EU Whistleblowing Directive a ‘potential minefield’ for compliance

The EU Whistleblowing Directive—which must be transposed into national law by Dec. 17—aims to increase the scope and level of minimum protection afforded to individuals who speak up about possible wrongdoing.

The directive extends protection to a relatively broad group of people beyond whistleblowers themselves, including several categories of individuals associated with them who may have facilitated the whistleblowing (such as colleagues and relatives).

Not only does it try to prevent retaliation against whistleblowers, but it also requires companies to implement effective internal mechanisms to enable employees to report and escalate concerns internally.

“The process that whistleblowers will need to follow to gain protection will almost certainly vary from country to country, presenting significant compliance problems for firms and businesses operating in multiple jurisdictions or on a cross-border basis within the EU.”

Neil Robson, Partner, Katten Muchin Rosenman

The directive does not include the potential for whistleblowers to receive monetary awards like programs in the United States.

Currently, only 10 EU countries have full whistleblower protection powers in place. The remaining 17 only offer partial protection, applying to certain industry sectors or categories of employee.

Lawyers warn the way in which countries interpret the directive could lead to potentially massive divergences from one country to the next for a number of reasons.

First, unlike EU regulations—which must be transposed into national law as written—directives are open to national interpretation, differing defined terms, concepts, and even scope. As such, it is possible to see 27 different versions of what is supposed to be broadly the same rule.

Second, as the term “whistleblowing” does not even exist in some EU national languages, there remains scope for wildly differing levels of implementation and enforcement.

Third, the directive does not even define whistleblowing. Instead, it refers to protecting individuals who report “breaches of European Union law,” which presents further implementation difficulties because not all national laws in EU countries are based on “Union law.”

Thomas Cattee, white-collar crime lawyer at law firm Gherson Solicitors, says there is also the potential for the directive to be “at odds” with existing national law regarding whistleblower protection and procedures in some countries. That (circumstance) could mean implementation of the directive will not lead to uniform protection in all situations.

Neil Robson, partner at law firm Katten Muchin Rosenman, says “confusion” and different national interpretations are “highly likely” given the potential for EU countries to provide differing levels of protection to whistleblowers; include or omit punishments for those trying to uncover whistleblowers; and offer protection only if people report concerns in a prescribed way.

Even the possibility of anonymous whistleblowing remains unclear and uncertain.

“By not being a regulation, the process that whistleblowers will need to follow to gain protection will almost certainly vary from country to country, presenting significant compliance problems for firms and businesses operating in multiple jurisdictions or on a cross-border basis within the EU,” says Robson.

“Equally, employees and staff that wish to blow the whistle on improper conduct are likely to find that the lack of certainty means that they can only be protected by doing X in Country A and doing Y in Country B and so on. It’s a potential minefield and may lead to possible whistleblowers feeling exposed or at risk,” he adds.

Daniel Peyton, head of the Employment Law practice in the London office of law firm McGuireWoods, agrees the possibility of broad areas of divergence makes it more difficult for whistleblowers to understand the extent to which their proposed disclosures will be protected or whether they risk retaliation for making disclosures.

“Whistleblowers not only risk retaliation if they get the law wrong, but may be susceptible to local law penalties too,” he says.

Peyton adds a divergence in standards will create problems for any business that has pan-EU operations because it will be more difficult to harmonize internal whistleblowing processes. Employers “risk creating internal systems whose enforcement either falls foul of or is not supported by local law,” he says.

Alja Poler De Zwart, a partner in law firm Morrison & Foerster’s Privacy and Data Security and Technology Transactions practice, says it is still difficult to tell how EU countries intend to transpose the directive.

“From what we have seen to date, a number of EU member states have not even issued a first draft of the implementing law,” she says. “Therefore, a bigger issue at the moment is whether laws will be implemented soon enough at the local level for organizations to have sufficient time to become compliant with specific local requirements before the December 2021 deadline.”