Webinar report: EU Whistleblower Directive: status of its implementation and related issues

Silvia Martina
Cagnola & Associati Studio Legale, Milan
sm@cagnolaeassociati.it

Eric Mayer
GSK Stockmann, Munich
Eric.Mayer@gsk.de

Roberto Soardi
Cagnola & Associati Studio Legale, Milan
rs@cagnolaeassociati.it

Moderator

Eric Mayer  GSK Stockmann, Munich; Co-Chair, Compliance Subcommittee, Anti-Corruption Committee

Speakers

Sophie Scemla  Gide Loyrette Nouel A.A.R.P.I, Paris
Silvia Martina  Cagnola & Associati Studio Legale, Milan; Newsletter Editor, Anti-Corruption Committee
Bogdan Bibicu  WOLF THEISS, Bucharest
Tobias Teicke  Comfield Legal, Berlin

In October 2019 the EU issued the Whistleblower Directive 2019/1937 (the Directive), which provides a unified framework for countries all over the EU with the intention of ensuring adequate protections for whistleblowers.

The Anti-Corruption Committee held a webinar on 18 January titled ‘EU Whistleblower Directive: status of its implementation and related issues’. The webinar was moderated by Mr Eric Mayer and saw the participation of professionals from across Europe, who provided the audience with their perspective on the European Directive’s implementation in their countries and explored what the current framework for whistleblowing is.

Mrs Silvia Martina, Mrs Scemla, Mr Bogdan Bibicu and Dr Tobias Teicke tackled the most interesting points, specifically describing how whistleblowers’ reports have to be handled and the different steps companies must take in light of the implementation of the Directive.

Firstly, answering to Mr Mayer’s question, the panellists indicated the specific point in time when the Directive was implemented in their countries. In France, the Directive was transposed by the Wassermann Law of March 2022 and the subsequent implementing decree of 3 October 2022. Romania also implemented the Directive in 2022, with Law no 361/2022, amended through Law no 67/2023. With reference to Germany and Italy, the implementation year was 2023 for both countries, with a particular distinction for Italy.

Indeed, as Mrs Silvia Martina reported to the audience, the Directive was implemented in Italy through Legislative Decree no 24 of 10 March 2023, and the relevant provisions have taken effect as of 15 July 2023, with an exception for private sector entities that employed, in the last year, an average of no more than 249 employees. For these entities, the provisions stipulated in the Directive took effect from 17 December 2023.

The panellists next discussed a topic of particular interest introduced by Mr Mayer, attempting to answer to one of the most pressing questions for many corporations after the implementation of the Whistleblowing Directive. The question related to whether one centralised corporate hotline would be sufficient or if groups of companies with multiple subsidiaries with up to 250 employees were required to implement multiple hotlines accordingly.

In France, Mrs Scemla explained that the answer depends on the number of employees for each entity. For entities with 50-249 employees, the implementation of a whistleblowing procedure, reporting channels and the appointment of a local referee must be made at the company level. For entities with more than 250 employees, the regime has not been clearly defined under French Law, but it seems that the implementation of a whistleblowing procedure, reporting channels and the appointment of a local referee must be made at the level of each local entity. 

Such a distinction is also provided for in Romania: if the Romanian subsidiary has less than 250 employees, it has the possibility to share the resources with the corporate entity regarding the receipt of reports related to violations of the law and the subsequent actions. Thus, a Romanian subsidiary with fewer than 250 employees will be able to use the one and only centralised corporate hotline.

In Germany, as Mr Teicke explained, companies with 50-249 employees have an obligation to establish a reporting channel according to the German Whistleblower Protection Act and entities may use a joint reporting channel and share resources on any investigation to be carried out without prejudice to the obligations to address the reported breach and give feedback to the whistleblower.

With regard to companies with more than 249 employees, there is also a general obligation to establish a reporting channel. However, the option to establish a centralised reporting channel on a holding level/parent company is not explicitly stated in German law, but only laid out in the official explanatory notes of the German legislator. Indeed, in Italy Legislative Decree 24/2023 provides the option for entities with fewer than 250 employees to share the reporting channel but does not expressly provide that this option can also be adopted within a group of companies. The issue was first addressed by Confindustria, which noted that this regulatory gap is not such as to exclude the option for groups to share platforms for internal reporting. It is recognised that in groups of companies, sharing platforms would facilitate whistleblowing and make reporting procedures efficient.

In line with the theme of handling reports made by whistleblowers, the panellists were asked by Mr Mayer whether there are any provisions in their respective countries for reports to be handled by independent third parties as an alternative or in addition to internal corporate channels. According to French law, the whistleblowing procedure and the relevant reporting channels shall be put in place within the reporting entity and a specific internal referee (or a specific internal department) must be designated to receive and process whistleblower reports. However, it is not excluded that reports may also be received by external third parties.

A similar situation occurs in Germany, where the receipt of whistleblowing reports may be delegated to external reporting channels operated by competent experts according to Article 8 of the Whistleblowing Directive. The same consideration is also made in Italy.

Indeed, according to Italian law on whistleblowing, the reporting channel must be managed by an autonomous internal entity or a dedicated office with specifically trained staff to manage the reporting channel, or be delegated to an external entity, also autonomous and with specifically trained staff.

Finally, as Mr Bibicu explained to the audience, Romanian law also provides that reports can be handled by external third parties. In particular, having regard to the use of third-party solutions, the Romanian implementing law only stipulates that, depending on the number of employees (without indicating a specific number) the duties regarding the receipt of reports and the subsequent actions may be performed by a person, a department or may be outsourced to a designated third-party, without providing further guidelines on cooperation with the designated third-party.

To conclude  the webinar, the panellists were asked by Mr Mayer to answer an important question about the management of reports: should reports have to be processed anonymously? The topic was deemed to be quite sensitive, and the experiences of the various countries involved  differ significantly from each other.

First, Mrs Scemla reported that under French Law there is no specific provision that expressly obliges subject companies to allow anonymous reports, even if there has been a long debate on the point. However, many sections of the so-called ‘Sapin II Law’ refer to the anonymous reports in such a way that it could be understood that anonymous reports, if any, should be allowed. Even in Germany, as Mr Teicke said, there is no specific provision under German Law that obliges companies to allow anonymous reports. Nonetheless, the German Whistleblower Protection Act states if an anonymous report is submitted it should then also be processed.

According to Italian law, Mrs Martina explained that the identity of the reporting person and any other information from which such identity may be inferred, directly or indirectly, may not be disclosed without the express consent of the reporting person to persons other than those competent to receive or act upon reports. The only cases where, in addition to the consent of the whistleblower, a written report containing the reasons for disclosure of the whistleblower's identity is absolutely necessary, are expressly provided for in the relevant Italian Decree.

In any case, if a criminal case arises from a whistleblowing report, the identity of the whistleblower would remain anonymous until the conclusion of the preliminary investigation, as provided for in the Italian code of criminal procedure.

Finally, Mr Bibicu explained the situation for Romania. In March 2023, the Romanian implementing law was amended also from the perspective of allowing anonymous reports. However, in addition to the guarantees provided by the Romanian implementation law, further guarantees in the sense of protecting the anonymity of the reporter can also be derived from the rules of criminal law and criminal procedure provided by the Romanian legal system. 

In conclusion, having listened to the panellists, it became obvious that each state implemented the EU Whistleblowing Directive with different provisions, and that the topic is so interesting and rich in potential insights that it will surely be discussed in future IBA events as well.

A recording of the webinar is available here.