Whistleblowing: how to develop an international approach

Whistleblowing practices are under increasing scrutiny as jurisdictions around the world seek to ensure that staff  are adequately protected when they "speak up" in respect of internal misconduct or malpractice.

Businesses are updating their internal whistleblowing policies and procedures to comply with the EU Whistleblowing directive on the protection of persons who report breaches of Union law (Directive (EU) 2019/1937), as well as local laws being implemented this year, in order to align approaches across their international operations.

Changes afoot, derived from the directive, include a requirement for organisations with more than 50 employees to set up internal reporting channels for whistleblowers, a requirement to have a dedicated person(s) handling any reports, new timescales for responding as well as an obligation on businesses to ensure that whistleblowers are protected against retaliation. Whistleblowing processes also need to be compliant with local data protection laws and the UK/EU General Data Protection Regulation (GDPR).

Below we set out some very high level examples of the overarching position in respect of whistleblowing in several jurisdictions. These examples do not provide the full picture but illustrate the variations that exist between jurisdictions.

Belgium

Belgium has chosen to transpose the directive in two stages: for the public sector and for the private sector. Belgian law implementing the Directive came into force on 2 January 2023 for the public sector and 15 February 2023 for the private sector.

The material scope of application of the Belgian law is broader than that of the directive, in that it focuses on tax and social fraud.

France

French law implementing the directive came into force on 1 September 2022. The directive supplements existing French whistleblowing protections which had been in place since 2013 and the new law goes beyond the minimum protections required for Member States. 

French laws offer wider protections than the directive in the following ways: (i) individuals will not need to have personal knowledge of the facts in order to report; (ii) entities surrounding the reporter (for example, facilitators) are also protected under French law; and (iii) the list of reprisals against which whistleblowers are protected upon reporting is widened.

An implementing decree was published on 3 October 2022 which provides guidance on the application of the new whistleblower legislation and sets out the procedures for the collection and processing of whistleblower alerts and communications.

Germany

In July 2022, a draft bill was published which goes beyond the directive in the scope of its protections for whistleblowers. Following some amendments, the German Whistleblower Protection Act was adopted by the German Bundestag on 16 December 2022 but blocked in the Federal Council (Bundesrat) and implementation is still pending.

The law, when passed, will most probably require all businesses with 50 or more employees to set up a secure reporting systems for whistleblowers (those with 50-249 employees have a transition period until December 2023).

In addition, whistleblowers will be granted additional protections meaning that employers must prove that there was no connection with the reporting of the information by the employee following dismissal, warnings, non-renewal of a fixed-term contract, relocation to another department, etc.

Italy

Italy implemented its own whistleblowing regulations in 2017 – however these do not cover everything set out in the directive.

For full compliance the Italian regime will need to widen its scope to include all legal entities with at least 50 employees, cover breaches of EU law and protect additional individuals including colleagues, relatives and any legal entity associated with the whistleblower.

A legislative decree covering this was issued on 10 March 2023 and this comes into force from 15 July 2023 (for companies with 250 employees or more) and 17 December 2023 (for companies with fewer than 250 employees).

Poland

Poland does not currently have any comprehensive whistleblowing protection legislation in place.

A draft whistleblowing protection bill was created in October 2021 but progress on this is still ongoing – a further version of the new legislation was published on 10 January 2023 and the draft has been forwarded for further legislative process.

The proposed Polish regime largely reflects the key principles of the directive, in particular it provides for "three channels" of reporting for whistleblowers and, in the context of internal reporting (implementation of the whistleblower protection procedure), will apply to all entities with more than 50 employees.

An exception is to be made for entities active in financial services, products and markets, anti-money laundering and terrorist financing, transport safety and environmental protection, in which case the directive will apply regardless of the number of persons employed.

Spain

On 13 March 2023 a new Spanish law intended to implement the directive came into force. Further details can be found here but, in summary, for entities with 50 to 249 employees, internal reporting procedures will be required by 1 December 2023. Employers with 250 or more employees will have three months from approval of the law to comply (that is, by 13 June 2023).

The new law contains certain leniency provisions which may apply where a whistleblower is also an offender.

Sweden

Sweden implemented its own whistleblowing regulations in 2016 – however this was limited to reporting serious misconduct of a key person within a business in the financial sector.

Sweden met the deadline to transpose the directive and implemented its own whistleblowing legislation on 17 December 2021.

The new Swedish regime widens the scope of the previous regulations as it is a cross-sectoral regulation on whistleblowing systems. In addition to the protections required by the directive, breaches of Swedish law and other serious misconduct are also protected.

The new regime required employers in the private sector with 250 employees or more, and employers in the public sector, to implement a whistleblowing scheme by no later than 17 July 2022. Private sector entities with between 50 and 249 employees have until 17 December 2023 to implement the scheme.

The Netherlands

The Netherlands already had detailed whistleblowing protection prior to the directive. The new Dutch regime (which is laid down in the Whistleblowers Protection Act) was passed on 24 January 2023, entered into force on 18 February 2023 and aims to implement the directive to better protect reporters.

The Dutch regime will protect those who report suspected breaches of national or EU law as well as internal company regulations that are implemented pursuant to a statutory obligations. This goes further than the directive, which only requires that Member States protect against breaches of EU law. It is important to note that an employer who has not installed a works council or employee representative body and is not obliged to do so, needs the consent of the majority of employees when adopting the internal reporting procedure.

UK

The UK was not required to implement the directive following its departure from the EU. Some of the content of the directive is already reflected in the UK regime, although the UK regime does not protect self-employed people, shareholders and board members in the same way that the new EU regime does.

There are also differences in respect of the relevant disclosures protected, reporting and confidentiality. Organisations can choose to "level-up" their UK policy to meet the requirements of the directive.

The UK government recently launched a review of the UK whistleblowing framework in which it will ''gather evidence on the effectiveness of the current regime in enabling workers to speak up about wrongdoing and protect those who do so''. The review will look into who is covered by whistleblowing protections, the availability of information and guidance for whistleblowing purposes and how employers and prescribed persons respond to whistleblowing disclosures, among other areas.

This year, we also expect to see progress on the following private member's bills which propose reforms to the UK's whistleblowing framework:

- Protection for Whistleblowing Bill – this seeks to establish an independent Office of the Whistleblower which would deal with the administration of arrangements to facilitate whistleblowing, act as a point of contact for whistleblowers and maintain a fund to support whistleblowers.

- Public Interest Disclosure (Protection) Bill – this seeks to create a new independent Whistleblowing Commission to set, monitor and enforce standards.

Osborne Clarke comment

As illustrated above, variations in local law poses compliance challenges for businesses needing to implement international whistleblowing procedures and policies.

As implementing legislation comes into force, businesses should keep under review their whistleblowing policies to provide employees with guidance (for example, when it might be appropriate to "blow the whistle", outlining any protections in place for whistleblowers, the process for raising concerns and the investigation process that will then be followed internally following disclosure) and to ensure compliance with local requirements.

How we can help

Our expert International Employment Team, working in collaboration with our overseas colleagues and best friends network, is best placed to advise your business in implementing international whistleblowing procedures and policies which are fully compliant with variations in local law. We have experience assisting clients with:

• Drafting or amending whistleblowing policies to ensure compliance with local requirements.
• Coordinating legal advice across jurisdictions and advising you on the best international approach for your organisation.
• Drafting related communications to employees.

We are happy to agree fixed fees per project based on where our input is required. Please contact one of our experts to find out more.