The Directive (EU) 2019/1937 of the European Parliament and of the Council of 23 October 2019 on the protection of persons who report breaches of Union law (“Whistleblowing Directive”) entered into force on December 16th, 2019. Member States are required to transpose the Directive into national laws until December 17th, 2021, whereas it is clear now that Slovenia will not reach the implementation by the deadline, as the draft implementational act, Act on Protection of Reporting Persons, has just been provided for public discussion and will remain there until December 23rd, 2021. Part of the Whistleblowing Directive relates to the public sector, which is partially already covered by the Integrity and Prevention of Corruption Act, therefore the new implementation act will be mostly focusing on the private sector.
Pursuant to the Whistleblowing Directive, companies in the EU will be obliged to ensure adequate protection against retaliation aimed at whistleblowers. Companies with 50 or more employees and majority of companies in the public sector will be required to implement an internal reporting and follow-up system enabling employees and certain other individuals to report compliance concerns. National laws may expand this requirement also to companies with less than 50 employees, following a risk assessment. Therefore, Article 9 of the Act on Protection of Reporting Persons provides such exceptions, where the obligation to establish internal reporting is not connected with number of employees, namely for entities operating in the field of healthcare and environment and for the majority of the public sector. Public disclosure requirements will also be implemented.
The goal of the Whistleblowing Directive and Act on Protection of Reporting Persons is thus to enable safe and risk-free sharing of relevant information concerning breaches of EU law (in certain most relevant areas such as public procurement, AML, public health and similar) to competent bodies. Considering that the Whistleblowing Directive enables Member States to deviate from the applicable requirements, especially in relation to setting up the reporting systems, it will be important to monitor local implementations for compliance. Interplay between local employment as well as data protection laws (and practice) will also play a major role. The draft Act on Protection of Reporting Persons is generally in line with the Whistleblowing Directive and does not extend its material scope. However, it is possible that in the legislative procedure material scope will be extended to national breaches as well, depending on the suggested amendments by the participants. Adoption of the Act on Protection of Reporting Persons is anticipated by spring 2022.
Internal reporting
As mentioned, legal entities in public (generally with more than 50 employees) and private sectors will be obligated to establish channels and procedures for internal reporting and in relation to follow-up activities. Companies with 50 to 249 employees will be able share resources for internal reporting and conduct of investigations, which will facilitate their activities. Reporting systems can be handled internally or provided by a third-party service provider. Employees and some other categories will then be able to report relevant information about breaches through established channels, in writing, orally or both.
Data on legal entities in Slovenia is kept according to the number of employees, not according to the number of workers, as it is defined by the Whistleblowing Directive. Therefore, the threshold for determining the legal entities obliged for establishing internal reporting channels in the Act on Protection of Reporting Persons is set according to the number of employees (and not according to the number of workers, which is a broader concept).
Draft of Act on Protection of Reporting Persons establishes the obligation of legal entity who must establish an internal reporting channel to also accept the instruction or rules, which regulate the procedure for receiving and processing internal reports and define the manner of cooperation with the competent authority for external reporting in detail. The procedure and notification on the adoption of such instruction or rules must be in accordance with labour legislation, as it is for all other acts adopted by employer.
Procedure of internal reporting is generally not formal, and it must be proceeded in due course. Such procedure shall be completed within three months. Channels will need to be operated in secure manner which will ensure that all personal information remains protected. A special trustee to receive and process the internal report (“Trustee”) must be appointed. Trustee shall keep a record of the report and review it in order to determine whether the conditions for the protection of the reporting person are met. Trustee shall send acknowledgment of receipt of the report to the reporting person within seven days. An impartial person or department competent for following-up on the reports can require further information from the reporting person. Trustee shall provide feedback to reporting person within three months as of acknowledgment of the receipt, if the procedure has not yet been completed by then, the Trustee shall only inform the reporting person of the status of the procedure. The internal reporting process ends with a note – an informal document, the form of which is not specified. Companies will also need to provide easily accessible information regarding use of internal reporting, access to adopted instruction or rules, information regarding external reporting and, where relevant, information on reporting to institutions, bodies, offices or agencies of the European Union. This information must be available to all potential reporting persons, not only to employees.
Trustee will also be obliged to report annually to the Commission for the prevention of corruption on the status and analysis of reports and violations in order to assess the effectiveness of the protection of reporting persons under the Act on Protection of Reporting Persons.
Legal entity who employs more than 250 people will have to establish such internal reporting channel within 60 days of the entry into force of the Act on Protection of Reporting Persons. Legal entity with (50 and) up to 249 employees will be obliged to establish the internal reporting channel by 17 December 2023, which is also the deadline set in the Whistleblowing Directive.
External reporting and public disclosures
In addition to the internal reporting channels established on the levels of companies, Member States will also need to establish independent external reporting channels and provide them with sufficient resources for handling the reports and acting effectively once a report is obtained.
One important aspect of the Whistleblowing Directive is also that a person who makes a public disclosure can also qualify for protection under the Whistleblowing Directive, if certain prerequisites are met (e.g. that a report has been filed by such person).
Prohibition of retaliation
If there are reasonable grounds to believe that the whistleblower’s information is true at the time of reporting and the information falls within the scope of the Whistleblowing Directive or Act on Protection of Reporting Persons, Member States must protect against potential retaliation the persons who correctly internally or externally reported or publicly disclosed such information. The threat of retaliation and attempt of retaliation are addressed same as retaliation. Retaliation is broadly defined as “any direct or indirect act or omission which occurs in a work-related context, is prompted by internal or external reporting or by public disclosure, and which causes or may cause unjustified detriment to the reporting person”. Whistleblowers will therefore be protected in such cases against suspension, withholding promotion, discrimination, harassment and similar.
If the legal entities will not follow the obligations pursuant to the Whistleblowing Directive and Act on Protection of Reporting Persons, they, as well as their responsible persons, may be subject to fines from EUR 2,000 to EUR 6,000 for legal entities and from EUR 500 to EUR 4,000 for responsible persons and other measures. Even though no minimum fine is provided by the Whistleblowing Directive, it will be an impediment that the fines need to be effective, proportionate and dissuasive.
The information in this document does not constitute legal advice on any particular matter and is provided for general informational purposes only.
