New High-Level Protections Have Been Proposed in the EU… How Will They Impact Your Organization?
“Recent scandals such as Dieselgate, Luxleaks, the Panama Papers and the Cambridge Analytica revelations show that whistle-blowers can play an important role in uncovering unlawful activities that damage the public interest and the welfare of our citizens and society”
Whistleblower protection: European Commission sets new, EU-wide rules – Press release, April 2018
That’s the introduction to a press release from the European Commission, which proposes new regulations and details the importance of whistleblower protections. Under the new proposed Whistleblowing Directive (‘the Directive’), employees who speak up about corporate violations of certain EU laws would be guaranteed a “high level of protection”. These new EU-wide standards would be implemented in 2019.
The proposed Directive is a logical consequence of recent high-profile scandals, where major corporate misbehavior was uncovered by whistleblowers.
Who will be impacted by the proposed whistleblower Directive?
The Directive will introduce an obligation on all organizations, both public and private, with 50 or more employees or with an annual turnover or total assets of more than €10M, to set up internal processes for reporting and whistleblowing.
However, all Financial Services companies and organizations where there is a risk of money laundering or terrorist financing will have to comply.
The Commission also envisions providing specific protections against retaliation that will apply to all employers. Small and micro organizations will be exempt from many of the requirements, including establishing internal reporting channels (more on that later.)
The proposed EU whistleblowing Directive, in summary
Currently, whistleblowing laws and protections vary amongst EU Member States. Some have comprehensive laws, others have legislation that only applies to specific industries or offenses.
The recent Directive aims to change this by establishing EU-wide whistleblowing standards.
The protection of privacy and personal data are also addressed, which isn’t surprising. It’s a trend we’ve seen throughout 2018. Some of the whistleblowing rules in this new Directive even have a direct link to the requirements of the General Data Protection Regulation (GDPR). If a company has prepared for the GDPR, they’ll have an advantage when these new guidelines come into play.
Three-tier reporting system: Reporting mechanisms and channels for whistleblowers
The Directive also proposes a new, three-tier reporting process for organizations to follow:
Tier 1: Internal reporting within organizations
Internal reporting is the first channel that employees should use. Remember: The benefits of employees being comfortable and confident in using an internal whistleblower hotline cannot be underestimated.
If the whistleblower feels internal reporting would be ineffective or jeopardize further investigations, they can choose the next tier.
(To avoid this hotline-related problem, and others, I highly recommend exploring Convercent’s Helpline solutions.)
Tier 2: External reporting to the competent and relevant national authorities
External reporting to authorities is intended to deal with situations where internal channels are ineffective or nonexistent.
Micro and small organizations (companies with less than 50 employees) aren’t formally required to establish internal reporting channels. In the absence of adequate reporting channels, these employees can report directly to national or EU authorities.
Tier 3: External public/media reporting
As a very last resort, a whistleblower can disclose information directly to the public via social media or web platforms, or directly to the media.
But, this is only an option when the first two channels do not exist or function poorly.
Meeting the requirement of whistleblower protection & anti-retaliation measures
The new Whistleblowing Directive also mandates protection of whistleblowers.
The definition of a whistleblower in the proposed legislation is widely drafted. Organizations will need processes in place to manage reports not only from employees, but also a potentially wide range of other parties, including shareholders, contractors and volunteers.
How does the Directive handle retaliation?
The burden will be on the employer to demonstrate that their action, like a change of role, was not retaliatory.
When retaliation can be proven, the whistleblower will be entitled to remedies to prevent workplace harassment or dismissal, and also access to free advice.
Given these requirements, it is essential that organizations have anti-retaliatory measures in place. That includes a written policy, which must be consistently enforced, and data-backed evidence of effectiveness.
Will the Directive apply to the UK, even post-Brexit?
With so many recent scandals, organizations shouldn’t underestimate the EU’s determination to achieve greater transparency and accountability in business operation.
And, as we saw with the GDPR, consumers are now demanding transparency and accountability more than ever. Transparency and accountability will likely be essential to any trade deal between the UK and the EU.
With that in mind, I expect the Directive will have relevance and applicability to the UK, even post-Brexit.
To prepare, companies should assess their hotline system
Put simply, organizations need to take an objective view of their whistleblowing obligations, capabilities and performance. Those with established whistleblower hotlines, coupled with effective anti-retaliation processes, will not only be compliant but also demonstrably compliant when these new obligations reach the statute books.
While many questions remain unanswered, EU-wide whistleblowing legislation is coming. Organizations already operating in line with those standards will clearly find it easier to comply.
But, if your company will be affected and you aren’t prepared for the challenges, it would be wise to use this interim time to prepare.
Additional whistleblowing resources
As your organization prepares for the new Whistleblowing Directive, use these resources to make the case for a proactive approach to managing whistleblowing: