The EU's new whistleblowing regime – why it matters to UK businesses

Friday 17 December 2021 marks a moment of divergence between the whistleblowing frameworks in the UK and EU, with the official implementation of the European bloc's new Whistleblowing Directive (Directive (EU) 2019/1937) (the Directive).

While businesses headquartered on the Continent have been preparing for the new requirements, it is crucial that UK employers assess whether they need to do likewise.

The UK and EU regimes diverge

When the EU began devising its new rules on whistleblower protections, the UK was still a Member State and was one of ten deemed by the European Commission to already have in place a comprehensive set of laws in this area.

These are in the form of the Public Interest Disclosure Act 1998 (PIDA), which amended the Employment Rights Act 1996 (ERA) to provide protection for workers, who report misconduct by their employers or third parties, from detrimental treatment and dismissal.

Beyond these protections, however, much of the way in which employers actually implement their whistleblowing procedures is left to “best practice” or to regulators in specific sectors, such as the UK's Financial Conduct Authority. For instance, UK employers are not actually required by law to have in place a whistleblowing policy or offer reporting channels for their workers.

The key element of the Directive which sees the EU depart from the UK position is that it will become a legal obligation, rather than mere “best practice”, for employers in the remaining 27 Member States to set up internal reporting channels for workers to make whistleblowing reports. According to the Directive, businesses with 250 or more “workers” (a very widely defined term) in a Member State should ensure that they have an in-country reporting channel available for their workers by 17 December 2021, where they seek to report “breaches of [European] Union law”. However, due to delays in the majority of jurisdictions, this only applies at the time of writing in Denmark and Sweden (as explained further below). Businesses with 50 or more workers will need to do so by the expiration of a further 2-year grace period on 17 December 2023.

Implementation of the Directive

The Directive only has “indirect” effect, meaning that each Member State must transpose its provisions into national law via domestic legislation. As our implementation tracker shows, only two Member States have actually transposed the Directive into domestic law on time: Denmark and Sweden. Of the remaining 25, several are at such an early stage of the legislative process that little can even be said as to what their implementing legislation might look like once it goes through.

The key feature to bear in mind with the implementation of any EU directive is that it only amounts to the “minimum standards” that all Member States must enact. In other words, if a country wishes to “gold-plate” the Directive, they are entitled to do so. By way of example, the Czech Republic has signalled its intent to impose the internal reporting channel requirement on employers of just 25 or more workers. This is a stark example of the importance of seeking legal advice in each Member State in which you operate – and not just at a Union-wide level.

From what is available of their draft legislation, the majority of Member States are also set to gold-plate the Directive by affording protection to whistleblowers where they report breaches of national law, such as criminal offences, in addition to breaches of EU law.

How will this impact UK businesses?

The Directive will impose obligations on employers who “operate” in the EU, something which is true of many UK-headquartered businesses. This means that, subject to the precise wording of each Member State's implementing legislation, even where the employer does not maintain an EU-registered entity, it could find itself within scope to the extent that it has workers operating at branches or office locations on EU soil. It is imperative that such businesses seek guidance on the extent to which the Directive will impact them, and what they need to do to ensure they are compliant.

Businesses who are already compliant with the UK regime cannot rely on this to cover their EU operations. First, as discussed above, the Directive goes further than the UK legislation in certain areas, notably with regard to internal reporting channels. Second, the Directive's full title makes clear that it is legislation “on the protection of persons who report breaches of Union law”. Evidently, post-Brexit, the UK's own whistleblowing protections could only be said to afford protection for reports of breaches of EU law to the extent that they also amounted to a breach falling within the scope of PIDA.

What next?

Until now, the UK has generally been seen as having one of the most robust and well-established whistleblower protection schemes in the world. However, the Directive may see this mantle pass across the Channel, at least for the time-being.

While the UK Government has indicated that it has no intention of implementing similar measures at this time, it will monitor the success of the new EU regime, so there is every chance of developments in the UK in due course.

How can DLA Piper help you?

DLA Piper's cross-border whistleblowing group comprises employment, regulatory and corporate investigations specialists from across the UK and EU. The team is ideally placed to advise organisations with European operations as to the implications of the Directive and the steps you may need to take to achieve compliance.