EU Whistleblowing Directive effects on UK legislation

Following the UK's departure from the EU on 31 December 2020, it is (of course) no longer an EU Member State but the Directive remains relevant for organisations with wider EU operations. We consider key considerations for UK entities and the implications of Brexit further below.

Strictly speaking, the UK is under no legal obligation to implement the Directive and it seems unlikely that the Directive will be implemented directly in the UK. However:

• The EU-UK Trade and Co-operation Agreement ("TCA"), which has applied provisionally since 1 January 2021, contains far-reaching level playing field provisions. The UK and EU agreed not to weaken or reduce their labour and social protections below the levels in place at the end of the transition period (31 December 2020) and to continue to strive to increase their respective labour and social levels of protection. Where there are significant divergences (which have a "material impact on the level playing field for trade and investment"), the EU can take appropriate rebalancing measures.

We are yet to see the implications of the Retained EU Law (Revocation and Reform) Bill which is currently being debated in the UK Parliament but this has the potential to impact a vast array of employment-related regulations, as discussed further in our insight.

If there is significant divergence in a way that materially affects trade or investment, the EU could trigger the rebalancing mechanism.

Even though the Directive is not being implemented in the UK, it remains relevant, particularly for financial services firms and organisations which operate across Europe, and may come to be regarded as best practice. It will also impact UK companies where global companies seek to establish a consistent approach to whistleblowing across their global organisation.

How does the Directive differ from the UK regime?

The UK was one of the countries which the Commission already deemed to grant whistleblowers comprehensive protection (under the Public Interest Disclosure Act 1998 ("PIDA") as incorporated into the Employment Rights Act 1996 ("ERA")).

Much of the content of the Directive is already contained in UK law, but the UK regime does not cover everything contained in the Directive. Some key differences are set out below:

Who is covered

• The Directive has a wider scope than the UK regime in that it protects self-employed people, shareholders and board members (including non-executives), as well as "facilitators" (these are individuals connected to the whistle-blower in a work-context, such as colleagues and relatives, and legal entities associated with the whistle-blower).

Relevant disclosures

• Under the Directive, protection relates to breaches of EU law that fall within specified sectors (including public procurement, financial services, protection of privacy and data (amongst others)). UK protection focuses on categories of wrongdoing (including criminal offences, breach of a legal obligation etc) and is not limited to sectors.

• With regard to whether a disclosure is protected, the EU and UK regimes are similar but whereas in the UK, the focus is on the subjective belief of the whistle-blower, the Directive focuses on whether the person had "reasonable grounds" to believe that there were grounds for a whistleblowing disclosure i.e. there is also an objective element. In the UK, there is an additional element that the disclosure must be, in the reasonable belief of the whistleblower, in the public interest.

Reporting

• Under the Directive, organisations with 50 or more employees in the private sector irrespective of the nature of their activities will be required to establish internal reporting channels. (The minimum threshold does not apply to regulated entities in the financial services sector or those vulnerable to money laundering or terrorist financing, which are required to have reporting channels regardless of their size.) There is no equivalent requirement in the UK (and no legal requirement for a whistleblowing policy), except for specific requirements applying to regulated firms in the financial sector.

• The Directive regime is similar to the UK in that reporting through internal channels is encouraged in the first instance, with escalation to external channels.

Confidentiality

• The Directive states that the identity of the whistleblower must not be disclosed without explicit consent to anyone beyond those dealing with the report, unless this is necessary and proportionate in the context of the investigation. This is similar to the position in the UK which has emerged through case law, although it is not specifically set out in legislation.

Record keeping

• The Directive prescribes obligations to keep records of reports. There is no explicit requirement to keep records of reports in the UK, but in practice these are likely retained by employers within HR records (retained in line with data protection guidelines).

Timeframes

• The Directive prescribes a specified timeline that organisations must follow, including acknowledging receipt of the report within seven days and providing feedback to the whistleblower within a reasonable time frame not exceeding three months from acknowledgement of receipt of the report. There is no equivalent timeframe to respond in the UK and no legal requirement to give feedback regarding action envisaged or taken.

Country-level oversight

• Member States must also designate a competent national authority to establish user-friendly external reporting channels. This body will be responsible for ensuring the public has accessible information on the whistleblower protections. There is currently no national authority in the UK with such a remit (although the charity Protect (formerly Public Concern at Work) provides support and advice to whistleblowers and organisations, and set up an expert independent commission to review the effectiveness of whistleblowing arrangements and make recommendations for change).

Retaliation

• Member States must take measures to ensure that whistleblowers are protected against retaliation. This protection is already incorporated into UK whistleblowing law under PIDA. Under the Directive, in any associated litigation, the burden of proof shifts to the person who has taken the detrimental measure to show it was taken on justified grounds.

What changes are we likely to see in the UK?

It is possible that we may see certain amendments or enhancements made to the UK regime to bring it closer into line with the Directive.

One potential area for change is that the scope of the UK regime could be expanded. Some current developments of interest, to be kept under review:

• On 15 December 2022, the Public Interest Disclosure (Prescribed Persons) (Amendment) Order 2022 amended the list of prescribed persons for the purpose of whistleblowing, in particular in relation to various environmental harms.

• The Public Interest Disclosure (Protection) Bill seeks to create a new independent Whistleblowing Commission to set, monitor and enforce standards.

• Similarly, another Private Members' Bill (the Office of the Whistleblower Bill 2019­/2021 was presented to Parliament in January 2020 (and had its first reading in the House of Lords on 20 May 2021) seeking to establish an independent Office of the Whistleblower, which would deal with the administration of arrangements to facilitate whistleblowing, which would act as a point of contact for whistleblowers but also maintain a fund to support whistleblowers and a panel of legal firms. The Bill's first reading took place in the House of Lords on 13 June 2021 and the second reading and next step to move to committee stage for a more detailed review, has yet to be scheduled. We may see progress on this Private Members' Bill during the course of 2023, which would lead to the establishment of an enhanced independent body in the UK in line with the Directive.

  • Whistleblowing charity Protect launched a new campaign “Let’s fix whistleblowing law” calling for reform to PIDA 1998 back in April 2021, and it continues to campaign for changes to the UK whistleblowing regime:

    • to expand its scope and protect a wider group of people;

    • to create new standards for employers – to have whistleblowing arrangements in place and a requirement to give feedback on concerns raised;

    • for the new standards to be underpinned by penalty regime set by new regulator the Whistleblowing Commissioner; and

    • provide better access to justice for whistleblowers.

Separately we may see firms start to align UK procedures with Directive standards in any event, where an EU/ globally aligned policy is preferred.