The Directive’s robust prohibitions against retaliation for covered persons—including both attempts and threats— is meticulously outlined in Article 19. Among other things, Article 19 broadly prohibits retaliation in the following forms:

Suspension, lay-off, dismissal or equivalent measures

Demotion or withholding of promotion

Transfer of duties, change of location of place of work, reduction in wages or change in working hours

Withholding of training

Negative performance assessment or employment reference

Imposition/administration of any disciplinary measure, reprimand or other penalty (including a financial penalty)

Coercion, intimidation, harassment or ostracism

Discrimination, disadvantageous or unfair treatment

Failure to convert a temporary employment contract into a permanent one, where the worker had a legitimate expectation that he or she would be offered permanent employment

Failure to renew (or early termination of) a temporary employment contract

Harm to one’s reputation (particularly in social media) or financial loss, including loss of business and income

Blacklisting on the basis of a sector or industry-wide informal or formal agreement

Early termination or cancellation of a contract for goods or services

Cancellation of a license or permit; and

Psychiatric or medical referrals[1]

Pursuant to Article 20 of the Directive, member states are also obliged to offer support for whistleblowers in the form of: (1) comprehensive information and advice that is easily accessible to the public and free of charge; (2) effective assistance before any relevant authority involved in the protection of the person from retaliation; and (3) legal aid in both criminal and cross-border civil proceedings in accordance with other EU directives and the national law of member states.[2] 

Reporting persons enjoy significant legal protections by virtue of Article 21 of the Directive, which among other things, immunizes from civil liability persons who report information on breaches in derogation of any restriction on disclosure of information, provided reasonable grounds exist to believe such reporting was necessary.[3] Indeed, in the context of an Article 21(5) proceeding before a court or other authority where the whistleblower is alleged to have been subjected to retribution, the Directive creates a rebuttable presumption that the detriment was made in retaliation for the report or public disclosure. According to Article 21(5), the burden shifts to the “person who has taken the [retaliatory] measure to prove that [it] was based on duly justified grounds.” The inclusion of this important protection in the Directive makes it all the more imperative that organizations avoid taking any adverse action in relation to a whistleblower, including any perceived actions that could rise to the level of retaliation. Any employment decisions involving a covered person under the Directive must be carefully scrutinized in conjunction with competent counsel.

To safeguard the protections afforded to whistleblowers elsewhere in the Directive, Article 23 instructs member states to provide for “effective, proportionate and dissuasive penalties”[4] applicable to both natural and legal persons alike. Penalties may be assessed by competent authorities for: (1) hindering or attempting to hinder reporting; (2) retaliating against a protected person in derogation of Article 4; (3) bringing “vexatious proceedings” against persons referred to in Article 4; and (4) breaching the duty of confidentiality concerning the identity of reporting persons.[5] Finally, Article 24 nullifies any attempt to waive or limit the rights and remedies afforded by the Directive to reporting persons by means of any contract, including as a condition of employment or in the context of a pre-dispute arbitration agreement.

Beyond generally familiarizing themselves with the Directive’s new requirements, those in the ethics and compliance functions of organizations operating in the internal market of the EU should be attuned to emerging legislative developments in individual member states, as the deadline for transposition into national law approaches in December 2021. Because the Directive establishes a minimum level of protection for those who report breaches of EU law,[6] it is conceivable that some states will choose to enhance the protections contained in the Directive. Therefore, familiarity with the particular requirements adopted by EU member states is critical to ensuring that organizations remain fully compliant with their obligations in the whistleblower protection space.

---

[1] Directive 2019/1937, Article 19(a)-(o), 2019 O.J. (L 305) 17, 43.

[2] Id. at Article 20(1)(a)-(c).

[3] Directive 2019/1937, Article 21(2), 2019 O.J. (L 305) 17, 44.

[4] Directive 2019/1937, Article 23(1), 2019 O.J. (L 305) 17, 45.

[5] Id. at Article 23(1)(a)-(d).

[6] Id. at Article 25(1).