EU Whistleblowing Directive Status Update [late 2023]

This article provides an update on the status of the EU whistleblowing law in 2023, explores the reasons behind the delays, and outlines the steps company leaders must take to prepare for the post-Directive era.

Let’s refresh our memory: The EU Whistleblowing Directive (2019/1937) was created to protect whistleblowers in the European Union. This directive allows employees to report concerns anonymously when they suspect misconduct. It gives them the confidence to expose corruption without worrying about facing retaliation.

It’s important to note that this is a “Directive” and not a “Regulation.” Regulations are uniformly applied across the EU, but Directives set a minimum standard that each member country must incorporate into its laws. This means there can be variations in how these laws are enforced and interpreted in different Member States (we’ll discuss this further later).

Below, you’ll find an updated table showing the whistleblowing laws’ current status in each EU Member State. You can also access official announcements and updates through the provided links.

1	🇦🇹 Austria	Adopted ✅	Link to announcement
2	🇧🇪 Belgium	Adopted ✅	Link to announcement
3	🇧🇬 Bulgaria	Adopted ✅	Link to announcement
4	🇭🇷 Croatia	Adopted ✅	Link to announcement
5	🇨🇾 Cyprus	Adopted ✅	Link to announcement
6	🇨🇿 Czechia	Adopted ✅	Link to announcement
7	🇩🇰 Denmark	Adopted ✅	Link to announcement
8	🇪🇪 Estonia	Delayed  ❌	Check the page for an update
9	🇫🇮 Finland	Adopted ✅	Link to announcement
10	🇫🇷 France	Adopted ✅	Link to announcement
11	🇩🇪 Germany	Adopted ✅	Link to announcement
12	🇬🇷 Greece	Adopted ✅	Link to announcement
13	🇭🇺 Hungary	Adopted ✅	Link to announcement
14	🇮🇪 Ireland	Adopted ✅	Link to announcement
15	🇮🇹 Italy	Adopted ✅	Link to announcement
16	🇱🇻 Latvia	Adopted ✅	Link to announcement
17	🇱🇹 Lithuania	Adopted ✅	Link to announcement
18	🇱🇺 Luxembourg	Adopted ✅	Link to announcement
19	🇲🇹 Malta	Adopted ✅	Link to announcement
20	🇵🇱 Poland	Delayed  ❌	See our note below
21	🇵🇹 Portugal	Adopted ✅	Link to announcement
22	🇷🇴 Romania	Adopted ✅	Link to announcement
23	🇸🇰 Slovakia	Adopted ✅	Link to announcement
24	🇸🇮 Slovenia	Adopted ✅	Link to announcement
25	🇪🇸 Spain	Adopted ✅	Link to announcement
26	🇸🇪 Sweden	Adopted ✅	Link to announcement
27	🇳🇱 The Netherlands	Adopted ✅	Link to announcement

Explaining the Delays in Directive Adoption

Implementing the Directive’s requirements across the European Union has been complex. Over the last year, several Member States, including Germany, Czechia, Hungary, and Slovenia, experienced extensive discussions and negotiations in integrating these requirements into their national laws.

Take Germany as an example. The Bundesrat (Federal Council) and the Bundestag (Parliament) engaged in prolonged deliberations over the details of the proposed legislation. After much debate and the intervention of a mediator, an agreement was reached in June 2023. This agreement notably altered certain aspects of the legislation: organizations in Germany are no longer required to process anonymous reports internally, and the financial penalties for non-compliance have been halved from €100,000 to €50,000.

This type of negotiation deadlock was common among the 27 EU Member States. However, as of now, 25 Member States have successfully concluded their negotiations and have incorporated the Directive into their national laws. Estonia and Poland are the only two countries still in the midst of discussions. Stay tuned for further updates.

Update on Estonia’s Progress with the Directive

Estonia’s journey towards adopting the Directive into national law is nearing completion, albeit with some delay. Following government approval in August 2023, the new law is anticipated to be enacted on January 1, 2024.

The proposed legislation, titled “Act on the Protection of Whistleblowers of Work-related Violations of European Union Law” (link here), faced hurdles during its development. It encountered various controversial amendments that sparked debate and required careful examination.

These complications led to a temporary impasse in the Parliament. Consequently, Estonia risks potential fines from the European Court of Justice due to the delay in transposing the Directive within the designated timeframe.

Status of Poland’s Whistleblowing Legislation

Poland’s approach to implementing a whistleblowing law stands in contrast to Estonia, as it currently lacks a definitive date for enacting its whistleblowing legislation. The most recent draft, prepared on July 12, 2023, marks the ninth iteration of the bill, but it has not yet been presented to the Parliament.

A significant challenge for Poland is the absence of an existing framework for whistleblower protection. This means the country is building its system from the ground up, requiring substantial effort and time.

This prolonged delay has led to repercussions from the European Commission. The Republic of Poland faces fines imposed by the Commission, which will continue to accrue until Poland successfully integrates the Directive into its national law.

Understanding the EU Whistleblowing Directive Post-December 17, 2023

Who Does the Directive Apply to After December 17, 2023?
From December 17, 2023, the EU Whistleblowing Directive will encompass many entities. This includes municipalities with over 10,000 residents, all public or private sector organizations with more than 50 employees, financial institutions of any size, and entities under Anti-Money Laundering (AML) and Combating Terror Finance (CTF) regulations, such as law firms and casinos.

What Protections Are Offered?
The Directive safeguards whistleblowers reporting various wrongdoings, including:

• Animal health and welfare
• Anti-money laundering and financial services
• Consumer and environmental protection
• Food and nuclear safety
• Data privacy
• Product Safety
• Public health and procurement
• Terrorist financing
• Transport safety

It also covers breaches of EU competition rules, financial interests, and corporate tax laws.

Compliance Requirements:
Organizations may need to collaborate with labor councils or unions to establish internal whistleblower procedures and external channels.

Key Obligations for Company Leaders:

• Provide written and telephonic reporting channels.
• Educate staff about whistleblower rights and protections.
• Ensure GDPR compliance in handling personal data.
• Securely store reports for future evidence.
• Acknowledge report receipt within seven days.
• Update whistleblowers about actions taken within three months.

Remember, while these guidelines apply EU-wide, specific penalties and scope vary by Member State.

Differences Among EU Member States:
The Directive sets a baseline, with Member States potentially imposing stricter guidelines. For example:

• Countries like Germany, Spain, and Sweden may have broader criteria for reportable matters.
• Sanctions for obstructing reports, breaching confidentiality, or retaliating against whistleblowers differ across Member States.

As a leader, it’s crucial to understand these nuances, especially if your business operates in multiple EU countries, as this could impact your risk and responsibility profile.