both.

Feedback

The Directive prescribes deadlines that employers must follow – a disclosure must be acknowledged within seven days and ‘meaningful’ feedback provided within a reasonable timeframe, not exceeding three months.

It states ‘informing, as far as legally possible and in the comprehensive way possible, the reporting person about the follow-up to the report is crucial for building trust in the effectiveness of the overall system of whistleblower protection…’ and that ‘the reporting person should be informed […] about the action envisaged or taken as follow-up to the report and grounds for the choice of that follow-up.’

It’s worth bearing in mind that there is no equivalent requirement under UK law for an employer to provide feedback to a whistleblower (although it is good practice for an employer to do so)

Confidentiality

According to Article 16, except where it is necessary and proportionate in the context of investigations, a whistleblower’s identity must not be disclosed to anyone other than the authorised staff members dealing with the report without the whistleblower’s explicit consent.

UK legislation does not impose an equivalent obligation, although a duty of confidentiality has developed through case law.

Record keeping

Article 18 of the Directive sets out a detailed record-keeping requirement. Again, there is no equivalent obligation under UK law, although employers tend to keep records of concerns raised by employees with HR files. Where such records are maintained, they should be in accordance with data protection principles.

How does the EU Whistleblowing Directive impact UK businesses?

Any employer based outside the EU that operates inside the EU will find itself subject to the Directive (or, rather, the implementing legislation of the member state(s) within which it operates).

In addition, the EU-UK Trade and Co-operation Agreement, which applied provisionally as of 1 January 2021 and entered into force on 1 May 2021, contains wide-ranging level playing provisions pursuant to which both sides agreed to continue to strive to increase their respective labour and social level of protection.

Lastly, from a practical perspective, some UK businesses may feel the need to ‘ramp up’ their whistleblowing policies and procedures to meet the provisions of the Directive. This could be out of concern about being seen to offer a significantly lower level of support and protection to employees, which could then have adverse implications in terms of trading, international procurement and investment decisions by EU business.

Moreover, for reasons of consistency and best practice, some international businesses will wish to maintain a single, unified whistleblowing framework across the various countries in which they operate.