Imagine...

You are a producer of pralines. You started out small, but today your company has over 150 employees. Right from the start you did everything you could to promote a compliance culture within your company. You find it imperative to always deal correctly with your commercial partners and to strictly comply with all applicable laws.    

You hear that Europe has adopted legislation establishing reporting channels for legal infringements. At your initiative, you had already set up such a reporting channel within your company a few years ago. Employees who identify or suspect abusive practices can always report this to their superior, who will arrange for the necessary follow-up. You are pleased to hear that you were ahead of your time. Or perhaps not? According to your legal department, there is still a good deal of work left to do. But if so, why? And what remains to be done?

A brief clarification.

People who work for a company are often the first to become aware of possible infringements that the company is committing and which can be detrimental to the public interest. Due to fear of retaliation, however, they often refrain from reporting the infringements they have discovered. In 2019 Europe adopted a directive designed to fix that situation. The directive contains minimum requirements for reporting channels and assures protection for reporting persons (AKA whistleblowers). It gave the Member States until 17 December 2021 to transpose these requirements into national law. For SME´s with 50 to 249 employees, the obligations only need to enter into force on 17 December 2023. This means that our praline producer still has the rest of this year to do what is necessary.

As a reminder, what kinds of breaches can be reported? Firstly it concerns infringements of important EU legislation. This legislation is listed in the directive and includes breaches of the rules on product safety, environmental and consumer protection, public procurement contracts, personal data, competition, state aid and the internal market. The directive introduces only a minimum level of protection. Member States may expand the protection on the basis of their own national law. Europe will also periodically evaluate whether the list of legislation should be extended. 

Who enjoys protection? The directive offers protection to persons who communicate information on infringements that they acquired in a work-related context. The protection extends to third parties who are connected to the whistleblowers and who can also suffer from retaliation, such as their colleagues or family members. The protection applies for the report of infringements both by the organisation for which the reporting person works and by organisations with which he was in professional contact, such as competitors, suppliers or customers. The protection applies broadly in time: prior to the employment relationship (if the information was obtained during a recruitment process or a pre-contractual phase), as well as during and after the employment relationship. One condition for protection is that the whistleblower must have had reasonable grounds to believe that the information he provides is true. Thus the protection will not cover malicious, frivolous or abusive reporting persons.

Who must be able to report? Under the directive, at a minimum employees must have access. Europe leaves it the Member States to decide whether they wish to oblige their companies to open up the internal reporting channels for a larger group.

What protection do reporting persons enjoy? The protection is far-reaching and includes a prohibition on any form of retaliation against whistleblowers and against third persons who are connected with them and who could suffer retaliation. Forms of retaliation include e.g. dismissal, discrimination, intimidation, the denial of promotions or blacklisting, as a result of which the reporting person can no longer find a job in the sector.

What actions do SME´s have to take? Every SME, regardless of the nature of its activities, must establish an internal reporting channel by 17 December 2023. An SME can either manage this internal reporting channel itself or appoint a third party for receiving infringement reports. The directive also allows SME´s to share resources for receiving reports and possibly for conducting investigations. It must be possible to make the report either in writing or orally, the identity of the reporting person and of third persons who might be named in the report must be protected, and there must be a careful follow-up by an impartial person or department. The follow-up entails, amongst other things, that the reporting person must receive an acknowledgment of receipt within 7 days and must receive feedback within a reasonable period (no longer than 3 months). The internal reporting channels must also provide clear and easily accessible information about the possible external reporting channels to government authorities.

And what about our producer? Our praline producer is thus on the right path, but there is still work to be done. For example, he must verify for whom he must open up his internal reporting channel and whether he is left the choice of expanding the circle of reporting persons, which would allow him to organise a wider compliance circle. For receiving and following up reports he must designate an independent person or department, not the superior (who might prove to be the subject of a possible report). He must also furnish information in an accessible manner about external reporting channels to competent authorities.

So, a substantial to-do list remains - but fortunately, he still has enough time!

Concretely.  

• Within the EU, a minimum protection applies for persons reporting suspected infringements of important legislation. The Member States can go further and adopt an even more protective regime.   
• By 17 December 2023, every SME must provide for an internal reporting channel that guarantees the anonymity of whistleblowers, and they must carefully follow up their reports.
• Reporting persons are protected against any form of retaliation and incur no liability so long as they report suspected infringements in good faith.

Want to know more?

• You can find the Directive (EU) 2019/1937 of the European Parliament and of the Council of 23 October 2019 here.
• The European Commission published an FAQ on whistleblower protection: https://ec.europa.eu/commission/presscorner/detail/en/MEMO_18_3442.
• You can find the Law on the protection of persons reporting infringements of the Union or national law identified within a legal entity in the private sector of 28 November 2022 here.
• You can find the ITP “Blow the whistle! New European protection for whistleblowers” here.
• Any questions? Contact our compliance team