On 26 November 2019, Directive (EU) 2019/1937 of 23 October 2019, on the protection of persons who report breaches of Union law, also known as, the "Whistleblowing Directive", was published.
This new Directive will ensure that whistleblowers can internally report and denounce to public authorities, through channels that guarantee their safety, any breach of European legislation that occurs within an organisation. Among the areas covered by the new Directive, it is remarkable the public procurement, money laundering, public health, transport safety, environmental protection or competition.
Its implementation seeks to reduce the unfair and even insufficient protection of whistleblowers from infringements among the Member States from two different perspectives:
On the one hand, the Directive may ease the appearance of "whistleblowers" by the compulsory implementation of internal reporting channels in all legal entities of the public sector, as well as those that operate in the financial sector or are subject to money laundering and terrorist financing prevention regulations and those with more than 50 employees within the private sector.
Likewise, member States must assign competent authorities to act as an external reporting channel. These authorities will simultaneously serve as a complement and as an alternative to the internal reporting channels of legal entities.
Both internal and external reporting channels must maintain the confidentiality of the complainant, as well as of the other facilitators (of information) and third parties associated to it. The definition of a whistleblower under the scope of protection of the Directive includes employees, people with a position of economic vulnerability in the company, contractors and suppliers, among others.
This regulation takes into account the public disclosure of violations in cases of ineffectiveness or risk of retaliations in using either of the reporting channels.
On the other hand, a series of protective measures are established for retaliations against whistleblowers. However, in the case of non-compliance with the protective measures, the Directive does not take into account the penalty system, but rather it is delegated to the internal legislation of the Member States, under the premise that these sanctions are effective, proportionate and dissuasive.
The Member States must implement the provisions of the Directive on 17 December 2021, with the exception of the internal reporting channels of private entities that have between 50 and 249 employees, which will have a 2-year term. With the full implementation of the regulation, the European Union aims to make significant progress in the fight against corruption and crime.