Whistleblower Protection in Europe: Where do we Stand?

The European Court of Human Rights (hereinafter referred to as “ECHR”) has just granted the status of whistleblower to a former employee of PwC, in Luxemburg, who was at the origin of public revelations on certain tax practices, known as “Luxleaks”.

Although the facts of this decision predate the implementation of the European Union (hereinafter referred to as the “EU”) framework on the subject, the ECHR ruling (1.) gives an opportunity to look into the European whistleblowing and whistleblower protection system, which has recently been strengthened (2.), and its French transposition (3.).

1. The ECHR ruling.

The ECHR considers that the conviction of a whistleblower can constitute a breach by a State of the freedom of speech protected under Article 10 of the European Convention on Human Rights.

This is what the ECHR has just recalled in its “Halet v. Luxemburg” decision,^[1] rendered on February 14, 2023, named after this PwC employee in Luxemburg, who had transmitted to a journalist confidential documents relating to advance tax rulings (“ATAs”), which had been used in the context of a television program and put online by an international consortium of journalists to form what the press called the “LuxLeaks”. This employee was dismissed and convicted for breach of professional secrecy to a fine of 1000 euros.

In its ruling, the Court, in order to determine whether the applicant could be recognized as a whistleblower, applied the six criteria identified in its previous case law, in particular in its “Guja” judgment,^[2] namely (i) the availability of alternative channels for making the disclosure, (ii) the public interest presented in the disclosed information, (iii) the applicant’s good faith, (iv) the authenticity of the disclosed information , (v) the detrimental effects of the disclosure, and (vi) the severity of the sanction.

In this case, the Court noted, in particular, that the information at issue shed light on the “tax avoidance, tax exemption and tax evasion” by multinationals companies, and was therefore of public interest. In consequence, the Court ruled that the State of Luxemburg had breached the freedom of speech of the applicant.

2. The EU Directive and Member States implementation.

The ECHR ruling comes right in the middle of the implementation of the EU Directive n°2019/1937 of October 23, 2019^[3] (hereinafter referred to as “Directive”). This Directive aims to create a common reference framework for the recognition and protection of persons who report violations of EU law in Member States.

1. 1. Increased criminal and reputational risks for companies.

The Directive contains several provisions that increase criminal and reputational risks for companies.

• The non-prioritization of reporting channels.

Article 10 clearly states that a report can be launched directly through an external channel. In addition, public disclosure is also possible either when an internal or external alert has been unsuccessful or directly in certain circumstances.^[4]

Thus, companies will lose the benefit of being informed first of internal malfunctions, of investigating them themselves, of putting in place preventive and remedial measures, and of informing the authorities if necessary in order to benefit from a negotiated procedure.

Consequently, the Directive obliges companies to considerably strengthen their internal reporting mechanisms, so that they are as incentive as possible, but without any guarantee that their employees will use them.

• The extension of protection to certain third parties.

The expansion of reporting channels is also accompanied by a strengthening of the protection afforded to whistleblowers, and an extension of this protection in particular to “third parties who persons who are connected with the reporting persons”, and to “facilitators” who assist the report in a professional context.^[5]

• The possibility of a financial reward for whistleblowers.

The Directive opens the way towards a financial reward for whistleblowers by requiring only that the reporting person has “reasonable grounds to believe that the information on breaches reported was true”^[6] in order to benefit from protection.

This contrasts with the American system, in which the SEC directly pays informants a percentage of the sums recovered by the SEC against the perpetrators of illicit practices.^[7]

It is also worth noting that the SEC announced in 2021 that its Whistleblower Program “has become fundamentally international in character”. Some EU Member States are among the foreign countries from which the largest number of tips were originated, especially Germany with 60 tips out of a total of 1350 from abroad, but also Italy (17) and France (16) to a lesser extent.^[8]

1. 2. The clarification of the European Commission on the possibility of sharing resources for companies with less than 250 workers.

The question of the application to corporate groups of the Article on the sharing of resources as regards the receipt of reports and investigations^[9] has been of concern to companies groups. Such an application would require subsidiaries with more than 250 workers to have a whistleblowing system and their own resources to receive and investigate whistleblowers.

The European Commission confirmed in a letter dated June 2, 2021 that the pooling of resources was only possible for companies with between 50 and 249 workers, regardless of whether they belong to a group of companies or not.^[10]

In spite of this clarification, the matter remains hotly debated in some Member States and in companies where systems are currently reviewed.

1. 3. The slow and diverse transposition of the Directive by the Member States.

Whereas the EU Members States had until December 17, 2021 to transpose the Directive in their legal systems, 7 Member States are still in the legislative process in March 2023, and one State (Hungary) has not even started such process. Spain is the last Member State to have voted its transposition law, on February 7, 2023.

On this regard, the EU Commission has announced on February 15, 2023 that it decided to refer the belated Member States to the Court of Justice for failure to transpose.

In addition, there are differences in the degree of transposition among the Member States. For example, Estonia and Latvia decided a legislation covering a wide array of whistleblowing situations, while serious debates on the issue of scope are still taking place in other countries, such as Germany and Italy.

3. The French law.

The French initial framework on whistleblowers protection was created in 2016 by the Sapin II law.^[11]

With the law of March 21, 2022^[12], which became effective on September 1^st, 2022, France took the opportunity of the transposition of the Directive to strengthen the status and protection of whistleblowers, regardless of whether they report EU or national breaches.

France made the choice of a rather diligent transposition. In particular, the French law extends the definition of “facilitators” to private non-profit legal entities^[13], such as Non-Governmental Organizations, going further than the Directive, which is limited to legal persons acting in a professional context.^[14]

On the other hand, France explicitly discarded the reward of whistleblowers^[15], even though a similar system exists with respect to certain tax offences.

---

In conclusion, the current European framework relating to whistleblowing will inevitably lead to an increase in the number of reports, which will entail a significant criminal risk for companies and which could be highly detrimental to their image, especially if they do not have effective internal reporting mechanisms and incentives.

The legislative framework remains fragmented, in particular for multinational companies. One can regret, in this regard, that the Directive has not necessarily brought further clarity. On the contrary, with respect to a centralized vs decentralized whistleblowing system, the interpretation by the European Commission of the Directive has introduced a layer of complexity.