On 7 October 2019, the European Union (the “EU”) adopted a Directive on the “protection of persons who report breaches of Union law”, which provides for the implementation of new comprehensive EU-wide rules on whistleblower protections (the “Directive”). To date, EU countries have offered varying and fragmented standards of protection for those who speak-out when they encounter wrongdoing that could harm the public interest. The Directive sets minimum standards of protection for whistleblowers reporting breaches of EU law in certain areas.

The key elements of the Directive include:

• Granting protections to a wide range of potential whistleblowers including those who may fall outside the orthodox employer-employee relationship such as job applicants, contractors, volunteers, former workers and board members, as well as individuals who assist whistleblowers such as colleagues and relatives;
• Imposing a positive obligation on companies with more than 50 employees and municipalities with more than 10,000 inhabitants to create effective and efficient internal whistleblowing channels and procedures;
• Encouraging whistleblowers to use internal reporting channels within their organisation first but also ensuring that protections are not lost for those who report breaches directly to the competent authority;
• Providing coverage for public, private and non-profit sectors, including areas such as public health, public procurement, financial services and privacy and personal data; and
• Prohibiting any form of retaliation against whistleblowers, including threats and attempts at retaliation, as well as holding whistleblowers free from liability for breaching restrictions on the acquisition or disclosure of information.

In the UK, whistleblowers are granted protection by the Public Interest Disclosure Act 1998 (“PIDA”). Broadly, workers are protected under PIDA against detriment and employees are protected from being dismissed because they have made a protected ‘qualifying disclosure’ (being ‘information’ disclosed in the public interest showing one of six prescribed categories of failure, such as the commission of a criminal offence).

EU Member States have until October 2021 to transpose the Directive into national law but with PIDA providing a foundation of whistleblower protection in the UK, the Government can cherry pick those aspects of the Directive that would supplement the UK’s legal framework, rather than adopt it wholesale. The Directive’s provisions that go beyond PIDA include allowing for a much broader range of people to claim protections (including third party groups such as family members) and imposing a general obligation on organisations over a certain size (not just those in the regulated sectors such as the NHS and financial services) to have whistleblowing arrangements in place. Notwithstanding the UK’s imminent departure from the EU, earlier this year the Government committed to allow Parliament to consider whether the UK should align with any future EU employment law changes.

Though the introduction of comprehensive EU-wide protections for whistleblowers is a welcome development, anyone considering speaking-out ought to carefully consider the limited protections afforded by both PIDA and the Directive, particularly where they may have played a personal part in alleged wrongdoing. PIDA and the Directive are creatures of civil law and do nothing to limit exposure to potential criminal prosecution, both for any part played by an individual in the underlying wrongdoing and the concomitant potential mishandling of data used to evidence their disclosures.