The Whistleblowing Directive’s Implementation Deadline Is Here, but Many Member States Take a Rain Check

Despite the fact that the deadline for implementing the EU Directive on the protection of persons who report breaches of Union law (“Directive”) is here, only four EU Member States took action to enact national implementing laws as of the morning of the 17th. The others are somewhere between close to finalizing and possibly not even starting yet.

It is therefore fair to say that implementation has not advanced as much as we might have expected when we first reported on the topic in June. With the holidays right around the corner, it seems unlikely that there will be any additional implementation progress made before the end of the year. Not knowing when Member States are likely to finalize their laws makes it difficult for multinational organizations to predict how to structure their compliance efforts in a pragmatic way.

Below we look at some of the key questions that might interest organizations that fall within the scope of the Directive. To find out more about the Directive’s substantive requirements, see this overview article. For additional information about the status of the implementation and latest developments and know-how, visit our MoFo Whistleblowing Resource Center.

Which Member States have implemented national laws?

As of the morning of December 17, only four EU Member States have adopted their implementing laws: Denmark, Lithuania, Portugal, and Sweden[1]. The biggest change in the national laws pertains to the scope of reportable topics. All Member States have decided to broaden the scope beyond that in the Directive, which is limited to violations of EU law only. For the most part, however, the adopted laws replicate the Directive’s requirements, with some deviations. You can read about notable points and deviations in the adopted implementing laws in our brief Q&As for each Member State.

Are centrally run whistleblowing hotlines allowed in national implementing laws adopted to date?

Most of the above-mentioned Member States include provisions that, to varying degrees, contemplate sharing of resources and centrally run hotlines. Many multinationals consider centrally run hotlines as a practical necessity for the purpose of proper compliance, not only with the Directive but other applicable whistleblowing rules across the world; however, this concept became an issue earlier this year after the European Commission Expert Group (“ECEG”) took the view that multinational organizations must offer local entity level reporting channels alongside their central whistleblowing hotlines. We discuss in this article what the ECEG’s position is, why it may not fulfil the Directive’s objectives in practice, and how it may even undermine whistleblowers’ protection.

This is an area that needs close monitoring. If your organization already maintains or plans to implement a centrally run hotline, you may want to consider sharing your thoughts with relevant authorities and legislators on why the ECEG’s idea of the need for locally run hotlines does not hold water.

What is the status with the other Member States?

Many Member States by now have introduced a draft bill, although a few (such as Hungary, Italy, and Luxembourg) have yet to do so. Furthermore, the Directive is still stated to be “under scrutiny” by the European Economic Area countries (Iceland, Lichtenstein, and Norway); this status has remained unchanged for some time now. Overall, we anticipate that the remaining countries will struggle to adopt national implementing laws before the end of the year. It is also questionable how many will manage to do it in the first half of 2022 or even later.

In part, the delays can be attributed to the COVID-19 pandemic, which every Member State is grappling with; this is serving as a major distraction for every government and its legislative initiatives, apparently resulting in delays across the board. On top of this, several Member States have undergone general elections this year, which either made whistleblowing laws a topic of hot debate (like in Germany) or something to ignore. Either way, whistleblowing has seemed, at times, low on the priority list of many Member States.

You can track the progress of developments in our Whistleblowing Resource Center.

What does the lack of implementation mean?

You may not be surprised to hear that this is not the first time Member States either have been slow to respond or have intentionally refused to transpose a directive into national law. Just this year, 23 Member States failed to implement the EU Copyright Directive in time for the June 2021 deadline, which resulted in the EC issuing formal notices, asking the Member States to explain the infringement. The same procedure may need to be followed here, at which point the EC may also choose to refer the case to the Court of Justice of the European Union if it is not reasonably satisfied with a Member State’s reason for delay.

Notably, the Directive does not include any direct obligations on organizations to set up whistleblowing hotlines. It instead mandates Member States to ensure that their national laws impose such obligations on organizations. Furthermore, while individuals may be able to enforce their rights against the state with respect to their own rights and protections (based on the concept of “vertical effect” as established, for example, in Pubblico Ministero v. Ratti (Case 148/78)); they are unlikely to have the standing to enforce directly against organizations in Member States without national implementing laws.

What does this mean for your organization?

That is the million-dollar question, and there are some key considerations in play.

• The size of your organization: The Directive has a staggered compliance timeline, depending on whether an organization has 50 – 249 workers (where the deadline for compliance is December 17, 2023) or more than 250 workers (where the deadline for compliance is now, December 17, 2021). Member States may also opt to defer their national deadlines (as Sweden has) to give organizations additional time to comply. Extra preparation time is never a bad thing, but it could leave organizations in limbo as to when is the optimal moment to activate their hotlines.
• Your intended approach: If you already have or are planning on setting up a centrally run hotline, you will have to decide whether to take a “one-size-fits-all” approach across all Member States or tailor your hotline according to specific Member State requirements. This presents a problem because organizations may need to repeatedly update and translate underlying documents to account for the various national requirements and train and retrain personnel on the latest new rules (not to mention engage with their works councils and unions on a continuous basis).
• Applicable national implementing laws: Monitor the status of national implementing laws for countries relevant to your organization (our local implementation chart may help). This does not mean you should do nothing – your organization should be ready to act and make decisions on how to proceed as soon as the applicable laws are adopted.
• Available resources: Line up whatever budget and resources you need to comply with the new rules, including any new personnel and training needed for managing investigations. It is worthwhile keeping relevant stakeholders informed so they know why the additional resources are necessary and they understand the importance of keeping up compliance efforts; in the end, this will ensure swift decision-making and result in fewer surprises for those stakeholders, thus also making your job easier.
• Works councils/unions: Depending on where your organization is located, you may need to notify and/or seek permission from your works councils and unions prior to establishing the new or updating the existing hotline. This process should be carefully managed in a way that best suits your relationship with your councils/unions.

[1] According to the most current information available to us, Malta’s implementing laws was signed by the President of Malta on December 18, and therefore counts as adopted, but is not yet in force.