Whistleblowing Directive: implementing a whistleblowing channel will be mandatory

On December 17, 2019, EU Directive 2019/1937 on the Protection of Whistleblowers entered into force. Under the Directive, Member States must have brought into force, by December 17, 2021, at the latest, the laws, regulations, and administrative provisions, as well as the other obligations, provided for in the Directive. Spain has not yet transposed the European Directive, but it is worth being aware of it so that your company can start planning for the introduction of these measures.

If a Member State fails to transpose the Directive within the established deadline, by failing to bring into force within its legal system the means necessary to achieve the intended results, it will be in breach of obligations assumed under the Treaties of the European Union.

Companies affected by the rules

Public institutions and private companies with more than 50 employees or €10 million in revenue will be required to comply with these new rules.

EU Member States may require entities with fewer than 50 workers to set them up if there are risks.

What the Whistleblower Directive is for

These rules seek to guarantee transparency and combat corruption in both the public and private sectors. To achieve this, the Directive proposes the creation of specific communication channels, arrangements, and methodologies so that employees and former employees in the private sector, as well as civil servants and former civil servants in the public sector, and workers, can report irregularities and breaches of various laws or violations of rights.

This is similar to what happens with anonymous complaints that lead to labor inspections or employment claims, only on a larger scale and with a dedicated protocol originating from the European Union itself. The term whistleblower is simply an anglicism which, translated literally, describes a person who blows a whistle. That is, someone who raises the alarm about an irregularity; in other words, a person who reports it.

This is the main pillar of the Directive, which also seeks to strengthen and protect the status of these anonymous whistleblowers who, at present, lack any kind of legal protection against retaliation.

How the Whistleblower Directive works

The law does not focus solely on protecting workers; it also covers shareholders, investors, members of the management body, interns, subcontracted staff, and suppliers. At the same time, it protects third parties connected with the whistleblower in question in the event of threats or retaliation.

The Whistleblower Directive provides for two types of whistleblower: the formal one and the anonymous one. In both cases, these persons will be entitled to appropriate protection in the event of attacks or intimidation against their physical integrity or property, or those of third parties.

As regards reports, they must always be reliable and verifiable. Under no circumstances may they be malicious, abusive, or based on publicly available information. Reports must be made through specific channels (which we will discuss later in this article), and practically any medium is valid: written, verbal, telephone, electronic, etc.

Consequences of the Whistleblower Directive

Spain already has rules aimed at the reporting of fraud, unlawful acts, acts of corruption, and violations of labor rights (among others). Some of them can be found in the anti-money laundering law or in the Criminal Code.

However, until now, none of the existing laws has specifically addressed the importance of protecting whistleblowers and encouraging the exposure of processes or conduct contrary to the law. In fact, in the vast majority of cases, such reports are dismissed and the person in question often faces lawsuits for calumny/defamation and other criminal proceedings. This is mainly because disclosing personal information or corporate secrets constitutes an offense.

The whistleblower protection rules reverse the burden of proof. This means that the whistleblower and/or their representatives will not have to prove that the offense was committed; instead, the organization will have to defend itself against the accusation.

In brief, the Directive’s most important implications will affect the following areas:

• Any form of threat, coercion, or retaliation against the whistleblower is prohibited. Non-compliance will result in financial penalties.

• Companies and public entities with more than 50 employees/civil servants must ensure that reporting channels are in place.

• Competent, third-party authorities responsible for following up on the report(s) will be designated.

• The investigation of the report must be completed within no more than three months, including the response to the whistleblower.

Fines for breaching the Whistleblower Directive

The Member States of the European Union consider it essential to establish criminal, civil, or administrative penalties to ensure that no retaliation is taken against whistleblowers.

The Directive sets a final deadline of December 17, 2023, for all Member States to transpose these measures into their legislation and administrative processes. In other words, the application of these measures will become mandatory in the coming years.

The fines for breaching the law are high, although in our view no penalties can be imposed yet, since private entities will not be required to implement internal reporting channels until the Directive has been transposed and the Member State has brought into force the legal provisions necessary to comply with the implementation of internal reporting channels.

• Very serious penalties, up to €50,000: These will apply where it is found that there was an intention or action to prevent, hinder, avoid, and/or deter the follow-up of the report, and likewise where the right to confidentiality of the whistleblower/reporting person is not respected. Similarly, any kind of retaliatory act (threats, coercion, etc.) will constitute an offense classified as very serious.

• Serious penalties, up to €25,000: Not having an internal reporting channel that complies with the law, or, for example, having one that does not guarantee confidentiality, will be considered a serious infringement. Likewise, not having an appropriate person and/or department to follow up on reports, or failing to check internal procedures, will also be considered a serious infringement.