The Whistleblowing directive is approved: What you should take into account

The Whistleblowing directive is approved: What you should take into account

Directive (EU) 2019/1937 of the European Parliament and of the Council of 23 October 2019 on the protection of persons who report breaches of European Union law (known as the “Whistleblowing Directive”) has been created with the aim of imposing an obligation on companies and public administrations of Member States to implement, within their own internal organization, secure and confidential reporting channels or mechanisms, together with the adoption of measures to protect whistleblowers who use these mechanisms from possible reprisals that could result from such reports by the company itself and/or senior management.

In other words, the aim of this Directive is that, through these whistleblowing channels, the activation of internal alarms within the company or administration itself should be made possible, so that the existence of possible irregularities can be made visible and, where appropriate, investigated and remedied (i.e. certain actions can be carried out aimed at or directed at remedying these irregularities within the company), making a suggestion box and/or whistleblowing channel available to the employees of the company in order to make them aware of the existence of possible irregularities, that certain actions can be carried out aimed at correcting these irregularities produced within the company), making available to company employees a suggestion box and/or whistleblowing channel to be able to report with guarantees those conducts that could represent a violation of the company’s own internal policies.

What obligations does it impose on companies?

In concrete terms, we can define the obligations imposed on the company as follows:

1. To have an internal reports channel.
2. To respond to the complaints/reports submitted.
3. Guaranteeing the anonymity of whistleblowers.

In other words, this Directive imposes on companies and public bodies the obligation to implement internal and confidential whistleblowing/reporting channels and protection measures for whistleblowers who wish to use these internal mechanisms to report infringements that may occur within the organization and which concern areas related to financial services, product safety, food and transport, public health, privacy and data protection, consumer protection, competition, etc., extending this scope of application to those infringements or irregularities “which directly affect or undermine the general interest”.

Likewise, and in accordance with Article 9 of the Directive, the response to complaints must be given within a reasonable period of time, which may in no case exceed three months after the complaint has been received by the person responsible for the company, or seven months after the complaint has been made if it has not been sent. In addition, the Directive also states that complaints may be made either in writing or verbally (i.e. by telephone, voice message or face-to-face meeting), and are understood to have been lodged in any of these ways.

Finally, another of the obligations that this Directive imposes on companies and public bodies is that of guaranteeing the anonymity of whistleblowers and their consequent protection (Article 16 of the Directive), provided that there is no legal obligation to disclose their identity (e.g. due to the existence of an investigation by the authorities, an ongoing judicial process that requires the disclosure of the identity of the whistleblower in order to safeguard the right of defense, etc.).

Who must comply with the Whistleblowing Directive?

This Directive establishes as obliged parties that must comply with the obligations regulated therein, as a minimum, the following (although these parties may be extended once each EU member country transposes this Directive into its national law):

1. All companies with more than 50 employees.
2. Companies in certain sectors, regardless of the number of employees (environment, public health, and other sectors set out in the Annex to the Directive).
3. All public sector companies.

When must companies adapt to this directive?

Specifically, EU member states were given a deadline of 17 December 2021 to transpose this Directive, although in Spain this transposition has not yet taken place or been carried out, which is why the obligation for companies with between 50 and 249 workers will not come into force until 17 December 2023.