On October 23, 2019, the European Commission unveiled a directive (“Directive”) on the protection of persons who report breaches of Union law to enhance the enforcement of EU law and policies in specific areas by laying down common minimum standards providing for a high level of protection of the so-called “whistleblowers”.
The main purpose of the Directive was to overcome the current fragmentation of the whistleblowers’ protection set forth in the different EU Member States’ legislations.
The Luxembourg government has voted the law today transposing the Directive (the “Whistleblower Law”).
The legislative work preceding the vote has been nourished, as many concerns arose from Luxembourg stakeholders on the draft bill of law. This allowed for a clearer legal instrument, whose objective is to encourage disclosure and reporting and whose large impact for employers, co-contracting partners or supervisors (present or past) should be carefully considered. Most importantly, such legislative work allowed for the express exclusion of information covered by professional secrecy.
The Whistleblower Law is wider in its scope of application than the Directive and, as such, goes further/beyond as it covers any type of national legislation, to provide a consistent and complete regime according to the authors of this law.
It protects all workers (employees or self-employed) in the private and public sectors, who have obtained information about violations of Luxembourg law or EU law – where the latter has a direct effect in domestic law – in a professional context.
The broad definition of a whistleblower under the Whistleblower Law encompasses notably workers, civil servants, but also shareholders, subcontractors, and persons whose employment relationship has ended or is under negotiation, as well as anonymous whistleblowers whose name was thereafter revealed. The definition of “information on violations”, which constitutes the basis for a disclosure, includes any reasonable suspicion about actual or potential violations that have occurred or are highly likely to occur, creating a legal framework for preventive disclosures and reporting.
In a nutshell, the Whistleblower Law creates a universal status for whistleblowers by reference to Luxembourg and EU applicable legislation.
The are a few limits to the whistleblowers’ protection under the Whistleblower Law. Indeed, the information disclosed falls outside the scope of the law, which, given its wide scope of application is unlikely to happen (the only express exclusion relates to national security), if the disclosure is not based on reasonable grounds to believe that the information reported on the violations was true at the time of reporting, and the whistleblower failed to first report (internally, externally or publicly) the information obtained.
Reporting can be done through either internal or external channels, or through public disclosure. Internal reporting refers to written or oral communication inside the corporation or otherwise structure where the whistleblower performs his activity.
External reporting refers to reporting to competent national authorities (22) or to the national reporting office while public disclosure refers to a disclosure in the public area – without further indication or reference to an existing definition of the same.
In this context, it is worth noting that the authors of the Whistleblower Law have envisaged public disclosures as a last resort where it is clearly impossible for the concerned whistleblower to do otherwise. Also, external reporting is conditional upon a prior internal reporting.
The Whistleblower Law introduces a specific protection covering the workers from all forms of retaliation, including threats and attempts at retaliation, which are prohibited (e.g., suspension of an employment contract, layoff, dismissal, non-renewal, or early termination of a fixed-term employment contract etc).
Key terms of the whistleblower law
- Obligation to set-up internal reporting channels for companies hiring a minimum of 50 employees since the past 12 months, allowing whistleblowers to inform their employers on a confidential and anonymous basis about violations of national law, and
- Any form of retaliation is null and void.
Sanction in case of non-compliance
- An administrative fine of between EUR 1,500 and EUR 250,000 in case of non-cooperation with the competent authorities/national reporting office and non-compliance with the establishment of internal reporting channels.
The maximum fine may be doubled in the event of a repeat offence within 5 years of the last sanction becoming final, and
- An administrative fine of between EUR 1,500 and EUR 25,000 imposed on those who take retaliatory measures and initiate abusive proceedings against whistleblowers.
Deadline to comply
- Companies between 50 and 249 employees shall comply and establish internal reporting channels by December 17, 2023, and
- Companies with 250 employees and more shall comply with the Whistleblower Law and establish internal reporting channels as soon as it comes into force.
