EU Whistleblower Directive – Prepare for Potential Policy Adjustments

While the Commission's ulterior actions target member states, the business community will be directly affected as national laws will be amended to align with the Directive’s standards. Therefore, it may be wise for businesses to already proactively adjust their policies and practices to avoid rushed changes when new adapted national laws come into effect.

Background

The 2019/1937 EU Whistleblower Directive has now finally been implemented by all member states. With the implementation laws in Estonia and Poland having come into force in May 2024, this marks the end of a complex and challenging implementation process. In January 2022, the European Commission initiated formal infringement proceedings against 15 member states that had failed to comply by the Directive’s original deadline. Most private businesses have already taken the necessary steps to comply with the Directive and the corresponding national laws in all the countries where they operate.

In July 2024, the European Commission published its implementation report of the Directive, identifying key areas where compliance has fallen short. The report highlights among others inconsistent protections for whistleblowers, gaps in reporting mechanisms, and weak retaliation safeguards. The Commission has urged member states to amend their national laws to fully align with the Directive’s standards and has threatened to escalate enforcement actions, including infringement procedures, against non-compliant states to ensure uniform application of whistleblower protection across the EU.

While these threats are directed at member states, the legal changes they bring will directly impact private businesses, as national laws will be amended to reflect the Directive’s standards. Therefore, businesses would be wise in taking proactive steps to ensure their policies are in alignment with what the Commission criticizes, that will later become potential changes, to avoid rushing to comply once the new rules come into effect.

Key Issues Identified by the Commission:

1. Gaps in Protection for Whistleblowers: Many member states (e.g. Poland, Hungary, Italy, and Bulgaria) have narrowed the scope of protection, failing to include the full range of individuals protected under the Directive, such as contractors, trainees, and volunteers.
   
   The Commission further flags discrepancies in how retaliation protections are applied in these same countries, with weak or vague retaliation safeguards that could undermine the effectiveness of the protection mechanisms.
   
   Private businesses should ensure their whistleblowing policies embrace the full scope of the Directive’s protections.
   
   
2. Local vs. Central Reporting Channels: One of the core requirements of the Directive is the establishment of internal reporting channels within organizations, which are necessary to ensure accessibility and effectiveness. However, only a few countries, such as Ireland and Poland, have fully implemented this requirement.
   
   Many countries, including Germany and France, have allowed centralized reporting systems even for companies with 250+ employees, raising concerns about the adequacy of these systems.
   
   Businesses relying solely on centralized whistleblowing platforms may want to consider establishing local reporting mechanisms for their larger entities.
   
   
3. Confidentiality Obligations: Some member states have not properly implemented rules requiring whistleblowers to be informed if their identity is disclosed to authorities.
   
   Policies may need to be updated to ensure proper communication with whistleblowers about how their identity is handled.
   
   
4. Internal Reporting Procedures: The issues spotted by the Commission also include insufficient diligence in follow-up processes, unclear timelines for acknowledging reports, and gaps in procedural guidance in several member states. These uncertainties are particularly evident in the transposition laws of France, Germany, and Poland.
   
   To prepare for potential adjustments in these countries, companies might already want to refine their reporting workflows to align with the Directive’s standards (which now go beyond national requirements).

Conclusion

Private businesses should proactively adjust their whistleblowing policies to align with the EU Whistleblower Directive’s broader standards, which often go beyond the sometimes-lenient national laws. While the EU Commission’s report targets member states, the resulting changes will have a direct impact on businesses operating in these countries. Companies must ensure that their policies cover the full scope of protections, include local reporting channels, and emphasize confidentiality and anti-retaliation measures. By staying informed about the potential amendments to national laws and aligning with the Directive’s rigorous standards, businesses can safeguard compliance and maintain strong, effective whistleblowing frameworks in the long run.