Whistleblowing Directive 2019/1937 is coming soon. What does this mean exactly and how can your company navigate the new legal requirements?

What’s going on?
In December 2019, Directive (EU) 2019/1937 (“Directive") on the protection of persons who report breaches of Union law entered into force. Member States are now required to bring into force the appropriate laws, regulations and administrative provisions necessary to comply with the Directive by 17 December 2021. The different Member States are currently at different stages of implementing the Directive, some already have whistleblowing laws on the books while some are only now introducing whistleblowing bills to be considered by their national legislatures.

Who is a „whistleblower“?
Whistleblowing is the act of drawing public attention of the authorities or of the public at large, to perceived wrongdoing within
public or private organizations. Examples of such wrongdoing may include fraud, corruption and other civil, criminal and administrative
violations.

As whistleblowers often face reprisals from their employer, superiors or even their colleagues, their protection has become an increasingly important focus for the European Union, as is incentivizing whistleblowing when there are many reasons stopping employees from doing so and protecting whistleblowers from retaliatory actions.

Is there anything you need to do?

Among other things, the Directive establishes the following requirements:

• All companies in the EU, irrespective of their size, are required to ensure that whistleblowers are protected against any form of retaliation;
   
• Companies with 50 or more employees will be required to implement an internal reporting and follow-up system enabling employees and other selected individuals to report perceived breaches of EU law; 
   
• Individual EU Member States, however, are allowed to require private companies with fewer than 50 workers to implement an internal reporting and follow-up system; the current whistleblowing bill in the Czech parliament, for example, prescribes the implementation of an internal reporting and follow-up system for companies with 25 employees or more;
   
• Other requirements, such as data protection compliance, duty of confidentiality, record-keeping duties, etc.

In order to ensure that your company complies with the new whistleblowing requirements and avoids unnecessary exposure, we believe that now is the perfect time to start implementing a robust compliance policy.