Julia Arbery (jarbery@stoneturn.com), based in Frankfurt, Germany, and Lisa Van Houten (lvanhouten@stoneturn.com), based in Chicago, Illinois, USA, are managing directors with global advisory firm StoneTurn.
The Panama Papers, the FIFA scandal, Cambridge Analytica, WikiLeaks—these are all well-known examples of whistleblower cases in the United States, where whistleblowing is an accepted and even encouraged practice due to the stringent laws that provide a safe harbor for reporting wrongdoing, both within an organization and to public authorities, regardless of anonymity. While Americans have had some sort of avenue to safely and anonymously voice concerns about corporate misgivings since the civil war,[1] whistleblowers have been much less common in the European Union (EU). In the absence of EU incentives for speaking out against corporate wrongdoing, corporate scandals and fraudulent activities were far less likely to be brought to light in the court of public opinion. In fact, according to the 2017 European Commission[2] poll on corruption, “81 percent of respondents said they did not report the corruption they had experienced or witnessed because they did not believe they had adequate protection. Similarly, 85 percent of respondents believed workers ‘very rarely’ or ‘rarely’ report concerns about threat or harm to the public interest due to fear of reprisals.” That is, until recently.
In April of 2019,[3] the European Parliament voted to overhaul whistleblower regulations and standardize protections across its 27 member countries against retaliation for speaking out. On October 7, 2019, EU ministers formally approved the new law requiring all member countries to implement the new directive within the next two years. The passage of this legislation presents a significant change for companies operating in the EU, as they will now need to thoroughly evaluate and enhance compliance policies and procedures to ensure these heightened standards are being met. To help companies get started, we provide an overview of the minimum standards set by the new whistleblower directive in the EU and best practices for companies and compliance professionals to consider as they navigate and implement these new standards in accordance with the local laws based on the new directive.
The need for change: Previous whistleblower regulations in the EU
Generally, speaking up on observed potential misconduct is a highly useful tool for the detection of breaches of the law, and it helps protect the public from wrongdoing in the business and government sectors. Yet, in Europe, whistleblowing has historically not been a part of the moral fabric of corporate culture; in fact, both the practice and the term have a negative connotation. It is less commonplace primarily because the regulatory framework in Europe is different. Furthermore, there is an absence of robust policies and procedures, training, and communication around concepts such as anti-retaliation, confidential reporting, speak-up cultures, and decreasing hierarchies within EU organizations, so people simply don’t know how to safely voice these types of concerns. There is an aversion to reporting on others in the EU, as it is a call back to past political situations where people were persecuted based on rumors and others’ denouncing of individuals. Additionally, many European jurisdictions have a difficult history wherein individuals were often prosecuted on hearsay.
There is also tension between the EU’s General Data Protection Regulation (GDPR) and whistleblower protection. For example, in a recent German matter, an individual who had been terminated asked to receive information about the person who reported the wrongdoing that resulted in his dismissal. To protect the whistleblower, the company initially refused to identify the individual citing confidentiality.
According to Section 15.1 of the GDPR, individuals may have the right to this information and can submit a subject data request without special reasons, indications, or triggers for this claim. It is then up to the organization maintaining the data to fulfill the two-stage right to information. The company has the right to refuse to provide the data requested if the claim submitted is either being used to abuse the rights of the data subject or if granting the request would impair the rights or freedoms of third parties. This may result in the need to protect the whistleblower, which would be determined on a case-by-case basis.
In this recent German matter, the local court granted the individual the right to the data, which indicated he would also receive information on who blew the whistle. According to the court, the threshold of third-party rights had not yet been reached as there is no right to anonymity. This lower court decision can still be challenged by a higher court, and the new EU whistleblower directive may lead to local laws that dictate how to proceed when there are conflicting interests (i.e., data protection, right to information, and whistleblower protection), which remains an open-ended question.
Ultimately, despite the fact that it doesn’t happen regularly in the EU, there are instances in which whistleblowing is the best or only course of action to alert corporate leadership and/or the public about malfeasance. Yet the laws that protect individuals against retaliation such as dismissal or a demotion were formerly disparate across the EU and typically only applied to specific sectors, such as financial services or categories of employees. In fact, of the 27 countries represented under the EU, only 9—France, Hungary, Ireland, Italy, Lithuania, Malta, the Netherlands, Slovakia, and Sweden—had laws in place that effectively protected whistleblowers.
Given that protections for whistleblowers across the EU are so fragmented, it’s no surprise that 96% of individual respondents to the Commission’s 2017 poll and 84% of organizations were supportive of the proposal to establish legally binding minimum standards on whistleblowing protection in EU law or that the new directive was approved by the European Union council of ministers in October of 2019.
