- White Paper
Expert Guide: Whistleblowing Laws in the European Union
A glance at the implementation of the EU Whistleblowing Directive in EU Member States
Content of this White Paper:
- Overview of the requirements of the EU Whistleblowing Directive
- National whistleblowing legislation throughout the EU
- EU Whistleblowing Directive transposition status by country
- Tips on fulfilling local whistleblowing requirements
- How speak-up culture works
- How to implement a whistleblowing system
Legal situation as of February 2023 and subject to change. This document will be updated accordingly.
In April 2018, the EU Commission launched a proposal for a directive aimed at providing uniform protection for whistleblowers and a provisional agreement was reached between member states and the European Parliament in March 2019. Adopted as Directive 2019/1937, the EU Whistleblowing Directive aims to provide common minimum standards of protection for whistleblowers across the EU and seeks to bring an end to a confusing patchwork network of national protection legislation. Most EU member states failed to meet the 17 December 2021 transposition deadline. Given the legislation’s ramifications for companies, this guide leverages EQS Group’s expert partner network to paint the most comprehensive picture possible of the ongoing transposition process around the continent.
While the White Paper takes a deep dive into the legislative process around Europe, a basic overview of the situation at country level can be found below:
Austria
In progress
Austria’s first House of Representatives (Nationalrat) approved the country’s new whistleblowing law in February 2023. The “HinweisgeberInnnenschutzgesetz” or “HSchG” transposes the EU Whistleblowing Directive into national law. Previously, only the states of Vorarlberg, Tyrol and Burgenland had laws in place protecting whistleblowers and the new legislation brings the country to both a universal national and European standard of protection. The law was now sent to the Federal Council (Bundesrat) for final approval.
Belgium
Implemented
The Belgian Chamber of Representatives has passed a bill proposed by Federal Employment Minister Pierre-Yves Dermagne giving better protection to whistleblowers with its French and Flemish titles translating to the “Draft Act on the Protection of Persons Reporting Violations of Union or National Law Within a Private Sector Legal Entity”. It will see the EU Whistleblowing Directive transposed into the Belgian legal system and it will come into force at some point in 2023.
Bulgaria
Implemented
After it failed to adopt a new whistleblowing law in December 2022, Bulgaria’s National Assembly of Parliament approved the legislation on 27 January 2023. It adopts the EU Whistleblowing Directive’s minimum standards for protecting persons reporting breaches of EU law and comes into force one year after its publication in the Official Gazette of Bulgaria. A key difference to previous proposals is that the Personal Data Protection Commission has been designated to receive and process external reports.
Croatia
Implemented
After two readings in late 2022, the Croatian parliament adopted “the Croatian Whistleblower Protection Act” which transposed the EU Whistleblowing Directive. It closed loopholes in the country’s previous whistleblower legislation and incorporated extended mechanisms, bringing Croatia in line with the new European protection standard.
Cyprus
Implemented
The EU Whistleblowing Directive was transposed in Cyprus on 04 February 2022 when the “Protection of Persons Reporting Breaches of Union and National Law in the Official Gazette” was published. It introduced a range of new internal and external reporting provisions as well as extensive protective measures for private and public sector whistleblowers.
Czech Republic
In progress
In November 2022, the Czech government approved a new draft bill on the protection of whistleblowers which will transpose the EU Whistleblowing Directive into national law. The draft has been criticised for numerous shortcomings and its final form will likely change before it gets the final green light in the House of Commons.
Denmark
Implemented
Copenhagen passed its Whistleblower Protection Act (Lov om beskyttelse af whistleblowere) on 24 June 2021 obliging all employers with more than 50 employees to set up a whistleblowing system. Denmark is notable for being the very first EU member state to transpose the EU Whistleblowing Directive into national law.
Estonia
In progress
The transposition process in ongoing in Estonia where a new protection bill passed the first reading in parliament at the start of 2022. It has received heavy criticism and hundreds of amendments and its planned entry into force on 1 June 2022 did not occur. The frustrating process is exacerbated by the fact that there is no joint and cross-sectoral valid regulation for whistleblower protection in Estonian law.
Finland
Implemented
Finland has transposed the EU Whistleblowing Directive and the new national legislation entered into force on 1 January 2023. It substantially enhances protection for whistleblowers and enables employers to receive and address suspected cases of wrongdoing. Private entities with 250+ employees and public entities with at least 50 staff members must establish internal reporting channels channels by 1 April 2023. Private sector organisations with between 50 and 250 employees must complete the process by 17 December 2023.
France
Implemented
After several months of parliamentary discussions and a positive ruling by the French Constitutional Council, the law transposing the EU Directive was passed in France. It amends the existing Sapin 2 law, covering all entities with 50 or more employees, public or private. Officially entitled “LOI n° 2022-401 du 21 mars 2022 visant à améliorer la protection des lanceurs d’alerte”, the new law is a considerable improvement on Sapin 2, and it brings France in line with the rest of Europe in terms of whistleblower protection.
Germany
In progress
Germany’s Federal Cabinet passed a government draft for the Hinweisgeberschutzgesetz or Whistleblower Protection Act in July 2022 and it was passed in the Bundestag on 16 December 2022. The Bundesrat rejected the law in February 2023 which is now calling a mediation committee on the scene.
Greece
Implemented
After a sluggish transposition process that was criticised for a lack of transparency, Greece’s draft whistleblower protection legislation was submitted to parliament on 31 October 2022. On 11 November 2022, it was passed and is now in force with two different implementation dates. That means that Greek organisations will have to implement a number of new compliance measures before the middle of 2023.
Hungary
Not started
The EU Whistleblowing Directive has not been transposed in Hungary and currently, there is no draft law available nor has information been published regarding the status of the implementation process. As a result, it remains unclear as to when Budapest will implement the new legislation.
Ireland
Implemented
After missing the original deadline, Ireland transposed the EU Whistleblowing Directive after passing the Protected Disclosures (Amendment) Bill 2022 in July 2022. It substantially extends the scope of protection by providing greater clarity for both whistleblowers and employers. A key aspect of the amendment involves the introduction of formal reporting channels at companies that will be monitored and enforced by the Inspectorate of the Workplace Relations Commission. Ireland’s new measures come into force on 01 January 2023.
Italy
In progress
In September 2022, the Italian government approved a new delegation law whereby a draft bill transposing 14 Directives, including the Whistleblowing Directive, must be completed within a three-month period and this also applies to the government recently elected. On 09 December 2022, the Council of Ministers met and approved the delegation law and parliament committees have 60 days to review it. The law will then go back to the government for final review.
Latvia
Implemented
In 2018, Latvia adopted a whistleblowing law that had numerous flaws. These were addressed when Riga transposed the EU Whistleblowing Directive on 20 January 2022 with the new measures entering into force on 04 February 2022. While the new legislation implements the requirements of the Directive, improvements have not been ruled out in the future, such as the introduction of a whistleblower reward mechanism.
Lithuania
Implemented
Like neighbouring Latvia, Lithuania had legislation dedicated to the protection of whistleblowers in place before the adoption of the EU Whistleblowing Directive. Amendments were then made to the existing legal framework and the changes came into force in February 2022, transposing the EU legislation into national law.
Luxembourg
In progress
Shortly after the EU Whistleblowing Directive deadline expired in late 2021, Luxembourg’s government issued a draft law for its transposition. The process is still underway, and the country intends to create one complete, coherent, easily understandable and accessible framework for whistleblower protection. Luxembourg will go beyond the scope of the Directive and the coalition programme forsees a rapid transposition of the new measures into national law.
Malta
Implemented
Whistleblower protection legislation has been in place in Malta since 15 September 2013 in the form of “the Whistleblower Act (Cap 527”). Valetta amended it in December 2021, passing a bill called the “Protection of the Whistleblower (Amendment) Act 2021” which transposed the Directive, strengthening and expanding protection for whistleblowers.
The Netherlands
Implemented
The Netherlands finally transposed the EU Whistleblowing Directive in January 2023 and its new national legislation introduces a swathe of requirements such as updated whistleblowing procedures, anonymous reporting and the appointment of an independent reporting body. The previous Wet Huis voor klokkenluiders or Dutch Whistleblower’s Authority was criticised for numerous weaknesses and the new law has seen it renamed the Wet Bescherming Klokkenluiders.
Poland
In progress
While Poland missed the original deadline, the Ministry of Family and Social Policy has prepared a new law – the draft Act on the Protection of Persons Who Report Breaches of Law. It is still being evaluated before being submitted to the Sejm (lower house of parliament). Upon entry into force, the new law will contain numerous improvements in whistleblower protection such as preventing retaliation and allowing for the possibility of anonymous reporting.
Portugal
Implemented
An early transposer of the EU Whistleblower Directive, Portugal implemented the new measures on 20 December 2021 through Proposta de Lei 91/XIV and they came into force on 18 June 2022. The Portuguese government took the transposition process extremely seriously behind the scenes and it was characterised by speed and a lack of publicity.
Romania
Implemented
Romania was among the countries that missed the initial EU Whistleblowing Directive transposition deadline and after numerous delays an improved version of a national whistleblowing law was adopted by parliament on 13 December 2022. It entered into force on 22 December 2022 and required regulated entities to implement whistleblowing channels by 6 February 2023. There are still concerns about the new legislation, particularly in the area of anonymous reporting which falls short of meeting international best practice principles.
Slovakia
In progress
Bratislava established its existing measures to protect whistleblowers on the basis of Whistleblowing Act No.54/2019 Coll on the protection of persons reporting anti-social activities which replaced previous legislation from 2014. Given that the current law broadly coincides with the obligations of the Directive, it is expected that transposition will be achieved through an amendment.
Slovenia
In progress
The Slovenian government has held a series of consultations about the implementation of the EU Whistleblowing Directive. A second round of talks is expected to be held once the Ministry of Justice prepares a new draft. Slovenia does have limited measures in place protecting whistleblowers, but they fall short of the Directive’s requirements.
Spain
In progress
Spain’s Ministry of Justice started working on a draft law in mid-2020 and it was open to public consultation until late January 2021. On 14 September 2022, the Spanish government approved the new whistleblower protection legislation but 25 Civil Society Organisations called on it to be urgently amended, holding up the transposition process.
Sweden
Implemented
After Denmark, Sweden became the second EU member state to transpose the Directive. The Genomförande av visselblåsardirektivet was approved in late September 2021 before coming into force on 17 December 2021. Sweden did have measures in place beforehand, but they had no clause guaranteeing anonymity and confidentiality, a major flaw that was rectified by the implementation of the new EU legislation.
A glance across the EU border
Switzerland
Will not be implemented
Swiss companies with EU branches with 50 or more employees that are subject to EU law must take action and implement internal reporting channels under the Directive. Organisations in Switzerland that are not directly impacted by the Directive are nevertheless advised to comply with it in order to demonstrate good governance and uncover wrongdoing at an early stage to minimise any ensuing damage.
United Kingdom
Will not be implemented
The UK has no legal obligation to transpose the EU Whistleblowing Directive following Brexit but like Switzerland, the new measures will apply to UK businesses operating in mainland Europe above a certain size. The UK does have its own national whistleblower protection legislation in the form of PIDA which has been criticized as being outdated and overly complex.
Acknowledgements
EQS Group would like to thank the following organisations for their comprehensive insights and assistance in compiling this guide:
Download the Expert Guide for a more comprehensive country-by-country analysis
Register now for our Compliance News Service and receive relevant news from compliance, whistleblowing and business ethics. After successful registration for the Compliance News Service, you will receive the link to the white paper via e-mail. You can unsubscribe from the news at any time.
