The European Union Whistleblower Protection Directive imposes a broad set of requirements – to Member States and EU companies.  At the heart of the EU’s concern is to ensure that no employee (or business partner) should risk their job as a result of exposing corporate wrongdoing.

Three-Tier Reporting System

The EU Directive establishes a three-tiered reporting system.  Tier-1 applies to corporate internal reporting systems; Tier-2 applies to government authorities; and Tier-3 reporting applies to public disclosure.  Companies have to afford whistleblowers a “free choice” of reporting initially to government authorities without being required to report internally to the company.  The EU’s policy is contrary to the SEC whistleblower reporting system which creates an incentive for whistleblowers to report initially to a company and wait for 120 days before reporting to government regulators and prosecutors.

Confidential reporting requires companies to restrict disclosure of information about the reporter’s identity and the substance of the report.  While the EU Directive does not mandate an anonymous reporting system, most companies will adopt such a system. A whistleblower will likely have the choice of whether to disclose his or her identity.

Companies will have a duty to provide initial feedback within seven (7) days and status reports within three (3) months (with the possibility of an extension to six (6) months).  To investigate these matters, companies have to assign case managers who are competent, diligent and impartial.  Such investigations have to be fully documented so that employees, business partners and government regulators understand the whistleblowing program.

Companies can still encourage internal reporting but they have to walk a fine line to avoid discouraging Tier-2 direct reports to government regulation.  This balancing act will require inclusive messaging to remind employees that they always have the right to report initially to the government.

Retaliation Burden of Proof

The EU Directive upends the normal burden of proof applicable to whistleblowing claims of retaliation.  Whistleblowers often have difficulty proving that any change in his/her working status or conditions was the direct result of reporting a claim.  Under the EU Directive, the whistleblower’s change in status will be presumed in retaliation for his/her claim if the employer is unable to provide proof that the whistleblower’s change in status was independent of any connection to the whistleblower’s report.

This burden of proof may create incentives for whistleblowers to threaten to raise allegations when faced with adverse employment actions.  However, a whistleblower has to have reasonable grounds to raise an allegation of wrongdoing.  The tension created by these legal principles will be a difficult issue for companies to navigate. 

Implementation Challenges

In the face of the requirements imposed by the EU Whistleblower Directive, companies need to begin building the elements of a compliant program.  To do so, companies have to plan an end-to-end system by establishing reporting systems, promoting the availability of the reporting system, creating a system to triage and assign investigators to handle a complaint, managing investigations, providing feedback and status reports to whistleblowers, and organizing documents and internal management procedures. 

Companies should assess their existing whistleblower and case management systems and identify priority projects to meet the requirements of the EU Whistleblower Directive.  Companies have to evaluate employee reporting system solutions and begin the planning process with the vendor.  Reporting system vendors will have to enhance their programs to meet EU Directive requirements.

To implement the system internally, companies have to design and implement new policies and procedures to explain system improvements, publicize the changes and ensure that employees are fully aware of the new system.