The European Union adopted the new ‘Whistleblower Directive’ in October 2019. EU member states will have 2 years to implement the new Directive, and must implement it at the latest by 17th December 2021).whistleblower

The new directive comes after several recent scandals (Panama Papers) and intends to harmonise whistle-blowing laws across the whole of the EU, where it is understood that only 10 member states were felt to have sufficient legal protection for whistleblowers (the UK being one of them).

What types of laws are covered?

Breaches of EU laws on public procurement, financial services, money laundering, terrorist financing. product and transport safety, protection of the environment, data protection and public health can be reported on. Employment law derived from the EU is not covered as it was felt that other claims could be bought by individuals if they felt their employment law rights had been breached.

Who can report law breaches?

The directive applies to ‘reporting persons‘ working in the private or pubic sector who have acquired information on breaches of law in a work-related context.  This includes employees and workers and also self-employed persons, board members and shareholders, volunteers, job applicants, people whose employment has ended and those under the third-party supervision of a contractor, sub-contractor or supplier.


Anyone reporting a breach will be protected if they had reasonable grounds to believe that:

  • the information is true at the time of their reporting
  • and that it falls within the scope of the Directive.

Internal reporting channels

Companies with 50 employees or more must set up internal reporting channels and procedures for reporting breaches of law.  Companies with up to 249 employees can share a reporting channel with other companies.

What does all this mean for the UK?

Well, you’ve guessed it, Brexit!  The UK does not need to implement the Directive.  However, employers with operations in the EU will be affected by it.

The UK has comprehensive whistleblower protection already in place in the Public Interest Disclosure Act (PIDA) 1999, as amended by the Employment Rights Act 1996 (in 2013).  But the current UK legislation does not require companies to set up internal reporting channels; and the Directive affects a wider range of individuals – such as the self-employed and shareholders – than the UK’s current law does (PIDA only currently covers employees and workers).

The 10 EU Member states understood to currently have comprehensive protection for whisteblowers are:

  • France
  • Hungary
  • Ireland
  • Italy
  • Lithuania
  • Malta
  • Netherlands
  • Slovakia
  • Sweden
  • the UK.