EUROPEAN COMMISSION Brussels, 23.4.2018 SWD(2018) 116 final COMMISSION STAFF WORKING DOCUMENT



IMPACT ASSESSMENT

Accompanying the document Proposal for a Directive of the European Parliament and of the Counci on the protection of persons reporting on breaches of Union law

{COM(2018) 218 final}

{SWD(2018) 117 final}



Table of Contents 1.Introduction: EU policy context 2.Problem definition 2.1 Whistleblower protection as one upstream component of enforcement of EU law 2.2 Who is a 'whistleblower' 2.3 How whistleblowing works – reporting channels 2.4 Underreporting of violations of EU law: magnitude of the problem and drivers A. Fear of retaliation B. Lack of sufficient protection at national and EU level C.Lack of effective implementation: low awareness and socio-cultural factors 2.5 Identification of acts and areas where whistleblower protection needs to be introduced as an enforcement tool of EU law 2.5.1. Acts and areas where the added value of EU whistleblower protection as an enforcement tool of EU law is already acknowledged 2.5.2. Areas where the necessity of introducing EU whistleblowing rules as an enforcement tool of EU law is proven 2.5.3.Areas where the case for introducing EU whistleblowing rules as an enforcement tool of EU law could be made in the future – need for "future-proof" EU action 2.6Baseline scenario 3.Need for action at EU level 3.1Subsidiarity: why is the EU better placed to take action? 3.2Legal bases 4.Objectives

5.Policy Options 5.1 Design of the policy options – Common minimum level of protection 5.2Assessed policy options 5.2.1Policy option 1: Baseline scenario – maintaining the status quo 5.2.2.Policy option 2: Commission Recommendation providing guidance to Member States on key elements of whistleblower protection complemented by flanking measures to support national authorities 5.2.3Policy Option 3: Directive introducing whistleblower protection in the area of the financial interests of the Union, complemented by a Communication setting a policy framework at EU level, including flanking measures to support national authorities 5.2.4Policy option 4: Directive introducing whistleblower protection in certain areas of EU law 5.2.5Policy Option 4 Sub option 1: Directive under policy option 4 complemented by a Communication setting a policy framework at EU level, including flanking measures to support national authorities 6.Impact of the Policy Options: Assessment 6.1 Methodology and baseline 6.2 Assessment of the Impacts 6.3 Analysis of the policy options 6.3.1. Policy Option 2: Commission Recommendation providing guidance to Member States on key elements of whistleblower protection complemented by flanking measures to support national authorities 6.3.2. Policy Option 3: Directive introducing whistleblower protection in the field of the financial interests of the Union complemented by a Communication providing guidance to Member States on key elements of whistleblower protection as well as flanking measures to support national authorities 6.3.3. Policy option 4: Directive introducing whistleblower protection in certain areas of EU law 6.3.4. Policy option 4 Sub option 1: Directive under policy option 4 complemented by a Communication providing guidance to Member States on key elements of whistleblower protection as well as flanking measures to support national authorities 6.4 How do the options compare? 7.Identification of the preferred option: Option 4, sub option 1 – Analysis and overall impacts 7.1 Analysis 7.2 A balanced approach

7.3Measures of whistleblower protection granted by the preferred option 7.4Proportionality of the preferred option 7.5Legal basis of the preferred option 7.6Coherence with existing and future EU rules 7.7Impact on SMEs 8.Monitoring and Evaluation Glossary Term or acronym Meaning or definition ACFE Association of Certified Fraud Examiners Charter Charter of fundamental rights of the European Union CJEU Court of Justice of the European Union CoE Council of Europe Commission European Commission Council Council of the European Union DG TAXUD Directorate General for Taxation and Customs Union – European Commission DG JUSTICE Directorate General for Justice and Consumers – European Commission ECHR European Convention on Human Rights ECtHR European Court of Human Rights EMA European Medicines Agency EPPO European Public Prosecutor Office FCA United Kingdom’s Financial Conduct Authority GBES Global Business Ethic Survey GCB Transparency International Global Corruption Barometer GDP Gross Domestic Product ICC International Chamber of Commerce MCA British Maritime and Coastguard Agency NHS United Kingdom’s National Health Service OECD Organisation for Economic Co-operation and Development OLAF European Anti-Fraud Office OPC Open Public Consultation PCaW Public Concern at Work PWC Global Economic Crime Survey SME Small and Medium-sized Enterprises TEU Treaty on the European Union TFEU Treaty on the Functioning of the European Union UNODC United Nations Office on Drugs and Crime UNCAC United Nations Convention against Corruption VAT Value Added Tax 1.Introduction: EU policy context The crucial importance of effective whistleblower protection for safeguarding the public interest has generated significant debate at EU level. The European Parliament, most recently in its resolution of 24 October 2017, on legitimate measures to protect whistle-blowers acting in the public interest when disclosing confidential information of companies and public bodies, called on the Commission to present, by end 2017, a horizontal legislative proposal establishing a comprehensive common regulatory framework which will guarantee a high level of protection for whistleblowers in the EU, in both the public and private sectors, as well as in national and EU institutions. The Council encouraged the Commission to explore the possibility for future action at EU level in its Conclusions on tax transparency of 11 October 2016 . Lack of effective protection of whistleblowers as journalistic sources raises growing concerns as regards its negative impacts on freedom of expression, enshrined in Article 11 of the EU Charter of Fundamental Rights ("Charter"), and on the "watchdog" role of investigative journalism . Civil society organisations and trade unions, such as Transparency International, Eurocadres, the European Public Service Union and the European Federation of Journalists, have consistently called for an EU-wide legislation on the protection of whistleblowers acting in the public interest . The Commission has expressed its full support for the protection of whistleblowers and introduced rules on whistleblower protection in different sectorial instruments. In 2016, it announced that it would assess the scope for horizontal or further sectorial EU action with a view to strengthening the protection of whistleblowers. This commitment was affirmed by President Juncker in the Letter of Intent complementing his 2016 State of the Union speech and in the 2017 Commission Work Programme. Protecting whistleblowers helps detect violations and abuse of the law harming the public interest. Lack of whistleblower protection can therefore lead to under-detection of these violations and under-enforcement of the law. To address this, several Member States have introduced measures to protect whistleblowers. The Treaty does not provide for a specific legal basis for the EU to regulate in general the legal position of whistleblowers. In particular, freedom of expression, as enshrined in the Charter, cannot serve as a standalone legal basis. However, the problem of lack of whistleblower protection also has an EU dimension, as it can also impair the effective enforcement of EU law. Alongside other means, such as complaints and audits, reports by whistleblowers, who are in a privileged position to reveal violations from inside their work-based context, can feed national and EU enforcement systems with information leading to effective detection, investigation and prosecution of violations of EU rules. In its 2016 Communication on “EU Law: Better Results through Better Application” , the Commission noted that enforcing EU law remains a challenge and set out its commitment to put "a stronger focus on enforcement in order to serve the general interest". In particular, it highlighted that "the effective enforcement of EU rules - from the fundamental freedoms, food and product safety to air quality to the protection of the single currency - matters to Europeans and affects their daily lives. It serves the general interest. Often, when issues come to the fore - car emission testing, water pollution, illegal landfills, transport safety and security - it is not the lack of EU legislation that is the problem but rather the fact that the EU law is not applied effectively. That is why a robust, efficient and effective enforcement system is needed to ensure that Member States fully apply, implement and enforce EU law […]". The EU legislator has introduced whistleblower protection in areas where it appeared urgent to ensure the effective implementation of EU law. For instance, following the financial crisis, which exposed serious shortcomings in the enforcement of EU rules on financial services, measures of protection of whistleblowers were included in the EU financial services acquis, ranging from rules on audit to rules on market abuse. Further examples are the introduction of whistleblower protection in legislation ensuring a high level of safety in civil aviation and maritime transport and in recommendations related to fighting corruption addressed to Member States in the context of the European Semester. The whistleblower protection currently available across the EU is uneven. Whistleblower protection standards are set out in international instruments and guidelines such as the 2004 UN Convention against Corruption (UNCAC), to which all Member States as well as the EU are parties, and the 1999 Council of Europe Civil and Criminal Law Conventions on Corruption. In its 2014 Recommendation on Protection of Whistleblowers, the Council of Europe recommended that “member states have in place a normative, institutional and judicial framework to protect individuals who, in the context of their work based relationship, report or disclose information on threats or harm to the public interest" and set out principles to guide States when introducing or reviewing such frameworks. Some of these principles have been taken up by a number of EU Member States in recent years. However, overall, only ten Member States have in place dedicated legislation covering employees both in the public and the private sector in all areas of national law. In many Member States, protection is only provided in the context of the fight against corruption or only for public servants. A large number of Member States are currently considering new legislation with a view to introducing or strengthening whistleblower protection. However, even the legislative projects envisaged do not point to a convergence based on uniform standards across the EU.

Recent scandals with cross-border impacts unveiled by whistleblowers, illustrate how insufficient protection of whistleblowers in a given Member State can have negative impacts not only on the functioning of EU policies in that Member State, but also spill-over impacts in other Member States and the EU as a whole, considering that violations and abuse of EU law reported by whistleblowers typically are of a cross-border nature or, even when purely national, have a cross-border impact. Uneven protection of whistleblowers across the EU can undermine the level-playing field needed for the internal market to properly function and for business to operate in a healthy competitive environment; it can result in unsafe products placed on the internal market, in pollution of the environment or other risks for public health and transport safety which go beyond national borders; and it means that whistleblowers in cross-border situations can "fall through the cracks" and suffer retaliation for seeking to protect the public interest. These were also the concerns expressed in the responses to the Commission’s 2017 open public consultation (OPC) , which revealed very strong support for setting legally binding minimum standards on whistleblower protection in EU law (96% of respondents), particularly in the areas of the fight against fraud and corruption; the fight against tax evasion and avoidance; the protection of the environment, and the protection of public health and safety. Despite any progress that may take place in certain Member States, gaps and unevenness of whistleblower protection in areas where lack of effective enforcement has negative cross-border impacts are bound to persist. It is therefore evident that only EU action can ensure a consistent high level of protection across the EU. It is also clear that the EU legislator needs to act proactively. Typically, Member States have introduced whistleblower protection following disasters and scandals which could have been prevented if persons who had insider information on threats or harm to the public interest had felt safe to report them. The introduction of whistleblower protection in the EU financial services sector is a similar case. This past experience at national and EU level attests to the need to use the potential of whistleblower protection as a component of enforcement of EU law not only ex-post in areas where instances of serious harm to the public interest have already occurred, but also preventively. In light of this institutional context and of past experience at national and EU level, strengthening whistleblower protection as a means of enhancing the enforcement of EU law is justified and proportionate in those areas where i) there is a need to strengthen enforcement; ii) underreporting by whistleblowers is a key factor affecting enforcement, and iii) violations of EU law that may result in serious harm to the public interest. Such an approach will ensure that the intervention focuses on areas with a clear EU dimension and where the impact on enforcement is the strongest. 2.Problem definition 2.1 Whistleblower protection as one upstream component of enforcement of EU law As set out in the introduction, many recent scandals with cross-border impacts derive from lack of effective enforcement of EU law, pointing to the need to strengthen the enforcement capacity of EU and national enforcement systems. Violations or abuse of EU law which can cause harm to the public interest can take many forms, such as fraud, corruption or wrongdoing – deliberate (malpractice) – or not (negligence). A number of actions have been taken to improve the EU and national capacity to detect, prosecute and deter violations of EU law. In 2017, for instance, the EU adopted the Directive on the protection of the financial interests of Union aimed at ensuring the sound financial management of EU funds and at supporting the actions of the European Anti-Fraud Office (OLAF) in combating fraud and irregularities in the implementation of the EU budget. Besides reinforcing the legislative framework, the EU has also empowered national and EU monitoring mechanisms and enforcement bodies – such as the anti-corruption bodies – to conduct effective investigations. The European Public Prosecutor Office (EPPO) was precisely created to investigate and prosecute the perpetrators of offences against the Union's financial interests and thus reinforce national law-enforcement efforts to counter EU fraud. In many sectors, EU enforcement agencies have been created to prevent and detect violations of EU law, such as the European Aviation Safety Agency (EASA). National enforcement authorities have been created and supported through EU networks, such as for instance the European Union Network for the Implementation and Enforcement of Environmental Law. Access to evidence triggering effective investigations and prosecutions is one of the pillars which enforcement action relies upon. A comprehensive system of collection of evidence is thus a pre-requisite for an effective enforcement of EU law. The EU has provided citizens with numerous complaint mechanisms and has established statutory audits in certain business sectors aimed at preventing or detecting malpractices which could distort competition and more generally affect the proper functioning of the internal market. Whistleblowing is one more upstream component of the enforcement system, another tool for detecting violations of the law. Available evidence is particularly strong in relation to fraud. For instance, the 2007 Global Economic Crime Survey (PWC, 2007) , based on 5.400 companies worldwide, had found that whistleblowers helped to detect more fraud than corporate security, audits, rotation of personnel, fraud risk management and law enforcement combined. According to a 2016 study analysing more than 2400 cases of fraud in 114 countries, about 40% of all detected fraud cases are uncovered by whistle-blowers . OECD (2016) found that the type of corporate misconduct most often reported via internal company mechanisms was fraud (over 40%). Between 1986 and 2009, the United States recovered more than US$ 24 billion thanks to the whistleblowing law “False Claims Act”. According to the 2014 and 2016 Global Fraud Reports, the average percentage of fraud uncovered by whistleblowers, across countries and across sectors, is 41%. Whistleblowers were the single most effective way to uncover fraud (41%), followed by 31% through external audit and 25% through internal audit. Figure 2.1 shows that 42% of companies use the monitoring of whistleblowing hotline reports to assess the effectiveness of compliance programmes. Figure 2.1 – Source: PWC (2016) – Adjusting the lens on economic crime. Preparation brings opportunity back into focus, Global Crime Survey 2016 In certain areas, violations of EU law are often difficult to unmask since evidence is difficult to collect. Reports by whistleblowers with insider access to such evidence can be crucial in those cases. Consequently, ensuring that whistleblowers feel safe to report can feed enforcement action and enhance its effectiveness (see Figure 2.2). The added value of whistleblower protection in terms of increasing reports and detection of violations of law is evidenced by Member States already having a system of whistleblower protection. For instance, in its last report on implementation of its whistleblower protection law (The Public Interest Disclosure Act of 1998), the UK exemplified that providing for a comprehensive system of protection leads to an increase of reports: the law adopted in 1998 had increased the willingness to report suspected fraud, bribery or corruption and while 54% of surveyed senior executives in the rest of Europe said they would report such a case, in the UK, the figure was significantly higher (86%). In Italy, following the introduction of rules on whistleblower protection in 2015, reports to the Anti-corruption agency increased significantly: from 16 in 2014 to 200 in 2015; in the first five months of 2017, already 263 were received. In Ireland, Transparency International reports that the enactment of whistleblowing legislation in 2014 was followed by an increase of 115% in persons demanding specialist legal advice or guidance since 2011. Figure 2.2 – Source: European Commission - The role of whistleblowing in the enforcement chain

2.2 Who is a “whistleblower” There is no common definition of “whistleblowing” at international level or between the Member States with adopted legislation on that topic. However, the baseline for defining whistleblowers and for setting EU standards can be found in the 2014 Council of Europe Recommendation which draws upon the case law of the European Court of Human Rights (ECtHR) on the right to freedom of expression. The Council of Europe defines whistleblowers as any person who reports – within an organisation or to an outside authority – or discloses – to the general public – information on a threat or harm to the public interest in the context of their work-based relationship, whether in the public or private sector. The material scope of the protection is thus defined vis-à-vis reporting acts or omissions that threaten or harm the public interest. Effective protection of the public interest requires that the information reported which qualifies for protection (the so-called “protected disclosures”) can be broad, also covering acts or omissions which may not be strictly illegal, but which nevertheless represent a threat or harm to the public interest (“wrongdoing”). The Council of Europe underlines that while the notion of public interest should be generally understood as the “welfare” or “well-being” of the general public or society and, in many areas, such notion would be common between Member States, in other areas there may well be a difference of appreciation. Thus, it intentionally refrains from defining what constitutes the public interest, providing instead a non-exhaustive list of categories of content that is typically considered as a subject of protected disclosures. These include: corruption and criminal activity; violations of the law and administrative regulations; abuse of authority/public position; risks to public health, food standards and safety; risks to the environment; gross mismanagement of public bodies; gross waste of public funds; a cover-up of any of the above. The Council of Europe Recommendation takes a broad approach to the personal scope of whistleblower protection, noting that the underlying reasons for recommending protection to whistleblowers is their position of economic vulnerability vis-à-vis the person on whom they depend for work, which goes beyond the classic definition of “employee”. Clearly, employees are the most vulnerable category to suffer retaliation, given the definite power imbalance in the employment relationship. Retaliation can occur in many different forms, including suspension, lay off or dismissal; demotion or loss of opportunities and transfer of duties; coercion, intimidation or harassment; ostracism at the workplace; discrimination; blacklisting on the basis of a sector or industry-wide informal or formal agreement, which entails that the person will not, in the future, be economically active in that sector or industry; damage to their reputation and threats of retaliation. However, also persons in other types of work-based relationship (such as suppliers, contractors, self-employed persons providing services, business partners, etc.): owitness malpractice that would be in the public's interest to report : Evidence suggests for instance that suppliers are more likely to observe bribery and corruption than non-suppliers, whilst in specific areas such as product safety their reporting has high added value, since they are much closer to the source of possible unfair and illicit manufacturing, import or distribution practices of non-compliant products, and, osuffer retaliation. This can take the form, for instance, of early termination or cancellation of their contract of services, licence or permit, loss of business, loss of income, blacklisting; damage to their reputation. Also these categories of persons should have at their disposal remedial measures against such forms of retaliation. The Council of Europe, therefore, uses the notion of “work-based relationship” to comprise all individuals who by virtue of a de facto working relationship (paid or unpaid) are in a privileged position vis-à-vis the access to information and may witness or identify wrongdoings at a very early stage. In this notion it includes temporary and part-time workers, past employees, trainees and volunteers, whilst recommending extending protection to consultants, freelance and self-employed persons, contractors and sub-contractors and job applicants. Moreover, it is important to make a distinction between whistleblowers – who report violations which affect the public interest – and other categories of complainants, such as aggrieved workers, whose reports relate to personal grievances or breaches of individual working conditions (public v. private interest). Whistleblowers are also to be distinguished from complainants who might be clients or citizen bystanders and who do not fear retaliation in relation to their complaint. The key distinguishing criterion is the lack of work-based connection between the latter and the reported person. It is because of their work-based relationship and the related risk of sanctions – for example, for breaching the duty of confidentiality – that whistleblowers require specific legal protection, so that they can feel safe to “raise the alarm”. When there is no a power imbalance between the reporting and the reported person, there is no need for protection against retaliation. Finally, protection of whistleblowers from work-related retaliation should be distinguished from protection against threats of physical harm which are most likely to arise in cases where they report information related to organised crime. In such cases, protective measures should be available to them, but these should be provided by the police or under “witness protection” laws relevant for criminal proceedings. Figure 2.3 – Source European Commission – Personal scope of whistleblower protection 2.3 How whistleblowing works – reporting channels Whistleblowers tend to persevere in reporting directly to their employers. The majority of workers raise concerns about illegal activities inside the organisation first and they only blow the whistle outside the organisation if they experience organisational retaliation or the concerns are not acted upon. A study for the French Ministry of Labour and representative of employees in France found that 57% of workers who reported information disclosed first the information to a colleague and 48% to a direct manager. Within a sample of 1,000 callers to their advice line, Public Concern at Work, a UK whistleblowing charity (PCaW), found that line managers and managers in higher position are the first recipients of workers’ concerns, in 74% of the cases when the concern is reported the first time, at the second attempt higher managers play a bigger role. Whistleblowers will often persevere with their reporting if they do not see action being taken. PCaW found that 56% of whistleblowers report their concern within their organisations on more than one occasion. External reporting (i.e. to regulators or independent bodies) increases dramatically at the third attempt, suggesting that reporters are facing forms of resistance within their organisations. The first report was made internally in 91% of cases, a proportion that fell to 73% and 60% in the second and third attempt respectively. A 2015 survey of UK National Health Service (NHS) staff found that 96.6% of staff who raised a concern did so internally and concerns were raised on more than one occasion: 41.7% of staff raised their concern in 2-3 occasions, 15.7% in 4-8 occasions, 6.7% more than 9 times . In terms of areas where reports are made, 13 of the 26 public authorities that responded to the 2017 Commission’s targeted consultation on whistleblower protection reported 7,059 cases from the previous 10 years related to tax evasion, tax avoidance, fraud, irregularities or any other illegal activities affecting the financial interests of the EU, money laundering, mismanagement of public funds, misuse of personal data, threats to public health and the environment, violations of human rights in general and violation of financial regulations.

2.4 Underreporting of violations of EU law: magnitude of the problem and drivers As evidenced in Section 2.1, reporting by whistleblowers is one of the upstream components of enforcement of EU law, and a means of “feeding” law enforcement with evidence. To this extent, underreporting by whistleblowers translates into “missed opportunities” of detecting and preventing violations of EU law and weakens the effectiveness of its enforcement. The size of the problem of these “missed opportunities”, as such (i.e. the number of cases where violations of EU law were not reported by whistleblowers), is, by its nature, impossible to quantify. However, indications about its magnitude can be drawn from surveys investigating perceptions of the size of underreporting. In particular, according to the 2017 Special Eurobarometer on corruption, 81% of respondents said that they did not report corruption that they experienced or witnessed (an increase of 7 % as compared to the 2014 survey). Only 18% said that they did report it (+6%). Also the majority of respondents (85%) to the Commission’s 2017 OPC believe that workers very rarely or rarely report concerns about threat or harm to the public interest. Further indications can be drawn from data about the magnitude of the drivers of the problem, set out below. The factors that contribute to the underreporting can be summarized as follows: A.Fear of retaliation B.Lack of sufficient protection at national and at EU level C.Lack of effective implementation: low awareness and socio-cultural factors. A. Fear of retaliation A.1. Under-reporting is due primarily to the fear of retaliation Fear of retaliation has a chilling effect on potential whistleblowers: when protection is not available or certain, individuals are dissuaded from reporting. According to the 2017 Special Eurobarometer on Corruption around one in three of all Europeans (29%) think that people may not report corruption because there is no protection for those reporting it – a percentage that has only slightly decreased compared to the 2014 survey (31%). In response to the question of the OPC about the reasons why workers do not report wrongdoing, the factors most commonly selected were fear of legal and financial consequences. Similarly, in response to the question which aspects they consider important for effective whistleblower protection, respondents mentioned as the most important measures to protect against retaliation at work. Transparency International France (2015) found that 39% of employees who did not report did so out of fear of retaliation . Qualitative evidence about this link can be drawn from numerous investigations of disasters, where authorities found that workers were aware of the underlying problems, but failed to report them. The official investigation into a rail crash in the UK in 1988, which killed 35 and injured 484 people, revealed that an inspector had seen the loose wiring but had said nothing because he did not want “to rock the boat” . The public inquiry into a series of explosions that in 1988 destroyed the Piper Alpha oil platform in the North Sea with the loss of 167 lives, found that “workers did not want to put their continued employment in jeopardy through raising a safety issue which might embarrass management” . Another such example was the release in 2010 from an industrial reservoir in Hungary of 800 million of litres of caustic sludge, resulting in environmental disaster and loss of lives, where the employees knew about looming problems but had been threatened with dismissal by the plant’s director if they went to the authorities. A.2 Fear of retaliation is often well-founded The first Global Business Ethics Survey conducted with more than 10,000 workers in the private, public, and not-for-profit sectors in 13 countries, showed that 33% of the workers observed misconduct, of which 59% reported the misconduct, with 36% of these experiencing retaliation. Based on the Global Business Ethics Survey, it has been estimated that improving whistleblower protection would entail a direct prevention of retaliation of 7% of the workforce employed in the sectors covered by the survey. In the US, the 2013 National Business Ethics Survey, taken with a representative sample of private sector employees at all levels, found that 41% of workers said they had observed misconduct on the job. Of these, 63% reported what they saw. Not all of these are in need of whistleblower protection. However, of those who reported they saw, 21% said they experienced retaliation. A.3 Retaliation can take many forms and have severe repercussions on whistleblowers As reflected in international guidelines retaliation can occur in many different forms, including threat of reprisal, suspension, lay off or dismissal, demotion or loss of opportunities and transfer of duties, coercion, intimidation or harassment, ostracism at the workplace, discrimination, damage to property dismissal, destruction of property, assault and even murder. Forms of retaliation specific to non-employees in the work-based context include early termination or cancellation of contract of services, licence or permit, loss of business, loss of income, blacklisting on the basis of a sector or industry-wide informal or formal agreement, which entails that the person will not, in the future, find employment in the sector or industry they were educated or trained for, with an impact on their future employment or damage to their reputation. Retaliatory actions may also be taken by co-workers of the reporting person or against relatives of the reporting person who are also in a work-based relationship with the reported person. Examples of different types of retaliation can be found in the ECtHR case law assessing whether such retaliation constitutes interference with the individuals' right to freedom of expression. For instance, in some of these cases, retaliation took the form of dismissal, of refusal of promotion; a premature termination of employment or non-renewal of contract . Typical cases of retaliation are also identified in the study carried out for the Commission by Milieu on “Estimating the economic benefits of whistleblower protection in public procurement”. Research demonstrates the severe repercussions that retaliation can have on both the mental and the physical health of whistleblowers (e.g. depression and symptoms analogous to post traumatic stress, but also physical pain and diseases). B. Lack of sufficient protection at national and at EU level

B.1 National level The lack of a comprehensive legal framework ensuring effective protection to whistleblowers in EU Member States is one of the main factors for underreporting and fear of retaliation. Only ten Member States (FR, HU, IE, IT, LT, MT, NL, SK, SE and UK) have a comprehensive law offering a full set of guarantees to ensure that, once whistleblowers report, they have legal and procedural tools to avoid or minimise the negative consequences. While differences persist between them, those countries provide for a dedicated legal framework including a majority of best practices and key recommendations of the Council of Europe. In the remaining nineteen Member States, the protection granted is partial and only granted in specific sectors (i.e. financial services), for reporting specific types of violations (i.e. fraud or corruption), only to public or private workers or only against limited forms of workplace retaliation or is not regulated at all.Within Member States’ legal orders, rules on whistleblower protection are often scattered across different laws (anti-corruption laws, public service laws, labour codes, criminal codes and sector-specific laws, such as competition laws and financial/banking laws). This fragmentation creates legal uncertainty which has a dissuasive effect, as potential whistleblowers cannot be confident that they will enjoy the protection of the law. Moreover, a large number of Member States do not require the existence of internal or external reporting channels, which makes very complicated the protection of confidentiality but also the follow-up of the reports. These gaps and this fragmentation of protection mean that, in many situations, individuals who draw attention to a wrongdoing they witness are not effectively protected against retaliation. Piecemeal national approaches do not offer sufficient protection of whistleblowers. An example is the Luxembourg law which only covers whistleblowing on corruption. This law could not be used to protect the “Luxleaks” whistleblowers. Moreover, the different national courts which assessed their case outside this framework of protection, reached very different conclusions, which shows the legal uncertainty on the scope and conditions for whistleblower protection persisting in the national level. Remedying legal uncertainty was precisely one of the main objectives of the Irish legislator, who, in 2014, abandoned the previous sector-by-sector approach and adopted a single comprehensive legislative act. In some Member States draft proposals for legislation on whistleblower protection are currently under discussion at government level or in the national Parliaments. However, these reforms are likely to be incomplete, incremental and uncoordinated. In some cases, draft legislative proposals, even if adopted, may not result in major changes or protection would still be provided on an ad hoc basis through piecemeal provisions within one or more laws. Insufficient protection within a single Member States and divergence of the national legal frameworks contribute to underreporting and have spill-over impacts on other Member States and the EU as a whole. Even if a Member State has a comprehensive legal framework, its protection is limited to its own jurisdiction while a whistleblower may choose a different country to report or the information reported may be passed across national boundaries by authorities in one jurisdiction to authorities in another (examples of cross-border whistleblowing are the employees of banks in some Member States who may wish to give information to tax authorities of other Member States or situations such as “Luxleaks”). Uneven protection may thus dissuade reporting and can result in gaps in the protection of whistleblowers who work for foreign based companies or in another Member State than the one whose law governs their employment relationship and who risk “falling through the cracks”. Examples: i) a French company moving to Greece, whose law on whistleblower protection does not apply to the private sector, would normally maintain its corporate policy , based on French law, which provides for extensive whistleblower protection. But if the employees feel reassured and blow the whistle, in the end, they will remain unprotected; ii) a person working in France for a subsidiary of a Greek company who blows the whistle and suffers retaliation from his/her Greek employer would not receive protection under French law. Finally, uneven protection across the Member States increases economic costs for companies established in more than one EU country, which need to adjust their internal arrangements and train their employees accordingly. B.2 European level At EU level, the protection provided is also piecemeal: there are a limited number of legislative instruments that provide for reporting channels and certain elements of protection in varying degrees, and only in specific areas (most instruments concern financial services, others are related for instance to anti-money laundering, transport safety, environmental protection or the equality acquis). The sectorial protection offered at EU level is thus very limited in scope, aimed at ensuring enforcement of specific EU instruments and not even covering the whole areas concerned. Moreover, the level of protection provided by EU law is limited: the existing provisions merely seek to encourage whistleblowing by essentially requiring – in most cases – Member States: i) to establish channels for reporting violations of the relevant rules; ii) to guarantee confidentiality and (iii) to take measures for the protection of whistleblowers from employment-related retaliation, and other types of unfair treatment. They therefore do not provide a definition of the scope ratione personae of the protection, do not define the conditions for granting protection, do not specify the forms of protection to be granted, and do not specify the possible remedial measures against retaliation. C. Lack of effective implementation: low awareness and socio-cultural factors A lesson learnt from the existing implementation of national systems is that legislation is not enough. It needs to be complemented by measures of awareness and information to the public. In the workshops organised by the Commission, Member States' experts underlined the need for awareness-raising campaigns and the added value of producing guidelines to employers and employees. Potential whistleblowers who witness illegal activities and who feel safe to report them may not do so, simply because they do not know where and how to report. The 2017 Special Eurobarometer on corruption found that 49% of respondents would not know where to report corruption if they were to experience or witness corruption (an increase of 5 points compared to the 2014 survey). Just under half (47%) said that they would know where to report it. Only 15% of all respondents to the Commission’s OPC had knowledge of existing rules on whistleblower protection in their country of residence or establishment. In response to the question about factors that raise awareness of whistleblower rights and procedures for effective whistleblower protection, one of the two factors they most commonly selected were state-led information and awareness-raising campaigns on the rights of whistleblowers (75% of respondents). Further barriers contributing to underreporting by whistleblowers are linked to socio-cultural factors such as the belief that reporting the wrongdoing would be futile and not be followed up, the loyalty to the employer or deep-rooted negative social perceptions of whistleblowers as “sneaks”, “informers” and “snitches”, resulting in their harassment and ostracism. Asked about the reasons why workers do not report wrongdoing, respondents to the OPC identified the fear of bad reputation as the third most important reason (45% of respondents) . 2.5 Identification of acts and areas where whistleblower protection needs to be introduced as an enforcement tool of EU law EU policy areas and acts where the introduction of whistleblower protection would be necessary and proportionate are to be identified based on the following criteria: i) there is a need to enforcement; ii) underreporting by whistleblowers is a key factor affecting enforcement, and iii) violations of EU law may cause serious harm to the public interest. The areas below are those identified based on currently available evidence as fulfilling these criteria. 2.5.1. Acts and areas where the added value of EU whistleblower protection as an enforcement tool of EU law is already acknowledged In a number of EU acts and policy areas, the legislator has already acknowledged the added value of whistleblower protection as a key tool to encourage reporting and enhance upstream the collection of information that enforcement bodies need to detect violations of EU law.

The financial services are an area where the EU legislator has sought to provide for whistleblower protection in all relevant instruments. Another such area is the prevention of money laundering and terrorist financing , the EU legislator has sought to put in place systems to facilitate reporting of violations. In other areas, elements of whistleblower protection have been introduced in some key acts. For instance, in the area of transport safety, such elements have been introduced in instruments related to civil aviation and maritime transport; in the area of environment protection, in an instrument related to the safety of offshore oil and gas operations. Any initiative to strengthen whistleblower protection at EU level would need to ensure consistency amongst existing EU rules and align them to common high standards. 2.5.2. Areas where the necessity of introducing EU whistleblowing rules as an enforcement tool of EU law is proven (I) The protection of the EU budget The protection of the financial interests of the EU is a core area in which enforcement of EU law needs to be strengthened. A lack of enforcement of financial rules not only causes a decrease of the revenues or the budget as a whole, which in turn leads to inefficient provision of public services, but it can also distort public investments and growth and reduces economic performance. While at national level fraud, corruption and other undue appropriations are types of violations of law that affect national expenditure, they can also heavily affect the financial interests of the Union – by affecting the collection of EU revenues (e.g. fraud to customs duties), the use of EU expenditures (e.g. fraud to structural funds) or the management of EU assets(e.g. EU buildings) . In 2016, RAND Europe estimated that corruption costs the EU between EUR 179bn and EUR 990bn in GDP terms per year . According to the 2016 EY 14th Global Fraud Survey on corporate misconduct, some EU Member States are within the first 30 top ranking countries. The Commission estimated that the financial interests of the Union are potentially adversely affected to an amount of EUR 4 billion yearly due to fraud, corruption and other related offences. The total of all offences against the financial interests of the Union in the Member States reported in 2016 (fraudulent or not, regarding EU expenditures or revenues) was 17,030 offences, involving a total damage of about EUR 2.9 billion. OLAF opened, in 2016, 219 investigations on fraud affecting the EU budget, and concluded 272 investigations, which resulted in 346 recommendations for recovery of EUR 631.1million. In this area, whistleblowers are one of the sources through which OLAF receives reports about suspicions of related irregularities. Where the whistleblowers are EU staff, they enjoy the protection offered by the Staff Regulations, including against retaliation. However, all other reporting persons who may suffer retaliation from their employer in connection with their reporting to OLAF are protected in accordance with the applicable national law, when such protection exists in national law. Acknowledging this deficiency at EU level, the EPPO Regulation encourages Member States to provide, in accordance with their national law, effective procedures to enable reporting of possible offences falling within the EPPO's competence and to ensure protection of the persons who report such offences from retaliation, and in particular from adverse or discriminatory employment actions. The role of the whistleblowers in reinforcing the fight against fraud and the need to set up measures enhancing prevention and deterrence was also highlighted by the European Court of Auditors in its October 2017 Audit brief on Fighting fraud in EU spending, which mentions that whistleblowing measures are much less costly and time‐consuming than the lengthy process of fraud detection, investigation and prosecution. Tax evasion and tax fraud of particular revenues linked to the EU budget hamper the financial interest of the EU and may also lead to inefficiencies in terms of competitiveness of businesses across the EU. The Commission has established in the last decade a large number of actions aimed at supporting national authorities to investigate and prosecute fraudsters that try to escape their tax obligations, taking advantage of the fact that tax officials cannot recover taxes themselves outside their national borders. Notwithstanding, fraud relating to the VAT, one of the sources of income of the EU budget, is still one of the most widespread types of tax fraud which go unreported. Even if by nature it is difficult to assess the magnitude of VAT fraud, it is estimated that out of the EU VAT gap estimated at almost EUR 160 billion revenue losses each year, EUR 50 billion would be due to VAT fraud alone. . (II) Areas crucial for the proper functioning of the internal market a) Public procurement Lack of enforcement of EU rules on public procurement has two dimensions. On the one hand, fraud and corruption can occur in the context of procurement carried out by the EU institutions and bodies (breach of the EU Financial Regulation and its rules on procurement). A large share of OLAF’s investigations in 2014-2016 related to fraud in public procurement, mainly in relation to structural funds and external aid. The costs of corruption risk in EU public procurement across all sectors was estimated at EUR 5 billion per year . On the other hand, fraud and corruption can be linked to national public procurement. In many sectors such as energy, transport, waste management, social protection and the provision of health or education services, public authorities are the principal buyers.While insufficient enforcement of rules on public procurement occurs at national level, it creates distortions of competition across the EU, increases costs for doing business, violates the interests of investors and shareholders and, overall, lowers attractiveness for investment, thus affecting the proper functioning of the internal market. In 2014, the EU reinforced rules seeking to ensure that public contracts are consistently awarded in an open, fair, and transparent manner across the EU and introduced minimum harmonised public procurement standards for the award of public contracts by or on behalf of Member States’ authorities. Despite these legislative efforts, unlawful practices still occur in public procurement. A 2017 study carried out for the Commission provides evidence on how whistleblowers effectively contribute to the detection of such practices by disclosing information that may not be readily available . This study estimated the loss of potential benefits due to a lack of whistleblower protection in the area of public procurement alone to be in the range of EUR 5.8 to EUR 9.6 billion each year for the EU as a whole. b) Competition EU competition policy aims to protect the efficient functioning of markets from competition distortions whether originating from Member States (distortive State aid), market players (distortive unilateral or coordinated behaviour), or mergers that would significantly impede effective competition. The estimated direct benefits of interventions by the Commission during 2017 in the cartel and merger areas alone range from 3.9 to 6.2 billion euros. This illustrates the magnitude of harm that breaches of the EU competition rules have on EU consumers and public interests. The ability to detect infringements of antitrust rules, circumventions of the merger rules (e.g. early implementation of a non-approved merger) or illegal state aid (e.g. in the context of fiscal measures) is crucial to ensure the proper enforcement of EU competition rules. In order to increase the detection possibilities, measures have already been undertaken to facilitate and incentivise companies and individuals with insider information to report potential wrongdoings to the Commission. The Leniency Programme has been a very successful tool to uncover secret cartel arrangements that may otherwise go undetected. Companies however increasingly weigh the benefits of immunity from fines or leniency reductions against the risk of important payments in follow-on private damage actions. The digitalisation and globalisation of markets have also resulted in complex business models and distribution systems that would nowadays often require insider knowledge to detect and successfully investigate.

In order to strengthen the fight against cartels and other antitrust violations, the Commission introduced in March 2017 an online tool that can be used to anonymously alert the Commission of breaches of antitrust law. This new communication channel gives whistleblowers the possibility to report illegal practices in full anonymity but does not offer protection to them if their identity becomes known to those who might take retaliatory action against them. Moreover, experience shows that the ability to interact directly with an identified whistleblower allows for a more efficient and successful investigative process. Effective protection for whistleblowers would encourage and enable the individuals to come forward without fearing retaliation. In the area of antitrust, the Commission shares the responsibility of enforcing the EU competition rules with national competition authorities. Only a very limited number of those have similar anonymous communication tools in operation. The introduction of protection of whistleblowers at Member State level would therefore have a significant impact on the ability of those authorities to detect and bring infringements of EU competition law to an end. It would also strengthen the incentives for companies to come forward and report cartels under leniency programmes themselves rather than risking detection through whistleblowing. c) Aggressive tax planning schemes Tax schemes that amount to evasion or avoidance negatively affect the proper functioning of the internal market. Whilst tax evasion involves violations of the law, taxpayers who engage in tax avoidance act against the spirit and purpose of the tax provisions with the intention of reducing their tax bill. In this context, aggressive tax planning consists in taking advantage of the technicalities of a tax system or of mismatches in the interaction between two or more tax systems for the purpose of reducing tax liability. The outcome of such situations could give rise to unfair tax competition and extensive tax evasion, distorting the level-playing field between companies that manage to avoid paying their fair share of taxes and other companies that do not have access to the same cross-border tax planning possibilities (mostly domestic and/or smaller firms). OECD found in 2013 that multinational companies pay as little as 5% in corporate taxes thanks to aggressive strategies to reduce tax liability, whilst smaller businesses pay up to 30% . Moreover, profit-shifting results in loss of tax revenues for Member States and for the EU as a whole (estimated to about EUR 50-70 billion per year). The “Luxleaks” scandal illustrated the distortions of competition resulting from such tax schemes (as EU companies not located in Luxembourg could not benefit from these arrangements) and their consequences for the overall budget of the EU. A 2017 European Parliament study estimated that the schemes uncovered by the “Panama Papers” had a budgetary impact (revenue loss) of approximately EUR 19 billion across eight Member States. The revenue loss for the entire EU-28 was estimated at EUR 109-237 billion, with a mid-point of EUR 173 billion . It estimated the volume of tax base shifted by companies in these eight Member States in 2015 at EUR 88 billion. The cascade effects of tax losses for Member States include less public money being available to invest in support for economic growth, job creation and public services . Moreover, aggressive tax arrangements have in certain cases other elements of criminality. Europol examined the link between the use of offshore schemes and criminality and found 3469 probable matches to organised crime and other criminal activities in the Panama Papers database. It also found 516 names linked to organised criminal gangs, 388 names connected to VAT fraud operations and 116 names linked to suspicion of terrorist activities in Europe. Many of these schemes are used for money laundering. Tax authorities often find it challenging to detect tax schemes amounting to evasion or avoidance. These are usually structured in several steps and, in most cases the discovery of one step would not allow the authorities to substantiate the existence of an infringement of the law or of tax avoidance. The cross-border dimension of many such schemes complicates the situation and reduces tax authorities' chances of unilaterally uncovering violations of the law, other breaches or harmful elements. As a result, evasion and avoidance can remain undetected or may be revealed with such delay that the authorities can no longer react. The Commission has recently proposed rules to improve transparency and the exchange of information in the field of taxation and to create a fairer corporate tax environment within the EU . These initiatives are expected to reinforce the integrity and strengthen the level of protection of the internal market against practices that distort competition. Recent scandals such as the “Panama Papers”, the “Paradise Papers” and “Luxleaks” have shown that whistleblowers can bring substantial volumes of cases of tax evasion or avoidance to the knowledge of the tax authorities and beyond. Moreover, empirical evidence shows the effect of whistleblowing in deterring the criminal use of offshore banking services and the resulting tax evasion. A 2017 study investigated the effect of the leaks of customer information from banks in tax havens on the stock prices of banks that are known to provide such services. Its findings suggest that such a leak lowered market expectations about the future earnings of tax haven banks that assist foreign customers with tax evasion. Thus, an increase in the perceived probability of a leak should be expected to deter the demand and supply of criminal offshore banking services. EU whistleblower protection would therefore be a complementary tool to increase Member States' effectiveness in identifying evasive and/or abusive schemes that could otherwise go undetected and would help deter such schemes, thus overall contributing to ensuring the proper functioning of the internal market. (III)Environmental protection In order to achieve effective protection of the environment, the EU legislator introduced dissuasive penalties for environmentally harmful activities, which typically cause or are likely to cause substantial damage to the air, including the stratosphere, to soil, water, animals or plants, including to the conservation of species. In 2008, the EU adopted legislation establishing common rules on criminal offences and made it possible to use effective methods of investigation and assistance within and between Member States. Despite these regulatory efforts, undetected malpractices affecting the protection of the environment in the territory of the EU remain a challenge. These are linked to persistent environmental problems, such as diffuse water pollution, poor urban air quality, unsatisfactory waste treatment, and species and habitats in decline. There is also a serious incidence of environmental crime and a high number of environmental complaints to the Commission and petitions to the European Parliament. The costs of non-implementation are estimated at 50 EUR billion per year. In the area of the EU waste legislation, illegal trade in waste may account for 10-15% of the EU market in waste and violations of waste management legislation accounted, in 2015, for 20% of EU environmental infringement cases . Examples of breaches include non-compliance of waste facilities with waste permit conditions (e.g. receiving more waste than is permitted or different kinds of waste than are permitted) or illegal waste shipments, often under cover of misleading or falsified documentation . Moreover, as evidenced by past environmental accidents, weaknesses in enforcement of EU law in one Member State may also have a ricochet effect in the protection of the environment, which negatively affects several territories of the EU. The industrial pollution caused by the ILVA steel plant in Italy (one of the largest in Europe) had direct impacts on the mortality rate related to cancer and respiratory diseases in the area . In January 2018, the Commission acknowledged that evidence-gathering, detecting and addressing environmental crimes remains a challenge and needs to be supported and reinforced. It thus launched specific measures to help national authorities promote, monitor and enforce compliance with EU rules on activities that can cause environmental harm. The EU legislator had already considered whistleblower protection as a factor contributing to better enforcing EU sectorial rules on environment, but the introduction of such protection appears necessary to ensure effective enforcement of the majority of the EU environmental acquis, whose violations can cause serious harm to the public interest. “Dieselgate” showed that the lack of whistleblower protection in a single Member State can have cross-cutting and wide-ranging consequences across the EU, including on the environment and on public health – with studies calculating, for instance, that excess emissions from rigged diesel cars cause about 5,000 premature deaths annually across Europe. (IV) Nuclear safety Ensuring that Europe has the highest standard of nuclear safety has been a key policy priority of the Union. Europe has adopted in recent years one of the most advanced nuclear safety regulatory frameworks in the world. While implementation and supervision remains largely at national level, the impacts of nuclear accidents are of cross-border nature. Recent accidents outside Europe and reports concerning breaches of standards have weaken public confidence in the sector. Whistleblower protection is therefore an important tool that would contribute to support the prevention and deterring of breaches of Euratom rules on nuclear safety, radiation protection, responsible and safe management of spent fuel and radioactive waste. The application of the enhanced whistleblower protection in the field of nuclear safety and radiation protection would be complementary to the robust existing provisions of the revised Nuclear Safety Directive on the effective nuclear safety culture, and in particular Article 8 b (2) (a) which requires that the competent regulatory authority and the licence holder to take measures that include in particular, management systems which give due priority to nuclear safety and promote, at all levels of staff and management, the ability to question the effective delivery of relevant safety principles and practices, and to report in a timely manner on safety issues.

Protecting whistleblowers in the area of nuclear safety would help avoiding situations where there are delays in the reporting of malpractices, including defects in the assembly of key components for the nuclear power plants' safety and safeguards obligations. Delays would be avoided if employees were certain of being protected against sanctions and/or retaliation when exposing bad practices as soon as they hear about them. Moreover, enhanced whistleblower protection in this area would also increase the trust of the general public against on the robustness of the safety measures established in Europe. (V)Product safety, consumer protection, public health According to EU legislation, only safe products can be placed into the EU internal market. Businesses must only place products which are safe on the market, inform consumers of any risks associated with the products they supply and make sure any dangerous products present on the market can be traced so they can be removed to avoid any risks to consumers. The Commission keeps a list of dangerous products found across Europe and information is collected in the Rapid Alert System, which facilitates the rapid exchange of information between the national authorities of 31 countries and the Commission on dangerous products found on the market. If a manufacturer or distributor finds out that one of their products on sale is dangerous, they have to inform the competent national authority. Moreover, product safety is ensured through EU instruments on manufacturing of products. Hence, the primary source of evidence-gathering on safety of products is mainly businesses, complemented by the investigations and audits of competent enforcement authorities. Information coming from employees and suppliers in the area of product safety has, thus, a high added value, since they are much closer to the source of possible unfair and illicit manufacturing, import or distribution practices of non-compliant products. Yet, there is insufficient reporting in relation to non-compliant products and unfair practices by companies that knowingly undercut EU product rules posing risks to human life. To date, still too many non-compliant products are placed on the EU market. 78% of respondents in the public consultation on the internal market for goods considered that this is because of companies' deliberate choice to exploit market opportunities at lowest costs, 33% ranked this unwillingness to comply even as the main reason for the high non-compliance rates observed. An area where lack of enforcement on product safety has proven dangerous to human beings is car manufacturing. In 2009, following a fatal accident with a Lexus sedan in the US, Toyota issued several recalls, assuring customers that it was addressing the “root cause". The automaker later admitted that it had been concealing and minimising related problems. The Dieselgate is another example of how car manufacturing malpractices can have high monetary and non-monetary impacts on society. Malpractices in the production of medical devices have also been reported as generating high risks to human health. A product safety scandal that came to light in 2010 concerned a French company that had made breast implants with industrial-grade silicone which had doubled the rupture rate of other implants and could cause medical problems. Press reports suggest that about 300,000 women in as many as 65 countries were affected . The role of whistleblowing in strengthening enforcement of rules in product safety was clearly acknowledged in the United States, where in the wake of the scandals over lead paint found in toys and other toy recalls, the Consumer Product Safety Act was amended, amongst others, to include whistleblower protections. Whistleblower protection is also necessary to enhance the enforcement of EU rules related to marketing and use of sensitive and dangerous products, including firearms, explosives precursors and defence-related products. In particular it could address the fraudulent intra-communitarian acquisition of defence-related products, weapons and firearms where violations often imply a diversion from the legal to the illegal market. The point of diversion originates in the legal market: illicit acts such as an armourer who would irregularly deactivate weapons or who would provide a fake deactivation certificate, a trader making false declarations of export or a gun or sport shop submitting a falsified authorisation to acquire weapons when buying firearms in another Member State. It tends to be facilitated by corruption, forged documents, poor regulation, monitoring or enforcement and appropriate export control. Persons who acquire insider information about such violations in their work-related context can facilitate the work of specialised investigators in this area and more generally help detect and prevent such violations. Another area where lack of enforcement relates to product safety and public health is the area of tobacco products. While EU legislation is in place, shortcuts in prevention of fraud are persistent. Fraud and illicit trade in cigarettes evidences insufficient enforcement of EU legislation on excise duties in tobacco products but also negatively affects the compliance with the EU Tobacco directive aimed at ensuring the proper functioning of the internal market for tobacco and related products, while ensuring a high level of health protection. At the same time, the annual EU-wide tax loss due to cigarette smuggling is estimated to be approximately 11.3 billion euros relating to a loss in the EU excise duties. In the pharmaceutical area, whistleblowers play an important role in unmasking violations and supporting enforcement. There have been cases where health care professionals revealed that pharma companies falsified manufacturing protocols, did not comply with clinical trial requirements, infringed advertising rules or provided payments to doctors. Some inspections of pharmaceutical companies or of their suppliers have been taking place on the basis of such information. A relevant example of whistleblowing was the disclosure, in 2009, of problems with Mediator, a weight-loss drug, the use of which led to the death of at least 500 people and to cardiovascular problems for thousands more people in France. The public revelation by a doctor of the gravity of the Severe Acute Respiratory Syndrome (SARS) virus in 2003 is an example of whistleblowing that potentially saved millions of lives. According to the World Health Organization, the SARS outbreak led to 8,098 cases and 774 deaths. Since 2013, the European Medicines Agency (EMA) has received 43 reports on various issues, from the manufacturing of medicines to the conduct of clinical trials . To further encourage such reports about, among other, pharmaceutical malpractices, EMA adopted in 2017 an internal policy on handling the information received by external sources disclosing improprieties that may have an impact on the authorisation, supervision and maintenance of medicinal products in the area of EMA activities. This policy aims to complement the existing policy on whistleblowing applying to EMA staff. One of the policy principles is to ensure confidentiality of information from external sources and protection of personal data. (VI)Food and feed safety and animal health and welfare While the General Food Law Regulation has been found to have achieved its core objectives, namely a high level of protection of human life and consumers' interests in relation to food and the effective functioning of the internal market, there are still national differences in the implementation and enforcement of the EU legislative framework. Past experience has demonstrated the valuable role of whistleblowers in strengthening enforcement in the area of food chain. In 2016, the Commission became aware through whistleblowers of illegal practices in the tuna sector and immediately launched several actions including through the EU Food Fraud Network. In the cases of contamination of eggs and egg products with fipronil in 2017, first information concerning the suspicion of fraud at the root of the incident was communicated by a whistleblower to a national food safety service. Examples of retaliation for whistleblowing have also been documented. For example, in Germany, a truck driver gave information to the police about the transport of rotten meat, uncovering one of the biggest scandals of its kind. He was presented, in 2007, with the Golden Badge for Moral Courage by the Federal Minister for Agriculture but he still lost his job. The added value of whistleblower protection in this area has been documented by some Member States. The UK Food Standards Agency, for example, reported that in 2012 it had handled 81 cases originating from whistleblowers, a marked increase from the 54 cases received in 2011, which was largely due to improved procedures for receiving reports. Animal health and welfare is another area where protection of whistleblowers is key to detection and prevention of violations of EU law with high negative consequences. For example, during the1990s in Germany, the veterinarian who publicly disclosed the symptoms in cattle that suggested animals had the Bovine spongiform encephalopathy, a neuro-degenerative fatal brain disease that may be passed to humans by infected meat (the “mad cow disease”) lost her job. Her internal reporting was ignored and the infected meat entered into the food chain. Cases of severe breaches of animal welfare rules are also typically revealed by “insiders” who witness such malpractice. (VII)Transport safety In the area of transport safety, malpractices that remained hidden and led to tragedies have been in the origin of the development of national and EU legislation on whistleblower protection. For example, one of the events triggering the adoption of the UK law was the capsizing in 1987 of a ferry operating between Belgium and the UK with the loss of 193 passengers and crew, where the official inquiry found that workers knew about the malpractice that had contributed to the loss of the vessel but were either too scared to speak up or the concerns they had expressed had been ignored. In maritime transport, the EU has progressively developed policies of the safety of both passenger and merchant ships in response to several major shipping accidents since the 1990s. The EU has also prioritised work on effective aviation safety standards. Regulation 376/2014 was designed to ensure a high level of safety in civil aviation by introducing reporting systems and providing for certain measures of whistleblower protection. The EU has also created safety agencies dealing with the different transport modes: the European Aviation Safety Agency , the European Railway Agency and the European Maritime Safety Agency. Given the acknowledged added value of whistleblower protection in preventing transport safety violations, EU whistleblower protection should also be provided in other transport modes, such as road and railway transport. This need is illustrated by investigations on accidents at national level. For example, following the railway accident in 2016 in Croydon, UK, in which 7 people were killed and 19 seriously injured, the official investigation report found that drivers had failed to report incidents amongst others because they feared retaliation, and recommended encouraging a ‘just culture’ inside the organisation. (VIII)Protection of privacy and personal data and security of networks

Regulation (EU) 679/2016 on the protection of personal data (General Data Protection Regulation, 'GDPR') and Directive 2002/58/EC on the protection of privacy in the electronic communications sector (so-called 'e-privacy Directive') protect the fundamental right to private life with regard to the processing of personal data. Despite the robust oversight system put in place by the Union legislation (i.e. through national data protection authorities and the mandatory presence of data protection officers within public authorities, and within companies in certain cases), whistleblowers remain a particularly valuable source of information to unmask certain types of infringements which are particularly harmful to the public interest - e.g. where the processing is likely to result in a high risk to the rights and freedoms of natural persons, or consists in regular and systematic monitoring of data subjects on a large scale, or consists of processing on a large scale of “special categories of data” pursuant to Article 9 of the GDPR (such as data revealing political opinions, religious or philosophical beliefs, racial or ethnic origins, sex life or sexual orientations, etc.). The recent Cambridge Analytica scandal shows by itself the scale of harm to the public interest that breaches of the EU data protection rules (e.g. acquisition of data without consent of the – tens of millions - individuals concerned, use of the personal data for a different purpose than the one for which it was collected) can entail. The scandal came to light thanks to the revelations made to The Guardian and to The Observer by whistleblower who was a former Cambridge Analytica employee. As to the security of networks, the ongoing digital transformation, which allows both European consumers and business to benefit from better services and significant cost-reductions, poses as well new threats to the security of the European society and economy. A 2016 study revealed that the number of security incidents across all industries rose by 38% in 2015, which accounted as the biggest increase since 2004, while at least 80% of European companies have experienced at least one cybersecurity incident . Directive (EU) 2016/1148 on the security of network and information systems (so-called 'NIS Directive') is aimed at building EU resilience to cyber-incidents and better protecting the internal market. It promotes a culture of risk management by introducing incident notification and security requirements for companies providing essential services across many sectors and sub-sectors (e.g. energy, health, transport, banking) and providers of key digital services . Whilst the Directive introduces the possibility for businesses to establish structural dialogues with public authorities about cyber-security vulnerabilities , economic operators are often reluctant to share potentially disruptive vulnerabilities and report significant incidents, due to the concern that their reputation could be harmed and the value of the company decreased. For example, in 2016 Yahoo disclosed that three years before a data breach compromised more than 1 billion accounts. However, only one year after, Yahoo shared the actual size of the attack, revealing that the data theft affected 3 billion accounts . For this reason, whistleblowers informing public authorities responsible for the enforcement of the NIS Directive about cyber-malpractices, unmanaged vulnerabilities or significant incidents could facilitate a timely and complete sharing of information by companies. As a result: (i) private entities could be further incentivised to invest into securing their network and information systems; (ii) public authorities could contribute to incident response and risk mitigation in a more effective manner; (iii) public authorities could acquire a more comprehensive overview of risks and incidents hampering the economy and take appropriate counter-measures. 2.5.3. Areas where the case for introducing EU whistleblowing rules as an enforcement tool of EU law could be made in the future – need for "future-proof" EU action The present identification of EU acts and areas where the introduction of whistleblower protection appears necessary is based on currently available evidence. It is possible that, in the future, evidence comes to the fore substantiating the need for whistleblower protection as a means of strengthening the enforcement of EU law also in other EU areas or legislative acts (including future acts). For this reason, any EU action should be “future-proof”, e.g. it should allow for flexibility in this regard, providing for a review process. 2.6 Baseline scenario Maintaining the status quo would entail no new action taken at EU level. EU Member States would be the primary source of protection of whistleblowers and the existing sectorial instruments of EU law as implemented. Any improvements would be left to the discretion of the Member States. The Commission would pursue the monitoring of the transposition and the enforcement of existing sectorial rules; continue monitoring the developments at national level in the context of the EU Semester and continue supporting research and promoting the exchange of good practices. As illustrated in the subsection 2.4.B above, gaps in national protection and legal uncertainty resulting from fragmentation and divergence of protection across the EU persist and are not addressed in a satisfactory way by the existing EU or national rules on protection of whistleblowers. Some of the gaps in protection identified are expected to be addressed in the future, as a number of Member States are currently considering adopting legislation with a view to introducing or improving whistleblower protection. However, in the absence of any EU action guaranteeing minimum harmonisation across the Member States, it is likely that reforms in the Member States will be incomplete and uncoordinated, maintaining the current uneven level of protection and divergences between countries, as well as legal uncertainty. As illustrated by recent unsuccessful attempts to introduce new rules on whistleblower protection in various Member States , it is not certain that all envisaged reforms will succeed. Secondly, the scope and impact of the reforms will vary. In some cases, the draft legislation, if adopted, will result in comprehensive coverage of both the public and the private sector. In other cases, however, the draft proposals, even if adopted, may not result in major changes or protection would still be provided on an ad hoc basis through piecemeal provisions within one or more laws . The transposition and implementation by Member States of sectorial EU law introducing rules on whistleblower protection might have a spill-over effect resulting in the setup of reporting channels or provision of protection also in other areas not covered by these instruments. However, there are no indications about the likelihood of such a development. Hence, under the baseline scenario, due to the increase of the national sectorial legislation in the next 5 years, the number of employers in the EU that provide whistleblower support (including reporting channels) to their employees on a voluntary basis is expected to increase between 5% and 15% in the next 5 years . In summary, even if in the medium short-term Member States are expected to further develop legislation due to national developments or transposition of EU law, there is still a clear risk that those Member States which do not have effective complete frameworks of protection in place will not remedy the drivers described in the section above. Protection provided in law to whistleblowers would not be consistent across Europe, and would not effectively achieve the objectives of combating under-reporting and fear of retaliation. In terms of protection of the financial interests of the Union, in absence of a reinforced system of protection of whistleblowers, the ‘VAT gap’ (among other loss in EU revenues), in the Member States, is estimated to amount to EUR 175 billion in 2017 and is expected to rise to EUR 217 billion by 2027. As ancillary negative effect, businesses operating in several EU countries would continue to experience unfair competition due to insufficient enforcement.

3.Need for action at EU level 3.1 Subsidiarity: why is the EU better placed to take action? The rationale for an EU initiative aimed at reinforcing whistleblower protection would be to improve enforcement of EU law so as to enhance the proper functioning of the internal market and the implementation of certain EU policies and to safeguard the financial interests of the Union and the EU budget at large. Section 2 evidences that the existing whistleblower protection at national and EU level is not sufficient to address underreporting as one of the causes of weak enforcement of EU law. Currently most Member States offer protection only in a piecemeal way and the level of protection varies. The protection at EU level is also limited, as existing rules only apply to specific sectors and offer limited protection. Insufficient protection of whistleblowers in a given Member State can have a negative impact on the functioning of various EU policies in that Member State, but also spill-over impacts in other Member States, as set out in section 2.2. The following table summarises the strength of potential spill-over impacts of insufficient enforcement in the areas identified as necessitating the introduction or the strengthening of whistleblower protection. Table 3.1 Strength of spill-over impacts of breaches of Union law Areas Strength of spill-over impacts in other Member States Protection of financial interests of the Union Very strong, as the revenues and expenditure of the Union itself are affected. Proper functioning of the internal market Public procurement and competition rules: strong, given resulting distortions of competition in the single market, increase in costs for doing business, violation of the interests of investors and shareholders, decrease of attractiveness for investment. Financial services including prevention of money laundering and terrorist financing: strong, given negative impacts on safety, stability and integrity of financial markets and security. Aggressive tax planning schemes: strong, as aggressive tax planning schemes give rise to unfair tax competition, distorting the level-playing field between companies or amongst Member States and resulting in loss of tax revenues for Member States and for the EU budget as a whole. Environmental protection and nuclear safety Strong, given that risks to the health of citizens and the environment go beyond national borders. Product safety, food safety, animal health and welfare, consumer protection and public health Strong, given that related risks go beyond national borders due to free movement of goods within the single market. Transport safety Strong, given that related risks go beyond national borders due to free movement of persons and goods within the single market. Protection of privacy and personal data and security of network and information systems Strong, given that related risks go beyond national borders due to free movement of data in a digital single market. Given the inter-connections in the current digital landscape, also threats from cyber-incidents can affect entities providing essential services across the EU and the damage the EU society and economy overall. While, as described under the baseline scenario, the situation in some Member States is expected to improve, gaps and unevenness of protection will persist, as even these improvements will be limited to certain areas or types of wrongdoing, leading to different types and levels of protection from one Member State to the other. This means that the cross-border impacts will also persist. It is therefore clear that only EU action can address unevenness of protection, ensuring a consistent high level of protection across the EU. Also as regards the protection of financial interests of the Union, it is clear that fraud and illegal activities affecting them cannot be dealt with by Member States acting alone. The Treaty itself presumes, in Articles 310(6) and 325(1) and (4) TFEU, the necessity of EU legislative action for setting out equivalent and deterrent measures to protect EU financial interests against illegal activities. Hence, EU action is warranted. For the above reasons, the improvement of enforcement of EU law cannot be sufficiently achieved by Member States acting alone or in an uncoordinated manner. This can only be achieved by action at EU level, providing minimum standards of harmonisation on whistleblower protection. Moreover, only EU action can provide coherence and align the existing EU sectorial rules on whistleblower protection. 3.2 Legal bases As indicated above, there is no legal basis in the Treaties specifically allowing the EU to regulate whistleblower protection in general. In particular, an initiative based on the protection of fundamental rights, notably freedom of expression, cannot be pursued since the EU Charter of Fundamental Rights cannot serve as a standalone legal basis. Moreover, although fraud and corruption are rather common types of violations of EU law which cause harm to the public interest in key policy areas and have clear spill-over impacts in terms of hampering the proper functioning of the internal market, the fight against those type of violations has no self-standing legal basis in the Treaties. However, certain Treaty articles can serve as legal basis for instruments aimed at strengthening whistleblower protection as a means of improving the enforcement of EU law: Articles 292, 50, 325 and 114 TFEU . Article 153(1)(a) and (b) TFEU could also be used to regulate aspects of whistleblower protection relating to the improvement of the working environment to protect workers’ health and safety and to working conditions. The initiatives based on these Articles are summarised as follows: Table 3.2 Summary of the scope of the initiatives that could be based on available legal bases Art. 292 TFEU Art. 50 TFEU Art. 114 TFEU Art 325 TFEU Art. 153 TFEU Type of initiative Non-regulatory Legislative Legislative Legislative Legislative Focus of the initiative Encourage Member States to protect whistleblowers across the board Protect the integrity of the private sector through the establishment of reporting channels Enhance the proper functioning of the internal market through the establishment of reporting channels and whistleblower protection Protect the financial interests of the Union through the establishment of reporting channels and whistleblower protection Protect employees’ health and well-being Personal scope Broad definition of workers: employees and self-employed (contractors, suppliers, etc.) Limited definition of workers: protection granted only to employees stricto sensu Broad definition of workers: employees and self-employed (contractors, suppliers, etc.) Broad definition of workers: employees and self-employed (contractors, suppliers, etc.) Limited definition of workers: protection granted only to employees stricto sensu Activity sectors Private and public sector Private sector Private and public sector Private and public sector Private and public sector Protected disclosures Violations or abuse of EU and national rules Violations or abuse affecting investors’ interests Violations or abuse of EU law affecting the proper functioning of the internal market Fraud or illegal activities affecting the financial interests of the Union Violations or abuse of EU and national rules



4.Objectives Objectives General ·To address underreporting of breaches of EU law leading to serious harm to the public interest in areas where strong whistleblower protection can significantly contribute to expose, prevent and deter such harm. Specific ·To strengthen the protection of whistleblowers and avoid retaliation against them; ·To provide legal clarity and certainty; ·To support awareness-raising and fight against socio-cultural factors leading to underreporting.

The general objective (increasing the reporting rate of violations of EU law) will be achieved by providing legal clarity and certainty on the legal framework and ensuring effective protection against retaliation in all Member States. When compared to the baseline scenario, this is expected to lead to a reduction of the level of violations of EU law, as more illegal activities will be prevented, reported, investigated and prosecuted. The general objective will, in turn, have ancillary benefits such as support of good governance, increase of businesses’ competitiveness, of transparency in the EU, as well as of protection of fundamental rights under the Charter. In this respect, any implementation of the general objective would enhance freedom of expression, as well as increase reporting and deterrence of fundamental rights violations within the implementation of EU law. 5.Policy Options 5.1 Design of the policy options – Common minimum level of protection In light of the enforcement challenges identified in section 2, the main differences of design of the policy options revolve around the material scope of application, e.g. what can be reported in terms of violations or abuses of EU law that would trigger the protection of whistleblowers. All the other elements, e.g. (1) personal scope, (2) obligation to establish reporting channels, (3) safeguards for the reporting and the reported persons, (4) measures against retaliation (5) measures to ensure the effectiveness of the framework for whistleblowers, are common to all the policy options. The rationale is that, besides establishing in which areas of EU law enforcement needs to be reinforced by whistleblower protection, all policy options need to counter the drivers of underreporting as established in Section 2. In particular: ·fear of retaliation is addressed by the measures of protection against retaliation. Some of these are aimed at preventing retaliation, such as the overall obligation to set up a clear legislative framework prohibiting retaliation; the obligation to provide for internal and external reporting channels; to guarantee confidentiality; to ensure access to information and impartial advice. Others are targeted to the situation where the whistleblower has already suffered retaliation and aim at providing as full a remedy as possible. ·lack of knowledge of where and how to report is countered by the obligations to establish reporting channels and to ensure access to information and independent advice; ·the sense of futility that has a dissuasive effect on whistleblowers is addressed by the obligations imposed on national authorities to follow up on the reports and give feedback. Therefore, any policy option should promote or provide for minimum standards, ensuring that Member States introduce essential components of an effective and balanced legal framework that protects whistleblowers who genuinely aim to safeguard the public interest whilst safeguarding the rights interests of persons that may be prejudiced by the reports. Accordingly, every policy option introduces the same common elements of protection based on the principles provided in the Council of Europe Recommendation and the ECtHR case-law on freedom of expression enshrined in Article 10 ECHR, as well as further international standards and good practices and EU fundamental rights and rules (e.g. data protection). 1.Personal scope (Principles 3 and 4 of the CoE Recommendation): the retained options have a broad personal scope. They cover both the public and the private sector and grant protection both to workers in standard employment relationships as well as to part-time workers, fixed-term contract workers or persons with a contract of employment or employment relationship with a temporary agency, and to a wider population of persons in a work-based relationship, such as self-employed persons providing services, freelance, contractors, sub-contractors and suppliers, given that, as indicated in Section 2.2, these broader categories can be key for exposing violations of the law and may suffer different forms of retaliation. Shareholders and persons in managerial bodies will also be included for the same reasons. The personal scope will also include further categories of reporting persons who do not rely on their work-related activities economically but who may nevertheless suffer retaliation, such as volunteers and unpaid trainees. More generally, the options would ensure that the need for protection is determined by reference to all the relevant circumstances and not merely by reference to the nature of the relationship, so as to cover the whole range of persons connected in a broad sense to the organisation where the breach has occurred, including in particular candidates for employment or for providing services to an organisation who acquired the information on breaches of law during the recruitment process or other pre-contractual negotiation stage. 2.Obligation to establish reporting channels (Principles 12 to 17). Member States should: ·ensure that private entities and public authorities establish internal reporting mechanisms (including following consultations with workers’ representatives where appropriate), meeting the requirements set out in the Council of Europe recommendation; ·provide for external reporting channels to competent national authorities or the competent EU authority where relevant; These obligations will ensure that the information gets to those people most able to investigate and with powers to deal promptly with the problem. 3.Safeguards for the reporting and the reported persons (Principle 18), in particular:

·ensuring the confidentiality of the data of the reporting person: reassuring workers that they will be protected may not always be enough, thus offering confidentiality can provide the added reassurance someone may need to speak up; ·protection of the personal data of both the reporting and the reported person; ·respect of the rights of defence of the reported person (including the right to access to the file, the presumption of innocence, the right to be heard and to seek effective remedy): this is crucial in order to avoid unfair treatment or reputational damages (Principle 10); ·a tiered use of reporting channels (principles 14, 17 and 24): the reporting persons should be required to first use the internal channels, i.e. report to their employer; only if this does not work – or could reasonably not be expected to work – report to the competent authorities, and only as a last resort to the public/media. This safeguard aims to ensure that the information gets to the persons who can contribute to the early and effective resolution of risks to the public interest as well as to prevent unjustified reputational damages from public disclosures. At the same time, it provides the necessary flexibility for the reporting person to choose the most appropriate channel depending on the individual circumstances and allows for the protection of public disclosures taking into account democratic principles such as transparency, and fundamental rights such as freedom of expression and media freedom, whilst balancing the interest of employers to manage their organisations and to protect their interests with the interest of the public to be protected from harm, in line with the criteria developed in the ECtHR case-law; ·to enjoy protection, the reporting persons should reasonably believe the information they disclose to be true (Principle 22): This is an essential safeguard against malicious/abusive disclosures, ensuring that those who deliberately and knowingly report false information do not enjoy protection. At the same time, it ensures that protection is not lost solely on the basis that the reporting person was mistaken as to its import or that the perceived threat to the public interest has not materialised, provided he/she had reasonable grounds to believe in its accuracy; in a similar vein, the reporting persons should be entitled to protection under an EU legislative initiative if they reasonably believe that the information they report falls within its scope. 4.Ensure the protection of reporting persons against retaliation ·Remedial measures against work-related retaliation (Principles 21 and 26): It is important to ensure that the reporting persons have at their disposal legal actions (“remedial measures”) which provide them with effective access to legal review, decision and remedy for retaliation broadly defined, e.g. against any act or omission occurring in the work-based context which causes them detriment. As mentioned in detail in Section 2.2, retaliation can take many forms and varies depending on the legal nature of the work-based relationship. The appropriate remedy will be determined by the kind of retaliation suffered. Typical remedial measures (the types of remedy will vary between legal systems) include actions for reinstatement, compensation for financial loss, award of damages. Of particular importance for whistleblowers are interim remedies pending the resolution of legal proceedings that can be protracted. These could be ordered by a court to stop threats or continuing acts of retaliation, or prevent forms of retaliation that might be difficult to reverse after the lapse of lengthy periods, such as dismissal, and that can ruin financially the individual; ·reversal of burden of proof, i.e. in a prima facie case of retaliation, the person who took the adverse measure against the reporting person carries the burden to demonstrate that this was not related to the reporting (Principle 25); ·prohibition of “gagging clauses”: no term or clause in any contract or agreement between individuals and the person or body for whom they are working can be relied on to preclude them from reporting or penalise them for having done so (Principle 11); ·right of the reporting p