By Alja Poler De Zwart and Mercedes Samavi
Do you work for an organization that does not know what to do with its whistleblowing hotline in Europe? Are you patiently waiting for any news on what is happening with the implementation throughout the European Economic Area (“EEA”) of the new EU’s Directive on the protection of persons who report breaches of European Union law (PDF: 1.5 MB) (the “Whistleblowing Directive”), while getting more and more concerned about the lack of information? Well, if it helps at all, you are not alone. Although the implementation deadline of December 17 appears quite far away for now, this is deceptive — especially for multinational organizations that have to start preparing to comply with likely varying local implementation requirements in multiple countries.
We have been monitoring the implementation progress in 30 EEA countries, and the outlook does not look that great. As far as we can tell, not a single country has managed to adopt its implementing law to date, and some countries appear to have not even started yet. The good news is that the majority of countries are in the middle of their implementation process, but whether local legislators will manage to agree on the bills soon enough to have them ready before December 17 is anyone’s guess. As eternal optimists, we hope for the best. But while we wait, we put together a short summary of our findings and thoughts to help provide some context.
What are the important deadlines?
The Whistleblowing Directive came into force on December 16, 2019. It requires the Member States to create rules for organizations with more than 50 workers and requires such organizations to implement whistleblowing hotlines for reporting a broad range of EU law violations. For that purpose, the Whistleblowing Directive contains minimum standards on how to respond to and handle any concerns raised by whistleblowers.
The Member States need to implement the Whistleblowing Directive into local law by December 17, 2021, although the compliance requirements are staggered depending on the organization’s size:
- Organizations with 250 or more workers will need to comply with the new rules by December 17, 2021; and
- Organizations with 50 to 249 workers will have an additional two years to comply with a deadline of December 17, 2023.
National implementation inevitably means that there will not be full harmonization, so the whistleblowing rules in the EU will likely differ by the individual Member States. This will, to a certain extent, mean that multinational organizations with operations in various Member States will need to take local differences into account when setting up their whistleblowing processes.
What is the status of Member States’ implementation efforts?
With just over six months to go before the implementation deadline, it is fair to say that the status is mixed across the various Member States. Let’s start with some hard statistics:
- Not a single Member State has adopted the Whistleblowing Directive into its local law.
- Five Member States (Austria, Cyprus, Hungary, Luxembourg, and Malta) appear not to have begun the legislative process at all.
- The three EEA EFTA states (Iceland, Liechtenstein, and Norway) appear to be still debating how the Whistleblowing Directive should be incorporated into the EEA agreement (i.e., the agreement (entered into force on January 1, 1994) that brings together the EU Member States and the three EEA EFTA States in a single market, referred to as the “Internal Market“).
- The UK decided pre-Brexit that it will not implement the Whistleblowing Directive into local law and will instead rely on its existing whistleblowing laws.
The better news, based on publicly available information, is that 22 Member States have at least started and are making progress towards implementation: Belgium, Bulgaria, Croatia, Czech Republic, Denmark, Estonia, Finland, France, Germany, Greece, Ireland, Italy, Latvia, Lithuania, Netherlands, Poland, Portugal, Romania, Slovakia, Slovenia, Spain, and Sweden.
Czech Republic, for example, appears to be close to finalizing its draft local law. Looking at its draft bill (available in Czech only), which could still change before it comes into force, Czech Republic seems to have used its right under the Whistleblowing Directive to expand the scope of what can be reported. The draft wording in the bill explicitly permits reporters in Czech Republic to raise concerns relating to any possible offense “that has the characteristics of a crime or misdemeanor” (no matter how serious). This is a much broader scope than detailed in the Whistleblowing Directive, which is limited to actual breaches of EU law. However, there are some concerns that there may be delays in actually passing the finalized draft, due to parliamentary elections scheduled for October 2021. Slovakia is also rumored to be near finalization, given that it has just appointed its first national Director of the Whistleblower Data Protection Office; more information about the Director and the draft bill is not yet available, but we will continue to track this.
The phrase “herding cats” comes to mind when looking at the current legislative landscape in each of the Member States. Now that we are in the summer season, it is likely that developments and implementation efforts will slow down even more as national parliaments go into summer recess. In the meantime, we will continue to monitor each Member States’ progress.
Are there any common themes?
At this stage, it is hard to identify any trends in the draft laws, given that so much is still in flux in each country. From what is available, however, there are some themes emerging in relation to legislative approach. Some countries, such as Ireland, are going through the legislative process in a pretty straightforward manner, with little controversy for now. Other countries are encountering internal debates — which could be politically driven. In Germany, for example, the Christian Democratic Union, which leads the Federal Ministry of Economics, has criticized the current draft as going beyond the Whistleblowing Directive’s requirements; the argument being that the proposed scope creates additional burdens on organizations. (Interestingly, we have seen other countries also raise similar questions over what they should do in terms of scope.) On the other hand, the Germany Federal Ministry of Justice — which is led by the Social Democratic Party — is standing firm on its proposals. Commentators have stated that this deadlock makes it questionable whether Germany can even meet the December 17 deadline.
What if a Member States fails to implement the Whistleblowing Directive on time?
Taking this to the extreme, if a Member State fails to implement the Whistleblowing Directive before the December 17 deadline, this will raise another headache, not only for organizations with operations in that country, but for the country itself and the EU. The Whistleblowing Directive, as an EU directive, requires local law implementation to be effective (compared to an EU regulation, which is immediately binding without additional input from the Member States). This means if a Member State does not adopt an implementing law, the Whistleblowing Directive will not be effective in that Member State.
By way of comparison, Slovenia has still not managed to implement its GDPR-implementing law; in general, this is not a problem because the GDPR applies directly in Slovenia without needing any national implementing laws. Failing to implement an EU directive, on the other hand, is not only a problem for the affected Member State but also for the European Commission, which would then need to initiate infringement procedures and bring proceedings against the Member State before the Court of Justice of the EU.
For Member States that fail to implement the Whistleblowing Directive in a timely fashion, organizations can at least adopt a whistleblowing hotline consistent with the Whistleblowing Directive itself and any other relevant implementing laws that are available on time, and then modify any internal policies and procedures when additional Member States implement the Whistleblowing Directive.
What does this mean for your organization in general?
The slow implementation inevitably means that organizations will have a longer wait than anticipated to get clarity over how to structure their whistleblowing projects. If Member States end up issuing local implementing laws at the last moment, then this will no doubt cause operational delays for organizations. This problem will likely be exacerbated for multi-national organizations with employees across more than one Member State.
The first steps towards compliance can already be done:
- If your organization does not have a whistleblowing hotline yet, then start setting one up. The process is usually not as simple as it looks, and it often includes engagement of a third-party whistleblowing hotline provider that can facilitate an online and telephone reporting channels.
- If your organization already has a whistleblowing hotline process in place (or has just set one up), then it can review the workings of the hotline and adjust the relevant internal processes to what the Whistleblowing Directive itself requires. The Whistleblowing Directive is quite clear on many requirements (such as who may use a hotline to report a wrongdoing, the timelines for acknowledging and responding to a whistleblowing report, and notice requirements towards the whistleblowers), so the relevant whistleblowing policies, notices, and investigation protocols can already be amended and then put on hold until the national implementing laws start trickling in. This way you will not have to do everything at the last moment and risk missing your own compliance deadline.
- Monitor local implementation activities in the Member States relevant to your organization for any deviations from the Whistleblowing Directive and/or additional and specific local requirements. As soon as a local law is finalized and adopted, your organization can consider the law’s requirements and determine the best approach to implement such requirements into its whistleblowing hotline process. Caution should be taken in relying on the draft laws because the current bills will likely change before they are finalized.
This post reflects information that was publicly available through official sources on June 8, 2021.
For more information on the Whistleblowing Directive and its requirements, please see the article written by Alja Poler De Zwart for the Journal of Investment Compliance, available at https://www.mofo.com/resources/insights/201125-eu-whistleblowing-rules.html.
Alja Poler De Zwart is a partner, and Mercedes Samavi is an associate, at Morrison & Foerster LLP.
Disclaimer
The views, opinions and positions expressed within all posts are those of the authors alone and do not represent those of the Program on Corporate Compliance and Enforcement or of New York University School of Law. The accuracy, completeness and validity of any statements made within this article are not guaranteed. We accept no liability for any errors, omissions or representations. The copyright of this content belongs to the authors and any liability with regards to infringement of intellectual property rights remains with them.