Harmonised European whistleblower protection rules: a proposed new directive and implications for life sciences

The European Commission has presented a proposal for a new Whistleblower Protection Directive. It’s ambitious, wide-ranging and will likely have a substantial impact on companies, individuals and authorities in the life sciences sector.  

Background
Five years ago, the European Commission shot down a request by the European parliament to propose EU whistleblower protection rules. Since then, whistleblower-initiated scandals such as LuxLeaks and Dieselgate have become recurring themes in European newspapers.

Responding to these developments, on 23 April 2018 the European Commission presented the Proposal for a Directive of the European Parliament and of the Council on the protection of persons reporting on breaches of Union law  (European Commission COM(2018) 218 final 2018/0106 (COD). Available here).  The proposed directive is ambitious, wide-ranging and goes beyond the Swedish whistleblower protection law that entered into force on 1 January 2017.

The proposed directive primarily puts forward a harmonised set of protectionary measures for whistleblower activities concerning breaches of EU Law. It also sets out potentially burdensome obligations for companies, states, regional administrations and municipalities to establish new internal organisations for internal whistleblower reporting.

Ambitions and expectations for the proposed directive are high. This was further emphasised at the press conference by the Commissioner for Justice, Consumers and Gender Equality Věra Jourová, who said “The new whistleblowers’ protection rules will be a game changer.’’ (European Commission press release, Whistleblower protection: Commission sets new, EU-wide rules, Brussels, 23 April 2018)

Companies, individuals and authorities in the life sciences sectors, especially those with operations centred on trade secrets-oriented business activities, would be wise to monitor these developments.

New harmonised whistleblower protection rules
The proposed directive aims to protect persons in the private or public sector who acquire information about breaches of certain areas of EU Law, including public procurement, product safety, public health, consumer protection and protection of privacy and personal data and financial services. Those persons covered include employees, freelancers, consultants, contractors, unpaid trainees and job applicants.

The first controversial component is that a whistleblower can be protected even if their disclosure turns out to be false or to not disclose a breach of EU Law. This is because the Commission has set a low threshold for whistleblower protection. A person would qualify for protection if they reported information on “breaches” of EU Law that they have “reasonable grounds to believe” to be true.

Furthermore, such “breaches” not only cover information about acts contrary to EU Law, but also acts that “do not appear to be unlawful in formal terms but defeat the object or purpose pursued by the applicable rules”.

Consequently, the proposed directive sets out a materially different scope from the Swedish Fundamental Law on Freedom of Expression and the newly instated whistleblower protection law, the latter of which is primarily limited to reports of serious grievances.

New obligations for companies and public authorities
If accepted in the proposed directive’s current form, the second controversial component will most likely become a major topic in the life sciences sector. The proposal puts forward a set of new obligations for all private companies of more than 50 employees or with an annual turnover of more than €10 million, as well as all state and regional administrations and all local municipalities of more than 10,000 inhabitants.

Firstly, such companies and authorities must establish internal reporting channels for whistleblower activities. These internal reporting channels must be “designed, set up and operated in a manner that ensures the confidentiality of the identity of the reporting person” and the reporting channels must also prevent unauthorised access.

Each company/authority must designate a person or a department responsible for receiving and following up on reports to the aforementioned channels. Any whistleblower report must be followed up within “a reasonable timeframe, not exceeding three months” and the designated person/department must provide feedback to the reporting person about the follow-up.

Although no penalties are proposed for non-compliance, those companies/authorities affected should take this obligation seriously. As explained below, internal reporting channels that adhere to the “reasonable timeframe” could be the company’s/authority’s last line of defence against public media disclosure.

Conditions for whistleblower protection
The conditions for whistleblower protection are designed to incentivise well-functioning internal reporting channels. This is because whistleblower protection generally requires the whistleblower to first report the information to the employer’s internal reporting channels. 
Whistleblowers can report directly to the national competent authority and retain protection if the company/authority has no internal reporting channels. Such direct reporting is also allowable if (a) the whistleblower “could not reasonably be expected” to use internal reporting channels “in light of the subject matter of the report” or (b) the whistleblower had reasonable grounds to believe that the internal reporting channels could jeopardise investigative actions by competent authorities.

In certain situations, the whistleblower is allowed to directly make a public media disclosure and retain full protection. This would be the case if the internal reporting channel of the company/authority concerned did not take appropriate action within the “reasonable timeframe” in response to the whistleblower report.

The whistleblower is also allowed to publicly disclose the information if they could not reasonably be expected to use the internal reporting channels due to (i) imminent or manifest danger for the public interest, (ii) the particular circumstances of the case, or (iii) where there is a risk of irreversible damage. 

Consequently, those companies and authorities affected would do well not only to set up internal reporting channels, but also to provide these with adequate resources to deal swiftly with potential reports. It would also be wise to consider further measures to limit risk exposure to the rules concerning disclosures to the national competent authority or the public.

New rights for protected whistleblowers
Much like the recently introduced Swedish whistleblower protection law, the proposed directive’s primary protection is three-fold: (i) prohibition of retaliation by the company/authority; (ii) invalidity of contract clauses prohibiting or restricting whistleblower activity; and (iii) penalties for those companies/authorities affected that hinder or retaliate against whistleblowers.

The proposed directive also provides further rights for whistleblowers suffering retaliation, most notably free comprehensive and independent legal advice.

Another ambitious set of EU rules presents challenges for the life sciences sector
The European Commission has expressed very high confidence in and expectations for the proposed directive (“Today’s proposal will guarantee a high level of protection for whistleblowers who report breaches of EU law by setting new, EU-wide standards. The new law will establish safe channels for reporting both within an organisation and to public authorities.[…] In the globalised world where the temptation to maximise profit sometimes at the expense of the law is real we need to support people who are ready to take the risk to uncover serious violations of EU law. We owe it to the honest people of Europe.” European Commission press release, Whistleblower protection: Commission sets new, EU-wide rules, Brussels, 23 April 2018),  which is reflected in the proposal’s scope and possible impact. From a practical point of view, those companies and authorities affected will likely face challenges in complying with the reporting channel obligations and in working proactively to limit risk exposure for business activities centred around sensitive IP, know-how or trade secrets. The importance of handling these challenges is evident given the potential consequences for life sciences companies through public disclosure of information relating to its sensitive IP, know-how or trade secrets. 

First and foremost, the proposed rules put considerable faith in the person faced with the decision of whether to report information concerning a potential breach of EU Law. For example, it would be hard to assess directive conditions such as whether there are “reasonable grounds to believe” that a company has acted in what appears “not to be unlawful in formal terms but defeat the object or purpose pursued by the applicable rules.” The same goes for whether the condition enabling protection for public disclosure, i.e. whether a person cannot “reasonably be expected to use internal reporting channels due to imminent or manifest danger for the public interest […] or where there is a risk of irreversible damage.”

Second, costs and administrative measures by companies and public authorities to establish effective internal reporting channels should not be underestimated. Addressing any whistleblower report within “a reasonable timeframe” might require substantial investment in the capacity and organisational support of the designated department (or person), particularly in larger organisations. Investment may be required to comply with the requirements to ensure confidentiality and prevent unauthorised access. These are just some of the questions almost 50% of EU companies will have to figure out should the proposed directive become reality.

Third, the proposed directive rules will most likely lead to complicated clashes of law between the articles on protection of whistleblower and other areas of law such as protection of IP rights and trade secrets. For example, the proposed directive is based on a different concept of “the public interest” compared with the Trade Secrets Directive (Directive 2016/943). (See Recital 20 of the Trade Secrets Directive (Directive 2016/943) compared with the European Commission’s Frequently Asked Questions: Whistleblower protection, Brussels, April 23, 2018, last section of the answer to question no. 2 (available here)

It may also be questioned whether the Commission has sufficiently addressed the complicated and sensitive matter of how to deal with malicious or abusive disclosures. The unenviable task of working out these aspects has, in the current proposed form, largely been handed to member states. 

What’s next?
The European Commission has processed the directive proposal under the ordinary legislative procedure, meaning that the proposal will submitted to EU member states and the European Parliament, with all having to agree on a single text. The outcome of these negotiations is uncertain, particularly in light of the vast differences in the member states’ national rules on whistleblower protection. Currently, only nine member states have a single horizontal law on whistleblower protection and two member states have no whistleblower protection rules at all.
Should the proposal become reality, there remains the interesting matter of how far member states will go in implementing the rules of the directive, which only stipulates a minimum standard for national rules. Will they include protection for reporting breaches of national law? Will they add further whistleblower protection measures or further obligations for those companies affected?

Companies and authorities in the life sciences sector, especially those whose operations centre around sensitive IP, know-how, trade secrets and confidential information, would do well to keep a close eye on developments.