Rebecca Walker (rwalker@kaplanwalker.com) is a partner in the law firm of Kaplan & Walker LLP, based in Santa Monica, California, and Princeton, New Jersey, USA.
Reporting and investigations systems are critically important components of a compliance and ethics program. Indeed, according to the U.S. Department of Justice and the Securities and Exchange Commission, “The truest measure of an effective compliance program is how it responds to misconduct.”[1] Whether an organization’s response to misconduct is the truest measure of an effective compliance program is subject to debate. However, it is beyond doubt that robust systems to encourage reporting and to investigate allegations are essential to an effective program. They are also highly probative of a company’s commitment to compliance.
The European Union (EU) Directive 2019/1937 (Whistleblower Directive), which is required to be transposed into national law by EU member states by December 17, 2021, highlights not just the importance of protecting whistleblowers from retaliation, but also places a spotlight on robust reporting and investigations. For any organization, these developments present an excellent opportunity to review reporting and investigations procedures, consider relevant standards and best practices, and make appropriate enhancements.
The EU Whistleblower Directive
The Whistleblower Directive on the protection of persons who report breaches of Union law, which was adopted by the European Parliament on October 7, 2019, applies to all companies that operate in the EU with 50 or more employees (and to municipalities that serve 10,000 or more people). Companies with 250 or more employees must comply with the directive beginning December 17, 2021. Businesses with between 50 and 249 workers have two additional years, with a deadline of December 17, 2023, for compliance.
The directive provides protection against retaliation for those who report alleged violations of EU law in a work-related context, including current, former, and prospective employees; contractors; unpaid trainees; volunteers; and even those who facilitated reporting, such as colleagues and relatives. This protection includes requirements (1) for companies to create internal reporting channels and (2) regarding how companies must respond to reports received. The directive encourages internal reporting, providing that member states “shall encourage reporting through internal reporting channels before reporting through external reporting channels, where the breach can be addressed effectively internally and where the reporting person considers that there is no risk of retaliation.”[2]
The directive is focused on reports of violations of EU law and specifies those categories of violations that must be within the scope of protection. They include public procurement, financial services, anti-money laundering and terrorist financing, product safety, transport safety, environmental protection, food safety, privacy, cybersecurity, and other topics.
While the directive sets out minimal standards for member states, it also expressly provides that member states can adopt more rigorous whistleblower protections.
