EU Whistleblowing Directive changes compliance landscape for multinational firms

The deadline for implementing the EU’s Whistleblowing Directive has been and gone and Member States at various stages implementing it. So, given there will inevitably be variations between jurisdictions, how should multinational businesses with a presence across different EU countries address that issue given that a ‘one-size-fits-all approach’ to whistleblowing reporting is not going to work. We will come to that shortly.

Since 17 December companies with 50 or more workers are meant to have in place appropriate reporting channels and procedures, depending on where they operate. They’ve had two years to do that but few have made any meaningful progress, and some have not even started. The Directive aims to provide common minimum standards of protection across the EU to whistleblowers who raise breaches of EU law with their employer and the scope of the protection is very wide, as you might expect. It includes reports about public procurement matters, financial services, products and markets, money laundering, the environment, personal data, IT systems, the list goes on.   

The UK has, of course, left the EU and the government has said the UK will not be updating its domestic laws. Nonetheless, multinational firms with UK headquarters will either have to reflect the changes in their global whistleblowing policy, or choose to adopt a jurisdiction-by-jurisdiction approach. The European Commission has indicated, in clear terms, that this will preclude reliance on a central compliance team within a parent company to handle all whistleblower reports, so therein lies the challenge. 

As you would expect, we have clients who operate across jurisdictions so we have been tracking implementation of the Directive closely. Take the Netherlands for example. The Netherlands was one of nine Member States which the EU Commission considered already had comprehensive whistleblower protection – the UK was also in that bracket, incidentally. That protection is currently in the form of legislation called The House for Whistleblowers Act and that’s what will be amended to comply with the Directive. The biggest change, the most far-reaching, is that whistleblowers will be given the opportunity to report directly, externally, outside their own organisation. In contrast, at the moment, there is still the obligation to report internally first. 

Stephanie Dekker is based in Amsterdam and joined me by video-link to discuss the Directive. I started by asking about the help she’ll be giving to multinational clients:

Stephanie Dekker: “We may for example advise clients on policy and procedure reviews and help them find cross border solutions that work for them. Another topic that I think is important to consider where it regards the advice to clients is the actual implementation of the new or amended whistleblowing procedures, and more specifically any requirements that may apply in that respect with regards to employee participation bodies. For example, in the Netherlands the establishment or amendment of whistleblowing procedures is subject to the consent of the works council except if this is a topic that is already regulated by a collective bargaining agreement that is applicable to the employer. Even more so under the new proposed legislation which implements the directive, a new requirement is introduced in this regard meaning that employers who don't have to have a works council but are required to have an internal whistleblowing procedure, needs the consent of more than half of the employees for the establishment of that procedure. So these are topics that are important to consider, also with regards to timing of the implementation project.”

Joe Glavina: “The delay in meeting the deadline means at least companies have time to audit existing whistleblowing policies and procedures. What’s the message to HR faced with that?”  

Stephanie Dekker: “Well, first and foremost, HR professionals in companies who do not yet have an internal whistleblowing procedure are recommended to consider whether the company may need one. In general, this applies when the company has 50 or more employees but it's important to note in this context that the concept of employee is broader than those persons with an employment contract and, therefore, you should carefully consider whether your company may fall above the threshold and also there are certain sectors in which this threshold does not apply, so this will be the first step. Subsequently, if you already have a whistleblowing procedure then it is likely that you will need to update it. First of all, because the scope will need to be expanded to also cover reports on breaches of EU law as set out in the Directive, but also because the Directive, and with that the Dutch implementation law, will include more stringent requirements for these whistleblowing procedures. So for example, certain deadlines will need to apply within which you need to confirm the receipt of a report, or provide feedback, and you will also need to keep a register of reports that you have received. One additional topic that will be relevant for the Netherlands is that currently under Dutch law the whistleblower, in principle, has an obligation to first make an internal report unless that can reasonably not be expected from him,  and that requirement will no longer apply once the Directive has been implemented. In that context, it is also very important to have clear communications with employees, and other persons covered by the internal reporting channels, on the fact that the reporting channel is there and to instil trust in the use thereof, so that employees are encouraged to use that channel and not immediately move towards external reporting.”
The current expectation is that the Dutch implementation law will be in place before the summer of 2022. 

Finally, it is worth mentioning that back in June last year we held a webinar on this topic: ‘EU Whistleblowing Directive - the road to implementation’ with speakers from a range of EU countries giving their input. Helpfully, the contact details of all of them are still on the Events page of the Pinsent Masons website. We have included a link to that page in the transcript of this programme. 

LINKS
- Link to Pinsent Masons contacts page