An overview of the Directive
Since the transposition deadline of the EU Whistleblowing Protection Directive on December 17, 2021, EU countries and organizations have been scrambling (and struggling) to transpose the rules into their respective legal frameworks. The Directive's purpose is to provide greater protection across EU countries for those wanting to report breaches of EU law. Those who choose to make a report must be provided with clear reporting hotlines and be protected against retaliation, among other requirements outlined in the Directive. EU legal entities with 250 or more employees, and no later than December 17th, 2023, organizations employing 50 or more employees must execute the defined reporting system. This also goes for entities in the public sector.
The critical requirements of the Directive include the following:
- Safe and accessible reporting channels
- Ensuring workers know when and where to report wrongdoing
- Protecting the confidentiality of whistleblowers and those involved
- Promptly acknowledging receipt of reports within seven days
- Providing an update on the investigation within three months of the initial report
- Protecting whistleblowers from dismissal, demotion or other forms of workplace retaliation
- Keeping a record of reports for no longer than necessary to comply with GDPR data-keeping rules
The Netherlands Whistleblower Protection Act
To comply with the Directive, the Netherlands' pre-existing House of Whistleblowers Act changed into The Whistleblower Protection Act. Companies that merely follow the old law are no longer legally compliant.
Under the new law, the scale of people granted protection has increased. Self-employed workers, volunteers, trainees, contractors, and suppliers, who raise a report and work, or have worked, for the organization, must now be covered. Family members of a whistleblower also qualify. This means companies are now receiving more whistleblowing reports on a wider variety of topics from a wider variety of people. To comply, organizations should consider hiring additional compliance and whistleblowing investigators to keep up with growing demands, or outsource hotline management to a third-party agency.
There are also stricter requirements for hotline channels, intake, and the processing of reports. Businesses must now provide a receipt of acknowledgment within seven days once a report is submitted, with confirmation that the information will be investigated. Companies also must maintain records of resolved cases. In addition, whistleblowers now have the right to report directly to an external authority, which can, unfortunately, cause reputational issues for companies should a case go public. It is, therefore, more important than ever for businesses to openly communicate their internal hotlines to employees, encourage their usage and collect reports as early as possible.
Another significant change is the shift of the burden of proof. Businesses must ensure their incident management processes and responses to a report are properly documented should they need to be used as legal evidence. For example, a whistleblower may feel they have been demoted or terminated due to previously raising a report, so they take the case to court. In that example, it is now up to the business to prove the employee was treated fairly and that the report is not linked to the later actions taken toward the employee. This new change is an advantage to whistleblowers, as it lowers the bar for them to challenge potential retaliation. It also means companies can protect themselves against whistleblowers who act maliciously.
Finally, should a company not comply with the new laws and an employee takes them to court, the House of Whistleblowers investigation department can give administrative orders, penalties and fines to the organization.
The content of this article is intended to provide a general guide to the subject matter. Specialist advice should be sought about your specific circumstances.
