On 23 April 2018, the European Commission – Directorate General of Justice and Consumers (the "Commission") proposed a Directive on the protection of persons reporting on breaches of EU law (the "Proposed Directive") (see Proposal for a Directive of the European Parliament and of the Council on the protection of persons reporting on breaches of Union law, 23 April 2018, COM (2018) 218 final-2018/0106(COD)).
The Proposed Directive aims to strengthen the protection available to natural or legal persons who report actual or potential breaches of EU law under EU Member State laws, including in relation to breaches of EU competition rules. The Proposed Directive sets out minimum EU-wide standards of protection so as to encourage more individuals in both the private and public sectors to help prevent and detect unlawful activities under EU law. The Proposed Directive is reportedly also aimed at protecting those who act as sources for investigative journalists to help safeguard freedom of expression and the freedom and plurality of the media. While not specifically focused on competition law, it can be expected that – once implemented – the Proposed Directive will also serve as encouragement to individuals who have relevant information about breaches of competition law to alert the competition authorities.
In the wake of a number of recent large-scale and cross-border infringement proceedings such as those relating to Dieselgate, LuxLeaks, the Panama and Paradise Papers and Cambridge Analytica, it has become clear that individuals play an important role in revealing potential violations of the law. Although, in many cases, these violations were identified as a result of individuals speaking up, they also highlighted the fragmented systems of protection in different EU Member States and across policy areas potentially lying at the basis of what has broadly been considered as an unsatisfactory level of reporting of legal violations.
The Commission conducted a 12-week open public consultation between 3 and 29 March 2017 inviting views on the issue of whistleblower protection at the national and EU level.1
In the words of the Commission, the Proposed Directive seeks to ensure "that whistleblowers feel safe to report [which] can lead to effective detection, investigation and prosecution of breaches of Union law that would otherwise have the potential to cause serious harm to the public interest". (See Communication from the Commission to the European Parliament, the Council and the European Economic and Social Committee, Strengthening Whistleblower Protection at EU Level, page 3.)
In the context of competition law, the Commission has long recognised the importance of whistleblowers in the detection and prevention of infringements of EU competition law in EU leniency policy, which currently offers companies involved in a cartel and which self-report and hand over evidence either total immunity from fines or a reduction of fines which the Commission would have otherwise imposed on them. The importance of individuals as whistleblowers was also reiterated with the introduction in March 2017 of the Commission's anonymous whistleblower tool (see the International Comparative Legal Guide to: Cartels & Leniency 2018, "Individuals as Whistleblowers", Ingrid Vandenborre and Thorsten Goetz). The introduction of whistleblower protection at Member State level will further strengthen the ability of the Commission and the national competition authorities to detect and bring to an end competition law infringements, although it may also have different implications from a competition law perspective.
The protection of whistleblowers is enshrined in a number of EU fundamental rights and rules as well as international instruments which require states to incorporate, or consider incorporating, specific measures to protect reporting persons. For example, the Proposed Directive references the case law of the European Court of Human Rights in relation to the right to freedom of expression and media, the 2014 Recommendation of the Council of Europe on the protection of whistleblowers (see Recommendation CM/Rec(2014)7 of the Committee of Ministers to Member States on the protection of whistleblowers, https://www.coe.int/en/web/cdcj/activities/protecting-whistleblowers) and international standards and good practices; for example, the 2004 UN Convention against Corruption to which all Member States and the EU are parties, the G20 Anti-Corruption Action Plan and the OECD Report of March 2016 on Committing to Effective Whistleblower Protection.
In particular, the Proposed Directive draws on the 2014 Recommendation of the Council of Europe on the protection of whistleblowers which sets out a series of key principles and safeguards to guide Member States when reviewing their national laws or when introducing legislation and regulations or making amendments as may be necessary in the context of their legal systems.
The Proposed Directive reflects the Commission's commitment to placing greater emphasis on ensuring effective enforcement as set out in its 2016 Communication EU Law: Better Results Through Better Application: "Often, when issues come to the fore – car emission testing, water pollution, illegal landfills, transport safety and security – it is not the lack of EU legislation that is the problem but rather the fact that the EU law is not applied effectively. That is why a robust, efficient and effective enforcement system is needed to ensure that Member States fully apply, implement and enforce EU law and provide adequate redress for citizens. Members of the public, businesses and civil society contribute significantly to the Commission's monitoring by reporting shortcomings in the application of EU law by the Member States. The Commission acknowledges the crucial role of complaints in detecting infringements of EU law" (see Communication from the Commission, C/2016/8600, EU Law: Better Results Through Better Application and the Annex, https://ec.europa.eu/info/publications/communication-commission-eu-law-better-results-through-better-application_en).
The Proposed Directive followed extensive consultation work carried out by the Commission in 2017 which consisted of a 12-week open public consultation, three targeted online stakeholder consultations, workshops with experts and academics, as well as external studies and surveys. (See Annexes 1, 2, 13, 14 and 15 on the Proposal for a Directive on the protection of persons reporting on breaches of Union law for more details on the procedural process, http://ec.europa.eu/newsroom/just/item-detail.cfm?item_id=620400.)
The Commission's analysis showed that the protection given to whistleblowers across the EU remains fragmented and uneven across policy areas. Only 10 EU Member States currently have comprehensive systems of protection of whistleblowers (namely: France; Hungary; Ireland; Italy; Lithuania; Malta; the Netherlands; Slovakia; Sweden; and the UK). In 16 of the remaining Member States, the protection is partial and/or only applies to specific policy areas or categories of employees. For example, in Germany, legislation covering the reporting of specific types of wrongdoing exists, but there is no comprehensive whistleblowing procedure. The level of protection very much depends on the type of wrongdoing and the individual circumstances of the case. In Austria, while the Federal Competition Authority introduced an electronic anonymous whistleblowing system in February 2018, there are only few laws in relation to releasing information in the context of corruption matters which include provisions relating to the protection of persons revealing specific wrongdoings. In Spain, there is no standalone national law providing protection for whistleblowers but only fragmented legislation that is, in theory, applicable to whistleblowing cases. In two Member States, Cyprus and Latvia, whistleblowers appear to have no protection. (See Annex 6 to the Commission Staff Working Document, Impact Assessment, accompanying the Proposal for a Directive of the European Parliament and of the Council on the protection of persons reporting on breaches of Union law, 23 April 2018, SWD(2018) 116 final, in particular, pages 126, 136, 152–154 and 177.)
The Commission's analysis also showed that the protection of whistleblowers offered at EU level varies from one instrument to the other and is often very limited. In addition, the scope and content of protection is mainly left at the discretion of Member States: for instance, none of the EU rules regulate the categories of persons who would be entitled to receive protection. (See Commission Staff Working Document, Impact Assessment, accompanying the Proposal for a Directive of the European Parliament and of the Council on the protection of persons reporting on breaches of Union law, 23 April 2018, SWD(2018) 116 final, pages 13 and 14.)
The Commission reportedly wants to use whistleblower protection as a systemic part of enforcement of EU law in those areas with a clear EU dimension and where the impact on enforcement is the strongest. These policy areas include competition law and State aid as well as a number of other areas such as, e.g., public procurement and financial services, among others, etc. The Proposed Directive encourages Member States to develop comprehensive frameworks of protection for whistleblowers that go beyond these minimum standards.
3 What Does It Mean for EU Competition Law?
Along with other detection and investigation tools, the Commission's leniency programme has been an important and successful tool to uncover secretive cartel activities since it was first put into place in 2006. However, the rise of private damages actions, including as a result of the legislation and other measures undertaken by the Commission, has impacted leniency applications. The Commission notes that while the leniency programme has been a very successful tool to uncover secret cartel arrangements that may otherwise go undetected, "[c]ompanies however increasingly weigh the benefits of immunity from fines or leniency reductions against the risk of important payments in follow-on private damage actions" adding that the "digitalisation and globalisation of markets have also resulted in complex business models and distribution systems that would nowadays often require insider knowledge to detect and successfully investigate". (See Commission Staff Working Document, Impact Assessment accompanying the Proposal for a Directive of the European Parliament and the Council on the protection of persons reporting on breaches of Union law, 23 April 2018, SWD(2018) 116 final, page 18.)
To alleviate the limitations to the existing reporting mechanisms and strengthen its fight against cartels and other breaches of competition law, the Commission introduced in March 2017 an online anonymous whistleblower tool to make it easier for individuals to alert the Commission about past, ongoing or planned cartels and other infringements while maintaining their anonymity (see http://ec.europa.eu/competition/cartels/whistleblower/index.html and the International Comparative Legal Guide to: Cartels & Leniency 2018, "Individuals as Whistleblowers", Ingrid Vandenborre and Thorsten Goetz).
Whilst the whistleblower tool guarantees the anonymity of whistleblowers, it does not offer protection in the eventuality that the whistleblower's identity becomes known to those who have the ability to take retaliatory action against them, such as, e.g., employers. The Commission's Impact Assessment also notes that "experience shows that the ability to interact directly with an identified whistleblower allows for a more efficient and successful investigative process. Effective protection for whistleblowers would encourage and enable the individuals to come forward without fearing retaliation". (See Commission Staff Working Document, Impact Assessment accompanying the Proposal for a Directive of the European Parliament and the Council on the protection of persons reporting on breaches of Union law, 23 April 2018, SWD(2018) 116 final, page 18.)
Only a limited number of EU Member States have implemented similar anonymous reporting tools (i.e. Denmark, Germany, Poland, Romania and Spain). The Commission's Impact Assessment considers that the introduction of rules protecting whistleblowers at Member State level "would have a significant impact on the ability of those authorities to detect and bring infringements of EU competition law to an end. It would also strengthen the incentives for companies to come forward and report cartels under leniency programmes themselves rather than risking detection through whistleblowing". (See Commission Staff Working Document, Impact Assessment accompanying the Proposal for a Directive of the European Parliament and the Council on the protection of persons reporting on breaches of Union law, 23 April 2018, SWD(2018) 116 final, page 18.)
The same emphasis was already reflected in the Commission's March 2017 proposal for a Directive to empower the competition authorities of the Member States to be more effective enforcers ("the Proposed ECN+ Directive"). The Proposed ECN+ Directive sets out, inter alia, minimum standards for the protection of employees and directors of companies that file for immunity – that they are protected from individual sanctions, where they exist, provided that they cooperate with the authorities. The proposal stipulates at Article 22 that: "Member States shall ensure that current and former employees and directors of applicants for immunity from fines to competition authorities are protected from any criminal and administrative sanctions and from sanctions imposed in a non-criminal judicial proceedings for their involvement in the secret cartel covered by the application, if these employees and directors actively cooperate with the competition authorities concerned and the immunity application predates the start of the criminal proceedings." The provision is designed to alleviate the risk that the information provided by individuals be used against them in criminal proceedings. The proposal stresses the importance of this protection in order to maintain incentives for companies to apply for leniency because their leniency applications often depend on their employees cooperating fully, without fear of incurring sanctions.
The Proposed ECN+ Directive also provides that the individuals who have knowledge of the existence or functioning of a cartel or other types of antitrust violations should be encouraged to provide that information, including through the establishment of reliable and confidential reporting channels.
The greater emphasis being placed on reporting by individuals must also be seen in the context of the efforts undertaken by the Commission to support and encourage private damages actions. While they impact companies, private damages actions do not target individual employees and typically have no direct impact on employees, whether current or former. While agencies encouraging private damages actions can thus do little to further incentivise companies to self-report in the wake of increasing damages exposure, they can incentivise individuals.
Although the Commission Staff Working Document, Impact Assessment, accompanying the Proposed Directive suggests that the introduction of protection of whistleblowers at Member State level would also have a significant impact on the ability of Member State authorities to detect and bring infringements of EU competition law to an end and would therefore "also strengthen the incentives for companies to come forward and report cartels under leniency programs themselves rather than risking detection through whistleblowing",it remains to be seen how the success of individuals reporting competition law breaches to competition authorities will impact the effectiveness of leniency programmes for companies.
Companies traditionally rely on employees coming forward in the context of internal investigations and often on the basis of carefully designed company compliance programmes that incentivise employees to self-report competition law breaches within the company. This internal reporting by individuals is often the basis for a company's application for immunity or leniency under the Commission's and/or national corporate leniency programmes. It would thus be helpful for competition authorities to clarify the rules on individual whistleblowers, including under the Proposed Directive, as they relate to the interaction between whistleblower tools for individuals and the latter's protection and leniency programmes for companies to avoid a potential further negative impact not only on the incentives, but also on the ability for companies to assemble – with the benefit of greater background and document access – the requisite information to support an investigative proceeding.
It is noteworthy that when only a few Member State legal regimes provide for criminal sanctions for individuals that have participated in competition law violations, the proposal does not impact sanctions for individual employees. With companies potentially negatively impacted by the consideration of private damages actions, and industries and markets becoming increasingly complex, the EU Commission's proposal appears to acknowledge agencies' increasing reliance on individuals.
The Proposed Directive does not go as far as, e.g., the UK Competition and Markets Authority, which offers individuals financial rewards for information on cartel activities and strict protection of their identity (https://www.gov.uk/government/publications/cartels-informant-rewards-policy), but rather aims to offer minimum standards of protection against retaliation, adequate reporting mechanisms and safeguards against abusive reporting. The proposal may thus mainly be relevant for individuals who face no legal sanction themselves as a result of participation in an alleged violation. Rather, the proposal seeks to provide protection against retaliatory measures without providing immunity to the individual concerned itself. To do so would directly impact, and potentially run counter to, competences held by individual Member States in relation to the enforcement of national laws. It may at the same time identify the limitations of the proposal, at least from a competition law perspective. In particular, the Proposed Directive distinguishes the "reporting person" from the "concerned person" (i.e. the natural or legal person to whom the breach is attributed). While the Proposed Directive offers protection against retaliation and effective reporting mechanisms to the former, with respect to the latter, the proposal offers rights to effective remedy and fair trial, the presumption of innocence, rights of defence, and the protection of identity. The Proposed Directive does not address circumstances where the reporting person is also the person to whom a breach is attributed, unlike the reporting mechanisms and immunity programmes under competition law. It is assumed that if the reporting person is also the person concerned, then the Proposed Directive would afford them the maximum protection under both regimes.
It is possible, and perhaps likely, that some Member States will go beyond the provisions of the proposal to provide greater protection, and thus greater incentives, to individuals.
Finally, from a competition law perspective, it is also interesting that the proposal comes at a time when the Commission published on 11 April 2018 its New Deal for Consumers comprising a draft Directive on representative actions for the protection of the collective interests of consumers designed to introduce a European-wide harmonised, compulsory, compensatory redress mechanism to protect the collective interests of consumers (i.e. group or collective damages actions). Like the Proposed Directive, as background to the proposed collective redress Directive, the Commission cited large-scale cross-border proceedings, such as the diesel emissions case, as examples of the difficulties currently faced by consumers seeking to claim collective redress across un-harmonised national regimes (see Proposal for a Directive on representative actions for the protection of the collective interests of consumers and repealing Directive 2009/22/EC, 11 April 2018, COM (2018) 184 final, 2018/0089(COD)). At present, whilst injunctive relief mechanisms are available in all Member States under the Injunctions Directive 2009/22/EC, collective damages actions are currently not available in all Member States and where they are available, they are often limited to specific sectors or areas of law.
We end with a brief discussion of the scope of the protection set out in the proposal.
4 Why a Directive?
The Directive finds its origins in a direct call for action by the European Parliament. In two resolutions issued in 2017 on the legitimate measures to protect whistleblowers acting in the public interest, the European Parliament "called on the Commission to present a horizontal legislative proposal to guarantee a high level of protection for whistleblowers in the EU, in both the public and private sectors, as well as in national and EU institutions". (Proposal for a Directive of the European Parliament and of the Council on the protection of persons reporting on breaches of Union law, 23 April 2018, COM (2018) 218 final, page 2.)
The Proposed Directive sets out minimum standards of protection, which could not be adequately achieved by Member States acting alone or in an uncoordinated manner (Proposal for a Directive of the European Parliament and of the Council on the protection of persons reporting on breaches of Union law, 23 April 2018, COM (2018) 218 final, page 16, Recital 84), leaving Member States the possibility to introduce or retain provisions more favourable to the rights of whistleblowers or to go beyond the level of protection set out in the Proposed Directive (Proposal for a Directive of the European Parliament and of the Council on the protection of persons reporting on breaches of Union law, 23 April 2018, COM (2018) 218 final, page 29, Article 19). In this respect, the existence of a different regime in the UK, that provides, e.g., for rewards in case individuals report legal violations, is a case in point, and other Member States may similarly develop further protections and/or incentives under their national laws.
The Proposed Directive is also designed to run in parallel to existing protection in other EU instruments (e.g. EU rules on employment, EU rules on protection against harassment and violence at work) and aims to contribute to the implementation of a number of core EU policies which have a direct impact on the completion of the single market including competition.
5 Minimum Standards of Protection
The Proposed Directive aims to set out common minimum standards for whistleblower protection in specifically defined EU law areas which the Commission consider the impact on enforcement is the strongest and where whistleblowers are in a privileged position to disclose breaches.
Under the Proposed Directive, the notions of "reporting person" and retaliation are based on the Council of Europe Recommendation on the Protection of Whistleblowers (cited here above) and are defined in the broadest possible manner to ensure effective protection. Reporting persons encompass the broadest possible range of categories of legal or natural persons who (irrespective of whether they are EU citizens or third-country nationals), by virtue of their work and/or work-related activities (irrespective of the nature of these activities and whether they are paid or not), have privileged access to information about breaches of EU law and who may suffer retaliation if they report them. The concept of "reporting person" comprises: workers within the meaning of Article 45 TFEU; persons having the status of self-employed, within the meaning of Article 49 TFEU; shareholders and persons belonging to the management body of an undertaking, including non-executive members, as well as volunteers and unpaid trainees; any persons working under the supervision and direction of contractors, subcontractors and suppliers; and generally any natural or legal person finding themselves in a position of economic vulnerability in the context of their work-related activities. (See Proposal for a Directive Proposal for a Directive of the European Parliament and of the Council on the protection of persons reporting on breaches of Union law, 23 April 2018, COM (2018) 218 final, Recitals 24–28 and Articles 2 and 3.)
The Proposed Directive provides that Member States must ensure that all companies (public or private) with more than 50 employees or with an annual turnover of over €10 million set up adequate internal reporting mechanisms to handle whistleblowers' reports. All State and regional administrations and municipalities with over 10,000 inhabitants will also be subject to the proposed rules. While the proposal exempts small companies, the exemption does not apply to small companies active in the financial sector. (See Article 4 of the Proposed Directive.)
The protection mechanisms that will have to be set up include clear and adequate reporting channels, within and outside of the organisation, ensuring confidentiality of the reporting person, and a three-tier reporting system consisting of internal reporting channels, reporting to competent authorities ("if internal channels do not work or could not reasonably be expected to work (for example where the use of internal channels could jeopardise the effectiveness of investigative actions by the authorities responsible)") and reporting to the public/media ("if no appropriate action is taken after reporting through other channels, or in case of imminent or clear danger to the public interest or irreversible damage").
The Proposed Directive suggests that there is no hierarchy between these reporting channels but that "[p]ersons who are considering reporting breaches of Union law should be able to make an informed decision on whether, how and when to report". (See Recital 47 of the Proposed Directive.)
The minimum standards to be implemented by the Member States into national law further include feedback obligations for authorities and companies who will have to respond and follow up on whistleblowers' reports within a reasonable time frame, and provisions relating to the prevention and sanction of all forms of retaliation. Article 14 of the proposal provides a non-exhaustive list of the many different forms that retaliation can take. If a whistleblower suffers retaliation, he or she should have access to adequate and effective legal remedies. (See Articles 5 to 15 of the Proposed Directive.)
Because it can be difficult for whistleblowers to prove the causal link between the reporting and the retaliatory measures, once the reporting person demonstrates prima facie that he/she made a report or disclosure in line with the directive and suffered a harm, under the Proposed Directive, the burden of proof would shift to the person who committed the harmful action who would then be required to discharge the burden by demonstrating that the action taken was not linked in any way to the reporting or the disclosure. (See Article 15(5) of the Proposed Directive.)
Safeguards to discourage malicious or abusive reports and prevent unjustified reputation damage are key features of the proposal. For example, the proposal requires that the reporting person had reasonable grounds to believe that the information reported was true at the time of reporting – ensuring that those who knowingly report wrong information do not enjoy protection. (See Article 13 of the Proposed Directive.)
Those affected by a whistleblower's report will fully enjoy their rights under the EU Charter of Fundamental Rights including the presumption of innocence, the right to an effective remedy and to a fair trial, and their right of defence. (See Article 16 of the Proposed Directive.)
The proposal requires Member States to provide for effective, proportionate and dissuasive sanctions to ensure the effectiveness of the reporting mechanisms and punish and dissuade any form of retaliation (direct or indirect), and also to punish and dissuade malicious and abusive whistleblowing. (See Article 17 of the Proposed Directive.)
Finally, Member States preserve the possibility of introducing or maintaining more favourable provisions that go beyond the minimum standards of protection set out in the Proposed Directive. (Article 19 of the Proposed Directive.)
6 Next Steps
The Proposed Directive will need to be approved by both the European Parliament and the Council of Ministers before it becomes law, a process that can take many months (a first reading typically takes 15 months and may be followed by a second and third reading should an agreement not be reached) and lead to amendments to the present text.
The Proposed Directive is currently in the first reading stage in the European Parliament. At the time of writing, the Committee on Legal Affairs has already issued a number of draft proposed amendments to make the directive "more cross-cutting in nature and more easily understandable for citizens" and to possibly extend its scope while deleting the proposed penalties for malicious whistleblowing. (Draft report by the Committee on Legal Affairs on the proposal for a directive on the protection of persons reporting on breaches of Union law (COM(2018)0218–C8–0159/2018 – 2018/0106(COD), page 44.)
It will be the responsibility of the Member States to implement the Proposed Directive, once adopted, into national law in line with the common minimum standards of protection the Commission has laid out. The current draft of the Proposed Directive stipulates an implementation deadline of 15 May 2021, which, however, may change depending on the timing for the adoption of the Proposed Directive.
While the Proposed Directive is not specifically focused on competition law, it can be expected to have a material impact on the Commission's cartel detection abilities. Still, to date, most cartels are being detected on the basis of the Commission's leniency programme that allows companies to report their involvement in a cartel in exchange for immunity from, or a reduction in, fines. Last year's introduction of the online anonymous whistleblower tool was a first step by the Commission to also induce individuals to provide information about competition law breaches to the Commission with the anticipation that reporting individuals would increase the likelihood of detection and prosecution of cartels which, in turn, would further deter companies from entering or remaining in a cartel. The success of the anonymous whistleblower tool is dependent on adequate protection of individual whistleblowers against retaliation, as well as the reliability of the information provided by the reporting individuals. The Proposed Directive is designed to close this perceived gap and to complement the Commission's existing toolbox comprising its corporate leniency programme and the anonymous whistleblower tool.
It remains to be seen whether the Proposed Directive, and national implementation in Member States, focusing on the individual's protection against retaliatory measures will be sufficient without providing immunity to the individual concerned itself and/or providing a financial reward to the individual as provided under the UK system, in particular in light of the Commission's and Member State agencies' increasing reliance on individual whistleblowers for the enforcement of competition law. It also remains to be seen how the protection will impact companies' incentives and ability to cooperate.
Another important question that remains open is how the success of individuals reporting competition law breaches to competition authorities will impact on the effectiveness of leniency programmes for companies. The Proposed Directive does not solve, and is not designed to solve, the interaction and potential conflict between whistleblower tools for individuals and the latter's protection, and the continued success of leniency programmes for companies who often rely on an employee's internal reporting as one basis for a company's application for immunity or leniency under the Commission's and/or national corporate leniency programmes.
1. The results are discussed in ICF Consulting Services Limited's "Study on the need for horizontal or further sectoral action at EU level to strengthen the protection of whistleblowers" of 27 November 2017 as well as in the Commission Staff Working Document, Impact Assessment, accompanying the Proposal for a Directive of the European Parliament and of the Council on the protection of persons reporting on breaches of Union law, 23 April 2018, SWD(2018) 116 final, in particular Annex 2, pages 65 to 71 – both documents can be found at http://ec.europa.eu/newsroom/just/item-detail.cfm?item_id=620400.
The authors wish to thank Caroline Janssens, Senior Professional Support Lawyer in Skadden Arps' Brussels office, for her contribution to this chapter.
Originally published by The International Comparative Legal Guide to Cartels & Leniency 2019.
The content of this article is intended to provide a general guide to the subject matter. Specialist advice should be sought about your specific circumstances.