In recent years, whistleblowers have repeatedly made headlines. Most recently, the Wirecard scandal certainly attracted the most attention and is therefore currently probably the most prominent example of whistleblowing. The public discussion in connection with the treatment of whistleblowers is becoming louder, and in 2019, with the entry into force of the EU Whistleblower Directive, an important legal impetus for the protection of whistleblowers was set. Was ist ein “Whistleblower” and how will it be in the framework of this new EU Directive More precisely defined?
Ein Whistleblower ist eine Person, die illegale oder unethische Aktivitäten in einer Organisation aufdeckt.
Well-known cases of whistleblowers include Julian Assange or Edward Snowden, but A whistleblower is someone who reveals information about wrongdoing within an organisation. whistleblower Whistleblower be referred to.
A whistleblower is initially „just“ a natural person who reports information about wrongdoing in companies or public institutions. This information must have been obtained by the person in the course of their work. There is no yardstick for the content – it can be information about serious misconduct, such as criminal offences or general dangers to employees or the entire company. However, it can also be less serious incidents, such as ethical breaches or violations of internal policies.
This definition is deliberately based on the EU Whistleblowing Directive, as it stipulates who should be protected when they report information about a Whistleblowing system reports. The EU Directive is binding for national implementation in all EU member states (in Germany: Whistleblower Protection Act).
Anyone can be a whistleblower.
The natural persons protected by the EU Whistleblowing Directive, as mentioned above, include all employees of a company: not just current full-time or part-time staff, but also trainees, former employees, and future employees.
Accordingly, employees form the largest group of potential whistleblowers. Members of the management board or other persons in leadership positions, as well as members of the supervisory board and shareholders, are also protected as whistleblowers in accordance with the EU Whistleblowing Directive. Outside the company, customers, contractors and suppliers can also be whistleblowers.
In summary, the EU Directive includes all groups of people connected with your company who may thus gain information about wrongdoing.
What is the Whistleblower Directive?
The EU first took place in October 2019 Whistleblower Directive enacted, which applies to almost all companies in the EU. The Whistleblower Directive had to be transposed into national legislation by the end of 2021 at the latest in the form of a Whistleblower Protection Act be implemented. This presents new challenges for companies. Find out in this article if your company falls under the directive. Read about the requirements an internal reporting system must meet within your company, and how you can protect yourself from whistleblowers leaking company secrets to the public with impunity.
Previously, the protection of whistleblowers in the EU was not regulated uniformly. This leads to unequal treatment and legal uncertainty. In order to enable fair competition and a well-functioning internal market within the EU, uniform standards are to be introduced in all EU member states with the implementation of the EU Whistleblower Directive.
The EU Whistleblower Directive covers a broad range of reporting areas, including: * **Public procurement:** Breaches related to public contracts. * **Financial services, products and markets, and prevention of money laundering and terrorist financing:** This includes fraud, market abuse, and other financial crimes. * **Product safety and conformity:** Issues with products that do not meet safety standards. * **Transport safety:** Breaches related to the safety of road, rail, sea, and air transport. * **Protection of the environment:** Environmental damage, pollution, and breaches of environmental law. * **Radiation protection and nuclear safety:** Risks to health and safety from radiation. * **Food and feed safety, and animal health and welfare:** Issues concerning the safety of food and animal well-being. * **Public health:** Threats to public health. * **Consumer protection:** Breaches that harm consumer interests. * **Protection of privacy and personal data, and security of network and information systems:** Violations of data protection rules and cybersecurity breaches. * **Acts detrimental to the financial interests of the Union:** Fraud and corruption that affect the EU budget. * **Breaches relating to the internal market, including breaches of Union competition and company rules and breaches relating to the place of work.**
For all EU states, any whistleblower who Breaches of EU regulations reports
- Public procurement, competition rules
- Money laundering, corruption, tax evasion, terrorist financing
- Data protection, security of network and information systems
- Food and feed safety, animal health and animal welfare
- Product safety, road safety
- Environmental protection and nuclear safety
- Public health and consumer protection
EU member states must now implement the Whistleblower Directive into national law. However, the EU standard must not be undercut in this process. States may be stricter and add additional national areas of application. What is the situation in Germany? Compared to other EU states, Germany has performed poorly in the legal protection of whistleblowers to date. In the past, EU directives were always implemented on time, with German thoroughness.
The implementation deadline for the EU Whistleblower Directive expired at the end of 2021. So far, the German Federal Government has not yet passed a whistleblower protection act. The first draft bill for the whistleblower protection act in Germany was rejected in 2021. After that, it was clear that the law would not be passed before the federal election. Following the federal election, a new draft was presented in April 2022 and sent to the ministries for coordination. The specialist public had until mid-May to comment on it. Due to the large number of statements that were then available to the Federal Ministry of Justice for evaluation, there is currently no new information on the new draft bill.
How must companies in the EU deal with whistleblowers in the future?
Affected companies should prepare for the implementation of the German Whistleblower Protection Act and meet the standards required by the Directive.
Before you start wondering how the EU Whistleblower Directive will be implemented in your company, you will find out below whether your company is affected and what requirements are laid down by the EU Whistleblower Directive.
Is your company affected?
Affected by this are:
- all companies with more than 50 employees, regardless of whether they work part-time or full-time
- regardless of the number of employees, all companies with an annual turnover of more than €10 million
- regardless of the number of employees, all companies subject to the Money Laundering Act
All authorities, state and regional administrations, and municipalities with more than 10,000 inhabitants are also affected. Companies with up to 249 employees are expected to have an extended implementation deadline until 2023.
Expectations of companies
The expectations for reporting systems in companies are laid out in great detail in the EU Whistleblower Directive. The most important points for you, in brief:
- Reports must be possible in writing and verbally.
- The channels must ensure the confidentiality of the whistleblower's identity.
- Communication with the whistleblower must be possible without them having to disclose their identity.
- An external or internal impartial person must be tasked with receiving and processing reports.
- This person should be independent in their role to rule out conflicts of interest.
- It must be ensured that unauthorised employees do not have access to the instructions.
Companies must process incoming warnings as follows:
- The whistleblower must receive an acknowledgement of receipt within one week.
- The whistleblower must be informed within 3 months about planned or taken measures regarding the report and the reasons for these follow-up actions.
- If the investigation takes longer, the whistleblower must be informed as to when they can expect further feedback.
- All indications must be documented in compliance with GDPR and be retrievable at any time.
Learn in 5 minutes
Before you book a live demo appointment with LegalTegrity, you can get to know our software in just 5 minutes. Request our demo video to get an overview of all the system's important features and customisation options. You will receive the demo video via email.
Our tips for installing a whistleblowing channel
Name at least two contact persons who are perceived by employees as neutral and trustworthy, so that responsibilities in the event of an absence are clearly regulated. In addition, name an external contact person. Should the internal responsible persons unexpectedly become unavailable, the functionality of the reporting channel can be maintained.
There are many different Whistleblower reporting channels. Opt for those that automatically monitor deadlines for you.
How should a whistleblower proceed?
Following the new EU Whistleblower Directive, a whistleblower should first report through the Internal reporting channel to inform their employer about the observed violation of the law. It is important to look closely here. A whistleblower can contact the relevant authorities and the public directly if:
- there is no internal reporting channel within the company that reliably protects the whistleblower's identity and guarantees anonymity.
- the whistleblower has not received an adequate response to their report within three or 6 months.
- The whistleblower is not employed by the company and the internal reporting channels can only be used by employees.
- the observed violation requires urgent action due to a threat to health, the environment, or safety, or falls within the scope of money laundering and counter-terrorism financing.
Tip:
- Offer your employees reporting channels that meet these criteria.
- Communicate to your employees that it is important to you to know when things are going wrong in the company and that you would also like to know about it anonymously.
This way, you can ensure that the information reaches you first, allowing you to take the necessary action.
In what capacity must the protected whistleblowers be connected to the company?
Under the EU Whistleblower Directive, any person who has obtained information about infringements of law in a professional context is considered a protected whistleblower:
- Employees, even if they have already left
- Members of administrative, management or supervisory bodies
- Contractors and the employees they employ
Protection only exists if a whistleblower could reasonably assume that the information was true and fell within the scope of the directive.
Tip:
Against this backdrop, you as a business owner should consider whether you might also open up your reporting channels to suppliers. In this way, you ensure comprehensive protection for individuals connected to the company.
- Open your reporting channels, e.g. for suppliers.
- Inform your employees about what they should report. It is best to formulate this clearly and positively.
- If you also employ non-academic staff, this information should be presented in a way that is easily understandable for everyone.
What about groups of people not mentioned in the Whistleblower Directive?
Fear of misuse often flares up reflexively. What happens if competitors want to boycott your company? If other individuals perhaps want to publish information that could harm your company? These groups of people are not covered by the protection of the directive. And most importantly: there is no statistical evidence that the introduction of a whistleblower system leads to an increase in false reports or threatens a wave of „snitching“ within the company.
As a company, what measures may you take against whistleblowers?
Admittedly, if an employee goes directly to the authorities or the public, the human disappointment is great. Why didn't they say anything? Breach of loyalty, abuse of trust, betrayal… If a scandal then looms, the demand for revenge and retribution is loud. The EU Whistleblower Directive has prevented this. The catalogue of prohibited reprisals is very comprehensive and reads like the „who's who“ of interpersonal torture instruments. To put it concisely:
Whistleblowers must be protected from all direct and indirect reprisals! This also includes the protection of third parties who are in close contact with the whistleblower.
Warning:
- Confidentiality agreements or clauses in contracts intended to circumvent this protection are void.
- In case of doubt, the company itself will draw the short straw, even with covert measures against the whistleblower, and will be sanctioned with additional penalties.
Why it's worth using a whistleblowing system
The EU Whistleblower Directive offers comprehensive protection for whistleblowers. At first glance, it puts companies at a disadvantage and carries a high risk of disclosing business secrets. On closer inspection, however, the EU Whistleblower Directive presents a significant opportunity for businesses. Employees, suppliers, and stakeholders are the first to see when something goes wrong within the company. Typically, it is individuals whose actions harm the company. You, as a business owner, will only become aware of this if the behaviour can be reported internally without personal risk. As a business owner, you can help ensure that this happens.
Name external or internal trusted individuals whom employees can also approach personally if they wish to report information confidentially, but not anonymously. Additionally, establish a whistleblower system that guarantees anonymity for whistleblowers. These should be easily accessible and very simple to use, regardless of educational level. Speak positively about the topic of whistleblowing and its great importance for the long-term success of your company. Explain internal reporting channels for all employees in a clear and transparent manner.
You would like to know more about the A lean and fast way of a digital whistleblowing system to implement the EU Whistleblowing Directive? Then Contact Would you like one of our experts for a personal conversation and an appointment for a Software Demo.
(The masculine form used refers to all people, regardless of gender.)
