Bracing for the Whistleblowing Directive

The whistleblowing rules in Europe are about to change dramatically. The new Directive on the protection of persons who report breaches of Union law (generally referred to as the "Whistleblowing Directive") will require Member States to create rules mandating that organizations set up whistleblowing management systems covering violations of the EU law.

The member states need to implement the Whistleblowing Directive into their local laws over the next year, which will certainly mean some differences from country to country and the whistleblowing rules in the EU will remain segmented, although the Whistleblowing Directive sets some minimum standards.

Organizations in private and public sectors will need to comply with the Directive's rules and implement their whistleblowing management system. The Directive will apply to all legal entities in the private sector with 50 or more employees and to the public sector regardless of its number of employees.

Private sector organizations with 250 or more employees will need to comply with the new rules by December 17, 2021. The same deadline is in place for the public sector. Organizations with 50 to 249 employees in the private sector have an additional two years – until December 17, 2023 – to become compliant.

Implementing a whistleblowing system never means just a reporting-system or platform. It always includes, at the absolute minimum, policies for reporting and rules on internal investigations. Once a whistleblowing system is implemented, training for the employees is critical. If this is taken seriously (with organizations wanting to make the whistleblowing system work), a proper internal communication campaign is also necessary.

This is not an easy task, especially in larger organizations, or in smaller-but-less-developed ones.

Preparations will require significant resources of all kinds, even in those entities where a whistleblowing management system is already in place. The essential questions to be raised are the following:

• Does the organization have competent resources to receive and respond to reports in line with the Directive?
• Does the organization have access to experts that can help with investigations?
• The Whistleblower Directive places strict demands on internal reporting procedures, and any whistleblowing system should support these internal reporting rules. Does the organization system live up to the requirements?
• Does the organization’s system allow for a whistleblower's identity to remain confidential?
• Can the organization’s system handle a potential increase in the number of reports received? Is it easy to access and use?

For other entities that currently do not have a whistleblowing management system, the questions might be different. Smaller organizations affected by the Whistleblowing Directive might not want to establish a new, specifically designed in-house system for their companies’ needs, but instead choose a “ready-to-use solution” with features that comply with the new Directive, which would be a more cost-effective option for them. They also might consider outsourcing their entire compliance function, and the investigations. The Whistleblowing Directive supports these solutions.

Once an organization successfully implements a whistleblowing management system, it is critical to encourage internal reporting as fast as possible. This will develop the organizations' compliance culture sooner – and a developed whistleblowing management system is a key pillar of the entire compliance management system. A proper whistleblowing management system will show employees and others that the organization is open to whistleblowing and values whistleblowing information, and that its leaders are committed to listening to and acting on reports they receive. 

Ensuring anonymity and whistleblowers’ protection are the basis of a whistleblowing management system, but afterward, any received complaints must be investigated. Without a proper and professional investigation, a compliance culture will not be built, and the trust in the whistleblowing management system will be destroyed.

Legal and compliance professionals often find it extremely difficult to conduct such investigations. They require specific tools, skills, resources, etc. The confidential nature of these cases makes it even more difficult.

A resource I would personally recommend is that of the Association of Corporate Investigators, a not-for-profit association established to support corporate investigation professionals through training, networking opportunities, and a centralized resource database for its members.

This article was published in issue 1.2 of CEE In-House Matters. The full edition is available here in pdf format, here in e-reader format, and here in electronic format.