Implementation of the EU Whistleblower Protection Directive
The Whistleblower Protection Act and the Implementation of the Directive in EU Member States
The Directive (EU) 2019/1937 on the protection of persons who report breaches of Union law (also known as the Whistleblower Protection Directive) was required to be transposed into national law by the EU member states by December 17, 2021. The directive was published in the Official Journal of the European Union on October 23, 2019, and came into force 20 days later.
The most crucial deadlines for implementation are as follows:
- December 2021: The deadline for EU member states to implement the directive at the national level and establish appropriate reporting channels for companies and public bodies has been set.
- December 2023: For companies with 50 to 249 employees, the deadline for establishing internal reporting channels has been extended.
EU Member States that met the deadline:
- Denmark and Sweden: December 2021
- Malta: Has had a whistleblower protection law since 2013, which was subsequently amended in December 2021 to ensure compliance with the Directive.
Failed to meet the deadline:
- The majority of EU member states have implemented the EU Whistleblower Protection Directive in 2022
- Germany and Austria: 2023
- Special Cases: Poland and Estonia – not yet fully transposed
At this point (July 2024), 25 of the 27 EU member states have transposed the EU Whistleblower Protection Directive (Directive (EU) 2019/1937) into national law. Only Poland and Estonia have not yet fully transposed the directive, but it is anticipated that this will be completed in summer 2024.
The various implementations of the Whistleblower Protection Directives in the EU Member States
Similarities:
- Internal and external reporting systems: All countries are required to provide internal reporting systems for organizations with more than 50 employees and independent external reporting systems through designated authorities.
- Protection against retaliation: The directive also ensures uniform protection for whistleblowers against retaliation, such as dismissal or demotion.
- Timeframe for feedback: It is expected that reports will be acknowledged within seven days and that feedback will be provided within three months.
Differences:
- The scope of reportable concerns: In an effort to enhance the directive’s scope, countries such as Germany and Spain are considering the inclusion of additional issues, including workplace harassment.
- Regulatory oversight: In some countries, such as Denmark, the existing data protection authorities have been designated as the primary regulators of whistleblower policies, while in other countries, specialized whistleblower authorities have been established.
- While anonymous reporting is not a mandatory requirement in all jurisdictions, it is nevertheless a common practice in many countries.
- Penalties for non-compliance: Varies widely; some countries impose high penalties, others are less severe.
