Expert Guide: Whistleblowing Laws in the European Union
A glance at the implementation of the EU Whistleblowing Directive in EU Member States
Content of this White Paper:
Legal situation as of August 2022 and subject to change. This document will be updated accordingly.
In April 2018, the EU Commission launched a proposal for a directive aimed at providing uniform protection for whistleblowers and a provisional agreement was reached between member states and the European Parliament in March 2019. Adopted as Directive 2019/1937, the EU Whistleblowing Directive aims to provide common minimum standards of protection for whistleblowers across the EU and seeks to bring an end to a confusing patchwork network of national protection legislation. Most EU member states failed to meet the 17 December 2021 transposition deadline. Given the legislation’s ramifications for companies, this guide leverages EQS Group’s expert partner network to paint the most comprehensive picture possible of the ongoing transposition process around the continent.
While the White Paper takes a deep dive into the legislative process around Europe, a basic overview of the situation at country level can be found below:
A preliminary draft law of Austria’s “HinweisgeberInnnenschutzgesetz or HSchG” – the country’s new whistleblower protection law – was published in June 2022 and it is expected to come into force in early autumn. Currently only the states of Vorarlberg, Tyrol and Burgenland have laws in place protecting whistleblowers and the new legislation will bring the country to both a universal national and European standard of protection.
The Belgian federal government reached a preliminary agreement on a draft bill transposing the EU Whistleblowing Directive in the private sector on 25 February 2022, but it still needs to be reviewed by several authorities prior to being debated and ultimately adopted by parliament. When the process is complete, the new legislation will bring significant improvements in protection for Belgian whistleblowers.
While Sofia failed to implement the EU Whistleblowing Directive ahead of the deadline, a new law transposing it entered parliament in April 2022. It adopts the EU legislation’s minimum standards for protecting persons reporting breaches of EU and national law and the end date of public discussion is 23 May 2022. The new law will come into force one year following its publication in the Official Gazette of Bulgaria.
After two readings in late 2022, the Croatian parliament adopted “the Croatian Whistleblower Protection Act” which transposed the EU Whistleblowing Directive. It closed loopholes in the country’s previous whistleblower legislation and incorporated extended mechanisms, bringing Croatia in line with the new European protection standard.
The EU Whistleblowing Directive was transposed in Cyprus on 04 February 2022 when the “Protection of Persons Reporting Breaches of Union and National Law in the Official Gazette” was published. It introduced a range of new internal and external reporting provisions as well as extensive protective measures for private and public sector whistleblowers.
Even though the Czech government introduced its draft Whistleblower Protection Bill on 9 February 2021, the country still failed to transpose it by the deadline date in mid-December of that year. The current draft is now heading for the inter-ministerial comment procedure and only afterwards will it be taken up by the Chamber of Deputies. Given the drawn-out and controversial nature of the process so far, it is not expected to take effect until winter 2022 or spring 2023 at the earliest.
Copenhagen passed its Whistleblower Protection Act (Lov om beskyttelse af whistleblowere) on 24 June 2021 obliging all employers with more than 50 employees to set up a whistleblowing system. Denmark is notable for being the very first EU member state to transpose the EU Whistleblowing Directive into national law.
The transposition process in ongoing in Estonia where a new protection bill passed the first reading in parliament at the start of 2022. It has received heavy criticism and hundreds of amendments and its planned entry into force on 1 June 2022 did not occur. The frustrating process is exacerbated by the fact that there is no joint and cross-sectoral valid regulation for whistleblower protection in Estonian law.
Helsinki is getting closer to transposing the Directive and an amended whistleblower protection law proposal is being sent to parliament by late September 2022. It will substantially enhance protection for whistleblowers and enable employers to receive and address suspected cases of wrongdoing. While the legislation will bring Finland in line with the new European standard, it is also expected to include a number of national additions.
After several months of parliamentary discussions and a positive ruling by the French Constitutional Council, the law transposing the EU Directive was passed in France. It amends the existing Sapin 2 law, covering all entities with 50 or more employees, public or private. Officially entitled “LOI n° 2022-401 du 21 mars 2022 visant à améliorer la protection des lanceurs d’alerte”, the new law is a considerable improvement on Sapin 2, and it brings France in line with the rest of Europe in terms of whistleblower protection.
Germany’s first draft of a new law transposing the EU Whistleblowing Directive was worked out in 2020 but it was not published due to a lack of agreement on its contents. As a result, Berlin missed the transposition deadline and a new draft from the Federal Ministry of Justice underwent the legislative process in April 2022 before being approved in late July. The Bundestag is expected to decide on the new legislation in the third week of September where it will then go through the Bundesrat and the further legislative process. This is expected to be completed this year and the new law will come into force three months after promulgation.
Much of the work regarding the transposition process in Greece remains incomplete and it has been mired in delays and a lack of transparency. Pressure has been growing, particularly as a result of a recent scandal though there is no implementation date on the horizon. Existing legal mechanism do at least provide partial protection to Greek whistleblowers, but they fall well below the standards of the Directive.
The EU Whistleblowing Directive has not been transposed in Hungary and currently, there is no draft law available nor has information been published regarding the status of the implementation process. As a result, it remains unclear as to when Budapest will implement the new legislation.
After missing the original deadline, Ireland transposed the EU Whistleblowing Directive after passing the Protected Disclosures (Amendment) Bill 2022 in July 2022. It substantially extends the scope of protection by providing greater clarity for both whistleblowers and employers. A key aspect of the amendment involves the introduction of formal reporting channels at companies that will be monitored and enforced by the Inspectorate of the Workplace Relations Commission.
Measures to protect whistleblowers have been in place in Italy for years but there are shortcomings, and they are set to be addressed by the EU Whistleblowing Directive. Italy missed the implementation deadline, and the transposition process has proven far from transparent with calls for urgent implementation growing louder. Despite those calls, very little information has been published about the implementation process so far.
In 2018, Latvia adopted a whistleblowing law that had numerous flaws. These were addressed when Riga transposed the EU Whistleblowing Directive on 20 January 2022 with the new measures entering into force on 04 February 2022. While the new legislation implements the requirements of the Directive, improvements have not been ruled out in the future, such as the introduction of a whistleblower reward mechanism.
Like neighbouring Latvia, Lithuania had legislation dedicated to the protection of whistleblowers in place before the adoption of the EU Whistleblowing Directive. Amendments were then made to the existing legal framework and the changes came into force in February 2022, transposing the EU legislation into national law.
Shortly after the EU Whistleblowing Directive deadline expired in late 2021, Luxembourg’s government issued a draft law for its transposition. The process is still underway, and the country intends to create one complete, coherent, easily understandable and accessible framework for whistleblower protection. Luxembourg will go beyond the scope of the Directive and the coalition programme forsees a rapid transposition of the new measures into national law.
Whistleblower protection legislation has been in place in Malta since 15 September 2013 in the form of “the Whistleblower Act (Cap 527”). Valetta amended it in December 2021, passing a bill called the “Protection of the Whistleblower (Amendment) Act 2021” which transposed the Directive, strengthening and expanding protection for whistleblowers.
The Wet Huis voor klokkenluiders or Dutch Whistleblower’s Authority is the existing legislation protecting whistleblowers in the Netherlands. The law has been criticised for having a number of weaknesses and it is set to be renamed the Wet Bescherming Klokkenluiders when the EU Whistleblowing Directive is transposed. Its shortcomings will be addressed while the Netherlands will be brought in line with universal EU standards.
While Poland missed the original deadline, the Ministry of Family and Social Policy has prepared a new law – the draft Act on the Protection of Persons Who Report Breaches of Law. It is still being evaluated before being submitted to the Sejm (lower house of parliament). Upon entry into force, the new law will contain numerous improvements in whistleblower protection such as preventing retaliation and allowing for the possibility of anonymous reporting.
An early transposer of the EU Whistleblower Directive, Portugal implemented the new measures on 20 December 2021 through Proposta de Lei 91/XIV and they came into force on 18 June 2022. The Portuguese government took the transposition process extremely seriously behind the scenes and it was characterised by speed and a lack of publicity.
Romania was among the countries that missed the initial transposition deadline and progress was finally made in mid-summer 2022. On 6 July, 2022, the Romanian parliament adopted a new law protecting whistleblowers (“Law no. 571/2004”) and it was challenged by a group of deputies and brought to the Constitutional Court. The case was dismissed and the new legislation brings long overdue and significant enhancements to whistleblowers in Romania as well as bringing the country in line with new EU protection standards.
Bratislava established its existing measures to protect whistleblowers on the basis of Whistleblowing Act No.54/2019 Coll on the protection of persons reporting anti-social activities which replaced previous legislation from 2014. Given that the current law broadly coincides with the obligations of the Directive, it is expected that transposition will be achieved through an amendment.
The Slovenian government has held a series of consultations about the implementation of the EU Whistleblowing Directive. A second round of talks is expected to be held once the Ministry of Justice prepares a new draft. Slovenia does have limited measures in place protecting whistleblowers, but they fall short of the Directive’s requirements.
Spain does not currently have uniform whistleblower protection regulations and provisions are considered limited. The Ministry of Justice started working on a draft law in mid-2020 and it was open to public consultation until late January 2021. In March 2022, the Council of Ministers approved a preliminary draft for the transposition of the EU Whistleblowing Directive which is currently at the parliamentary stage.
After Denmark, Sweden became the second EU member state to transpose the Directive. The Genomförande av visselblåsardirektivet was approved in late September 2021 before coming into force on 17 December 2021. Sweden did have measures in place beforehand, but they had no clause guaranteeing anonymity and confidentiality, a major flaw that was rectified by the implementation of the new EU legislation.
A glance across the EU border
Will not be implemented
Swiss companies with EU branches with 50 or more employees that are subject to EU law must take action and implement internal reporting channels under the Directive. Organisations in Switzerland that are not directly impacted by the Directive are nevertheless advised to comply with it in order to demonstrate good governance and uncover wrongdoing at an early stage to minimise any ensuing damage.
Will not be implemented
The UK has no legal obligation to transpose the EU Whistleblowing Directive following Brexit but like Switzerland, the new measures will apply to UK businesses operating in mainland Europe above a certain size. The UK does have its own national whistleblower protection legislation in the form of PIDA which has been criticized as being outdated and overly complex.
EQS Group would like to thank the following organisations for their comprehensive insights and assistance in compiling this guide:
Download the Expert Guide for a more comprehensive country-by-country analysis
Register now for our Compliance News Service and receive relevant news from compliance, whistleblowing and business ethics. After successful registration for the Compliance News Service, you will receive the link to the white paper via e-mail. You can unsubscribe from the news at any time.