In October 2019, the European Council formally adopted the Directive on the Protection of Persons who Report Breaches of Union Law (the EU Directive) aimed at providing enhanced protection to whistleblowers. The EU Directive will now be formally signed and published, and EU member states will have until the end of 2021 to incorporate the new rules into their national law. In addition to setting minimum standards of protection for disclosure, the EU Directive also requires EU member states to establish safe channels for reporting both within an organisation and to public authorities.

The main aim of the EU Directive, as stated in Article 1, is to ensure that there are common minimum standards across the EU. As the EU Directive suggests, current protection offered to whistleblowers across the EU is fragmented and uneven as only 10 EU member states have in place comprehensive legislation. The EU Directive will therefore affect not only EU member states that do not have any measures in place, but also those that have already implemented laws on whistleblowing.

Scope of the EU Directive

The EU Directive specifically protects disclosures relating to 10 key areas including public procurement, financial services, money laundering, environment protection, consumer and data protection etc. It applies to all reporting individuals working in the private or public sector who acquired information on breaches in a work-related context. Compared to the UK’s whistleblowing legislation for example, the EU Directive has a wider reach, as it extends beyond workers to include, self-employed individuals (although some may be covered by UK law), shareholders, non-executive directors, volunteers, unpaid trainees and former workers where the work based relationships has since ended.

Under the EU Directive, whistleblowers will be protected against any form of retaliation, which is defined as any direct or indirect act or omission occurring in a work-related context, prompted by internal or external reporting or by public disclosure, and which causes or may cause unjustified detriment to the reporting person. This could be suspension, demotion or dismissal.  It is important to note, however, that the EU Directive encompasses breaches of EU law, while breaches of national measures will still be the responsibility of the single EU member states.

A reporting person qualifies for protection under the EU Directive if they satisfy the following conditions:

• They have reasonable grounds to believe that the information reported was true at the time of reporting and that such information fell within the scope of the EU Directive. In UK legislation, this requirement is only necessary where the disclosures are being made to a prescribed external person, such as a regulator.
• They reported either internally or externally or made a public disclosure.

New Reporting Channels and Procedures

The EU Directive requires EU member states to make sure that employers establish adequate internal channels and procedures for reporting and follow-up reports. These obligations apply to all employers in the private sector with 50 or more employees. Following an appropriate risk assessment, EU member states can also require legal entities in the private sector with fewer than 50 workers to establish internal reporting channels and procedures.

The procedures for internal channels should ensure the confidentiality of the whistleblower’s identity.  These channels need to be separate from general communication channels, and have dedicated staff members to handle and follow up on reports received within 3 months (which can be extended to 6 months in certain cases).

The EU Directive also requires EU member states to establish external reporting channels, which should be independent and autonomous and to be used only after internal remedies have been exhausted.

Public disclosures

The EU Directive also protects individuals who make public disclosures when they meet the following conditions:

• The individual reported internally and externally first but no appropriate action was taken in response to the report.
• The person has reasonable grounds to believe that: (i) the breach may constitute an imminent or manifest danger to the public interest or (ii) in the case of external reporting, there is a risk of retaliation or a low prospect of the breach being effectively addressed.

What happens in the UK

The UK Government has confirmed in October 2019 that it will not incorporate the EU Directive into its legislation, as it is due to leave the EU before the EU Directive will be implemented across EU member states.

The UK has already in place one of the most comprehensive whistleblowing protection legislations in the EU through the Public Interest Disclosure Act 1998 (PIDA) which amended the Employment Rights Act 1996. However, in August 2019, a review conducted by a UK all-party parliamentary group on whistleblowing (the Working Group) determined that the current UK legal framework is complicated and overly legalistic. In particular, the Working Group recommended the establishment of mandatory reporting channels, an extension of the scope of the protections to reflect existing working practice and protect the public, and the creation of an Independent Office for the Whistleblower as a new regulator.

The EU Directive would have helped to address the areas of concern identified by the Working Group relating to establishing internal reporting channels and extending to a wider category of individuals.  The  UK Government has committed, earlier this year, to allow Parliamentary discussions on whether to align UK legislation with EU standards. Notably, the implementation of the EU Directive in 2021 by the rest of Europe will inevitably affect UK companies with operations in other EU member states. UK employers will need to wait and see whether there will be any changes or developments to the current legislation that resemble the requirements set out in the EU Directive.

Full text of the EU Directive can be found here.