COUNTRY-LEVEL UPDATES ON IMPLEMENTATION STATUS
Once implemented into national law, the EU's Whistleblowing Directive (2019/1837/EU) is expected to have a significant impact on the policies and processes of companies related to employment relationships, data privacy and processing safeguards. This means that businesses will need to review and adjust their compliance procedures. The Directive allows for significant freedom for countries to implement it into national laws beyond its original scope and may pose substantial challenges to businesses to implement appropriate whistleblowing channels.
The Directive is applicable to private and public sector organisations and covers a wide range of business activities and topics: from public procurement and environmental protection to consumer protection and product safety. While the spectrum of reporting channels is also broad, from internal reporting to public disclosure, the Directive provides significant legal protection for whistleblowers, as well as financial and non-financial incentives to report violations. In addition, it imposes a reverse burden of proof on companies.
As the Directive is expected to be implemented in most CEE/SEE countries in 2023, our Whistleblowing Tracker will follow the implementation status in 13 countries in Central, Eastern and South-Eastern Europe (EU and non-EU countries) and provide an overview of upcoming changes.
Go to respective country: Albania, Austria, Bosnia and Herzegovina, Bulgaria, Croatia, Czech Republic, Hungary, Poland, Romania, Serbia, Slovakia, Slovenia, Ukraine
ALBANIA
Information current as of 9 January 2023
1. Current implementation status
N/A
However, in 2016 Albania adopted the Law no 60/2016 "On
whistleblowing and protection of whistleblowers" and several
ancillary legal acts (the "Effective Law ").
2. What is the implementation period?
N/A
3. Is anonymous reporting permitted?
Under the Effective Law, a whistleblower may choose to
remain anonymous, and the employer must respect this (also in the
case of anonymous reports). Generally, whistleblowers are protected
from retaliation and cannot be fired or demoted. They cannot be
penalised in any other way either, such as blacklisting, reduction
of pay, reassignment, salary decrease, loss of office or privileges
or change in duties.
4. What is the range of the envisaged sanctions under
local law?
Under the Effective Law, a fine of up to EUR 4,500 can be
imposed for penalising a whistleblower or up to EUR 1,000 for
breaching the confidentiality of the whistleblower's
identity.
Furthermore, any failure by the employer to initiate an investigation after receiving a report of corruption by an employee may also lead to a fine of ALL 500,000 (approx. EUR 4,000).
AUSTRIA
Information current as of 28 February 2023
1. Current implementation status
The Directive has been transposed into national law with
the new Whistleblower Protection Act, which was promulgated in the
Federal Law Gazette on 24 February 2023 and entered into force on
25 February 2023.
In addition, there are some regulations in individual sectors on whistleblower protection and/or on reporting channels, most notably in the banking sector.
2. What is the implementation period?
The Whistleblower Protection Act entered into force on the
day following its promulgation, i.e. on 25 February 2023,
however:
- enterprises with 250 employees have six (6) months following the entry into force to establish reporting channels;
- enterprises with 50 to 249 employees will be subject to regulations on the establishment of reporting channels as at 17 December 2023;
- the bill does not apply to enterprises with less than 50 employees.
3. Is anonymous reporting permitted?
Under the Whistleblower Protection Act, anonymous
reporting is permitted, and anonymous whistleblowers enjoy the same
protection as non-anonymous whistleblowers. However, enterprises
are not obliged to enable anonymous reporting in their reporting
channels.
4. What is the range of the envisaged sanctions under
local law?
Under the Whistleblower Protection Act, a fine of up to
EUR 20,000 (EUR 40,000 in the event of recurrence) can be imposed
for (i) hindering or attempting to hinder reporting, (ii) bringing
vexatious proceedings against a whistleblower, (iii) retaliating
against a whistleblower, (iv) breaching the confidentiality of a
whistleblower's identity or (v) knowingly making a false
report.
Furthermore, in the case of retaliation measures taken against the
whistleblower, (i) the measure is deemed void (e.g. in the case of
a termination of employment) and/or (ii) the person responsible for
the retaliation is obliged to restore legal compliance and will be
liable for compensation for material loss and personal impairment
suffered (e.g., in the case of disadvantageous or unfair
treatment).
BOSNIA AND HERZEGOVINA
Information current as of 09 January 2023
1. Current implementation status
N/A
Whistleblowing is only partially and briefly regulated by several
Company Law Acts (at entity levels), the Law on Protection of
Witnesses and several Laws on Public Service. At the state level,
the only applicable act is the Law on Protection of Individuals
Reporting Corruption in Institutions of BIH which was adopted in
2013. Apart from that, the Law on Protection of Individuals
Reporting Corruption has been adopted in Republic Srpska and in
Brcko Districit BIH. In FBIH, there is no such legislation.
2. What is the implementation period?
N/A
3. Is anonymous reporting permitted?
N/A
4. What is the range of the envisaged sanctions under
local law?
N/A
BULGARIA
Information current as of 10 July 2023.
1. Current implementation status
The EU Whistleblowing Directive is transposed into
national law with the new Whistleblower Protection Act
("WPA"), promulgated in State Gazette Nr. 11 of
03.02.2023.
2. What is the implementation period?
According to the supplementary provisions of the WPA the
act shall enter into force three months after its promulgation in
the State Gazette (e.g. May, 2023). However, the provisions for
establishing an internal whistleblower channel in private companies
with 50 to 249 employees shall enter into force as of Dec. 17,
2023.
3. Is anonymous reporting permitted?
The WPA does not allow anonymous reporting and explicitly
provides that no investigation shall be initiated upon the
submission of an anonymous signal. However, it also provides these
provisions are without prejudice and protection against retaliation
shall still be afforded to anonymous whistleblowers who have
submitted the anonymous report not under the WPA, but under another
legal act.
The new WPA supports the skeptical views on anonymous reports, already established in the existing sector-specific pieces of legislation governing whistleblowing. For more on this topic please see here.
4. What is the range of the envisaged sanctions under
local law?
The WPA contains different sanctions depending on the type
and the severity of the violation in question for the individual
involved.
Legal entities, who are required to establish internal channels for reporting, and failed to comply with this obligation, may be subject to administrative fine in the range BGN 5,000 – BGN 20,000 (approx. EUR 2,500 – EUR 10,000), respectively – BGN 10,000 – BGN 30,000 for repeated violation.
Reporting or publicly disclosing false information deliberately may be sanctioned with fine in the range – BGN 3,000 – BGN 7,000 (EUR 1,500 – EUR 3,500).
Sanction in the range BGN 400 to BGN 4,000 (EUR 200 to EUR 2,000) may be imposed for the following violations:
- of the confidentiality obligations;
- obstruction of the submission of a signal;
- failure or delay to take the necessary follow-up actions on the signal deliberately;
- failure to provide information on the follow-up of the whistleblower within three months.
A fine in the range BGN 2,000 – BGN 4,000 (approx. EUR 1,000 – EUR 2,000) may be imposed to person who: i) takes an action for the purpose of repression against the person who submitted the report or against a person related to him/her; or 2) initiates proceedings, if it is carried out with the sole intention of harming the whistleblower.
CROATIA
Information current as of 06 January 2023
1. Current implementation status
The EU Whistleblowing Directive is fully transposed in the
Croatian Act on Protection of Persons Reporting Irregularities
(Zakon o zaatiti prijavitelja nepravilnosti (OG 46/22); the
"Act"), which entered into force on 23 April 2022.
Croatia previously had legislation on whistleblower protection (Act on Protection of Persons Reporting Irregularities, OG 17/19), which was in force from 1 July 2019 to 22 April 2022.
2. What is the implementation period?
Already implemented.
3. Is anonymous reporting permitted?
The Act does not explicitly address this issue. However,
there are strong arguments in favour of the standpoint that
anonymous reporting is permitted. There is no specific regulatory
guidance about anonymous reporting at this time.
4. What is the range of the envisaged sanctions under
local law?
Failure to establish an internal reporting channel and
ensure its implementation (e.g. failure to adopt the relevant
internal bylaws, appoint a confidential person etc.), may trigger a
monetary fine up to approx. EUR 4,000 for the company and up to
approx. EUR 1,400 for the responsible person within the
company.
Retaliation or malicious actions of the company (e.g. disclosure of the identity of the reporting person without their consent, influencing the actions of the confidential person etc.) may trigger a monetary fine up to approx. EUR 6,600 for the company and up to approx. EUR 4,000 for the responsible person within the company.
CZECH REPUBLIC
Information current as of 03 July 2023
1. Current implementation status
The Whistleblowing Act implementing the Directive has been
approved by the Parliament and will come into force on 01 August
2023.
2. What is the implementation period?
There is no implementation period. The only exception is
for companies between 50-249 employees, which must establish a
whistle-blowing system by 15 December 2023.
3. Is anonymous reporting permitted?
No, the Whistleblowing Act does not explicitly allow
anonymous reporting. However, entities may voluntarily decide to
accept anonymous notifications and handle them either as prescribed
by the Whistleblowing Act or in line with their internal
regulations.
4. What is the range of the envisaged sanctions under
local law?
The Whistleblowing Act provides for a fine of up to EUR
2,100 for a false report. Responsible persons for handling reports
can be fined up to EUR 4,200 for breaching their duties. Entities
subject to the Whistleblowing Act can be fined up to EUR 42,000.
Further fines are:
- EUR 4,000 for a person who prevents another person from filing a report;
- EUR 4,200 for anyone subjecting another person or allowing another person to be subjected to retaliation measures; and
- EUR 3,400 for providing information which is likely to defeat or undermine the purpose of the report or reveals the identity of a whistle-blower or a person named in the report without their consent.
HUNGARY
Information current as of 24 April 2023
1. Current implementation status
The Hungarian Parliament adopted the whistleblowing act in
line with Directive (EU) 2019/1937 of the European Parliament and
of the Council on 11 April 2023, however, the President of the
Republic sent it back to Parliament for reconsideration. Parliament
shall deliberate the law once more and decide on whether to
implement the changes to the law recommended by the office of the
President, or to pass the law as is, over the President's
objections. (We note that the objections are not linked to the EU
Directive, but the higher protection of certain fundamental values
and rights laid down in the Fundamental Law of Hungary.)
2. What is the implementation period?
The act will enter into force on the 60th day following
its promulgation in the Hungarian Official Gazette.
The provisions are applicable
- from the 60th day after promulgation for employers with 250 or more employees;
- from the 60th day after promulgation for certain employers to whom specific legislation applies (e.g. money laundering law), irrespective of the number of employees;
- from 17 December 2023 for employers with at least 50 but no more than 249 employees.
3. Is anonymous reporting permitted?
Yes, however the employer may decide not to investigate
the anonymous report.
4. What is the range of the envisaged sanctions under
local law?
Monitoring the requirements of the internal reporting
channel shall be governed by Act CXXXV of 2020 on services and
subsidies promoting employment and on employment supervision, with
the exception that fines and disqualification from carrying out
activities shall not apply. Compliance with employers'
obligations shall be monitored by the employment inspection
authority.
The law on offences will protect against action being taken against a whistle-blower or obstructing whistle-blowers' attempts at making reports.
POLAND
Information current as of 24 July 2024
1. Current implementation status
The Act on the Protection of Whistleblowers (the
"Act") was published in the Official Gazette on June 24,
2024. The legislation is awaiting entry into force.
There are already specific provisions and sectoral arrangements
related to the reporting of breaches of the law and other
irregularities. These include, in particular, (i) provisions of
banking
law providing for the reporting of breaches or potential breaches
of banking law and Regulation (EU) No 575/2013; (ii) provisions of
the Trading in Financial Instruments Act compelling companies
operating in a regulated market to have procedures for the
anonymous reporting of any infringements of law, including
Regulation No 596/2014 and Regulation 600/2014; (iii) provisions of
the Act on the prevention of money laundering and terrorist
financing requiring obligated institutions to develop and implement
an internal procedure of anonymous reporting for actual or
potential breaches of the provisions in the field of combating
money laundering and terrorist financing.
2. What is the implementation period?
The Act will enter into force three months from the date
of promulgation, i.e., 25 September 2024, except for provisions on
external reporting, which will have an additional three months for
implementation, effective by 25 December 2024.
3. Is anonymous reporting permitted?
Anonymous reporting is permitted according to the Act.
Specifically, legal entities, the Ombudsman, and public authorities
can accept anonymous reports. However, entities that receive
reports will independently decide whether or not to consider
reports submitted anonymously.
4. What is the range of the envisaged sanctions under
local law?
The Act proposes differentiated sanctions, depending on
the severity of the violation in question for the individual
involved. As a general rule, a fine, restriction of freedom or
imprisonment is applicable, depending on the case. Penalties are
provided for impeding a report, retaliating against the individual
who made the report, revealing the identity of the individual who
made the report, falsifying reports, and failing to implement
internal procedures.
Under the Criminal Code, a fine will be imposed in daily rates by setting out a number of daily rates and the value of one daily rate; unless the law states otherwise, the minimum number of daily rates is 10, and the maximum is 540.When determining the daily rate, the court shall take into account the offender's income, personal and family situation, financial situation and earning capacity; the daily rate may not be lower than PLN 10 or higher than PLN 2,000. The maximum amount of the fine is PLN 1,080,000 (approx. EUR 249,000).
ROMANIA
Information current as of 09 January 2023
1. Current implementation status
The Romanian law transposing the EU Whistleblowing
Directive (i.e. Law No.361/2022 – the "Romanian
Whistleblowing Law") entered into force on 22 December
2022.
In terms of the history of the Romanian Whistleblowing Law, after a long period of having two drafts running in parallel via the legislative channels, one of these drafts was approved by the first chamber of the Romanian Parliament (Senate) on 18 April 2022 and by the second one (Chamber of Deputies) on 29 June 2022. The approved draft was challenged before the Constitutional Court, which ruled that the draft does not raise issues from the constitutional angle. In parallel, the President of Romanian refused promulgation and sent the draft for re-examination to the Senate. The Senate approved again the draft on 1 September 2022.
After securing certain positive opinions, the draft law was included on the agenda of the decisional chamber of the Parliament, the Chamber of Deputies, for the meeting on 4 October 2022. Up to mid-December 2022 there were no updates regarding the status, including why the draft was withdrawn on 4 October 2022 from the agenda of the Chamber of Deputies.
The draft was finally approved a second time by the decisional chamber of the Parliament, the Chamber of Deputies, on 13 December 2022, and it was promulgated by the President of Romania on 16 December 2022. Further, the law was published in the Official Gazette of Romania, Part I, on 19 December 2022, and entered into force in 3 (three) days after its publication, on 22 December 2022.
2. What is the implementation period?
According to the Romanian Whistleblowing Law, the
obligation to put in place internal reporting channels for entities
having between 50 and 249 employees is postponed to 17 December
2023. The reports in relation to which investigations were not
finalised by the entrance into force of the Romanian Whistleblowing
Law will remain regulated by the laws in effect upon reporting. The
existing law approved in 2004 is repealed upon entrance into force
of the Romanian Whistleblowing Law.
3. Is anonymous reporting permitted?
Yes. However, anonymous reporting will only be analysed to
the extent that it contains sound indications regarding a
breach.
4. What is the range of the envisaged sanctions under
local law?
The applicable sanctions are fines ranging from EUR 400 to
EUR 8,000.
SERBIA
Information current as of 06 January 2023
1. Current implementation status
At the moment, there are no indications that the currently
appliable Serbian Law on Protection of Whistleblowers from 2014
will be amended any time soon to implement the changes under the EU
Whistleblowing Directive.
2. What is the implementation period?
N/A
3. Is anonymous reporting permitted?
Yes. Under the currently appliable Serbian Law on
Protection of Whistleblowers, anonymous reporting is permitted.
4. What is the range of the envisaged sanctions under
local law?
Non-compliance with the Serbian Law on Protection of
Whistleblowers exposes an employer and its responsible person/s to
monetary fines ranging from approx. EUR 425 to approx. EUR 4,235,
and from approx. EUR 85 to approx. EUR 850, respectively. The
breaches include failure to adopt and/or publish a general
enactment on the procedure for internal whistleblowing, failure to
protect a whistleblower from harmful actions or not taking measures
to stop harmful actions, failure to provide written notification of
rights from this law to all employed persons, etc.
SLOVAKIA
Information current as of 11 July 2023
1. Current implementation status
Directive 2019/1937 of the European Parliament and of the
Council of 23 October 2019 on the protection of persons who report
breaches of Union law (the "Directive"), has been
transposed into the Slovak legislation (the "Amended
Act"). The Amended Act entered into force on 1 July 2023 (with
the exception of some provisions that will become effective on 1
September 2023). The Slovak Republic has had whistleblowing
legislation in place since 2015 and the overlap with the Directive
was significant.
2. What is the implementation period?
The Amended Act is effective as of 1 July 2023, with the
exception of some provisions that will become effective on 1
September 2023.
3. Is anonymous reporting permitted?
Anonymous reporting is permitted, and an anonymous
whistleblower whose identity has subsequently been revealed is
protected.
4. What is the range of the envisaged sanctions under
local law?
Under the Amended Act, a fine of up to EUR 6,000 can be
imposed for penalising a whistleblower or for breaching the
confidentiality of the whistleblower's identity. Furthermore, a
fine of up to EUR 20,000 may be imposed for violation of the
obligations under the Amended Act. Effective as of 1 September
2023, penalties for infringement of the obligations under the
Amended Act are to be increased and will range between EUR 30,000
and EUR 100,000 (depending on the size of the company and the
seriousness of the offences).
SLOVENIA
Information current as of 15 February 2023
Status: The Directive 2019/1937 of the European Parliament and of the Council of 23 October 2019 on the protection of persons who report breaches of Union law ("Directive") has been transposed into Slovenian legislation. The Slovenian Parliament has adopted the Whistleblower Protection Act which will enter into force on 22 February 2023.
1. Current implementation status
The Whistleblower Protection Act was adopted by the
Parliament on 27 January 2023 and represents the first uniform
legislation governing whistleblower protection in Slovenia.
Slovenian legislation has previously regulated the protection of
whistleblowers in a rather fragmented manner, with individual
provisions in several sectoral laws, such as the Integrity and
Prevention of Corruption Act, Market in Financial Instruments Act,
Criminal Code, Slovenian Sovereign Holding Act, Banking Act, and
many others that are still in force.
2. What is the implementation period?
The Whistleblower Protection Act will enter into force on
22 February 2023. However, entities in the private sector employing
250 or more employees are obliged to set up an internal reporting
channel within 90 days from the date of the entry into force of the
act, i.e. by 23 May 2023,. while all other entities must comply
with this obligation by 17 December 2023. The Slovenian Commission
for the Prevention of Corruption needs to establish a reporting
information system within one year from entry into force.
3. Is anonymous reporting permitted?
Yes, the Act provides the protection of an anonymous
whistleblower whose identity has subsequently been revealed. Other
valid legislative acts also mostly protect anonymous
whistleblowers.
4. What is the range of the envisaged sanctions under
local law?
For serious offences, fines range between EUR 5,000 and
EUR 20,000; EUR 10,000 and EUR 60,000 for companies (depending on
their size) and, additionally, between EUR 300 and EUR 2,500 for
their responsible persons.
UKRAINE
Information current as of 05 January 2023
1. Current implementation status
N/A
Whistleblowing regarding corruption matters is regulated by the Law
of Ukraine "On Prevention of Corruption" (the
"Law"). The Law came into force on 26 October 2014 and
has been amended several times since then.
2. What is the implementation period?
N/A
3. Is anonymous reporting permitted?
Under the Law, anonymous reporting is permitted.
4. What is the range of the envisaged sanctions under
local law?
A fine in the amount of up to approx. EUR 1,100 together
with deprivation of the right to hold certain positions or engage
in certain activities for a period of one year can be imposed for
the unlawful disclosure of information about the whistleblower,
his/her close persons or information that may identify the
whistleblower, his/her close persons.
Unlawful dismissal of a whistleblower due to his/her reporting of
corruption or corruption-related offenses may lead to a fine up to
approx. EUR 1,300. Alternatively, such types of criminal liability
such as the deprivation of the right to hold certain positions or
engage in certain activities for up to three years or correctional
labour for up to two years can be imposed.
The content of this article is intended to provide a general guide to the subject matter. Specialist advice should be sought about your specific circumstances.
