The EU Whistleblowing Toolkit:
Navigating Laws and Best Practices

Laws in Austria do not address the issue of accepting and following up on anonymous reports, it can be concluded that private sector entities are not required to follow up on anonymous reports. We have noticed law firms recommendation that as best practice it is generally recommended to follow up as the identity of the whistleblower may be revealed at any time. As soon as their identity is known to the obliged entity, the whistleblower is fully protected under the Act on Whistleblowing and the obliged entity must acknowledge and respond to the report within the time periods stipulated in the Act on Whistleblowing. Austrian Whistleblowing Law

Belgium is a federal state made up of several autonomous entities. Each entity must adopt its own act to transpose the EU Directive. On 28 November 2022, the Belgian Parliament passed the Belgian Act on the Protection of Whistleblowers, that came into force on 15 February 2023.

In July of 2023 a new Bill was adopted for the French-speaking Community and Wallonia Region. As of then, the regions of Belgium are now almost fully covered by transposition laws. This review is focused on the Belgian Act on the Protection of Whistleblowers.

Besides these laws, Belgium has 3 main laws that are applied to cases of whistleblowing that were established and used before the enactment of the new legislations:

1. The Belgian Law of July 31, 2017 - This applies to the financial market and states how the Financial Service and Markets Authority needs to provide. This is with accordance to the Royal Decree of Belgium of September 24th, 2017. 
2. The Belgian Law of September 18, 2017 - This applies to money laundering and provides a supervising authority that is applied to WB cases.
3. Belgian Law of September 15, 2013 - This law applies to the public sector and is used in WB cases where the problematic act was done by a member of a federal administrative authority. The first 2 laws are relevant to the private sectors and the last to the public sector alone.
   
   

The Belgian Act on the Protection of WhistleblowersThe adopted Bill for the French-speaking Community and Wallonia Region

In early 2023 Bulgaria passed its first Whistleblowing Act as part of the process of transposing the EU Whistleblowing Directive into national legislation. The Law on the Protection of Persons Reporting or Publicly Disclosing Information on Violations (PDPA) entered into force on 4 May 2023.

Cyprus adopted the EUWD laws in January 2022 and it seems that it is in accordance with the standard expectations of the directive. 
 The three "Explanatory Guides to Better Apply Whistleblower Protection Legislation" have been produced and have been made publicly available on the Ministry of Justice website and sent to Ministries and designated persons likely to receive reports. 
 It is understood that the Academy of Public Administration has been instructed to begin further work to support implementation with training seminars for civil servants. 
 https://fimonoi.com/ is currently working to produce its own guidance on whistleblower protection as well as a series of guides to develop a training programme, for semi governmental organizations, municipalities and legal persons governed by public law about the provisions of the whistleblowers law. The 2022 Law on the Protection of Persons Reporting Violations of Union and National Law (Law 6(I)/2022)

On June 24, 2021, the Act on the Protection of Whistleblowers (the Whistleblowing Act) was adopted as the Danish implementation of EU directive 2019/1937 (the Whistleblowing Directive). In addition, Denmark has laws in the financial sector that also regulate whistleblowing. The Act entered into force on December 17th, 2021 for employers with 250+ employees and will enter into force on December 17th, 2023 for employers with 50-249 employees. The Act widens the scope of the Directive’s minimum standards by protecting reports of serious wrongdoing and violations of national, as well as breaches of EU Law, which has been a key issue facing Member States required to transpose the Directive. Additionally, the Act allows anonymous reporting, but this is not mandatory (it is mandatory in regard to sector specific laws in the financial sector). Also, the employer/recipient is not obliged to process or follow up on anonymous reporting, and the anonymous reporter will from a practical perspective not be protected against retaliation as long as the individual is anonymous Denmark Whistleblower info

As of Feb. 2023: Finland, implemented a national legislation of the Whistleblowing Directive that entered into force on 1 January 2023 (https://www.eduskunta.fi/FI/vaski/HallituksenEsitys/Sivut/HE_147+2022.aspx, here referenced as: "Finland Whistleblowing law"). However, there is a transition period for establishing an internal reporting channel. Private sector entities regularly employing at least 250 employees and public sector entities regularly employing at least 50 employees must set up an internal reporting channel by 1 April 2023. Private sector entities regularly employing at least 50 but less than 250 employees have until 17 December 2023 to establish an internal reporting channel. However, regarding anonymous reports, private sector entities are not required to accept and follow up on anonymous reports. In addition, if entities with less than 50 employees have established a voluntary internal reporting channel, they have until 17 December 2023 to bring them into compliance with the new legislation.
 (Status before Feb 2023:) Finland does not have WB regulations. Any WB regulations that are applied in Finland are based on sector specific laws. A draft law proposal to transpose the directive was delayed and therefore Finland missed the deadline (17/12/21) in which they were required to transpose their WB regulation. The independent body that reviews draft legislation (‘Lainsäädännön arviointineuvosto’) analyzed the bill and declared the draft only in partial compliance with the guidelines for assessing the impact of legislative proposals. They recommended the proposed legislation be clearer on the main impact on the rights and obligations of employees and employers and clearer on the impact of setting up new reporting channels in place of existing systems currently used by public authorities. The Legislative Review Board states that the draft proposal be amended in accordance with the Council's opinion before the Ministry of Justice submits its proposal. In September 2022 a new draft was issued. The new Bill would introduce significant legal reforms to strengthen the protection of whistleblowers and transpose the EU Directive on whistleblowing (2019/1937) into Finnish national law.
 The bill calls for organizations to establish internal reporting channels. A statement by the Finnish Ministry of Justice states:
 "Private sector organizations with at least 50 employees must implement an internal notification channel by 17 December 2023 at the latest. For other organizations, the internal reporting channel must be implemented within three months of the law coming into force." Finland Whistleblowing Law (Hallituksen esitys HE 147/2022 vp)

The French bill (act n° 2022-401) was passed in March 2022 and entered into force on September 1st. This law transposed the EU Directive and reforms the prior existing law regarding whistleblowing: The Sapin II Law from 2016. It seems that anonymous reporting is not encouraged, although it is allowed.

Note: both laws (of 2016 and 2022) are sometimes referred to as Sapin II Law.

France Whistleblowing Law

On 12 May 2023 the German government passed a new law to transpose the Whistleblower Directive into German law, named Hinweisgeberschutzgesetz (AKA HinSchG). The Whistleblower Protection Act will come into force by July 2, 2023. However, private employers with generally 50 to 249 employees do not have to set up their internal reporting until December 17, 2023 (Section 42 of the German WB law). By January 2024, fines can be imposed on employers if they have not set up the required internal reporting points. Administrative penalties of up to EUR 50,000 and compensation for damages. The material scope of the HinSchG is broader than the directive. The law allows oral and written reports. The law also encourages companies to encourage the use of internal reporting, even though external reporting is allowed as well. There is no reference in the law regarding anonymous reporting but if a report is received it must be dealt with. Another relevant law is the supply chain act that states that companies with over 3000 (or 1000 starting january 2024) need to have a complaint procedure set up.

German Whistleblowing law

The Protected Disclosures Act 2014 (2014 Act) is the principal legislation relating to whistleblowing and provides protection to workers who make a protected disclosure. The Protected Disclosures (Amendment) Act 2022, which amends the 2014 Act, was signed by the President on 21 July 2022 to provide for the transposition of the EU Whistleblowing Directive into Irish law (the Act). The Act entered into force in January 2023. All private sector organizations with 50 or more employees must establish internal reporting channels for their employees to make protected disclosures. A derogation from this requirement will apply to organizations with between 50 and 249 employees until 17 December 2023. This threshold does not apply to employers who are public bodies or who fall within the scope of certain EU Acts, including those in relation to financial services, products and markets, prevention of money laundering and terrorist financing, transport safety, and protection of the environment. Following concerns raised by the EU Commission regarding the transposition of the Directive, The Minister for Public Expenditure, NDP Delivery & Reform signed ”Statutory Instrument No. 375 of 2023 European Union (Protection of Persons who Report Breaches of Union law) regulations 2023” to further amend the Protected Disclosures Act. The regulations came into operation on 22 July 2023.

The Protected Disclosures (Amendment) Bill 2022 Regulations 2023

Italy has adopted a new law to transpose the EU Directive on whistleblowing. On 9 March 2023, the Counsel approved the law. The final text of the https://www.gazzettaufficiale.it/eli/gu/2023/03/15/63/sg/pdf was published on the Gazzetta Ufficiale (the Official Record) on 15 March 2023 and came into effect on 15 July 2023 (small and medium enterprises applicability was delayed to 17 December 2023). The previous law (179/2017) applied sometimes to private and public sectors alike but in some cases it addressed only one of the sectors. Following the adoption of new legislation to transpose the EU Directive on Whistleblowing, the Anti Corruption Authority (ANAC) – the public authority nominations as the national whistleblowing authority - has released it’s https://www.anticorruzione.it/documents/91439/146849359/Delibera+n.+311+del+12+luglio+-+linee+guida+whistleblowing++versione+unitaria.pdf/4cb30860-0676-5bf3-44d2-eaaeefba5ce4?t=1689332547758 for handling whistleblowing, in particular receiving external reporting.

Italy Whistleblowing info

The Dutch Whistleblowing Protection Act (Wet Bescherming Klokkenluiders) gives effect to the Whistleblowing Directive and was signed into law on 25 January 2022. It replaces the Whistleblowers Authority Act, which is a prior piece of legislation, implemented in 2016, in Dutch law, dealing with whistleblowing. The Dutch Whistleblowing Protection Act partially entered into force on 18 February 2023. Clauses relating to anonymous reporting and enforcement will enter into force at a later date. In July 2023, the Minister of the Interior and Kingdom Relations submitted a letter to the House of Representatives in which he indicated that they aim to finalize the rules for anonymous reporting. It is expected that this will enter into force mid-2024. Anonymous reporting is not prohibited. Data that is no longer relevant must be removed.

 The report provided below about whistleblowing regulations in the Netherlands include information about the old Whistleblowing Authority Act (2016), which was replaced and brought for comparison purposes.

Netherlands Whistleblowing info

Poland has not yet adopted a whistleblowing law. The transposition process of the Directive began in December 2020 in Poland but has faced delays. Several versions of a draft bill on the protection of whistleblowers have been published, but none of them have yet been forwarded to the Parliament. The European Commission referred Poland to the Court of Justice of the EU in February 2023 for this reason. The article flags key issues, including:

 1. Lack of adequate legal protection: As there are no dedicated, comprehensive regulations protecting whistleblowers in Poland, in cases of retaliation, labour law provisions are applied – which are considered ineffective in whistleblowing cases).

 2. Limited Worker Protection: Poland's labor law fails to cover millions of workers not in traditional employment relationships, leaving them vulnerable to retaliation for whistleblowing.

 3. Courts' Limited Jurisdiction: Poland's courts can only investigate reasons provided by employers for termination, making it challenging to prove if whistleblowing was the actual cause of the retaliatory action.

 4. Ineffective Equal Treatment Provisions: Existing provisions on equal treatment and harassment fall short in protecting whistleblowers due to the difficulty in proving discrimination.

 The analysis also examines the Draft Act's material scope, personal scope, protection measures, whistleblowing channels, and sanctions. Notably, the proposals lack dedicated interim relief measures and may not provide adequate incentives for whistleblowers. The main law that currently applies towards whistleblowing is the AML Act.

Polish Whistleblowing info

Portugal adopted WB regulations on 22 December 2021. The law came into force on 18 June 2022. This law establishes the creation and operation of institutional whistleblowing channels and the prohibition of any form of retaliation accompanied by the establishment of protection and support measures for whistleblowers. The Portuguese legislator followed the material scope defined in the Directive. Although, there are other laws that apply alongside the WB law, the main one being Law no. 93/99, which regulates the application of measures to protect witnesses in criminal proceedings. Additionally, there are measures established in order to prevent the use of the financial system for money laundering or terrorist financing.

Portugal Whistleblowing info

The implementation of the EU Whistleblowing Directive has been made by the newly adopted Act No. 189/2023 Coll. which amends the effective Slovak Act No. 54/2019 Coll. on Protection of Persons Reporting Anti-Social Activity and on Amendment of Certain Acts. This adopted law came into effect, fully, as of the 1st of September 2023. 

The reforms of the law includes:

• Expanding the definition of a whistleblower to include a wider range of persons including former employees and applicants, contractors, suppliers, job candidates, etc.
• Extending retaliation protection to other persons including those who assist a whistleblower, close associates, companies owned/co-owned by the whistleblower and whistleblowing officers.
• Redefining retaliation to include examples of prohibited action such as dismissal, demotion or denial of promotion, revocation of a contract, as well as damage to a person’s reputation.

 The new law also clarifies that anonymous reports are possible and that where an anonymous whistleblower is subsequently identified, they will be afforded protection under the Act.

Slovakia Whistleblowing info

Spain is a kingdom made up of 17 autonomous regions, thus there are laws that are specific to certain regions alone and some laws apply to the kingdom as a whole. When Spain did not have whistleblowing regulations and some regions had laws relevant only to them, it was sometimes difficult to fully understand in each region which laws were relevant. On February 16th, 2023, the Congress of Deputies approved the new whistleblowing law (Law 2/2023 of 20 February 23, regulating the protection of persons who report regulatory infringements and the fight against corruption). The law came into force on March 13th 2023.

Spanish Whistleblowing info

The draft bill was approved in late September and entered into force by the deadline of December. Additionally, in October, two further supplementary regulations were added: 1.National authorities have been nominated as competent authorities to handle whistleblowing reports. The Swedish Work Environment Authority has been selected to be the authority with responsibility for oversight over the functioning of the reporting channels. 2. The Swedish Work Environment Authority has been tasked with providing funding to trade unions and employer organizations as well as civil society organizations working on “issues relating to safety and the environment in working life and against corruption and other abuses in the workplace.” Anonymous reporting is not prohibited.

Sweden Whistleblowing info