The draft bill is designed to implement Directive (EU) 2019/1937 of the European Parliament and of the Council (23 October 2019) on the protection of persons who report breaches of EU law ("the Directive"). The Directive entered into force on 7 December 2019 and must be implemented in Dutch law by 17 December 2021.
In addition to the implementation of the Directive, the bill also provides for a number of other amendments to the House for Whistleblowers Act. This blog briefly discusses the Act and the Directive and the most significant proposed amendments to the Act.
The House for Whistleblowers Act
The House for Whistleblowers Act entered into force on 1 July 2016. Its objective is to improve the conditions for reporting societal malpractice by making it possible to investigate such malpractice and providing better protection for those who report it. The Act already requires there to be an internal reporting procedure in the case of employers who, as a rule, employ at least fifty people, and it prescribes the matters that must be regulated in any case.
The Act also established the 'House for Whistleblowers' (i.e. the Dutch Whistleblowers Authority). In the Netherlands, a whistleblower can choose to report malpractice by going outside the company, namely to the House for Whistleblowers. That organisation advises whistleblowers who wish to make a report and informs them about their legal protection situation. It also investigates malpractice when other authorities are not empowered to do so, and it investigates how employees may have been treated due to reporting a case of malpractice.
The Directive
The Directive of 23 October 2019 is intended to afford a minimum level of protection to persons who, through their work, become aware of and report breaches of EU law as referred to in the Directive. The Netherlands has already regulated protection for whistleblowers to some extent in the House for Whistleblowers Act, but by no means all EU countries have regulated such protection nationally. The Directive therefore provides for a minimum level of protection for whistleblowers, meaning that Member States can extend that protection beyond what is required by the Directive. The draft bill of 30 July 2020 proposes amending a number of provisions in the Dutch House for Whistleblowers Act in accordance with the Directive.
Proposed amendments
Material scope of application
Article 2 of the Directive stipulates the material scope of application. Persons who report breaches (that have very likely occurred) of EU law within the meaning of said Article 2 must be afforded a minimum level of protection. That minimum protection must be regulated for such areas as public procurement, financial services, money laundering, public health, safety, and consumer rights.
Personal scope of application
Implementation of the Directive will create a wider group of persons receiving support and legal protection when a suspicion of malpractice is reported. Article 4 of the Directive specifies its personal scope of application, i.e. the group of persons who must receive support and legal protection in the case of such a report. That group of persons is more extensive than is covered by the present House for Whistleblowers Act. It will be extended – by linking it to the concept of a 'reporting person' (Section 1 of the draft bill) – to include job applicants, shareholders, directors, anyone working under the supervision and direction of contractors, subcontractors or suppliers, and those who assist a reporting person. The draft Explanatory Memorandum shows that the scope of the amended House for Whistleblowers Act will also cover self-employed persons [ZZP-ers], voluntary workers, confidential advisors, trade union representatives, colleagues or family members who are in a work-related relationship with the reporting person’s employer, client, or service recipient.
Internal reporting
The Directive also entails additional obligations for employers. It obliges companies with more than 50 employees and municipalities with more than 10,000 inhabitants to establish an internal reporting channel for their employees (within the meaning of Article 45(1) TFEU, including civil servants). The Directive extends the requirements for internal reporting of breaches. Those requirements are set out in Sections 1a and 2a of the draft bill. For example, reporting persons must receive acknowledgement of receipt of their report within a specific period of time, and certain information must be provided to them regarding the next steps to be taken. As required by the Directive, reports of breaches of EU law must also be recorded (Sections 2b and 2c of the draft bill). If there is no (appropriate) response to a report within the specified period of time, even after an external report has been made, the reporting person will be covered by protection measures – such as the prohibition of detrimental action towards him/her and indemnification in respect of all kinds of legal proceedings – if the reporting person subsequently makes the information public (see Section 17e(1)(b)(2) and Section 17f of the draft bill). This protection is also afforded to persons who report a suspicion of malpractice under national law.
Employers may choose to establish a single internal reporting channel for both reports of malpractice under national law and breaches of EU law. If a report concerns a breach of EU law and the seriousness of the breach, or the combination with other breaches, is such that it also constitutes malpractice under national law, it must be dealt with in accordance with the requirements of the Directive.
External reporting
Article 11 of the Directive requires Member States to designate competent authorities to establish external reporting channels. Section 2d of the draft bill designates the following as competent authorities:
- The Netherlands Authority for Consumers and Markets (ACM)
- The Netherlands Authority for the Financial Markets (AFM)
- The Netherlands Data Protection Authority (AP)
- The Dutch Central Bank (De Nederlandsche Bank)
- The House for Whistleblowers
- The Inspectorate for Health and Youth Care (IGJ)
- The Dutch Healthcare Authority (NZa)
If an organisation not designated as a competent authority receives a work-related report of a breach of EU law, that report must be dealt with in accordance with the requirements of the Directive.
As with internal reporting, the requirements proposed in Sections 2b and 2c of the draft bill (for example recording of the report) also apply to external reporting. Section 2f(3) of the draft bill sets out the other requirements that apply to external reporting, including sending an acknowledgement of receipt of the report within seven days and informing the reporting person within three months (with a possible once-only extension of three months) of the follow-up to the report.
Protection and support measures
The Directive stipulates support and protection measures for persons who report breaches of EU law covered by the Directive so as to protect them against retaliation such as dismissal, suspension, transfer, or harassment (Articles 19–22 of the Directive). These protection and support measures are implemented in Sections 17e to 17g of the draft bill. Section 17e(1) of the draft bill comprises the prohibition of detrimental action, to the effect that a reporting person may not be made the object of such action after the handling of his/her report or publication of the report. In addition, Section 17e(2) of the draft bill stipulates that the burden of proof no longer lies with the whistleblower but with the employer that has imposed the detrimental measure, which must in turn demonstrate that the detriment sustained by the reporting person is not a result of his/her report (i.e. reversal of the burden of proof). Section 17f of the draft bill also regulates indemnification of reporting persons in respect of legal proceedings. Sections 17e and 17f also apply to those assisting reporting persons and to third parties involved. Finally, Section 17g of the draft bill stipulates that a competent authority must provide a reporting person with evidence and documents so that, in proceedings for legal protection, he/she can prove that a report was made.
Evaluation of the House for Whistleblowers Act
Finally, it is relevant to note that the report on evaluation of the House for Whistleblowers Act was published on 30 June 2020 and sent to the Dutch House of Representatives on 15 July 2020 (as a Memorandum to Parliament). Because a supplementary study was commenced, it was expected that full evaluation of the Act would be completed by the end of August 2020; nothing has so far been announced, however. In the Memorandum to Parliament, the Minister of the Interior and Kingdom Relations made clear that the suggestions for improvements to the Act that the evaluators made in the report would not be included in the bill for implementation of the Directive. If amendments are put forward as a result of the evaluation, a separate legislative process will therefore be started.
In conclusion
EU Member States have until 17 December 2021 at the latest to implement the Directive in their national legislation. For the Netherlands, the House for Whistleblowers Act will be the appropriate piece of legislation in which to do so. The draft bill for implementation of the Directive entails additional obligations for employers, as well as for works councils and directors. For directors and works councils there will be plenty of work to be done when the Directive is implemented in the House for Whistleblowers Act in 2021. That is because works councils have the right of endorsement as regards procedures for dealing with reports of suspicion of malpractice within their organisation (See Section 27(1)(m) of the (Dutch) Works Councils Act [Wet op de ondernemingsraden, "WOR"]). Before implementation of the Directive can become a reality, the Dutch House of Representatives and Senate will both still need to consider it.