The European Council has now adopted the Whistleblower Protection Directive. The Directive can be considered an important development in the protection of those who report breaches of European Union (EU) law.

It is no coincidence that at the time it was approving the Directive, the European Parliament noted the value of whistleblowers in uncovering and investigating some of the most recent and most significant scandals.  Luxleaks and the Panama Papers were referred to as examples of whistleblowers’ importance in helping tackle unlawful activities.

While the Directive relates to the making of disclosures in important areas such as financial services, fraud, money laundering, procurement and data protection, it is only one part of a series of measures that the EU is devising to give more protection to those who report wrongdoing.

Protection offered by the Directive

In the Directive, a whistleblower is defined as someone who:

  • makes a disclosure in good faith and
  • had reasonable grounds to believe the information given was true at the time it was disclosed.

The Directive does not apply solely to employees. Under it, protection is also given to former employees as well as those who apply for jobs with a company or organisation, contractors and those who provide assistance and support to whistleblowers.

The Directive also makes recommendations about how whistleblowers should report their concerns. Under it, whistleblowers are encouraged to use internal reporting channels within the organisation where they believe wrongdoing is being committed before, if necessary, resorting to using external reporting channels. But whistleblowers will not lose protection if they report their concerns to external channels first.

Under the Directive, whistleblowers are protected from real and threatened attempts at retaliation, such as any form of intimidation, suspension or demotion. It also ensures that whistleblowers are free from liability for disclosure of information if any judicial proceedings arise in the future. 

Company Requirements under the Directive

The Directive does not specify the types of reporting channels that companies should have in place. But it does suggest that they should have systems that enable whistleblowers to make reports via:

* an online reporting system

* a mailbox

* by post

* to a telephone hotline or answering machine.

If the whistleblower requests a personal meeting the company should offer this. The company should also ensure that the whistleblower’s identity is kept confidential.

Under the Directive, companies in the EU that have more than 50 employees or a €10M annual turnover are required to devise and introduce suitable internal reporting channels. Clear and easily accessible information about these channels must be made available to employees, suppliers, service providers and business partners.

Companies must also appoint a suitable person to manage any whistleblower reports that are made. The following are all classed as suitably qualified for that role:

* Compliance officer

* Head of human resources

* Legal counsel

* Chief financial officer

* A member of management or the executive board

Companies are able to outsource the management of whistleblower reports to specialist service providers. But the Directive can be seen as a clear attempt to remove the complaint of many whistleblowers – that their report is not followed up by the company or even goes unacknowledged. Companies, therefore, must ensure that outsourcing the management of such reports does not mean that those reports are not properly examined and, where necessary, acted upon.

Under the Directive, once a whistleblower has submitted a report the company must provide acknowledgement of its receipt within seven days. The company has three months – although this can be extended to six months in certain circumstances - to provide the whistleblower with either an update on any ongoing investigation, the result of any completed investigation or notice of any action to be taken

Whistleblowing and the UK

With the Public Interest Disclosure Act 1998 (PIDA), the UK already has legislation in place that offers protection for whistleblowers. The UK government has notified the House of Commons' European Scrutiny Committee that it will not implement the Directive but will review the UK’s whistleblowing framework once the impact of the EU’s reforms can be assessed.

A review of whistleblowing arrangements earlier this year by the UK All Party Parliamentary Group concluded that PIDA is complex, fragmented and obsolete. The Group stated that new legal definitions of whistleblowing and whistleblower were needed because of current working practices and the need to ensure that the public received protection. It recommended that an Independent Office for the Whistleblower be created as the regulator and emphasised the need to ban non-disclosure agreements (NDAs) when whistleblowing is involved, due largely to their misuse in cases involving sexual harassment.

In the UK, financial services firms authorised by the Prudential Regulation Authority or Financial Conduct Authority are bound by rules relating to the procedures they have to have in place to manage whistleblowing.

Gilham v Ministry of Justice [2019] UKSC 44 saw the Supreme Court hold that protection under PIDA applies to those holding public office, even if they have no formal employment contract. Ms Gilham, a district judge, made a number of complaints about the impact public sector cuts have had on the justice system. She argued that her complaints were a protected disclosure under PIDA and claimed her whistleblowing led to her suffering reprisals. The Ministry of Justice said that she was an office holder rather than a worker and so was not covered by whistleblowing protections. But the court held that denying such protection to non-contractual office holders was not compatible with a person's rights under the European Convention of Human Rights: Article 10 (freedom of expression) and Article 14 (protection against discrimination). This is an important decision: it shows that non-contractual office holders (which can include company directors and trustees as well as those holding public office) can have protection in the UK as whistleblowers even though they may not be employees.  

The Directive’s Importance

The Directive is an important development for those doing business in the EU. EU member states must transpose it into their domestic law by October 2021. For those companies that will be covered by the Directive it is essential that they examine the procedures they currently have in place, see whether they meet the requirements of the Directive and take all relevant steps to ensure they are compliant with it.

The UK’s intention to pursue Brexit means it will not be bound by the Directive. But it is certainly the case that the British authorities recognise (as mentioned earlier) that there is a case to be made for making changes to current law regarding whistleblowing. Whether any such changes mirror precisely the Directive remains to be seen. Yet UK firms should be taking appropriate advice on their whistleblowing procedures if they have any doubts about their fitness for purpose.