By Alja Poler De Zwart (Partner, Brussels) & Mercedes Samavi (Senior Associate, London), Morrison & Foerster LLP

Is your company fully equipped if someone witnesses a situation in the workplace that troubles them and wishes to report it? Do you have a system in place for receiving and handling these types of reports? The EU Directive of the European Parliament and of the Council on the Protection of Persons Who Report Breaches of Union Law (the “Whistleblowing Directive”) requires all EU countries to create rules for public and private companies about setting up whistleblowing hotlines through which individuals can submit concerns about the company’s alleged violations. Even if your company already has some form of a whistleblowing or ‘speak up’ procedure in place, you should take the time to familiarise yourself with the Whistleblowing Directive and the national laws that implement it, to see to what extent it affects your company’s operations. 

What is a whistleblowing hotline?

A good and effective whistleblowing hotline provides an easy and user-friendly way for the whistleblower to report an issue that they are concerned about, such as a violation of certain laws that they have witnessed or heard about regarding your company. Your company needs to ensure that whistleblowers can do so without facing retaliation. 

It is now common for a company hotline to consist of an online platform and a telephone channel. With the introduction of the Whistleblowing Directive, companies should also anticipate receiving reports directly from the whistleblower via physical meetings. Hotlines are often outsourced to a third-party service provider who will receive the report and pass it to the company for further investigation and resolution.

The reports are usually escalated to the responsible person or department within the company that is sufficiently independent from the issue being reported. This point of contact then investigates the whistleblower’s concerns and takes appropriate actions.

What does the Whistleblowing Directive do?

The Whistleblowing Directive instructs all EU countries to implement their own national laws for how companies should set up their internal whistleblowing hotlines and how whistleblowers should be protected. In addition, the national laws should create external reporting channels that whistleblowers can use under certain conditions instead of their company’s hotline. This means that, under certain conditions, whistleblowers can turn to external reporting channels set up by each EU country or, as a last resort, make a public disclosure – such as speaking with the media.

Under the new rules, all whistleblowers who acquire information about violations of EU law in a “work-related context” qualify for wide-ranging protections. Individuals in a “work-related context” therefore include not only current and former employees but also non-employees, such as job applicants, subcontractors, shareholders, volunteers, interns, trainees, business partners, facilitators, colleagues, and family members.

The rules for setting up an internal whistleblowing hotline apply to public and private companies with 50 or more workers. While the Whistleblowing Directive contains minimum standards (such as the categories of individuals who can submit reports via the hotlines, what they can report, and how they can report), it is up to each EU country to determine if it wants to impose stricter or more detailed obligations on companies  and/or grant greater benefits and protections to the whistleblowers.  

Under the Whistleblowing Directive, EU countries were required to introduce the implementing laws by 17 December 2021. With this deadline now come and gone, the majority of countries have failed to meet this requirement. The status report of which EU countries have enacted national whistleblowing laws makes for troubling reading – only a handful of countries brought in laws in time for the 17 December deadline and some have not even published proper draft bills. Not only has this disrupted companies’ efforts to operationalise their whistleblowing hotlines – particularly companies with a presence in multiple EU countries – but it has left many potential whistleblowers unsure about the extent to which they are protected if they make a report.

What does this mean for your company?

To meet these compliance requirements, your company needs to have a plan in place. 

Check in with your Compliance department or whichever department is in charge of internal investigations to see what the status quo is within your company, whether there is a hotline structure or if you need to set one up from scratch. The relevant department may need to look into this issue and determine whether the Whistleblowing Directive and new national laws apply to your company. If yes, that department will need to make decisions about how to ensure that your company’s hotline is compliant with the new laws.

The final picture of whistleblowing rules in the EU is still in flux. Monitor the status of national laws in EU countries that are applicable to your company, by checking reliable sources such as Morrison & Foerster’s Whistleblowing Resource Center. Discuss with stakeholders how you will address updating your company’s hotline to reflect deviations across different national laws. When assessing which national laws apply to your company, be mindful of whether there are any staggered deadlines for compliance which depend on the number of workers engaged by your company.

Identify the right people to have in the room when discussing how to set up or update your company’s hotline – you will likely need to gather representatives from Privacy, Legal, Compliance and HR. If you have works councils or trade unions, they may also need to give approval or be notified. 

Operating a hotline requires a lot of resources and effort – your company will need to create new policies and procedures or re-write existing policies to accommodate the new national laws. Do not forget to budget for things such as translation costs and additional training for relevant personnel such as investigators and investigation coordinators/leads. Given that we are still waiting for many EU countries to adopt their implementing laws, these resources may need to be updated to accommodate deviations within those laws. Be upfront with appropriate stakeholders about any budgeting estimates and resource requests so they are not surprised by them later down the line.

While the impact of the Whistleblowing Directive on businesses is still being determined, it is vital that your company is ready for the changes, or risk being caught unprepared. Even with many EU countries behind on adopting national laws, this should not deter companies from carefully considering what needs to be done.