From All the Bells and Whistles, to No Whistles at All – An Update on the EU Whistleblowing Directive

As we pass the one year anniversary of the implementation deadline for the EU Directive on the protection of persons who report breaches of Union law (the “Whistleblowing Directive”), the majority of the EU Member States (MS) have either adopted or are at least in the process of adopting their national implementing laws. Only a handful of MS met the December 17, 2021 deadline and those that did not are facing consequences, as the European Commission (EC) has initiated infringement procedures against MS for missing the deadline.

Below, we look at key figures around the Whistleblowing Directive’s implementation, the main ways in which national laws deviate from the Whistleblowing Directive, and our 2023 forecast for the remaining MS.

For more information about the Whistleblowing Directive’s substantive requirements, see our overview article and our masterclass webinar.

For further detail about implementation status and the latest whistleblowing updates, visit MoFo’s Whistleblowing Resource Center.

What is the overall implementation status?

As of the date of this article and to our knowledge, a total of 13 MS have implemented the Whistleblowing Directive into their national laws (see the implementation map on MoFo’s Whistleblowing Resource Center), and another 13 have drafted their national laws but have not yet adopted them. Some of these MS (including Czech Republic, Germany, and Italy) are nearing the finish line in their legislative processes. Meanwhile, for Iceland, Liechtenstein, and Norway, the Whistleblowing Directive is apparently still being scrutinized by the European Economic Area (EEA) European Free Trade Association before it becomes incorporated into the EEA Agreement.

Currently, Hungary is the only MS to show no signs of implementing the Whistleblowing Directive.

Since the UK has left the EU, it will not be adopting the Whistleblowing Directive and continues to regulate whistleblowing under its own regime.

How do the implementing laws differ?

Some MS have added “bells and whistles” to their national laws, going beyond the minimum standards set by the Whistleblowing Directive. Key deviations include:

• Scope of Reportable Concerns: Most MS have a broader scope of reportable concerns than the Whistleblowing Directive. For example, some allow reports to include concerns about any breach of national law or other serious matters (such as threats or harm to the public interest and may even cover HR matters).
• Deadlines: Several MS have tighter deadlines for organizations in relation to: (i) the implementation of their internal reporting channels and (ii) acknowledging and providing feedback to whistleblowers’ reports.
• Penalties: As the Whistleblowing Directive is silent on specific penalties, MS have discretion to decide on how sanctions are imposed. Numerous MS, such as Cyprus, Denmark, and France, have introduced criminal liability for whistleblowing infringements, and many have established fines for individuals and/or companies for breaches.

What is the forecast for 2023?

So far, the EC has launched infringement procedures against 24 MS for failing to meet the implementation deadline, and 19 of those MS have received reasoned opinions with two months to respond to the EC. If their response is found to be unsatisfactory, the EC may refer these cases to the Court of Justice of the European Union.

This added pressure might be the reason for the recent flurry of several MS either implementing their laws or approaching the end of their legislative process. It will hopefully accelerate the remaining MS’ adoption of national laws in 2023, particularly as the December 17, 2023 staggered deadline approaches (this is the deadline for organizations with 50-249 workers to set up a compliant hotline). We will continue to watch for any developments on this issue across the EU and report them in future client alerts.