Clifford Chance

The EU Whistleblower Protection Directive must be transposed into Member States' local legislation by 17 December 2021. With a little less than six months to go before the deadline, companies are asking important questions to the European Commission.

Companies are faced with the question as to whether the Directive can be reconciled with their existing group-wide whistleblower systems, or whether each legal entity, at least for those exceeding 249 workers, must now have its own local reporting system and investigative resources, resulting in international groups having to overhaul their current central reporting system and allocation of investigative resources.

The Directive requires all legal entities in the private sector with 50 or more workers to provide whistleblowing channels for the reporting of certain categories of EU law infringements. While the regime specifies that legal entities with between 50 and 249 workers may share resources for the purposes of reporting, there is – according to the EU Expert Group – no such exception for group companies exceeding 249 workers. Can legal entities with 250 or more workers therefore no longer rely on central group whistleblowing systems and can groups no longer investigate complaints at a central level?

This question has been live in Denmark which is in the process of implementing the Directive. A group of large Danish corporates has questioned this with the European Commission, as has a group of other large EU-based corporations (Germany, Netherlands, etc.).

In an exchange provided to us, the Commission Expert Group on the Directive confirmed their interpretation that the Directive's requirement for legal entities with 50 or more workers to establish their own channels for reporting applies regardless of any existing group-wide whistleblowing systems. This is due to 'the need to ensure the reporting channels' efficiency, including by ensuring the proximity to the whistleblower'.

In essence, while a group-wide solution at parent level could still be offered to workers of a group's subsidiaries, it appears that an alternative local reporting channel must be established by the subsidiary, and the whistleblower will then have a choice whether to report locally or use the parent's/group system.

It is unclear to what extent the member states' representatives in the Expert Commission were involved in the responses. However, if this position remains unchanged, the decision of which level within the group is the most appropriate at which to investigate a report will no longer be that of the group but will be at the discretion of the whistleblower.

If the whistleblower decides to report into the parent company's system, the complaint would still be dealt with at parent company level, but this would not apply in the case of a report to the local subsidiary, unless the whistleblower agrees. This touches upon central principles of governance as set up in groups in recent years to ensure uniform standards of compliance across the group to the extent possible.

The Commission's Expert Group has stressed that a local report can be forwarded to another group company, with the agreement of the whistleblower, where the subsidiary concludes that it does not have the power to deal with the report effectively. The whistleblower may also elect to withdraw the report.

From a practical perspective, unless it is directly raised in the complaint, under the new regime a subsidiary may not become aware that stakeholders at other subsidiaries within the group are involved in the matter investigated, and that the investigation would be more effectively handled in a coordinated manner.

Companies are concerned that local subsidiaries might decide to close an investigation that, with the benefit of group oversight, would have merited a wider, coordinated investigation. Unless this interpretation changes, the Directive will have a significant impact on the ability of company groups to investigate reports centrally, which has been the preferred option for many until now.

Outsourcing the operation of a reporting channel to a third party (other than a group company), such as an external service provider remains possible, but will be limited to receiving the report and confirming receipt within seven days. The responsibility for the actual follow-up in terms of investigating and addressing the breach, where relevant, remains with the designated person/ department within the relevant company.

An amendment to the Danish draft implementation law will allow companies to continue their existing central solutions for now.

It remains to be seen in the coming months how these questions will be dealt with in other EU Member States as local implementation laws are debated.

The aim of the Directive to provide better and more effective whistleblower protection is right. This may, however, better be achieved by allowing larger corporations to continue their central whistleblowing systems in a practical compromise, enabling them to investigate with full oversight. We will continue to closely follow the developments in the members states and support discussions amongst our clients.