EU Whistleblower Protection Directive: Practical implementation considerations

20 November 2023 3 min read

By Sarah Hellewell

At a glance

17 December 2023, the deadline for medium-sized companies to implement internal reporting channels under the Whistleblower Protection Directive, is fast approaching.
Many multi-national employers are addressing similar implementation issues which are best considered at the project planning phase.
DLA Piper's Guide to implementation of the Directive is a comprehensive resource providing information on local implementation laws as well as a summary of the Directive's key provisions and a comparison with the US Sarbanes-Oxley regime.

The EU Whistleblower Protection Directive was due to be transposed into the national laws of EU Member States by 17 December 2021. However, most countries failed to meet this deadline. The subsequent threat of infraction proceedings by the European Commission means that 2023 has seen a flurry of implementing laws.

Larger employers, of 250 or more workers, were often given little time to meet national deadlines for compliance with the Directive’s core obligation to implement an internal whistleblowing reporting channel.

In most countries, medium-sized employers with 50 to 249 workers were given until 17 December 2023 to comply with the impact of the Directive on their business. Multi-national businesses with medium-sized entities across various EU jurisdictions have also been able to benefit from this extension, but the 17 December deadline is fast approaching meaning that action is now required.

Our experience of advising on compliance with the Directive and national transposition laws has shown several common implementation issues which are best considered at the planning phase of a Whistleblowing Directive compliance project.

An important step is to identify which of a business’s entities must have a reporting channel because they meet the legislative threshold of 50 workers, and which need not. Also consider if relevant national implementing legislation encompasses not only legal entities but also, for example, branches meeting the worker-number threshold.
Many employers are taking a comprehensive approach and providing a reporting channel for workers across their entire EU business, regardless of the size of the employing entity. Nonetheless, gaining an initial understanding of where a channel is mandatory and where it is optional is key to understanding the business’s compliance landscape and enabling risk-based decisions on the design of the procedure.
Many businesses are using the project planning stage to decide who to extend their reporting procedure to. A channel must be provided for the business’s workers, but it could also be extended to, for example, self-employed staff, ex-employees, new recruits, and those working for contractors or suppliers. Where a business is proposing a procedure for extended categories of individual, it should assess if they will access to the same procedure as its workers or a limited version, for example with more flexible timeframes for responding to reports.
The Whistleblowing Directive sets minimum standards which local country whistleblowing laws must meet, but it has been open to local legislators to go beyond its provisions. The scope has been extended in several countries meaning that there are local variations in relation to, for example, matters that can be reported and local language requirements as well as data privacy and confidentiality. Variations for countries in which a business operates are best identified early so that either a levelled-up group procedure can be set up or country variations can be incorporated as required.
A major compliance challenge facing multinational businesses relates to the use of centralised reporting channels. Many want to use or to implement group procedures which assign receipt, investigation, and management of whistleblowing reports to a centralised compliance function. This option is often preferred as it ensures that reports are handled by the business function with the relevant skills and expertise. This approach, however, contradicts the view of the European Commission that a group whistleblowing channel should not be the only option offered by multinational businesses and a local reporting option must also be available to an individual. Although work-arounds are often possible, this is nonetheless a significant matter to be considered at the planning stages.

For comprehensive information on local laws implementing the Directive in seventeen EU countries access our Guide to implementation of the EU Whistleblower Protection Directive on GENIE. This resource also enables you to track country by country implementation of the Directive; provides an overview of the Directive's key provisions; compares the Directive and the US Sarbanes-Oxley regime; and identifies actions for employers to take as they update their programs to ensure workplace whistleblowing compliance with the new laws in each EU Member State.