At the end of last year new legislation was brought in to implement The Whistleblower Directive (2019/1937) (the Directive). Within the remaining 27 EU member states, companies and public bodies with 250 or more employees must implement an internal reporting system. Despite the UK no longer being an EU state, there could still be a significant impact on UK businesses, as Peter Nicholson, legal director and solicitor specialising in employment law at Nelsons, discusses.
Previous whistleblower protection across EU member states has been described as ‘fragmented’ and ‘uneven’. Therefore, the core purpose of the new Directive is to lay ‘common minimum standards providing for a high level of protection of persons reporting breaches of Union law’ according to article one.
Much of the Directive’s content is already reflected in the UK, as The European Commission recognises the comprehensive protection to whistleblowers under the Public Interest Disclosure Act 1998, as incorporated into the Employment Rights Act 1996. However, there are still some key differences.
Scope
The Directive goes further than UK law. Whereas the latter protects just employees and workers, the Directive covers self-employed people, shareholders and board members, including non-executive directors, as well as ‘facilitators’, such as colleagues and relatives, and legal entities associated with the whistleblower. This could mean that a whistleblower’s employer, such as an external supplier, would have legal rights against another company if, for example, the company denied its services or boycotted it because of the actions of the whistleblower.
Protection under the Directive relates to breaches of EU law that fall within certain sectors, such as procurement, financial services, transport and public health. By contrast, protection under UK law focuses on categories of wrongdoing, or ‘relevant failures’ such as criminal offences, failure to comply with legal obligations and danger to health and safety.
When it comes to whether a particular disclosure is protected, the Directive is consistent with UK law. However, while UK law focuses on the subjective belief of the whistleblower, the test under the Directive is more of an objective one focusing on ‘reasonable grounds’ to believe there was a basis to make a protected disclosure.
Under UK law, a disclosure must, in the reasonable belief of the worker, be made in the public interest to be protected. By contrast, there is no express public interest requirement set down in the Directive. Recital 22, however, gives member states the scope to exclude ‘reports concerning interpersonal grievances exclusively affecting the reporting person, namely grievances about interpersonal conflicts between the reporting person and another worker’, from the scope of protection.
Reporting
While UK law is focused on preventing the mistreatment of whistleblowers, the Directive sets out a mechanism to facilitate and support the process of whistleblowing in the first place.
The Directive requires private sector organisations with 50 or more employees to create internal reporting channels. For organisations with 250 or more employees, the reporting channels requirement will be triggered on 17 December 2021, whereas those with 50 to 249 employees will have an additional two years to introduce suitable processes.
Save for certain requirements that apply to regulated financial services businesses, there is no general obligation under UK law for employers to establish internal reporting channels or, for that matter, have a whistleblowing policy in place – although, it is strongly encouraged that an employer does both.
Feedback
The Directive prescribes deadlines that employers must follow. Namely, a disclosure must be acknowledged within seven days and ‘meaningful’ feedback provided within a reasonable timeframe, not exceeding three months.
It states ‘informing, as far as legally possible and in the comprehensive way possible, the reporting person about the follow-up to the report is crucial for building trust in the effectiveness of the overall system of whistleblower protection…’ and that ‘the reporting person should be informed […] about the action envisaged or taken as follow-up to the report and grounds for the choice of that follow-up.’
It’s worth bearing in mind that there is no equivalent requirement under UK law for an employer to provide feedback to a whistleblower.
Confidentiality
According to article 16, except where it is necessary and proportionate in the context of investigations, a whistleblower’s identity must not be disclosed to anyone other than the authorised staff members dealing with the report without the whistleblower’s explicit consent. UK legislation does not impose an equivalent obligation, although a duty of confidentiality has developed through case law.
Record keeping
Article 18 of the Directive sets out a detailed record keeping requirement. Again, there is no equivalent obligation under UK law, although employers tend to keep records of concerns raised by employees with HR files. Where such records are maintained, they should be in accordance with data protection principles.
UK business impact
Any employer based outside the EU that operates inside the EU will find itself subject to the Directive (or rather the implementing legislation of the member state(s) within which it operates).
In addition, the EU-UK Trade and Co-operation Agreement, which entered into force on 1 May 2021, contains wide-ranging level playing provisions pursuant to which both sides agreed to continue to strive to increase their respective labour and social level of protection.
Lastly, from a practical perspective, some UK businesses may feel the need to ‘ramp-up’ their whistleblowing policies and procedures to meet the provisions of the Directive. This could be out of concern about being seen to offer a significantly lower level of support and protection to employees, which could then have adverse implications in terms of trading, international procurement and investment decisions by EU business.
Moreover, for reasons of consistency and best practice, some international businesses will wish to maintain a single, unified whistleblowing framework across the various countries in which they operate.
