Improved protection of whistleblowers in the EU as of 2021

Susanne Hofmann Data Protection Officer, PwC Switzerland and Liechtenstein 20 Nov 2019

The European Union (EU) has formally adopted new rules on whistleblower protection - a game-changing piece of legislation that will help protect persons reporting on incidents, so-called whistleblowers, across Europe. It is the first time that the EU has a dedicated legislation in this area. 

The new rules require legal entities to set up new or enhanced channels for reporting, both within an organisation - private or public - and to public authorities. It will also provide a high level of protection to whistleblowers against retaliation and require national authorities to adequately inform citizens and train public officials on how to deal with incident reporting.

The key elements include:

  • There is an obligation to create effective and efficient reporting channels in companies of over 50 employees;
  • Whistleblowers are encouraged to use internal channels first, before turning to external channels which public authorities are obliged to set up. However, whistleblowers will not lose their protection if they decide to use external channels in the first place;
  • Protected persons include those who could acquire information on breaches in a work-related context, e.g. employees, including civil servants at national/local level, volunteers and trainees, non-executive members, shareholders, etc.;
  • The new rules introduce safeguards to protect whistleblowers from retaliation, such as being suspended, demoted and intimidated. Those who assist whistleblowers, such as colleagues and relatives, are also protected;
  • The provisions cover areas such as financial services, public procurement, public health, etc. However, elements of whistleblower protection have already been introduced in specific EU instruments. Such existing EU legislation shall be complemented by these new rules. Hence, the existing instruments are going to be fully aligned with the minimum standards, whilst maintaining any specificities they provide for, tailored to the relevant sectors;
  • The rules create an obligation to respond and follow-up to the whistleblowers' reports within three months (with the possibility of extending this to six months for external channels in justified cases).

The legislation will now be formally signed and published in the Official Journal. Member states will have two years to transpose the new rules into their national law until 2021.

Your PwC Experts will provide you with more detailed information soon.

And now?

Companies with more than 50 employees will have to implement appropriate measures to comply with the new requirements. Those measures will include the implementation of an incident reporting system within the organisation to meet the internal channel reporting requirements, as well as adopting policies and guidelines establishing the appropriate internal organisation and the applicable processes.

Contact us

Susanne Hofmann

Susanne Hofmann

Data Protection Officer, PwC Switzerland and Liechtenstein

Tel: +41 58 792 17 12