Source: https://eucrim.eu/articles/matter-life-death-whistleblowing-legislation-eu/
Timestamp: 2019-04-24 23:55:01+00:00

Document:
“Un attachement passionné au droit” – this is the way François Ost described the relationship of a whistleblower with the law, adding “risquant son emploi et s’exposant à toutes sortes de poursuites judiciaires, parce qu’il dénonce la corruption de ses supérieurs hiérarchiques, la fraude fiscal de sa banque, la fraude environnementale ou sanitaire de l’entreprise qui l’occupe.”1 In this context, it becomes clear that lives, the environment, money, and reputations are at stake. However, this “attachement passionné au droit” is often viewed with suspicion and alarm, rather than as the positive contribution to the rule of law that it is.
In other Member States, legislation exists but proves inadequate in the face of some of the challenges and so continues to evolve. The UK Public Interest Disclosure Act (PIDA) of 1998, one of the earliest pieces of dedicated legislation in the EU, shows that even this legislation has had to be “tweaked” on several occasions, based on jurisprudence and practice. Even so, it is not clear that the necessary change in culture has taken place across all sectors. In the public health sector, for instance, whistleblowers in the recent Gosport hospital tragedy were “fired, gagged and blacklisted” for drawing attention to the fact that 456 elderly people had died in the hospital after having been given excessive doses of opioid drugs through pumps by medical staff.6 It is tragic that the whistleblowers were not listened to.
At present, there is a tendency to try to move away from concepts connected with the intention of the whistleblowers, such as “good faith,” and to move towards tests that focus on the nature of the information itself.7 The notion of “public interest”8 can be equally slippery and is undergoing some careful recalibration in some Member States.
In France, the “Sapin II” law adopted in December 201610 requires a number of organisational measures to be put in place in order to protect whistleblowers. They include the setting up of internal reporting mechanisms for firms with more than 500 employees and with a turnover of over €100 million. This requirement also applies to municipalities with more than 10,000 inhabitants. The French Anti-Corruption Agency has acquired a new role in ensuring the respect for procedures.
However, new legislation alone is no “magic bullet” and, with recently enacted legislation, time needs to pass before whistleblowers begin to understand and trust systems that have been put in place. Hence, there may not be a noticeable increase in the number of whistleblowers reporting immediately after the adoption of legislation. A change in culture in the work place must also take place for whistleblowers to begin to trust reporting procedures.
Whistleblowing does not lend itself well to statistical analysis, as the number of disclosures or the number of recognised or presumed whistleblowers are a crude measuring tool and do not give any idea of the interests at stake. A presumed whistleblower in the nuclear safety sector or in the public health sector giving information on dangerous behaviour or products counts as one data entry in statistical terms. In prevention terms, the human misery and financial costs potentially prevented may be much higher indeed. Thus, in the future, it will be necessary to develop more sophisticated statistical models in relation to whistleblowing, which are based on the grounds for preventing harm – in this way, the small number of whistleblowers could no longer be used as a reason for not putting an adequate legal framework in place. This should be taken into account when developing benchmarks and indicators for whistleblowing policies, as advocated by the European Parliament.11 It is a challenging task for criminologists, who are undoubtedly needed in this area.
We are conscious here that investigative journalists and their sources are also exposed through the nature of their work. This is beyond the scope of this article however, as is whistleblowing regulation within the EU institutions. Both these topics – journalists and their sources and regulation of whistleblowing within the EU institutions – deserve further analysis.
In 2018, the European Commission, mindful of securing strong legal bases in relation to the EU internal market, proposed a directive extending the sectoral approach. As we shall see, this proposed directive does potentially widen the ambit of whistleblowing rules, but also raises a number of issues. In the following, both approaches are briefly presented and juxtaposed.
Recent, highly publicised whistleblowing incidents in the financial and public health sectors have suggested that harmonisation at the EU level could ensure that minimum standards on the protection of whistleblowers are respected. The harmonisation level should at least require that national legislation be in compliance with the existing ECtHR case law. Such harmonisation would also make it possible for all Member States to draw on the experience already acquired in some Member States, and it would promote the equal treatment of workers throughout the EU. Harmonised rules would cover both the public and private sectors and apply horizontally to all sectors of the economy, with as few exceptions as possible (typically and controversially: national security). All workers would be covered, whatever their status.
"The sectoral approach resulted in a number of separate protected disclosure provisions across a number of statutes. While there are similarities between these provisions, there are also significant differences. This uncoordinated approach led to an unsatisfactory patchwork of sector specific provisions which are potentially confusing in nature and which fail to provide clarity in the law relating to protected disclosures. The continuation of such a policy, even on a coordinated basis, would take some considerable time to ensure a sufficiently broad sectoral coverage. Such an approach would not be in accordance with best international practice and would also militate against the generally recommended concept of a robust and comprehensive pan-sectoral approach. […] Not recommended."
"Whistleblower legal frameworks should not be sector-specific (subject to some qualifications) and should apply to public, private and not-for-profit sectors."
However, as will be discussed in the next section, the European Commission subsequently opted for the continuation of pre-existing sectoral approaches at the EU level.
The EU approach to whistleblowing, as applicable in the Member States, has hitherto been one tailored to specific sectors and issues in order to include investment products,17 insurance distribution,18 securities,19 statutory audits,20 market abuse,21 money laundering,22 credit institutions,23 and trade secrets24. Provisions on whistleblowing vary in accordance with the sector: they are comprehensive in market abuse legislation, whilst whistleblowing is mentioned only briefly in the directive on trade secrets, as an exception to the general rule on secrecy.25 The limited protection that whistleblowers enjoy at present in EU law therefore depends on the Single Market sectors in which the whistleblower seeks to act.
(x) protection of privacy and personal data and security of network and information systems.
The following are also covered: breaches relating to the Internal Market, as referred to in Art. 26(2) TFEU, as regards acts breaching the rules of corporate tax or arrangements whose purpose is to obtain a tax advantage that defeats the object/purpose of the applicable corporate tax law. We will return to the material scope of this proposed directive and the issues it raises later.
Support awareness-raising and the fight against socio-cultural factors leading to under-reporting.
As a result, a legislative initiative under Art. 153(1)(a) and (b) TFEU was not attempted. Such an initiative would have regulated aspects of whistleblower protection relating, respectively, to improvement of the working environment to protect workers’ health and safety and to working conditions, and it would have provided protection to workers reporting on violations of both national and EU law. It was argued that the personal scope of such an initiative would be too limited, in the sense that it would not allow for protection of all the categories of persons referred to in the Council of Europe Recommendation.31 Thus, such a horizontal approach would only have limited effectiveness in terms of improving the enforcement of EU law.
Notwithstanding the limitations in the applicability of the proposed EU directive, the Commission’s proposal is innovative especially in five aspects. This innovation results from the fact that these aspects are not always present in the most advanced EU and/or national legislations.
Any persons working under the supervision and direction of contractors, as well as sub-contractors and suppliers.
Reporting persons whose work-based relationship is yet to begin are also included. It may be useful to compare this with the situation that exists in the Irish Protected Disclosure Act of 2014.32 The Act’s definition of the term “worker” includes employees and former employees, trainees, people working under a contract for services, independent contractors, agency workers, people on work experience, and the Gardaí (Police force). The Irish legislation does not, however, mention volunteers, that is to say persons without contract of employment.
Secondly, the proposed directive has adopted the “tiered” approach to reporting that is already evident, for example, in Ireland, France, the UK, the Netherlands, Belgium, or Romania. This tiered approach involves a separation between “reporting” (internally or externally) and disclosing (making the disclosure public) in the draft directive.
The reporting person was entitled to report to a competent authority directly through the external reporting channels by virtue of Union law.
In addition, the draft directive provides that public/media disclosure may also justify protection under certain circumstances: According to Art. 13(4)(b) a person making a public disclosure qualifies for protection if he or she could not reasonably be expected to use internal and/or external reporting channels, due to imminent danger in terms of the public interest, or to the particular circumstances of the case, or where there is a risk of irreversible damage. This provision allowing public disclosure is meant to avert environmental or public health disasters and extends the boundaries of legally acceptable action by whistleblowers.
Vulnerable small private entities, following a risk assessment to be conducted by the Member State.
Public sector entities obliged to set up internal reporting channels are state or regional administrations or departments, municipalities of more than 10,000 inhabitants, and other entities governed by public law. The thresholds are considered necessary so as not to unnecessarily burden small entities, and this approach has already been adopted by a number of Member States. A harmonisation of thresholds seems desirable, particularly in cross-border cases.
Fifthly, Art. 17 lays down penalties applicable to natural or legal persons who hinder or attempt to hinder reporting, take retaliatory measures against reporting persons, bring vexatious proceedings against reporting persons, or breach the duty of maintaining the confidentiality of the identity of reporting persons. According to Art. 17(2), Member States must also provide for effective, proportionate, and dissuasive penalties applicable to persons making malicious or abusive reports or disclosures, including measures for compensating persons who have suffered damage from malicious or abusive reports or disclosures.
These five points show that the legislation intends to address situations in the public and private sectors, whilst paying attention to the rights and obligations of the various parties. It is worth remembering, however, that this will only apply to aspects of the Single Market and to “PIF.” The defined material scope of the proposed directive may exclude practices in hospitals, residential homes, schools, etc. unless there is a recognisable, single-market issue at stake, which is covered by one of the above-mentioned Single Market legal bases. It may be difficult for employees and members of the public to know whether a particular “report” or “disclosure” would justify protection against retaliation. In this context, the draft directive does not mention a whistleblower’s access to legal advice in this admittedly complex regulatory framework.
An EU internal market perspective makes sense from the European Commission's point of view. However, from a human rights perspective, it is not clear why the internal market should be privileged in terms of whistleblower protection. As the EU is not yet a party to ECHR, perhaps this level of coherence is not yet required; in any case it would seem desirable.
Art. 1 of the draft directive refers to an annexe with nine pages of legal instruments the directive would apply to. One wonders therefore it would be immediately clear to a prospective whistleblower whether his information would fall within the ambit of any of these instruments.
Would it protect whistleblowers in hospitals and institutions dealing with vulnerable people, for example? The answer seems to be: it depends! Protection would be guaranteed only if the public health issue concerned the quality and safety of organs and substances of human origin or the quality and safety of EU medicinal products and devices. There is therefore scope for the protection of a whistleblower with information on faulty or dangerous products. The directive would not, however, cover a whistleblower such as Heinisch, with information on ill-treatment in an institution. In such cases of ill-treatment in institutions, national law on whistleblowing (when it exists) would have to apply. As a consequence, one whistleblower reporting on both aspects (faulty products and ill-treatment) might only be protected for part of his or her disclosure by the implementing rules of the directive. It is not clear yet how this can work in practice.
“any action taken by the recipient of the report, made internally or externally, to assess the accuracy of the allegations made in the report and, where relevant, to address the breach reported, including actions such as internal enquiry, investigation, prosecution, action for recovery of funds and closure”.
In the same way, the reporting person must receive “feedback” about the “follow-up of the report” – feedback is not defined here. The precise nature of follow-up and feedback will therefore be left to Member States’ competent authorities.
Obligation to provide advice and legal support for reporting persons and those facilitating the reporting.
Let us also look at the procedure for internal reporting in Art. 4 of the proposed directive. It requires “a diligent follow up to the report by the designated person or department.” This does not have quite the same bite as a “duty to investigate and take the necessary remedial measures.” The term “follow up” (at least in English) tends to suggest that one is waiting for someone else to act. But who would be acting in this case? And would this be any clearer in national legislation?
As mentioned in the introductory remarks, the proposed whistleblower directive includes the protection of the EU’s financial interests (PIF).
The financial interests of the EU have been usefully defined in Art. 2(1) of Regulation 883/2013 to include revenues, expenditures, and assets covered by the budget of the European Union and those covered by the budgets of the institutions, bodies, offices, and agencies and the budgets managed and monitored by them. In the context of PIF, three points are worth mentioning.
The second point relates to institutional dynamics that do not appear altogether propitious. The European Parliament called on the Commission, and on the European Public Prosecutor’s Office, as far as it is within its mandate, to create efficient channels of communication between the parties concerned, to likewise set up procedures for protecting whistleblowers who provide information on irregularities relating to the financial interests of the Union, and to establish a single working protocol for whistleblowers.37 It also calls for the creation of a special unit with a reporting line as well as dedicated facilities within Parliament for receiving information from whistleblowers relating to the financial interests of the Union.38 This mechanism would be in addition to the establishment of a European referral body associated with the Office of the European Ombudsman to receive and handle reports at the Union level.
It seems that the optimum trajectory for PIF whistleblowers’ information still needs to be clearly defined, as does the role of the EPPO in this area. Perhaps from the potential PIF whistleblower’s point of view, it should be crystal clear who receives the information, who is responsible for acting on it -- and who may grant protection. OLAF's role and cooperation with EPPO in relation to whistleblowers should also be clarified. Too circuitous a route for "PIF" disclosures could lead to information not reaching the person habilitated to take action in time and to whistleblowers not obtaining timely protection from those with authority to grant it.
The third point has to do with a specific conundrum related to EU expenditure. EU budget funding is often mixed with national, regional, or private funding. This can lead to a confusing legal situation. Member States may decide to apply one whistleblower regime to the national part of funding in accordance with existing national legislation (if any exists), whilst the EU whistleblowing regime would apply to only the EU part of the funding. Yet other Member States may consider the whistleblowing directive to apply to the entire funding (which, by the way, would not correspond to the present definition of the financial interests of the European Union).
The same remark would apply mutatis mutandis on the income side of the EU budget (customs duties, VAT), as national tax is often evaded at the same time as EU tax. In the area of indirect taxation, however, experience shows that information often comes from informants, rather than from whistleblowers. The draft directive does not, however, provide any framework for the protection of informants – indeed it was not intended to do so, the legal framework for the protection of informants being the sole competence of the Member States. This means however that only a small proportion of "PIF" information providers would be protected on the income side of the EU budget.
Whistleblowing legislation will remain a matter of striking a delicate balance between the rights and obligations of the whistleblower, the employer, and all persons concerned. Contrary to popular belief, such legislation does more than just ensure whistleblower protection, but also ensures that an adequate response is given in reaction to disclosures and that the above-mentioned delicate balance is scrupulously respected. As such, it is complex legislation, obviously touching on many areas of law: criminal, civil, labour, and sector-specific laws.
Whistleblowing is often discussed as an antidote to financial malpractice. There certainly is plenty to deal with, and the proposed directive represents a real advancement, with Single Market-related and finance-related sectors being well covered – including, inter alia: procurement, insurance, money laundering, protection of the EU’s financial interest of the EU. At the same time, there is a wider range of problems in relation to which the potential of whistleblowing has yet to be fully explored or supported by EU legislation, as pointed out by the European Parliament. At their extreme, these problems concern life-and-death situations, affecting the greater population (when exposed to chemical or biological hazards) and vulnerable groups in society (for example, the sick and/or aged, as illustrated by the UK’s Gosport tragedies). The present patchwork of legislative responses are only steps on the road to progress in this legal area.
Should the directive be adopted, the issues raised in this article could no doubt be resolved in time. It is in the nature of whistleblowing legislation that it evolves in practice, so we look forward to following the proposed directive’s journey - and not just in relation to “PIF”.
The information and views in this article are those of the author and do not reflect the official opinion of the European Commission.

References: Art. 26
 Art. 153
 Art. 13
 Art. 17
 Art. 17

Art. 1
 Art. 4
 Art. 2