France: Whistleblowers: New protection rules within the EU

Therecent Panama Papers and LuxLeaks scandals have illustrated the urgent need toestablish legislation to protect whistleblowers, as their revelations haveraised awareness of the serious breaches of EU law – particularly harmful tothe public interest – and of the precariousness of their status.

The entry into force on December 16, 2019 of Directive 2019/1937 of October 23, 2019 on the protection of persons who report breaches of EU Law is a major step forward in encouraging Member States to go beyond the common minimum standards by creating a harmonized framework within the European Union to provide effective protection to whistleblowers.

While inFrance and in about ten other EU Member States, a comprehensive protectivelegislation for whistleblowers already exists[1], theDirective represents a major step forward as it enables the European Union toestablish a general framework to protect persons – working in the private orpublic sector – who have obtained information on breaches of EU law in a professionalcontext.

TheDirective is indeed intended to apply to breaches of EU law concerning inparticular the fight against money laundering, product and transport safety,health protection, the environment as well as the protection of consumers,privacy and personal data.

However,to enjoy protection under the Directive, reporting persons must (i) havereasonable grounds to believe, at the time of reporting, that the mattersreported by them are true, and (ii) comply with the established procedure.

As such,the Directive provides for the establishment of internal and external“reporting channels”:

  • “Internal reporting channels”: Member States shallensure that legal entities in the private and public sector establish suchchannels. These channels should enable (i) the secure receipt of information byensuring the confidentiality of the identity of the reporting person and anythird party mentioned in the report, (ii) the acknowledgment of receipt of thereport within a period of seven days, and (iii) the designation of an impartialperson or department competent for following-up on the reports;
  • “External reporting channels” (that may be used bywhistleblowers as a complement to, or as a substitute for, internal reportingchannels): Member States shall designate independent and autonomous competentauthorities that will be responsible for ensuring the completeness, integrityand confidentiality of the information and preventing access thereto by non-authorizedpersons.

When the oral or written report has been made through one of these channels, the reporting person will benefit from a particularly broad protection during the processing period. In this respect, the Directive specifies that feedback must be provided to the reporting person within a maximum of three months from the acknowledgment of receipt or, if no acknowledgement was sent to the reporting person, three months from the expiry of the seven-day period after the report was made.

The Directive specifies that Member Statesmust not only take all appropriate measures to protect the whistleblower – byensuring that the identity of the whistleblower is not revealed and byprohibiting any form of retaliation – but also support him/her by providing easilyaccessible information and advice, effective assistance and legal aid. It isinteresting to note that the whistleblower may also benefit from a financialassistance and psychological support.

Finally,the Directive requires Member States to provide for effective, proportionateand dissuasive penalties applicable to natural or legal persons who/that hinderreporting, take retaliation measures or breach the duty of maintaining theconfidentiality of the identity of reporting persons. The deadline fortransposing the Directive into domestic law has been set on December 17, 2021.