- White Paper
Expert Guide: Whistleblowing Laws in the European Union
A glance at the implementation of the EU Whistleblowing Directive in EU Member States
Content of this White Paper:
- Overview of the requirements of the EU Whistleblowing Directive
- National whistleblowing legislation throughout the EU
- EU Whistleblowing Directive transposition status by country
- Tips on fulfilling local whistleblowing requirements
- How speak-up culture works
- How to implement a whistleblowing system
Legal situation as of February 2024 and subject to change. This document will be updated accordingly.
In April 2018, the EU Commission launched a proposal for a directive aimed at providing uniform protection for whistleblowers and a provisional agreement was reached between member states and the European Parliament in March 2019. Adopted as Directive 2019/1937, the EU Whistleblowing Directive aims to provide common minimum standards of protection for whistleblowers across the EU and seeks to bring an end to a confusing patchwork network of national protection legislation. Most EU member states failed to meet the 17 December 2021 transposition deadline but steady progress was finally seen throughout 2023. Given the legislation’s ramifications for companies, this guide leverages EQS Group’s expert partner network to paint the most comprehensive picture possible of the ongoing transposition process around the continent.
While the White Paper takes a deep dive into the legislative process around Europe, a basic overview of the situation at country level can be found below:
Austria
Implemented
Austria’s parliament approved the country’s new whistleblowing law in February 2023. The “HinweisgeberInnnenschutzgesetz” or “HSchG” transposes the EU Whistleblowing Directive into national law. With its promulgation, the law came into force on February 25, 2023. The law provides a transitional period of six months for legal entities with 250 or more employees to set up internal whistleblowing systems.
Belgium
Implemented
The Belgian Chamber of Representatives has passed a bill proposed by Federal Employment Minister Pierre-Yves Dermagne giving better protection to whistleblowers with its French and Flemish titles translating to the “Draft Act on the Protection of Persons Reporting Violations of Union or National Law Within a Private Sector Legal Entity”. It saw the EU Whistleblowing Directive transposed into the Belgian legal system and the new measures came into force for companies with at least 250 employees in February 2023. Organisations with at least 50 employees had to comply by December 2023.
Bulgaria
Implemented
After it failed to adopt a new whistleblowing law in December 2022, Bulgaria’s National Assembly approved the legislation on 27 January 2023. It adopted the EU Whistleblowing Directive’s minimum standards for protecting persons reporting breaches of EU law and came into force on 4 May 2023, while the provisions establishing obligations for employers in the private sector with between 50 and 249 employees applied from 17 December 2023. One of the key differences to previous proposals is that the Personal Data Protection Commission has been designated to receive and process external reports.
Croatia
Implemented
After two readings in late 2022, the Croatian parliament adopted “the Croatian Whistleblower Protection Act” which transposed the EU Whistleblowing Directive. It closed loopholes in the country’s previous whistleblower legislation and incorporated extended mechanisms, bringing Croatia in line with the new European protection standard.
Cyprus
Implemented
The EU Whistleblowing Directive was transposed in Cyprus on 04 February 2022 when the “Protection of Persons Reporting Breaches of Union and National Law in the Official Gazette” was published. It introduced a range of new internal and external reporting provisions as well as extensive protective measures for private and public sector whistleblowers.
Czech Republic
Implemented
In November 2022, the Czech government approved a new draft bill on the protection of whistleblowers to transpose the EU Whistleblowing Directive into national law. The new Whistleblower Act implementing the EU Whistleblowing Directive was passed in early June 2023 and came into force on August 1st of that year.
Denmark
Implemented
Copenhagen passed its Whistleblower Protection Act (Lov om beskyttelse af whistleblowere) on 24 June 2021 obliging all employers with more than 50 employees to set up a whistleblowing system. Denmark is notable for being the very first EU member state to transpose the EU Whistleblowing Directive into national law.
Estonia
In progress
The transposition process in ongoing in Estonia where a new protection bill passed the first reading in parliament at the start of 2022. It has received heavy criticism and hundreds of amendments and its planned entry into force on 1 June 2022 did not occur. The frustrating process is exacerbated by the fact that there is no joint and cross-sectoral valid regulation for whistleblower protection in Estonian law.
Finland
Implemented
Finland has transposed the EU Whistleblowing Directive and the new national legislation entered into force on 1 January 2023. It substantially enhances protection for whistleblowers and enables employers to receive and address suspected cases of wrongdoing. Private entities with 250+ employees and public entities with at least 50 staff members were obliged to establish internal reporting channels channels by 1 April 2023. Private sector organisations with between 50 and 250 employees had to complete the process by 17 December 2023.
France
Implemented
After several months of parliamentary discussions and a positive ruling by the French Constitutional Council, the law transposing the EU Directive was passed in France. It amends the existing Sapin 2 law, covering all entities with 50 or more employees, public or private. Officially entitled “LOI n° 2022-401 du 21 mars 2022 visant à améliorer la protection des lanceurs d’alerte”, the new law is a considerable improvement on Sapin 2, and it brings France in line with the rest of Europe in terms of whistleblower protection.
Germany
Implemented
Germany’s Federal Cabinet passed a government draft for the Hinweisgeberschutzgesetz or Whistleblower Protection Act in July 2022 and it was passed in the Bundestag on 16 December 2022. The Bundesrat rejected the law in February 2023. In a second approach in July 2022, Germany’s Federal Cabinet passed a government draft for the Hinweisgeberschutzgesetz or Whistleblower Protection Act. The new measures came into force at the beginning of July 2023.
Greece
Implemented
After a sluggish transposition process that was criticised for a lack of transparency, Greece’s draft whistleblower protection legislation was submitted to parliament on 31 October 2022. On 11 November 2022, it was passed and is now in force with two different implementation dates. That means that Greek organisations will have to implement a number of new compliance measures before the middle of 2023.
Hungary
Implemented
Hungary was the last EU member state to get its EU Whistleblowing Directive transposition process underway and a proposal for a new law was finally submitted to parliament on 28 February 2023. The transposition process in Hungary has been delayed and complicated. The new Whistleblower Protection Act to implement the EU Whistleblowing Directive in Hungary was finally passed at the end of May 2023 and it entered into force in July 2023.
Ireland
Implemented
After missing the original deadline, Ireland transposed the EU Whistleblowing Directive after passing the Protected Disclosures (Amendment) Bill 2022 in July 2022. It substantially extends the scope of protection by providing greater clarity for both whistleblowers and employers. A key aspect of the amendment involves the introduction of formal reporting channels at companies that will be monitored and enforced by the Inspectorate of the Workplace Relations Commission. Ireland’s new measures came into force on 01 January 2023.
Italy
Implemented
In September 2022, the Italian government approved a new delegation law whereby a draft bill transposing 14 Directives, including the Whistleblowing Directive, must be completed within a three-month period and this also applies to the government recently elected. On 09 December 2022, the Council of Ministers met and approved the delegation law and parliament committees have 60 days to review it. The legislation received the green light in March 2023.
Latvia
Implemented
In 2018, Latvia adopted a whistleblowing law that had numerous flaws. These were addressed when Riga transposed the EU Whistleblowing Directive on 20 January 2022 with the new measures entering into force on 04 February 2022. While the new legislation implements the requirements of the Directive, improvements have not been ruled out in the future, such as the introduction of a whistleblower reward mechanism.
Lithuania
Implemented
Like neighbouring Latvia, Lithuania had legislation dedicated to the protection of whistleblowers in place before the adoption of the EU Whistleblowing Directive. Amendments were then made to the existing legal framework and the changes came into force in February 2022, transposing the EU legislation into national law.
Luxembourg
Implemented
Shortly after the EU Whistleblowing Directive deadline expired in late 2021, Luxembourg’s government issued a draft law for its transposition. The Whistleblower Protection Act was passed in Luxembourg in mid-May 2023. The “Loi du 16 mai 2023 portant transposition de la Directive (UE) 2019/1937 du Parlement européen et du Conseil du 23 octobre 2019 sur la Protection des personnes qui signalent des crimes du droit de l’Union” exceeds the minimum requirements of the directive as expected and includes a broad definition of whistleblowers. It also offer a point of contact to support whistleblowers.
Malta
Implemented
Whistleblower protection legislation has been in place in Malta since 15 September 2013 in the form of “the Whistleblower Act (Cap 527”). Valetta amended it in December 2021, passing a bill called the “Protection of the Whistleblower (Amendment) Act 2021” which transposed the Directive, strengthening and expanding protection for whistleblowers.
The Netherlands
Implemented
The Netherlands finally transposed the EU Whistleblowing Directive in January 2023 and its new national legislation introduces a swathe of requirements such as updated whistleblowing procedures, anonymous reporting and the appointment of an independent reporting body. The previous Wet Huis voor klokkenluiders or Dutch Whistleblower’s Authority was criticised for numerous weaknesses and the new law has seen it renamed the Wet Bescherming Klokkenluiders.
Poland
In progress
Poland missed the original deadline and its new government has announced its commitment to the Directive’s transposition. The Polish Act on the Protection of Persons Who Report Breaches of Law, known as the “Whistleblower Act,” will regulate the procedure for reporting breaches of law and the protection of those reporting them.
Portugal
Implemented
An early transposer of the EU Whistleblower Directive, Portugal implemented the new measures on 20 December 2021 through Proposta de Lei 91/XIV and they came into force on 18 June 2022. The Portuguese government took the transposition process extremely seriously behind the scenes and it was characterised by speed and a lack of publicity.
Romania
Implemented
Romania was among the countries that missed the initial EU Whistleblowing Directive transposition deadline and after numerous delays an improved version of a national whistleblowing law was adopted by parliament on 13 December 2022. It entered into force on 22 December 2022 and required regulated entities to implement whistleblowing channels by 6 February 2023. There are still concerns about the new legislation, particularly in the area of anonymous reporting which falls short of meeting international best practice principles.
Slovakia
Implemented
Slovakia established its existing measures to protect whistleblowers on the basis of Whistleblowing Act No.54/2019 Coll on the protection of persons reporting anti-social activities which replaced previous legislation from 2014. The new Whistleblower Law was passed on May 10, 2023 and added national law to the previous law, which was already broadly in line with the requirements of the Directive. Despite the progress, a change of government in Bratislava and a swathe of legal reforms will likely weaken Slovakia’s whistleblower protection standards.
Slovenia
Implemented
After a series of proposals were circulated and numerous delays, Slovenia finally passed its Whistleblower Protection Act on 27 January 2023, transposing the EU Whistleblowing Directive. The country previously had limited measures in place protecting whistleblowers, but they fell short of the Directive’s requirements. The new law now broadens protection and brings Slovenia into line with the latest European standards.
Spain
Implemented
Spain’s Ministry of Justice started working on a draft law in mid-2020 and it was open to public consultation until late January 2021. On 14 September 2022, the Spanish government approved the new whistleblower protection legislation but 25 Civil Society Organisations called on it to be urgently amended, holding up the transposition process. It was finally completed on 21 February 2023 when the new law was published in Spain’s Official State Gazette.
Sweden
Implemented
After Denmark, Sweden became the second EU member state to transpose the Directive. The Genomförande av visselblåsardirektivet was approved in late September 2021 before coming into force on 17 December 2021. Sweden did have measures in place beforehand, but they had no clause guaranteeing anonymity and confidentiality, a major flaw that was rectified by the implementation of the new EU legislation.
A glance across the EU border
Switzerland
Will not be implemented
Swiss companies with EU branches with 50 or more employees that are subject to EU law must take action and implement internal reporting channels under the Directive. Organisations in Switzerland that are not directly impacted by the Directive are nevertheless advised to comply with it in order to demonstrate good governance and uncover wrongdoing at an early stage to minimise any ensuing damage.
United Kingdom
Will not be implemented
The UK has no legal obligation to transpose the EU Whistleblowing Directive following Brexit but like Switzerland, the new measures will apply to UK businesses operating in mainland Europe above a certain size. The UK does have its own national whistleblower protection legislation in the form of PIDA which has been criticized as being outdated and overly complex.
Acknowledgements
EQS Group would like to thank the following organisations for their comprehensive insights and assistance in compiling this guide:
Download the Expert Guide for a more comprehensive country-by-country analysis
Register now for our Compliance News Service and receive relevant news from compliance, whistleblowing and business ethics. After successful registration for the Compliance News Service, you will receive the link to the white paper via e-mail. You can unsubscribe from the news at any time.
