Many European countries have only partial legal protections for whistleblowers. Here is a country-by-country overview.
Whistleblowers play a vital role in exposing corruption, fraud and mismanagement. Because many whistleblowers face reprisals after they report, adequate legal protection is needed urgently. But many countries in Europe have failed to implement this. We provide an overview of current whistleblowing legislation, both inside and outside the EU.
EU countries
Note: The new EU Whistleblowing Directive 2019 introduces minimum standards for the protection of whistleblowers and obliges many public and private entities to introduce their own internal whistleblowing channels. EU countries are required to transpose the directive by December 2021.
Below you will find a detailed overview of whistleblowing legislation in the individual EU countries.
Austria
Austria still lacks a specific whistleblower protection law. However, the 2011 amendment to the Public Service Law guaranteed public employees protection against discrimination if they reported corruption offences. There are very few whistleblower mechanisms in the private sector, except for a requirement for banks to have internal whistleblowing systems in place, and protection for employees who report environmental misconduct.
Last updated: 13/08/2020
Belgium
In Belgium only companies in the financial services sector and public institutions are required to implement a whistleblowing system. The 8 mai 2019 law states that employees and former public sector employees are entitled to submit reports and receive protection against retaliation. There are no comprehensive protections for employees of private companies.
Last updated: 13/08/2020
Bulgaria
Despite growing public and political interest in the issue in recent years, Bulgaria has no specific legislation regarding whistleblower protection and there is no legal obligation for entities to implement a whistleblowing system. The only law providing meaningful protection is the Administrative Procedure Code, passed in 2006. This law allows persons and organisations to report abuses of power, corruption, mismanagement of public property, and other illegal or inappropriate acts that affect state or public interests. The law, however, only applies to public sector wrongdoing. Private sector employees have no specific protections other than a generic labour law provision that grants workers the right to compensation if they are treated unjustly.
Last updated: 13/08/2020
Croatia
On 1st July 2019, Croatia received its first whistleblower protection act, the Law on the Protection of Persons reporting Irregularities. This act is designed to prohibit actions that may hinder the reporting of irregularities and offers whistleblowers protection against retaliation. The act obliges employers with 50 or more employees to implement a whistleblowing system. Although the protection of whistleblowers was already subject to partial regulation through the Labour Act, Criminal Code, and Act on Data Secrecy, the act is the first piece of Croatian legislation that sets out a comprehensive legal framework on this subject.
Last updated: 13/08/2020
Cyprus
There are no specific regulations regarding the implementation of whistleblowing systems or the protection of whistleblowers. Certain whistleblowers are however offered protection under section 59 (6B) of the Anti-Money Laundering and Combating Money Laundering Law 2007.
Last updated: 13/08/2020
Czech Republic
Commercial and public entities are currently not obligated to establish whistleblowing systems. On 18 February 2019, the Czech Ministry of Justice submitted a proposal for a new law – the Act on Protection of Whistleblowers – to the Czech Government, but no complex regulation which would support whistleblowers and provide them with protection has been implemented yet in the Czech legal system. In June 2020 it was confirmed that the Czech Minister of Justice would have the legislative draft of a whistleblowing bill ready by September 2020 which would fulfil the requirements of the EU Whistleblowing Directive. The proposed law also establishes an Agency for the Protection of Whistleblowers if the whistleblower opts to report externally.
Last updated: 13/08/2020
Denmark
Current legislation obliges companies in the financial sector to implement a whistleblowing system and allows whistleblowers to remain anonymous. There is no general legislation for whistleblower protection. Legislation which transposes the EU Whistleblowing Directive into Danish law is expected during the next parliamentary session (October 2020).
Last updated: 13/08/2020
Estonia
There is currently no obligation for entities to set up a whistleblowing system. Legal protection for whistleblowers is limited to public sector employees in corruption cases. The Estonian Anti-Corruption Act decrees that reports from staff of public institutions regarding suspected corruption or other misconduct by colleagues made in good faith shall remain confidential and can be disclosed only with the written consent of the official who made the report. An amendment to the act provides public employees with protection from retaliation. On 22 July 2020, the Estonian Minister of Justice confirmed that the bill to transpose the EU Whistleblowing Directive was underway.
Last updated: 13/08/2020
Finland
Though frequently ranked as one of the least corrupt countries in the world, Finland currently does not oblige entities to implement a whistleblowing system and has no legal protection in place for whistleblowers. However in cases where there are whistleblowing systems in place, these systems have to adhere to the requirements laid out in the Personal Data Act (523/1999), the Act on Protection of Privacy in Working Life (759/2004) and the Employment Contracts Act (55/2001). In March 2020 it was reported that Finland’s Ministry of Justice had set up a national working group for the purpose of transposing the EU Whistleblower Directive.
Last updated: 13/08/2020
France
The French anti-corruption Law “Sapin II” requires that companies establish an internal whistleblowing system that allows employees to report behaviours that violate the corporate code of conduct (if registered office in France & over 50 employees). Subject to certain conditions, the whistleblower can benefit from criminal immunity. Whistleblowers benefit from specific protection against any retaliatory or discriminatory measures within the workplace.
Last updated: 13/08/2020
Germany
While entities are not legally obliged to implement a whistleblowing system, they are strongly advised to do so. The German Corporate Governance Code requires companies to fulfil legal regulations and corporate guidelines by taking measures such as implementing a whistleblowing system. Meeting these requirements is mandatory for all issuers in the regulated market in Germany and increasingly becoming best practice. And while there is no specific legal protection for whistleblowers, the German labour court has established certain principles on whistleblowing (“cascade principle”) which mean that employees are protected if they first try to report internally to their employer.
Last updated: 13/08/2020
Greece
While there is no obligation for entities to implement a whistleblowing system, it is encouraged. There is no comprehensive legal protection for whistleblowers, however in April 2014 Greece introduced provisions that aimed to protect people who report corruption from criminal prosecution for perjury, slander, libel, and breach of confidentiality and personal data. Additionally, the law bans various forms of retaliation against public employees who report corruption, including firing, disciplinary actions, discrimination and withholding promotions. On 20th June 2020 it was announced that the government had established a legal drafting committee to prepare the draft law to transpose the EU Whistleblowing Directive.
Last updated: 13/08/2020
Hungary
Act CLXV 2013 on Complaints and Whistleblowing came into force on 1st January 2014 which established an electronic whistleblowing system for the public sector operated by the Commissioner for Fundamental Rights (an ombudsman). Whistleblowing reports are registered with an anonymised code and published on the internet in a form accessible to all without any data relating to the whistleblower’s identity. The ombudsman then transfers the report to the competent authority for investigation. The act emphasises that the whistleblower should be protected against retaliation. In the private sector there is no legal obligation for companies to establish whistleblowing systems, but if they do, they must meet several requirements. The whistleblowing rules must be published on the company’s website in Hungarian and the company must request an application to the data protection authority for permission to process such data.
Last updated: 13/08/2020
Ireland
While Ireland currently has no general obligation on companies to provide whistleblowing channels, the Money Laundering and Terrorist Financing Regulations 2019 oblige financial institutions and other persons subject to anti-money laundering/counter-terrorist financing compliance obligations to put in place independent and anonymous whistleblowing arrangements. The Protected Disclosures Act 2014 (currently under review) provides legal protection for whistleblowers and ensures whistleblowers can avail of significant employment and other protections if they are penalised by their employer. On 6th June 2020 Ireland announced a public consultation on the transposition of the EU Whistleblowing Directive into national law. On 12th June 2020 Ireland’s Programme for Government “Our Shared Future” detailed a commitment to ensure the effectiveness of new whistleblowing legislation.
Last updated: 13/08/2020
Italy
Law No. 179/2017, which came into force on 29th December 2017, expanded existing whistleblowing protections to the private sector, requiring companies that have adopted formal compliance programmes pursuant to Legislative Decree No. 231/2001 to also implement a formal whistleblower programme. Acts of discrimination or retaliation against whistleblowers are prohibited.
Last updated: 13/08/2020
Latvia
The Latvian Whistleblowing Law obliges companies with more than 50 employees to establish a whistleblowing system. The law which came into force on 1st May 2019 ensures legal protection for whistleblowers and that sufficient information and support for the whistleblowers and support for companies establishing a system are accessible.
Last updated: 13/08/2020
Lithuania
In January 2019 Lithuania introduced legislation which required companies with more than 50 employees to introduce internal whistleblowing channels. Whistleblowers are guaranteed legal protection and may also be remunerated for the information they report.
Last updated: 13/08/2020
Luxembourg
Companies regulated by the CSSF (credit institutions and investment firms incorporated under Luxembourg Law) are obliged to implement a whistleblowing system. Other companies that fall outside of the CSSF’s purview are free to decide whether to opt in on this obligation. The Law of 13th February 2011 introduced specific provisions to the Labour Code which protect whistleblowers in both the private and public sector.
Last updated: 13/08/2020
Malta
In September 2013 Malta introduced the Protection of the Whistleblower Act which puts in place a structure for public and private sector employees to disclose information regarding improper practices and protected whistleblowers from retaliation. In Malta every employer must have an internal whistleblowing system in place.
Last updated: 13/08/2020
Netherlands
On 1st July 2016 the House for Whistleblowers Act came into force which required companies with more than 50 employees to put in place internal reporting procedures. In addition to this act, the Corporate Governance Code requires all companies listed on the Dutch stock exchange to have whistleblowing procedures in place. The House for Whistleblowers Act bans retaliation if an employee has a reasonable belief that their report was accurate. The Dutch bill to implement the Whistleblower Directive is expected to open for consultation in July 2020.
Last updated: 13/08/2020
Poland
Except for banks and investments companies, Polish law does not require Polish companies to implement whistleblowing systems or provide protection to whistleblowers. The proposed new Polish law on corporate criminal liability will however provide protection for whistleblowers and this is in line with the most recent EU policy.
Last updated: 13/08/2020
Portugal
In Portugal there is currently no obligation for companies to establish a whistleblowing system and there are extremely limited legal protections for whistleblowers. Portugal has no dedicated whistleblowing law, extremely limited provisions for public and private sector employees and no government agency that supports or protects whistleblowers. In January 2020 Portugal confirmed that it will adopt the EU Whistleblowing Directive into law by the end of the year.
Last updated: 13/08/2020
Romania
In Romania there is no obligation on any company or entity to implement a whistleblowing system. Legal protection for whistleblowers is limited to public sector employees. Law 571/2004 protects personnel within public authorities and institutions who disclose violations of the law.
Slovakia
The Act on Certain Measures Related to the Reporting of Anti-social Activities came into force in 2015. The act was modified in March 2019 to require all private employers with at least 50 employees, and all public institutions, to have internal whistleblowing systems in place. The act provides pre-emptive protections from retaliation in the workplace. In 2019 a new Office for the Protection of Whistleblowers was established.
Last updated: 13/08/2020
Slovenia
There is currently no requirement for companies or organisations to implement a whistleblowing system. While there is no designated law to protect whistleblowers, the Integrity and Prevention of Corruption Act provides near-comprehensive protection to employees who report crime and corruption in good faith.
Last updated: 13/08/2020
Spain
The Organic Law on Data Protection and Guarantee of Digital Rights (3/2018) took effect in Spain on 7th December 2018 and stated that companies may establish whistleblowing systems in which employees can report — anonymously, if necessary — any act or behaviour in breach of company regulations, policies, or rules. Spain is currently debating a proposal for the protection of whistleblowers and on 2nd July 2020 the ABRE Coalition published an open letter calling for the participatory transposition for the protection of whistleblowers in Spain.
Last updated: 13/08/2020
Sweden
There is currently no legal obligation for companies and organisations to set up whistleblowing systems; it is however a common place and whistleblowers are generally expected to report internally first. A whistleblower protection law was introduced in 2016 and a new proposal to transpose the EU Whistleblower Directive was brought forward in June 2020 that replaces this law. This proposal states that the whistleblowing law should not be limited to reported breaches of EU law, but also include information on breaches of Swedish law. The whistleblower should be free to choose whether to first report through an internal reporting channel or to report directly through an external reporting channel (not including the media).
Last updated: 13/08/2020
Countries outside the EU
Albania
In Albania private entities with more than 100 employees and public entities with more than 80 employees (Art. 10 of the Law 60/2016) are obliged to establish internal reporting units responsible for both receiving and acting on reports. Law 60/2016 also provides legal protection for whistleblowers. In principle a report should contain the identification data of the whistleblower and his/her contact data, but the law also permits anonymous reports if the whistleblower has clearly provided reasons for anonymity, and if the report contains sufficient data on which the investigation may start.
Last updated: 13/08/2020
Kosovo
Public employers with more than 15 employees, and private employers with more than 50 employees are obliged to appoint a whistleblowing officer responsible for processing reports. Laws No. 04/L-043 on Protection of Informants and No. 06/L –085 on Protection of Whistleblowers protect the whistleblower and the persons associated with the whistleblower from reprisals.
Last updated: 13/08/2020
Norway
Under the Working Environment Act established in July 2017, all companies regularly employing five or more employees need to have a written whistleblowing policy. This policy should include encouragement for whistleblowers to report on ‘censurable conditions’, the procedure for internal reporting and name the person(s) responsible for handling internal reports. The act also prohibits retaliation by the employer against the whistleblower.
Last updated: 13/08/2020
Russia
There is no legal obligation for companies or organisations to establish whistleblowing systems. However, in the document “Measures to prevent corruption in organisations” (Меры по предупреждению коррупции в организациях) the Ministry of Labour and Social Protection strongly encourages it. The Federal Anticorruption Law No. 273, Article 13.3 requires companies operating in the country to implement anti-corruption compliance programmes containing specific anti-corruption measures. Only whistleblowers in the civil service are protected against retaliation under Russian law.
Last updated: 13/08/2020
Switzerland
In Switzerland there is no obligation for companies and organisations to implement whistleblowing systems. The National Council discussed whistleblower protection as part of the current process to revise the Code of Obligation, but it was rejected on 5th March 2020 for the second time.
Last updated: 13/08/2020
Ukraine
Amendments to the Ukrainian law On Prevention of Corruption came into force on 1st January 2020 which state that law enforcement authorities which fight corruption, public law organisations, state enterprises, private companies of which more than 50% is owned by the state and companies participating in state tenders exceeding UAH 20 million (approx. EUR 750,000) must establish protected anonymous channels for whistleblower reports. Any reports received through these channels must be reviewed and processed within certain time periods, and the whistleblowers must be informed of the status of their reports. The law also provides for a financial reward to incentivise whistleblower reports. Whistleblowers are protected under the law and they must not face negative consequences. Whistleblowers can choose to report anonymously either internally or externally to the media or to the authorities.
Last updated: 13/08/2020
UK
In the UK only organisations regulated by the Financial Conduct Authority or within the National Health Service are obliged to establish whistleblowing channels. So far the Public Interest Disclosure Act 1998 (PIDA) protects whistleblowers from detrimental treatment by their employer. Apart from that, a bill was presented to Parliament in late January 2020 which should entitle workers to further protection against protects workers from detriment and dismissal (including being selected for redundancy). Detriment is not defined in the legislation, but it might include threats, disciplinary action, loss of work or pay, damage to career prospects or suspension.
In Northern Ireland, whistleblowers are only protected from victimisation if they are a worker (employees, agency workers and trainees), they reveal information of the right type by making what is known as a ‘qualifying disclosure’ (in the public interest and concerning past, current or future malpractice) and they reveal it to the right person, and in the right way making it a ‘protected disclosure’.
Last updated: 13/08/2020
This blog article is for non-binding general information purposes only and does not constitute legal advice. All offered information is without guarantee or liability for correctness and completeness.
