Enhancing compliance, accountability and transparency through whistleblowers

June 2019 | EXPERT BRIEFING | FRAUD & CORRUPTION

financierworldwide.com

In its 2016 communication, ‘EU law: Better results through better application’, the European Commission (EC) acknowledged that applying and enforcing EU law remains a challenge. Recent large-scale scandals such as ‘Dieselgate’, ‘Lux leaks’ or the Danske Bank case of 2018 confirm that no company or public body is immune to malpractice. There is, therefore, an urgent need to reinforce compliance and effective access to evidence, detection and investigation of wrongdoing.

Against this background, protecting those insiders who report information about malpractice could be an essential tool for the enforcement chain, for both EU and national authorities. Yet, the role of whistleblowers has historically suffered from a lack of cultural acceptance, which has led to fragmentation and uneven protection across the EU countries. Currently, only a few Member States and limited EU sectoral law, developed reactively in the aftermath of the financial crisis, provide measures to protect whistleblowers. Regardless, the economic benefits of whistleblowers are indisputable. According to a 2017 EC study, the potential benefits of whistleblowers in enforcing public procurement rules alone could help recover between €5.8bn and €9.6bn per year.

Main features of the future EU Directive

To enhance enforcement and reform the current fragmentation of the EU and national legal frameworks, on 23 April 2018, the EC put forward a Proposal for a Directive on the protection of persons reporting on breaches of Union law, the Whistleblowing Directive, which was agreed on 11 March 2019 by the European Parliament and the Council. The Directive will oblige all Member States to bring forward national laws by 2021 providing minimum standards to protect whistleblowers, as well as procedures and channels for reporting.

It is important to note that the Directive is based on the principles emanating from the existing case law of the European Court of Human Rights (ECHR), relating to the interaction of whistleblowing with the right to freedom of expression. Furthermore, the Directive is mindful of the fact that certain EU sectoral protections, namely under the EU financial services, anti-money laundering and civil aviation acquis, is already granted and leaves such rules unaffected. At the same time, the Directive complements those sectoral rules with more detailed procedures and measures of protection.

Wide material and personal scope

The Directive lists 13 areas of EU law where breaches can be reported: public procurement, financial services and money laundering, product, transport and food and feed safety, animal health and welfare, environmental and consumer protection, nuclear safety, public health, protection of personal data, protection of the financial interests of the Union, breaches of competition law and corporate tax rules. Thus, the Directive only includes key areas with a clear EU dimension in order to be mindful of the principle of subsidiarity – the EU can only regulate what it is competent for.

However, several sectors have noted the complexity that whistleblowers may face when trying to understand whether they would be protected when reporting. For example, a whistleblower may report fraud related to public funding, without knowing whether the money comes from the EU, for which protection is granted under the Directive, or from national sources, where there is no protection granted. Hence, together with the Proposal, the EC issued a Communication on ‘Strengthening whistleblower protection at EU level’, where it strongly encouraged Member States “to consider extending its scope of application to other areas [of national law], and more generally to ensure a comprehensive and coherent framework at national level”.

In terms of personal scope, the Directive includes the broadest possible category of whistleblowers: employees of the public and private sector, as well as services providers, contractors or suppliers or other non-standard forms of employment, such as volunteers, trainees or shareholders. Furthermore, the Directive also provides protection from indirect retaliation suffered by persons who have not reported themselves, but who have assisted the whistleblower in his or her reporting, such as colleagues or relatives who also work for the same employer.

Reporting channels: ensuring confidentiality, follow-up and reporting to the media

The lack of availability or proper functioning of internal channels has been repeatedly described as one of the main deterrents to reporting. According to a large number of surveys, more than 90 percent of whistleblowers try to report their concerns internally within the company first and, not just once, but several times, if the initial reports are not followed up.

Consequently, the Directive includes an obligation to establish internal reporting channels for all private companies in Europe with 50 or more employees, as well as for all public institutions with the exception of small municipalities with less than 10,000 inhabitants or public bodies with less than 50 employees. Internal reporting channels will have to guarantee the confidentiality of the identity of the whistleblower, which is a cornerstone of whistleblower protection, and an independent person or department will have to be designated to receive reports, diligently follow them up and provide feedback to the whistleblower within three months. Moreover, companies and public institutions will be required to provide their employees with information on how to report.

For cases where internal channels do not exist or are not expected to work, such as where management is involved in the wrongdoing or where there has been no follow-up of the internal report, for example, the Directive obliges Member States to create a secure external reporting channel, which will need to ensure confidentiality, and designate a competent authority to follow- up and provide feedback to the whistleblower within three to six months. Competent authorities will also have to provide user-friendly information which is easily accessible about the available reporting channels and protection measures.

Finally, the Directive gives the whistleblower a third layer of reporting: the possibility to publicly disclose information, including reporting to the press. Yet, to preserve the rights and protect the identity of those accused by whistleblowers, the chance to publicly disclose information and be protected for it will be restricted to those cases where competent authorities have not acted upon the report (for example, where there is collusion or where evidence may be destroyed) or where there is a case of emergency or manifest danger.

Prohibition of retaliation and measures of protection

Retaliation may occur in many different forms, such as dismissal, demotion, transfer of duties, harassment or ostracism at the workplace. Fear of suffering economic or personal harm is often well-founded and has a chilling effect, being this is the main deterrent for potential whistleblowers not to report.

Accordingly, the Directive clearly prohibits any form of harm and lists some of the most common retaliation suffered by employees and self-employees, such as dismissal, cancellation of contract or blacklisting.

The Directive also includes measures if retaliation does occur. While the type of harm suffered will determine the most adequate remedy, legal protection is, however, the most important element. The Directive reverses the burden of proof in judicial proceedings, which will oblige the employer, once the whistleblower has established a prima facie case, to demonstrate and justify the grounds of the contested measure taken. Similar to discrimination cases, this responds to the imbalance of power in the means of evidence to sustain or contest a detrimental measure. This protection is accompanied by the chance to request interim relief to halt ongoing retaliation, as well as protection from liability due to breaching a disclosure agreement, copyright or data protection rules or disclosing trade secrets or defamation, among others. Employees cannot waive their rights through any contractual means. Legal remedies are accompanied by an obligation of Member States to provide comprehensive information and advice, free of charge, and assistance by competent authorities before the courts.

It is important to note that the Directive defines retaliation as an unjustified detriment to the whistleblower. The protection given to whistleblowers is not absolute and does not shield an employee against any other justified measure taken by the employer, for example due to a restructuring. The employer maintains the right to impose any detrimental measure based on duly justified grounds.

Conditions for protection

The Directive provides safeguards to discourage malicious whistleblowing and prevent unjustified reputational damage. In particular, whistleblowers qualify for protection only if they had reasonable grounds to believe that the information they reported was true at the time of reporting and that their report fell within the scope of the Directive, or national implementing law. Member States must provide for proportionate sanctions to dissuade malicious or abusive reports or disclosures, as well as sanctions against those who hinder reporting or bring vexatious proceedings against whistleblowers or who breach the duty of confidentiality with regard to the identity of whistleblowers.

Conclusion

The Whistleblowing Directive is a major step toward protecting those who report wrongdoing and help enforce the law. It will bring protection to 40 percent of the EU workforce, which is currently unprotected, and will increase the level of protection available for nearly 20 percent of workers. This new set of measures should be seen as an opportunity, rather than an extra regulatory burden, for businesses: reducing illegal activities, corruption and fraud, which result in distortions of competition and increase financial costs, will promote a healthy competitive market. Likewise, with the Directive, the EU adopts a model of protection widely implemented in other economic areas, such as the US, Australia and Japan, which will enhance transparency, public accountability, democratic values, and, ultimately, the rule of law. Adoption of the Directive is estimated by autumn 2019.

Christel Mercadé is a legal officer at the Directorate-General for Justice and Consumers of the European Commission. She can be contacted on +32 (0)2 296 14 99 or by email: christel.mercade-piqueras@ec.europa.eu. This article presents the personal views of the author and does not reflect the official opinion of the European Commission.

Christel Mercadé

European Commission