EU Whistleblowing Directive Part 2

High-level of protection

Who will this impact?

The Directive is applicable to all EU states and aims to provide a high-level of protection to whistleblowers across a wide range of sectors including public procurement, financial services, anti-money laundering, product and transport safety, nuclear safety, public health, consumer and data protection. It is applicable to both public and private companies as well as public authorities. For organisations with more than 50 employees, an internal reporting system will be required. Additionally all companies, irrespective of size, will be required to ensure that whistleblowers are protected against any form of retaliation.

In the UK, financial services firms are subject to the FCA’s (Chapter 18 of the SYSC Senior Management Arrangements, Systems and Controls) and the PRA’s rules on whistleblowing. Given the scope to now cover companies with over 50 employees, this will broaden the number of companies that will need to have effective processes and procedures
in place.

The definition of a whistleblower has been widened to include any of the following who have a work-related activity:

• Employees.
• Contractors.
• Volunteers and Interns.
• Suppliers.
• Consultants.
• Shareholders.
• Managers.
• Candidates (current and former) and alumni.
• Non-Executive Directors.

In addition, protections will also be given to:

• Facilitators.
• Colleagues.
• Relatives with a work connection.

These extra protections are new but highlight that the ripples created from whistleblowing in the workplace often impact many more people than just the individual concerned.

Currently 85% of whistleblowers are employees and given the increase in coverage, it is likely that more cases will be raised by non-employees.

What do you need to do?

Should you DIY or Buy?

Given the heightened level of obligations that the EU directive is likely to bring, ‘What do we need to do?’ is a question many Boards will be discussing in the upcoming months. Directors will want to know what needs drafting, changing or amending to comply and how much it is going to cost. Cost is a key factor for many companies especially in the current uncertain economic climate.

The Directive mandates that Member States introduce effective, proportionate and dissuasive penalties relating to;

Hinderance
If an organisation or individual hinders, or attempts to hinder, reporting of concerns.

Confidentiality
If an organisation or individual fails to appropriately safeguard the identity of a whistleblower.

Retaliation
If an organisation or individual takes, or permits, detriment to the Whistleblower.

DIY

If you have an in-house legal resource, with the knowledge and time available to bring themselves up to speed with the new EU requirements, this could be something you task them with. However, your legal team’s time may be better spent focusing on other more sensitive or time critical areas of the business.

Buy

You may want to look at external providers who live and breathe the legislation. They will be offering ‘off the shelf’ products that you could incorporate easily into your business operations. Given that they are the experts, the procedures will have been considered fully and should be robust. Additionally, outsourcing whistleblowing helplines can help provide that added level of independence and security to ensure that anonymity is not compromised unintentionally.

Conclusion

Whether or not to DIY or buy is a decision which will be unique to an organisation. 85% of the FTSE 100 already have independent whistleblowing services in place. Whichever route is chosen, the output will need to be of a high standard to ensure that the procedures are robust as the risk attached with getting it wrong is likely to outweigh the cost of buying a quality product.

Types of reporting

Out of your hands?

Under the Directive whistleblowers will receive full protection if they follow a predefined escalation route. There are two scenarios in which a whistleblower will receive protection when reporting externally;

01.

If they do not believe internal channels are safe or effective.

If your whistleblowing arrangements are not in line with best practice, for example;

• You operate a digital only system.
• It is well known that the whistleblowing arrangements in place are ineffective
  i.e. email, voicemail or webform only.
• Your whistleblowing policy is insufficient.

A whistleblower can report externally citing the poor efficacy and/or confidentiality of the system.

02.

If they have reported internally at least 3 months ago and the issue has not been resolved.

If your whistleblowing arrangements are operating poorly and do not produce results within 3 months a whistleblower can report externally citing poor efficacy of the internal system.

The same approach to protection also applies to the External Competent Authority, if this body handles the case ineffectively and the whistleblower reports this publicly.

It is clear to see how it would be possible to lose control of a situation before an organisation is even aware of an issue. It is therefore vital that your whistleblowing arrangements are of good quality to enable your firm to resolve an incident of misconduct before it becomes a public relations disaster

Whistleblowing cases

Why is it important?

The Directive is likely to drive a further increase in whistleblowing cases given the increased protection and legal aid & financial assistance available to whistleblowers coupled with increasing public awareness of speaking up for instance the
‘#metoo’ and ‘BLM’ movement.

This is made even more relevant in the age of social media. If an employee has an issue with the behaviour they observe in the workplace it is easier than ever to leave poor reviews on sites such as Glassdoor or even to take to Twitter to vent their frustrations.

Whistleblowing is culturally sensitive, and historically has been stigmatised. This stigma is disappearing fast with research and lived experience starting to show whistleblowing as a valuable and courageous act. While routine ‘spying’ on colleagues will remain controversial, whistleblowers raising genuine concerns are able to make positive change in the world today.

As the existing legislation does not financially support whistleblowers to pursue a claim against their employer there may be an under representation of cases and companies may find their working practices are not as effective as they were previously led to believe.

In addition to enhanced financial support for whistleblowers they will no longer lose their protection if they decide to report their case through external channels, as is currently the case. This may mean that companies are exposed to external bodies at an earlier stage and may cause more reputational damage than before. Given the current economic downturn, reputational damage may signal the end for some businesses as they may never be able to recover.

In essence, the increased protections and support offered are likely to encourage more whistleblowers to speak up about their concerns. The risk of exposure for wrongdoings are likely to trend upwards in businesses generally with some businesses being held to account for the first time. New robust processes will be required for many and existing frameworks will need to be reviewed to ensure that the procedures currently in place will still be fit for the future.