From 17 Dec 2021, whistleblowers who report breaches of European Union (EU) laws will have greater protection. However, most EU member states have not yet implemented the directive, or adjusted any existing whistleblowing laws. Following Brexit, the United Kingdom (UK) does not have to implement the directive, but is subject to the provisions of the Trade and Cooperation Agreement (TCA).

Highlights

• Definition of protected individuals. The directive includes a wide definition as to the individuals — not just employees — who will be protected against retaliation and other actions (such as demotion, transfer of duties, discrimination or unfair treatment), and establishes the conditions for making whistleblower disclosures. 
  
  
• Scope of whistleblower protection. The directive covers disclosures regarding public procurement, financial services, money laundering, terrorist financing, corporate tax, product and transportation safety, environmental and nuclear safety, food and feed safety, animal health and welfare, public health, consumer protection, and protection of privacy, data protection and security of network and information services. Member states’ laws could expand whistleblower protection to other types of wrongdoing. 
  
  
• Reporting channels. The directive requires private companies with more than 50 employees to establish internal reporting channels within their organization, ensure confidentiality for whistleblowers, and designate an individual or department to be responsible for receiving whistleblowing reports. The directive sets out the minimum conditions that organizations must meet, including the timeframes for responding to whistleblowers. Member states can delay the establishment of reporting requirements until 17 Dec 2023 for private sector employers with between 50 to 249 employees, and can decide if anonymous reporting is allowed. 
  
  
• Financial services sector. All regulated entities in the financial services sector or organizations vulnerable to money laundering or terrorist financing must have reporting channels (the minimum 50-employee threshold does not apply). Many of these firms are already subject to whistleblowing systems. 
  
  
• National authorities. Member states must designate a competent national authority with responsibility for whistleblowing, and establish a user-friendly external reporting channel separate from normal public complaints systems. 
  
  
• External disclosure. In certain circumstances, individuals will be allowed to disclose information externally to a national competent authority.

In 2018, prior to the directive’s agreement, the commission reported that only nine member states (France, Hungary, Ireland, Italy, Lithuania, Malta, the Netherlands, Slovakia, Sweden, and the UK) offered comprehensive legal protection for whistleblowers.  Although the UK is not required to implement the directive, the EU-UK TCA includes provisions aimed at establishing a level playing field in relation to labor and social provisions. It is not known if the UK government will amend its current whistleblowing framework to incorporate the directive. Employers subject to the United States’ Sarbanes-Oxley legislation and EU whistleblower laws should examine their whistleblowing policies to determine if changes are necessary. 

Related resources

Non-Mercer resources

• Directive (EU) 2019/1937 on the protection of persons who report breaches of Union law (EurLex, 26 Nov 2019)
• Trade and Cooperation Agreement between the European Union and the United Kingdom (EurLex, 30 Apr 2021)

Mercer Law & Policy resource

• EU finalizes law on whistleblower protections (9 Oct 2021)