Article
Whistleblowing Directive Tracker
COUNTRY-LEVEL UPDATES ON IMPLEMENTATION STATUS
Once implemented into national law, the EU’s Whistleblowing Directive (2019/1837/EU) is expected to have a significant impact on the policies and processes of companies related to employment relationships, data privacy and processing safeguards. This means that businesses will need to review and adjust their compliance procedures. The Directive allows for significant freedom for countries to implement it into national laws beyond its original scope and may pose substantial challenges to businesses to implement appropriate whistleblowing channels.
The Directive is applicable to private and public sector organisations and covers a wide range of business activities and topics: from public procurement and environmental protection to consumer protection and product safety. While the spectrum of reporting channels is also broad, from internal reporting to public disclosure, the Directive provides significant legal protection for whistleblowers, as well as financial and non-financial incentives to report violations. In addition, it imposes a reverse burden of proof on companies.
As the Directive is expected to be implemented in most CEE/SEE countries in 2023, our Whistleblowing Tracker will follow the implementation status in 13 countries in Central, Eastern and South-Eastern Europe (EU and non-EU countries) and provide an overview of upcoming changes.
Go to respective country: Albania, Austria, Bosnia and Herzegovina, Bulgaria, Croatia, Czech Republic, Hungary, Poland, Romania, Serbia, Slovakia, Slovenia, Ukraine
ALBANIA
Information current as of 9 January 2023
1. Current implementation status
N/A
However, in 2016 Albania adopted the Law no 60/2016 “On whistleblowing and protection of whistleblowers” and several ancillary legal acts (the “Effective Law “).
2. What is the implementation period?
N/A
3. Is anonymous reporting permitted?
Under the Effective Law, a whistleblower may choose to remain anonymous, and the employer must respect this (also in the case of anonymous reports). Generally, whistleblowers are protected from retaliation and cannot be fired or demoted. They cannot be penalised in any other way either, such as blacklisting, reduction of pay, reassignment, salary decrease, loss of office or privileges or change in duties.
4. What is the range of the envisaged sanctions under local law?
Under the Effective Law, a fine of up to EUR 4,500 can be imposed for penalising a whistleblower or up to EUR 1,000 for breaching the confidentiality of the whistleblower’s identity.
Furthermore, any failure by the employer to initiate an investigation after receiving a report of corruption by an employee may also lead to a fine of ALL 500,000 (approx. EUR 4,000).
Related experts
AUSTRIA
Information current as of 28 February 2023
1. Current implementation status
The Directive has been transposed into national law with the new Whistleblower Protection Act, which was promulgated in the Federal Law Gazette on 24 February 2023 and entered into force on 25 February 2023.
In addition, there are some regulations in individual sectors on whistleblower protection and/or on reporting channels, most notably in the banking sector.
2. What is the implementation period?
The Whistleblower Protection Act entered into force on the day following its promulgation, i.e. on 25 February 2023, however:
- enterprises with 250 employees have six (6) months following the entry into force to establish reporting channels;
- enterprises with 50 to 249 employees will be subject to regulations on the establishment of reporting channels as at 17 December 2023;
- the bill does not apply to enterprises with less than 50 employees.
3. Is anonymous reporting permitted?
Under the Whistleblower Protection Act, anonymous reporting is permitted, and anonymous whistleblowers enjoy the same protection as non-anonymous whistleblowers. However, enterprises are not obliged to enable anonymous reporting in their reporting channels.
4. What is the range of the envisaged sanctions under local law?
Under the Whistleblower Protection Act, a fine of up to EUR 20,000 (EUR 40,000 in the event of recurrence) can be imposed for (i) hindering or attempting to hinder reporting, (ii) bringing vexatious proceedings against a whistleblower, (iii) retaliating against a whistleblower, (iv) breaching the confidentiality of a whistleblower’s identity or (v) knowingly making a false report.
Furthermore, in the case of retaliation measures taken against the whistleblower, (i) the measure is deemed void (e.g. in the case of a termination of employment) and/or (ii) the person responsible for the retaliation is obliged to restore legal compliance and will be liable for compensation for material loss and personal impairment suffered (e.g., in the case of disadvantageous or unfair treatment).
Related experts
BOSNIA AND HERZEGOVINA
Information current as of 09 January 2023
1. Current implementation status
N/A
Whistleblowing is only partially and briefly regulated by several Company Law Acts (at entity levels), the Law on Protection of Witnesses and several Laws on Public Service. At the state level, the only applicable act is the Law on Protection of Individuals Reporting Corruption in Institutions of BIH which was adopted in 2013. Apart from that, the Law on Protection of Individuals Reporting Corruption has been adopted in Republic Srpska and in Brcko Districit BIH. In FBIH, there is no such legislation.
2. What is the implementation period?
N/A
3. Is anonymous reporting permitted?
N/A
4. What is the range of the envisaged sanctions under local law?
N/A
BULGARIA
Information current as of 10 July 2023.
1. Current implementation status
The EU Whistleblowing Directive is transposed into national law with the new Whistleblower Protection Act (“WPA”), promulgated in State Gazette Nr. 11 of 03.02.2023.
2. What is the implementation period?
According to the supplementary provisions of the WPA the act shall enter into force three months after its promulgation in the State Gazette (e.g. May, 2023). However, the provisions for establishing an internal whistleblower channel in private companies with 50 to 249 employees shall enter into force as of Dec. 17, 2023.
3. Is anonymous reporting permitted?
The WPA does not allow anonymous reporting and explicitly provides that no investigation shall be initiated upon the submission of an anonymous signal. However, it also provides these provisions are without prejudice and protection against retaliation shall still be afforded to anonymous whistleblowers who have submitted the anonymous report not under the WPA, but under another legal act.
The new WPA supports the skeptical views on anonymous reports, already established in the existing sector-specific pieces of legislation governing whistleblowing. For more on this topic please see here.
4. What is the range of the envisaged sanctions under local law?
The WPA contains different sanctions depending on the type and the severity of the violation in question for the individual involved.
Legal entities, who are required to establish internal channels for reporting, and failed to comply with this obligation, may be subject to administrative fine in the range BGN 5,000 – BGN 20,000 (approx. EUR 2,500 – EUR 10,000), respectively – BGN 10,000 – BGN 30,000 for repeated violation.
Reporting or publicly disclosing false information deliberately may be sanctioned with fine in the range – BGN 3,000 – BGN 7,000 (EUR 1,500 – EUR 3,500).
Sanction in the range BGN 400 to BGN 4,000 (EUR 200 to EUR 2,000) may be imposed for the following violations:
- of the confidentiality obligations;
- obstruction of the submission of a signal;
- failure or delay to take the necessary follow-up actions on the signal deliberately;
- failure to provide information on the follow-up of the whistleblower within three months.
A fine in the range BGN 2,000 – BGN 4,000 (approx. EUR 1,000 – EUR 2,000) may be imposed to person who: i) takes an action for the purpose of repression against the person who submitted the report or against a person related to him/her; or 2) initiates proceedings, if it is carried out with the sole intention of harming the whistleblower.
Related experts
CROATIA
Information current as of 06 January 2023
1. Current implementation status
The EU Whistleblowing Directive is fully transposed in the Croatian Act on Protection of Persons Reporting Irregularities (Zakon o zaštiti prijavitelja nepravilnosti (OG 46/22); the “Act”), which entered into force on 23 April 2022.
Croatia previously had legislation on whistleblower protection (Act on Protection of Persons Reporting Irregularities, OG 17/19), which was in force from 1 July 2019 to 22 April 2022.
2. What is the implementation period?
Already implemented.
3. Is anonymous reporting permitted?
The Act does not explicitly address this issue. However, there are strong arguments in favour of the standpoint that anonymous reporting is permitted. There is no specific regulatory guidance about anonymous reporting at this time.
4. What is the range of the envisaged sanctions under local law?
Failure to establish an internal reporting channel and ensure its implementation (e.g. failure to adopt the relevant internal bylaws, appoint a confidential person etc.), may trigger a monetary fine up to approx. EUR 4,000 for the company and up to approx. EUR 1,400 for the responsible person within the company.
Retaliation or malicious actions of the company (e.g. disclosure of the identity of the reporting person without their consent, influencing the actions of the confidential person etc.) may trigger a monetary fine up to approx. EUR 6,600 for the company and up to approx. EUR 4,000 for the responsible person within the company.
Related experts
CZECH REPUBLIC
Information current as of 03 July 2023
1. Current implementation status
The Whistleblowing Act implementing the Directive has been approved by the Parliament and will come into force on 01 August 2023.
2. What is the implementation period?
There is no implementation period. The only exception is for companies between 50-249 employees, which must establish a whistle-blowing system by 15 December 2023.
3. Is anonymous reporting permitted?
No, the Whistleblowing Act does not explicitly allow anonymous reporting. However, entities may voluntarily decide to accept anonymous notifications and handle them either as prescribed by the Whistleblowing Act or in line with their internal regulations.
4. What is the range of the envisaged sanctions under local law?
The Whistleblowing Act provides for a fine of up to EUR 2,100 for a false report. Responsible persons for handling reports can be fined up to EUR 4,200 for breaching their duties. Entities subject to the Whistleblowing Act can be fined up to EUR 42,000. Further fines are:
- EUR 4,000 for a person who prevents another person from filing a report;
- EUR 4,200 for anyone subjecting another person or allowing another person to be subjected to retaliation measures; and
- EUR 3,400 for providing information which is likely to defeat or undermine the purpose of the report or reveals the identity of a whistle-blower or a person named in the report without their consent.
Related experts
HUNGARY
Information current as of 24 April 2023
1. Current implementation status
The Hungarian Parliament adopted the whistleblowing act in line with Directive (EU) 2019/1937 of the European Parliament and of the Council on 11 April 2023, however, the President of the Republic sent it back to Parliament for reconsideration. Parliament shall deliberate the law once more and decide on whether to implement the changes to the law recommended by the office of the President, or to pass the law as is, over the President’s objections. (We note that the objections are not linked to the EU Directive, but the higher protection of certain fundamental values and rights laid down in the Fundamental Law of Hungary.)
2. What is the implementation period?
The act will enter into force on the 60th day following its promulgation in the Hungarian Official Gazette.
The provisions are applicable
- from the 60th day after promulgation for employers with 250 or more employees;
- from the 60th day after promulgation for certain employers to whom specific legislation applies (e.g. money laundering law), irrespective of the number of employees;
- from 17 December 2023 for employers with at least 50 but no more than 249 employees.
3. Is anonymous reporting permitted?
Yes, however the employer may decide not to investigate the anonymous report.
4. What is the range of the envisaged sanctions under local law?
Monitoring the requirements of the internal reporting channel shall be governed by Act CXXXV of 2020 on services and subsidies promoting employment and on employment supervision, with the exception that fines and disqualification from carrying out activities shall not apply. Compliance with employers’ obligations shall be monitored by the employment inspection authority.
The law on offences will protect against action being taken against a whistle-blower or obstructing whistle-blowers’ attempts at making reports.
Related experts
POLAND
Information current as of 9 August 2023
1. Current implementation status
The Whistleblowing Directive has not yet been implemented. The first draft of the Act implementing the Directive was published on the government legislation website on 18 October 2021 (the “Draft Act”). Since then, several versions of the Draft Act have already been issued. Currently, the Draft Act is at the stage of preparation in the Legal Affairs Committee. It is not excluded that the Draft Act will still be subject to modifications.
There are already specific provisions and sectoral arrangements related to the reporting of breaches of the law and other irregularities. These include, in particular, (i) provisions of banking law providing for the reporting of breaches or potential breaches of banking law and Regulation (EU) No 575/2013; (ii) provisions of the Trading In Financial Instruments Act compelling companies operating in a regulated market to have procedures for the anonymous reporting of any infringements of law, including Regulation No 596/2014 and Regulation 600/2014; (iii) provisions of the Act on the prevention of money laundering and terrorist financing requiring obligated institutions to develop and implement an internal procedure of anonymous reporting for actual or potential breaches of the provisions in the field of combating money laundering and terrorist financing.
2. What is the implementation period?
According to the Draft Act, the new regulations will come into force 2 months after their promulgation, with the exception of some regulations that come into force 14 days after their promulgation. Thereby, employers with more than 50 employees will have 14 days to establish an internal procedure for reporting violations after promulgation.
3. Is anonymous reporting permitted?
According to the Draft Act, anonymous reporting is only permitted if such a possibility is provided for in the internal or external reporting rules.
4. What is the range of the envisaged sanctions under local law?
The Draft Act proposes differentiated sanctions, depending on the severity of the violation in question for the individual involved. As a general rule, a fine, restriction of freedom or imprisonment is applicable, depending on the case. Penalties are provided for impeding a report, retaliating against the individual who made the report, revealing the identity of the individual who made the report, falsifying reports, and failing to implement internal procedures.
Under the Criminal Code, a fine will be imposed in daily rates by setting out a number of daily rates and the value of one daily rate; unless the law states otherwise, the minimum number of daily rates is 10, and the maximum is 540.When determining the daily rate, the court shall take into account the offender’s income, personal and family situation, financial situation and earning capacity; the daily rate may not be lower than PLN 10 or higher than PLN 2,000.
Related experts
ROMANIA
Information current as of 09 January 2023
1. Current implementation status
The Romanian law transposing the EU Whistleblowing Directive (i.e. Law No.361/2022 – the “Romanian Whistleblowing Law”) entered into force on 22 December 2022.
In terms of the history of the Romanian Whistleblowing Law, after a long period of having two drafts running in parallel via the legislative channels, one of these drafts was approved by the first chamber of the Romanian Parliament (Senate) on 18 April 2022 and by the second one (Chamber of Deputies) on 29 June 2022. The approved draft was challenged before the Constitutional Court, which ruled that the draft does not raise issues from the constitutional angle. In parallel, the President of Romanian refused promulgation and sent the draft for re-examination to the Senate. The Senate approved again the draft on 1 September 2022.
After securing certain positive opinions, the draft law was included on the agenda of the decisional chamber of the Parliament, the Chamber of Deputies, for the meeting on 4 October 2022. Up to mid-December 2022 there were no updates regarding the status, including why the draft was withdrawn on 4 October 2022 from the agenda of the Chamber of Deputies.
The draft was finally approved a second time by the decisional chamber of the Parliament, the Chamber of Deputies, on 13 December 2022, and it was promulgated by the President of Romania on 16 December 2022. Further, the law was published in the Official Gazette of Romania, Part I, on 19 December 2022, and entered into force in 3 (three) days after its publication, on 22 December 2022.
2. What is the implementation period?
According to the Romanian Whistleblowing Law, the obligation to put in place internal reporting channels for entities having between 50 and 249 employees is postponed to 17 December 2023. The reports in relation to which investigations were not finalised by the entrance into force of the Romanian Whistleblowing Law will remain regulated by the laws in effect upon reporting. The existing law approved in 2004 is repealed upon entrance into force of the Romanian Whistleblowing Law.
3. Is anonymous reporting permitted?
Yes. However, anonymous reporting will only be analysed to the extent that it contains sound indications regarding a breach.
4. What is the range of the envisaged sanctions under local law?
The applicable sanctions are fines ranging from EUR 400 to EUR 8,000.
Related experts
SERBIA
Information current as of 06 January 2023
1. Current implementation status
At the moment, there are no indications that the currently appliable Serbian Law on Protection of Whistleblowers from 2014 will be amended any time soon to implement the changes under the EU Whistleblowing Directive.
2. What is the implementation period?
N/A
3. Is anonymous reporting permitted?
Yes. Under the currently appliable Serbian Law on Protection of Whistleblowers, anonymous reporting is permitted.
4. What is the range of the envisaged sanctions under local law?
Non-compliance with the Serbian Law on Protection of Whistleblowers exposes an employer and its responsible person/s to monetary fines ranging from approx. EUR 425 to approx. EUR 4,235, and from approx. EUR 85 to approx. EUR 850, respectively. The breaches include failure to adopt and/or publish a general enactment on the procedure for internal whistleblowing, failure to protect a whistleblower from harmful actions or not taking measures to stop harmful actions, failure to provide written notification of rights from this law to all employed persons, etc.
SLOVAKIA
Information current as of 11 July 2023
1. Current implementation status
Directive 2019/1937 of the European Parliament and of the Council of 23 October 2019 on the protection of persons who report breaches of Union law (the “Directive“), has been transposed into the Slovak legislation (the “Amended Act”). The Amended Act entered into force on 1 July 2023 (with the exception of some provisions that will become effective on 1 September 2023). The Slovak Republic has had whistleblowing legislation in place since 2015 and the overlap with the Directive was significant.
2. What is the implementation period?
The Amended Act is effective as of 1 July 2023, with the exception of some provisions that will become effective on 1 September 2023.
3. Is anonymous reporting permitted?
Anonymous reporting is permitted, and an anonymous whistleblower whose identity has subsequently been revealed is protected.
4. What is the range of the envisaged sanctions under local law?
Under the Amended Act, a fine of up to EUR 6,000 can be imposed for penalising a whistleblower or for breaching the confidentiality of the whistleblower’s identity. Furthermore, a fine of up to EUR 20,000 may be imposed for violation of the obligations under the Amended Act. Effective as of 1 September 2023, penalties for infringement of the obligations under the Amended Act are to be increased and will range between EUR 30,000 and EUR 100,000 (depending on the size of the company and the seriousness of the offences).
Related experts
SLOVENIA
Information current as of 15 February 2023
Status: The Directive 2019/1937 of the European Parliament and of the Council of 23 October 2019 on the protection of persons who report breaches of Union law (“Directive“) has been transposed into Slovenian legislation. The Slovenian Parliament has adopted the Whistleblower Protection Act which will enter into force on 22 February 2023.
1. Current implementation status
The Whistleblower Protection Act was adopted by the Parliament on 27 January 2023 and represents the first uniform legislation governing whistleblower protection in Slovenia. Slovenian legislation has previously regulated the protection of whistleblowers in a rather fragmented manner, with individual provisions in several sectoral laws, such as the Integrity and Prevention of Corruption Act, Market in Financial Instruments Act, Criminal Code, Slovenian Sovereign Holding Act, Banking Act, and many others that are still in force.
2. What is the implementation period?
The Whistleblower Protection Act will enter into force on 22 February 2023. However, entities in the private sector employing 250 or more employees are obliged to set up an internal reporting channel within 90 days from the date of the entry into force of the act, i.e. by 23 May 2023,. while all other entities must comply with this obligation by 17 December 2023. The Slovenian Commission for the Prevention of Corruption needs to establish a reporting information system within one year from entry into force.
3. Is anonymous reporting permitted?
Yes, the Act provides the protection of an anonymous whistleblower whose identity has subsequently been revealed. Other valid legislative acts also mostly protect anonymous whistleblowers.
4. What is the range of the envisaged sanctions under local law?
For serious offences, fines range between EUR 5,000 and EUR 20,000; EUR 10,000 and EUR 60,000 for companies (depending on their size) and, additionally, between EUR 300 and EUR 2,500 for their responsible persons.
Related experts
UKRAINE
Information current as of 05 January 2023
1. Current implementation status
N/A
Whistleblowing regarding corruption matters is regulated by the Law of Ukraine “On Prevention of Corruption” (the “Law”). The Law came into force on 26 October 2014 and has been amended several times since then.
2. What is the implementation period?
N/A
3. Is anonymous reporting permitted?
Under the Law, anonymous reporting is permitted.
4. What is the range of the envisaged sanctions under local law?
A fine in the amount of up to approx. EUR 1,100 together with deprivation of the right to hold certain positions or engage in certain activities for a period of one year can be imposed for the unlawful disclosure of information about the whistleblower, his/her close persons or information that may identify the whistleblower, his/her close persons.
Unlawful dismissal of a whistleblower due to his/her reporting of corruption or corruption-related offenses may lead to a fine up to approx. EUR 1,300. Alternatively, such types of criminal liability such as the deprivation of the right to hold certain positions or engage in certain activities for up to three years or correctional labour for up to two years can be imposed.
