Directive 2019/1937 – A Step Towards a More Effective Whistleblower Protection
SÉRVULO PUBLICATIONS 11 Dec 2019
The role of whistleblowers in modern society has been of utmost importance in revealing some the largest scandals of our days. In a time where whistleblowing protection is also being discussed in Portugal, experiences of other member States and cases such as “LuxLeaks”, “Panama Papers” or “Cambridge Analytica” demonstrate the importance of reporting illegal practices and of establishing institutionalized mechanisms to protect whistleblowers from retaliations. The European model, whether we like it or not, and our societies are built upon a growing number of reports and public divulgation that «feed national and Union enforcement systems with information, leading to effective detection, investigation and prosecution of breaches of Union law, thus enhancing transparency and accountability».
These words are motivated by the entry into force in the EU legal order, on 16 December, of Directive (EU) 2019/1937 of the European Parliament and of the Council of 23 October 2019 on the protection of persons who report breaches of Union law. SÉRVULO had previously commented on the legislative procedure of the Directive.
The Directive aims at ensuring a minimum standard of protection for whistleblowers. It has a general scope, covering almost all areas of EU competence, including the internal market, public procurement, public health, protection of the environment, consumer protection, transport safety, product safety and privacy and data protection. It also covers areas where there is already an European legal instrument that protects whistleblowers, such has the leniency program in competition law (Regulation 773/2004, article 4.º-A; and Directive 2019/1) and the instruments in the areas of financial services, European public administration and prevention of money laundering and terrorist financing. In these areas, the Directive is only applicable where it does not contradict said instruments.
The Directive prescribes three different manners through which a report can be made: internal reporting, external reporting and public disclosures.
Internal reporting is the preferential form through which reports can be made and it falls on public and private entities to implement it. It is up to them to establish the means and procedures through which reports can be made and acted upon. Private entities with under 50 workers are exempted from the obligation to create internal reporting schemes, if no other EU legal instrument provides for their existence. Member States can also defer the application of the Directive for private entities with less than 250 workers up to 2023. In the public sector, the obligation to establish means for internal reporting is applicable to all entities, independently of their number of workers, although member States can exempt municipalities with less than 10.000 inhabitants and public entities with less than 50 workers.
The mechanisms to be implemented include, namely, (i) channels for receiving the reports (in writing, orally or both) and acknowledgment of receipt; (ii) an impartial service competent for following up on reports; (iii) a reasonable timeframe to give feedback regarding the report, which cannot exceed 3 months. The entities must ensure that the identity of the whistleblower is only known to authorized personnel and that they possess a record of all reports made under the Directive.
For whistleblowers, the Directive means access to a large acquis of rights which includes the right not to suffer any retaliation for the report. With regards to this right we must emphasize that, whenever a report is made under the Directive, the whistleblower cannot be held liable for any breach of a non-disclosure clause. Also, he cannot be held liable for any infringement which does not constitute a crime with regards to access to information needed for the report. The Directive also prescribes that, whenever there is a litigation regarding a detriment suffered by the whistleblower, the person who adopted the detrimental measure must prove that the measure was based on duly justified grounds, reversing the burden of proof. The whistleblower can also benefit from a series of support measures and his rights cannot be limited or waived, even by a pre-dispute arbitration agreement.
Regarding the persons concerned in the report, the Directive establishes that Member States must ensure, and it could not be otherwise, the right to an effective remedy and a fair trial, the presumption of innocence and their rights of defense. The persons concerned also benefit from the protection given to whistleblowers with regards to the confidentiality of their identity.
In this new culture of responsibility but also of reporting and mutual vigilance, challenges are tremendous. Even though member States have two years to implement the Directive (17 December 2021), the structural changes it imposes cannot be accomplished in a small period of time. Private and public entities alike must begin to work towards implementing the changes prescribed in the Directive and promote compliance internally. It is expected that the Portuguese State will promote a large public debate, involving several stakeholders, in order to ensure an adequate implementation of this Directive.
Miguel Gorjão-Henriques
mgh@servulo.com
Francisco Marques de Azevedo
fma@servulo.com
