Implementation of EU Directive on Whistleblowing 2019/1931 (Part I of II)

by Daniela Melendez · March 27, 2024

By: Daniela Melendez, Associate at The Volkov Law Group and Alex Cotoia, Regulatory Compliance Manager at The Volkov Law Group

Since its enactment in 2019, the European Union (“EU”) Directive on Whistleblowing 2019/1931 (“EU Directive”) has required all 27 EU Member States to incorporate certain requirements pertaining to the protection of whistleblowers into their own bodies of national law. The EU Directive alloted 2 years from December 17, 2021 for this express purpose. As shown below (see Table 1, below), only the nations of Poland and Estonia have not yet adopted legislation incorporating the EU Directive requirements into domestic law—a delay that could lead to sanctions for infringement.

Generally speaking, the EU Directive obligates Member States to require employers to set up both internal and external reporting channels. The EU Directive also includes simplifications for employers with generally no more than 249 employees and allows these groups of employers to share whistleblower channels in the same country, where they can operate a joint internal reporting office or jointly contract with an external third party (save for the Netherlands). As shown below, some Member States have extended the scope of reportable matters, covering more than breaches of EU law. The EU Directive further stipulates that whistleblowers are protected against all forms of reprisals, including but not limited to, omission from a salary increase and termination of employment. Finally, a sizable number of EU Member States have fixed fines for violations of these new provisions.

During the 2 year period since the EU Directive entered into force, Member States have faced considerable challenges in codifying its provisions into their respective bodies of national law. For instance, the governments of Greece, Hungary and Italy were notably criticized for enacting whistleblower laws without involving relevant stakeholders or ignoring altogether recommendations made by civil society organizations. This is in strong contrast to countries like France or Ireland, where very robust whistleblower protection laws were ultimately adopted, which includes financial incentives for whistleblowers and robust protection from multiple forms of retaliation.

Although they have transposed EU Directive into legislation, a number of Member States do not yet fully comply with minimum standards imposed by the EU Directive, such as the right of the whistleblower to report information directly to the authorities, full access to remedies in an appropriate judicial forum, compensation for damage suffered, the opportunity to obtain free and easily accessible legal advice, and the adoption of penalties for those violating the EU Directive’s proscriptions.

TABLE 1

EU DIRECTIVE IMPLEMENTATION TRACKER

Member State	Status	Remarks
Austria	Law adopted	Austria transposed the EU Directive into national law in February 2023. Kristof Wabl, Head of the national Whistleblowing Working Group mentioned: “The unique opportunity to finally bring about a change in mentality in Austria and to grant whistleblowers the long overdue protection is being wasted with this draft law.”
Belgium	Law adopted	A bill from the French speaking community and Wallonia Region was adopted. Most of the regions of Belgium are covered by transposition laws.
Bulgaria	Law adopted	In Bulgaria, it is concerning the lack of adoption of secondary legislations and its inconsistencies.
Croatia	Law adopted	The whistleblower protection law was challenged by journalists and it was subsequently amended to exempt journalists from liability where there was an overriding public interest.
Cyprus	Law adopted	Adopted January 2022. Most recently, the commissioner of legislation published explanatory guidelines on whistleblower protection to support the implementation of the new legislation.
Czechia	Law adopted	The whistleblowing law was adopted and subsequently one of its first whistleblowing cases implicated both the Ministry of Finance and the Ministry of Transport.
Denmark	Law adopted	Notably, Denmark was the first Member State to codify the EU Directive’s whistleblower protection requirements into national law.
Estonia	Delayed	A draft law is still being debated.
Finland	Law adopted	In December 2022, the Finnish Parliament approved the Whistleblowing Law. Finland was the 20th country since the enactment of the Directive to codify its requirements into its own body of law.
France	Law adopted	In October 2022, new whistleblower protections were adopted in line with the EU Directive’s requirements. In addition, France adopted new rules to provide financial support to whistleblowers.
Germany	Law adopted	The German whistleblowing law was adopted in May 2023. However, in September 2023, a German NGO filed a complaint with the European Commision against Germany alleging that the Whistleblower Protection Act was in breach of the EU Directive.
Greece	Law adopted	Greece was the 11th country to transpose the EU Directive into national law. Nonetheless, critics have argued that the law was passed without the input of relevant stakeholders and therefore, that the law “falls short” of the EU Directive’s requirements. Military associations have argued that the law does not provide further protection to whistleblowers serving in the armed forces, which impedes the ability of those alleging sexual harassment to come forward with such allegations.
Hungary	Law adopted	Adopted November 2022. As was the case in Greece, the law in Hungary was criticized by being passed without appropriate consultation with relevant stakeholders. More particularly, critics have said that the law does not provide adequate minimum protection for whistleblowers nor meaningful financial support to whistleblowers facing retaliation.
Ireland	Law adopted	The new whistleblower protection law entered force in January 2023. In July 2023, the legislation was amended following a series of objections raised by the European Commission. Additionally, in November 2023, the government published guidance to support public bodies in understanding their new obligations under the whistleblower law.
Italy	Law adopted	Italy’s whistleblower protection law was adopted in March 2023. Nonetheless, Transparency International’s Whistleblower Protection lead in Italy mentioned that “[t]he legislative process of this law was not transparent nor inclusive as the Legislature did not have a consultation with civil society organizations or practitioners, and the final text reflects this.” In July 2023, Italy’s national whistleblowing authority released guidelines on how to handle whistleblower reports. In the same month, the whistleblowing authority launched a reporting platform designed to receive reports of breaches.
Latvia	Law adopted	The whistleblower protection law was adopted in January 2022 and its protections were expanded beyond mere violations of EU law.
Lithuania	Law adopted	The whistleblower protection law was adopted in December 2021. However, the European Commission initiated infringement proceedings against Lithuania for failing to enact a national law that satisfies the EU Directive’s minimum requirements.
Luxembourg	Law adopted	Luxembourg’s whistleblower protection law was enacted in May 2023. In October 2023, the government published an overview of the country’s new whistleblowing framework. Under the law, a new reporting office was created under the Minister of Justice.
Malta	Law adopted	Malta’s whistleblower protection law was adopted in December 2021.
Poland	Delayed	In January 2024, the Polish government announced its intention to commence the transposition of the EU Directive’s requirements into its own body of law.
Portugal	Law adopted	In November 2021, the whistleblower protection law was enacted. The law created new institutional whistleblowing channels and includes a robust prohibition barring any form of retaliation. Nonetheless, critics have pointed out that lawmakers disregarded the recommendations of stakeholders and civil society organizations in passing the law.
Romania	Law adopted	The national whistleblower protection law entered force in December 2022. In March 2023, a law to amend the original whistleblower protection law was enacted. Significantly, the law relaxes the requirements with regard to anonymous whistleblower reports, which were considered by some as being too strict.
Slovakia	Law adopted	In May 2023, the whistleblower protection law was adopted, although amendments to the original law were under consideration by the Slovakian government. In light of concerns raised by relevant stakeholders that the proposed amendments would make reporting more burdensome, the Slovakian government announced its intention to abandon the amendment effort altogether.
Slovenia	Law adopted	In February 2023, the whistleblowing law was enacted. Slovenia was the 19th country to adopt legislation to implement the EU Directive’s requirements.
Spain	Law adopted	In February 2023, the whistleblowing law formally transposing the EU Directive was enacted. Spain was the 18th country to adopt legislation to implement its requirements.
Sweden	Law adopted	In September 2021, the Swedish Parliament approved new legislation to transpose the EU Directive into Swedish national law. The government adopted further regulations to identify specific government entities as competent authorities to handle whistleblower reports.
The Netherlands	Law adopted	In January 2023, whistleblower protections were adopted, making the Netherlands the 14th EU Member State overall to codify its requirements into domestic law.