EUROPEAN COMMISSION

Brussels, 23.4.2018

SWD(2018) 116 final

COMMISSION STAFF WORKING DOCUMENT

IMPACT ASSESSMENT

Accompanying the document

Proposal for a Directive of the European Parliament and of the Counci on the protection of persons reporting on breaches of Union law

{COM(2018) 218 final}
{SWD(2018) 117 final}

Table of Contents

1.Introduction: EU policy context

2.Problem definition

2.1 Whistleblower protection as one upstream component of enforcement of EU law

2.2 Who is a 'whistleblower'

2.3 How whistleblowing works – reporting channels

2.4 Underreporting of violations of EU law: magnitude of the problem and drivers

A. Fear of retaliation

B. Lack of sufficient protection at national and EU level

C.Lack of effective implementation: low awareness and socio-cultural factors

2.5 Identification of acts and areas where whistleblower protection needs to be introduced as an enforcement tool of EU law

2.5.1. Acts and areas where the added value of EU whistleblower protection as an enforcement tool of EU law is already acknowledged

2.5.2. Areas where the necessity of introducing EU whistleblowing rules as an enforcement tool of EU law is proven

2.5.3.Areas where the case for introducing EU whistleblowing rules as an enforcement tool of EU law could be made in the future – need for "future-proof" EU action

2.6Baseline scenario

3.Need for action at EU level

3.1Subsidiarity: why is the EU better placed to take action?

3.2Legal bases

4.Objectives

5.Policy Options

5.1 Design of the policy options – Common minimum level of protection

5.2Assessed policy options

5.2.1Policy option 1: Baseline scenario – maintaining the status quo

5.2.2.Policy option 2: Commission Recommendation providing guidance to Member States on key elements of whistleblower protection complemented by flanking measures to support national authorities

5.2.3Policy Option 3: Directive introducing whistleblower protection in the area of the financial interests of the Union, complemented by a Communication setting a policy framework at EU level, including flanking measures to support national authorities

5.2.4Policy option 4: Directive introducing whistleblower protection in certain areas of EU law

5.2.5Policy Option 4 Sub option 1: Directive under policy option 4 complemented by a Communication setting a policy framework at EU level, including flanking measures to support national authorities

6.Impact of the Policy Options: Assessment

6.1 Methodology and baseline

6.2 Assessment of the Impacts

6.3 Analysis of the policy options

6.3.1. Policy Option 2: Commission Recommendation providing guidance to Member States on key elements of whistleblower protection complemented by flanking measures to support national authorities

6.3.2. Policy Option 3: Directive introducing whistleblower protection in the field of the financial interests of the Union complemented by a Communication providing guidance to Member States on key elements of whistleblower protection as well as flanking measures to support national authorities

6.3.3. Policy option 4: Directive introducing whistleblower protection in certain areas of EU law

6.3.4. Policy option 4 Sub option 1: Directive under policy option 4 complemented by a Communication providing guidance to Member States on key elements of whistleblower protection as well as flanking measures to support national authorities

6.4 How do the options compare?

7.Identification of the preferred option: Option 4, sub option 1 – Analysis and overall impacts

7.1 Analysis

7.2 A balanced approach

7.3Measures of whistleblower protection granted by the preferred option

7.4Proportionality of the preferred option

7.5Legal basis of the preferred option

7.6Coherence with existing and future EU rules

7.7Impact on SMEs

8.Monitoring and Evaluation

Glossary

1.Introduction: EU policy context 

The crucial importance of effective whistleblower protection for safeguarding the public interest has generated significant debate at EU level.

The European Parliament, most recently in its resolution of 24 October 2017, on legitimate measures to protect whistle-blowers acting in the public interest when disclosing confidential information of companies and public bodies 1 , called on the Commission to present, by end 2017, a horizontal legislative proposal establishing a comprehensive common regulatory framework which will guarantee a high level of protection for whistleblowers in the EU, in both the public and private sectors, as well as in national and EU institutions. The Council encouraged the Commission to explore the possibility for future action at EU level in its Conclusions on tax transparency of 11 October 2016 2 .

Lack of effective protection of whistleblowers as journalistic sources raises growing concerns as regards its negative impacts on freedom of expression, enshrined in Article 11 of the EU Charter of Fundamental Rights ("Charter"), and on the "watchdog" role of investigative journalism 3 . Civil society organisations and trade unions, such as Transparency International, Eurocadres, the European Public Service Union and the European Federation of Journalists, have consistently called for an EU-wide legislation on the protection of whistleblowers acting in the public interest 4 .

The Commission has expressed its full support for the protection of whistleblowers and introduced rules on whistleblower protection in different sectorial instruments. In 2016, it announced that it would assess the scope for horizontal or further sectorial EU action with a view to strengthening the protection of whistleblowers 5 . This commitment was affirmed by President Juncker in the Letter of Intent complementing his 2016 State of the Union speech 6 and in the 2017 Commission Work Programme 7 .

Protecting whistleblowers helps detect violations and abuse of the law harming the public interest. Lack of whistleblower protection can therefore lead to under-detection of these violations and under-enforcement of the law. To address this, several Member States have introduced measures to protect whistleblowers. The Treaty does not provide for a specific legal basis for the EU to regulate in general the legal position of whistleblowers. In particular, freedom of expression, as enshrined in the Charter, cannot serve as a standalone legal basis.

However, the problem of lack of whistleblower protection also has an EU dimension, as it can also impair the effective enforcement of EU law. Alongside other means, such as complaints and audits, reports by whistleblowers, who are in a privileged position to reveal violations from inside their work-based context, can feed national and EU enforcement systems with information leading to effective detection, investigation and prosecution of violations of EU rules.

In its 2016 Communication on “EU Law: Better Results through Better Application” 8 , the Commission noted that enforcing EU law remains a challenge and set out its commitment to put "a stronger focus on enforcement in order to serve the general interest". In particular, it highlighted that "the effective enforcement of EU rules - from the fundamental freedoms, food and product safety to air quality to the protection of the single currency - matters to Europeans and affects their daily lives. It serves the general interest. Often, when issues come to the fore - car emission testing, water pollution, illegal landfills, transport safety and security - it is not the lack of EU legislation that is the problem but rather the fact that the EU law is not applied effectively. That is why a robust, efficient and effective enforcement system is needed to ensure that Member States fully apply, implement and enforce EU law […]".

The EU legislator has introduced whistleblower protection in areas where it appeared urgent to ensure the effective implementation of EU law. For instance, following the financial crisis, which exposed serious shortcomings in the enforcement of EU rules on financial services, measures of protection of whistleblowers were included in the EU financial services acquis, ranging from rules on audit to rules on market abuse 9 . Further examples are the introduction of whistleblower protection in legislation ensuring a high level of safety in civil aviation and maritime transport and in recommendations related to fighting corruption addressed to Member States in the context of the European Semester 10 . 

The whistleblower protection currently available across the EU is uneven. Whistleblower protection standards are set out in international instruments and guidelines 11  such as the 2004 UN Convention against Corruption (UNCAC), to which all Member States as well as the EU are parties, and the 1999 Council of Europe Civil and Criminal Law Conventions on Corruption. In its 2014 Recommendation on Protection of Whistleblowers 12 , the Council of Europe recommended that “member states have in place a normative, institutional and judicial framework to protect individuals who, in the context of their work based relationship, report or disclose information on threats or harm to the public interest" and set out principles to guide States when introducing or reviewing such frameworks.

Some of these principles have been taken up by a number of EU Member States in recent years. However, overall, only ten Member States have in place dedicated legislation covering employees both in the public and the private sector in all areas of national law 13 . In many Member States, protection is only provided in the context of the fight against corruption or only for public servants. A large number of Member States are currently considering new legislation with a view to introducing or strengthening whistleblower protection. However, even the legislative projects envisaged do not point to a convergence based on uniform standards across the EU.

Recent scandals with cross-border impacts unveiled by whistleblowers, illustrate how insufficient protection of whistleblowers in a given Member State can have negative impacts not only on the functioning of EU policies in that Member State, but also spill-over impacts in other Member States and the EU as a whole, considering that violations and abuse of EU law reported by whistleblowers typically are of a cross-border nature or, even when purely national, have a cross-border impact. Uneven protection of whistleblowers across the EU can undermine the level-playing field needed for the internal market to properly function and for business to operate in a healthy competitive environment; it can result in unsafe products placed on the internal market, in pollution of the environment or other risks for public health and transport safety which go beyond national borders; and it means that whistleblowers in cross-border situations can "fall through the cracks" and suffer retaliation for seeking to protect the public interest.

These were also the concerns expressed in the responses to the Commission’s 2017 open public consultation (OPC) 14 , which revealed very strong support for setting legally binding minimum standards on whistleblower protection in EU law (96% of respondents), particularly in the areas of the fight against fraud and corruption; the fight against tax evasion and avoidance; the protection of the environment, and the protection of public health and safety.

Despite any progress that may take place in certain Member States, gaps and unevenness of whistleblower protection in areas where lack of effective enforcement has negative cross-border impacts are bound to persist. It is therefore evident that only EU action can ensure a consistent high level of protection across the EU.

It is also clear that the EU legislator needs to act proactively. Typically, Member States have introduced whistleblower protection following disasters and scandals which could have been prevented if persons who had insider information on threats or harm to the public interest had felt safe to report them 15 . The introduction of whistleblower protection in the EU financial services sector is a similar case. This past experience at national and EU level attests to the need to use the potential of whistleblower protection as a component of enforcement of EU law not only ex-post in areas where instances of serious harm to the public interest have already occurred, but also preventively.

In light of this institutional context and of past experience at national and EU level, strengthening whistleblower protection as a means of enhancing the enforcement of EU law is justified and proportionate in those areas where i) there is a need to strengthen enforcement; ii) underreporting by whistleblowers is a key factor affecting enforcement, and iii) violations of EU law that may result in serious harm to the public interest.

Such an approach will ensure that the intervention focuses on areas with a clear EU dimension and where the impact on enforcement is the strongest.

2.Problem definition

2.1    Whistleblower protection as one upstream component of enforcement of EU law

As set out in the introduction, many recent scandals with cross-border impacts derive from lack of effective enforcement of EU law, pointing to the need to strengthen the enforcement capacity of EU and national enforcement systems.

Violations or abuse of EU law which can cause harm to the public interest can take many forms, such as fraud 16 , corruption 17 or wrongdoing – deliberate (malpractice) – or not (negligence).

A number of actions have been taken to improve the EU and national capacity to detect, prosecute and deter violations of EU law. In 2017, for instance, the EU adopted the Directive on the protection of the financial interests of Union 18 aimed at ensuring the sound financial management of EU funds and at supporting the actions of the European Anti-Fraud Office (OLAF) in combating fraud and irregularities in the implementation of the EU budget.

Besides reinforcing the legislative framework, the EU has also empowered national and EU monitoring mechanisms and enforcement bodies – such as the anti-corruption bodies – to conduct effective investigations. The European Public Prosecutor Office (EPPO) was precisely created to investigate and prosecute the perpetrators of offences against the Union's financial interests and thus reinforce national law-enforcement efforts to counter EU fraud. In many sectors, EU enforcement agencies have been created to prevent and detect violations of EU law, such as the European Aviation Safety Agency (EASA). National enforcement authorities have been created and supported through EU networks, such as for instance the European Union Network for the Implementation and Enforcement of Environmental Law.

Access to evidence triggering effective investigations and prosecutions is one of the pillars which enforcement action relies upon. A comprehensive system of collection of evidence is thus a pre-requisite for an effective enforcement of EU law. The EU has provided citizens with numerous complaint mechanisms 19 and has established statutory audits in certain business sectors aimed at preventing or detecting malpractices which could distort competition and more generally affect the proper functioning of the internal market. Whistleblowing is one more upstream component of the enforcement system, another tool for detecting violations of the law. Available evidence is particularly strong in relation to fraud.

For instance, the 2007 Global Economic Crime Survey (PWC, 2007) 20 , based on 5.400 companies worldwide, had found that whistleblowers helped to detect more fraud than corporate security, audits, rotation of personnel, fraud risk management and law enforcement combined. According to a 2016 study analysing more than 2400 cases of fraud in 114 countries, about 40% of all detected fraud cases are uncovered by whistle-blowers 21 . OECD (2016) found that the type of corporate misconduct most often reported via internal company mechanisms was fraud (over 40%). Between 1986 and 2009, the United States recovered more than US$ 24 billion thanks to the whistleblowing law “False Claims Act” 22 . According to the 2014 and 2016 Global Fraud Reports 23 , the average percentage of fraud uncovered by whistleblowers, across countries and across sectors, is 41%. Whistleblowers were the single most effective way to uncover fraud (41%), followed by 31% through external audit and 25% through internal audit. Figure 2.1 shows that 42% of companies use the monitoring of whistleblowing hotline reports to assess the effectiveness of compliance programmes.

Figure 2.1 – Source: PWC (2016) – Adjusting the lens on economic crime. Preparation brings opportunity back into focus, Global Crime Survey 2016

In certain areas, violations of EU law are often difficult to unmask since evidence is difficult to collect. Reports by whistleblowers with insider access to such evidence can be crucial in those cases. Consequently, ensuring that whistleblowers feel safe to report can feed enforcement action and enhance its effectiveness (see Figure 2.2).

The added value of whistleblower protection in terms of increasing reports and detection of violations of law is evidenced by Member States already having a system of whistleblower protection. For instance, in its last report on implementation of its whistleblower protection law (The Public Interest Disclosure Act of 1998), the UK exemplified that providing for a comprehensive system of protection leads to an increase of reports: the law adopted in 1998 had increased the willingness to report suspected fraud, bribery or corruption and while 54% of surveyed senior executives in the rest of Europe said they would report such a case, in the UK, the figure was significantly higher (86%) 24 .

In Italy, following the introduction of rules on whistleblower protection in 2015, reports to the Anti-corruption agency increased significantly: from 16 in 2014 to 200 in 2015; in the first five months of 2017, already 263 were received 25 . In Ireland, Transparency International reports that the enactment of whistleblowing legislation in 2014 was followed by an increase of 115% in persons demanding specialist legal advice or guidance since 2011 26 .

Figure 2.2 – Source: European Commission - The role of whistleblowing in the enforcement chain

2.2    Who is a “whistleblower”

There is no common definition of “whistleblowing” at international level or between the Member States with adopted legislation on that topic. However, the baseline for defining whistleblowers and for setting EU standards can be found in the 2014 Council of Europe Recommendation which draws upon the case law of the European Court of Human Rights (ECtHR) on the right to freedom of expression 27 .

The Council of Europe defines whistleblowers as any person who reports – within an organisation or to an outside authority – or discloses – to the general public – information on a threat or harm to the public interest in the context of their work-based relationship, whether in the public or private sector. The material scope of the protection is thus defined vis-à-vis reporting acts or omissions that threaten or harm the public interest. Effective protection of the public interest requires that the information reported which qualifies for protection (the so-called “protected disclosures”) can be broad, also covering acts or omissions which may not be strictly illegal, but which nevertheless represent a threat or harm to the public interest (“wrongdoing”).

The Council of Europe underlines that while the notion of public interest should be generally understood as the “welfare” or “well-being” of the general public or society and, in many areas, such notion would be common between Member States, in other areas there may well be a difference of appreciation. Thus, it intentionally refrains from defining what constitutes the public interest, providing instead a non-exhaustive list of categories of content that is typically considered as a subject of protected disclosures. These include: corruption and criminal activity; violations of the law and administrative regulations; abuse of authority/public position; risks to public health, food standards and safety; risks to the environment; gross mismanagement of public bodies; gross waste of public funds; a cover-up of any of the above.

The Council of Europe Recommendation takes a broad approach to the personal scope of whistleblower protection, noting that the underlying reasons for recommending protection to whistleblowers is their position of economic vulnerability vis-à-vis the person on whom they depend for work, which goes beyond the classic definition of “employee”.

Clearly, employees are the most vulnerable category to suffer retaliation, given the definite power imbalance in the employment relationship. Retaliation can occur in many different forms, including suspension, lay off or dismissal; demotion or loss of opportunities and transfer of duties; coercion, intimidation or harassment; ostracism at the workplace; discrimination; blacklisting on the basis of a sector or industry-wide informal or formal agreement, which entails that the person will not, in the future, be economically active in that sector or industry; damage to their reputation and threats of retaliation.

However, also persons in other types of work-based relationship (such as suppliers, contractors, self-employed persons providing services, business partners, etc.):

owitness malpractice that would be in the public's interest to report 28 : Evidence suggests for instance that suppliers are more likely to observe bribery and corruption than non-suppliers 29 , whilst in specific areas such as product safety their reporting has high added value, since they are much closer to the source of possible unfair and illicit manufacturing, import or distribution practices of non-compliant products, and,

osuffer retaliation. This can take the form, for instance, of early termination or cancellation of their contract of services, licence or permit, loss of business, loss of income, blacklisting; damage to their reputation. Also these categories of persons should have at their disposal remedial measures against such forms of retaliation 30 .

The Council of Europe, therefore, uses the notion of “work-based relationship” to comprise all individuals who by virtue of a de facto working relationship (paid or unpaid) are in a privileged position vis-à-vis the access to information and may witness or identify wrongdoings at a very early stage. In this notion it includes temporary and part-time workers, past employees, trainees and volunteers, whilst recommending extending protection to consultants, freelance and self-employed persons, contractors and sub-contractors 31 and job applicants.

Moreover, it is important to make a distinction between whistleblowers – who report violations which affect the public interest – and other categories of complainants, such as aggrieved workers, whose reports relate to personal grievances or breaches of individual working conditions (public v. private interest).

Whistleblowers are also to be distinguished from complainants who might be clients or citizen bystanders and who do not fear retaliation in relation to their complaint. The key distinguishing criterion is the lack of work-based connection between the latter and the reported person. It is because of their work-based relationship and the related risk of sanctions – for example, for breaching the duty of confidentiality – that whistleblowers require specific legal protection, so that they can feel safe to “raise the alarm”. When there is no a power imbalance between the reporting and the reported person, there is no need for protection against retaliation.

Finally, protection of whistleblowers from work-related retaliation should be distinguished from protection against threats of physical harm which are most likely to arise in cases where they report information related to organised crime. In such cases, protective measures should be available to them, but these should be provided by the police or under “witness protection” laws relevant for criminal proceedings.

Figure 2.3 – Source European Commission – Personal scope of whistleblower protection 32

2.3    How whistleblowing works – reporting channels

Whistleblowers tend to persevere in reporting directly to their employers. The majority of workers raise concerns about illegal activities inside the organisation first and they only blow the whistle outside the organisation if they experience organisational retaliation or the concerns are not acted upon. A study for the French Ministry of Labour and representative of employees in France found that 57% of workers who reported information disclosed first the information to a colleague and 48% to a direct manager 33 . Within a sample of 1,000 callers to their advice line, Public Concern at Work, a UK whistleblowing charity (PCaW), found that line managers and managers in higher position are the first recipients of workers’ concerns, in 74% of the cases when the concern is reported the first time, at the second attempt higher managers play a bigger role 34 .

Whistleblowers will often persevere with their reporting if they do not see action being taken. PCaW 35 found that 56% of whistleblowers report their concern within their organisations on more than one occasion. External reporting (i.e. to regulators or independent bodies) increases dramatically at the third attempt, suggesting that reporters are facing forms of resistance within their organisations. The first report was made internally in 91% of cases, a proportion that fell to 73% and 60% in the second and third attempt respectively. A 2015 survey of UK National Health Service (NHS) staff found that 96.6% of staff who raised a concern did so internally and concerns were raised on more than one occasion: 41.7% of staff raised their concern in 2-3 occasions, 15.7% in 4-8 occasions, 6.7% more than 9 times 36 .

In terms of areas where reports are made, 13 of the 26 public authorities that responded to the 2017 Commission’s targeted consultation on whistleblower protection 37 reported 7,059 cases from the previous 10 years related to tax evasion, tax avoidance, fraud, irregularities or any other illegal activities affecting the financial interests of the EU, money laundering, mismanagement of public funds, misuse of personal data, threats to public health and the environment, violations of human rights in general and violation of financial regulations.

2.4    Underreporting of violations of EU law: magnitude of the problem and drivers

As evidenced in Section 2.1, reporting by whistleblowers is one of the upstream components of enforcement of EU law, and a means of “feeding” law enforcement with evidence. To this extent, underreporting by whistleblowers translates into “missed opportunities” of detecting and preventing violations of EU law and weakens the effectiveness of its enforcement. The size of the problem of these “missed opportunities”, as such (i.e. the number of cases where violations of EU law were not reported by whistleblowers), is, by its nature, impossible to quantify. However, indications about its magnitude can be drawn from surveys investigating perceptions of the size of underreporting.

In particular, according to the 2017 Special Eurobarometer on corruption 38 , 81% of respondents said that they did not report corruption that they experienced or witnessed (an increase of 7 % as compared to the 2014 survey). Only 18% said that they did report it (+6%). Also the majority of respondents (85%) to the Commission’s 2017 OPC believe that workers very rarely or rarely report concerns about threat or harm to the public interest.

Further indications can be drawn from data about the magnitude of the drivers of the problem, set out below.

The factors that contribute to the underreporting can be summarized as follows:

A.Fear of retaliation 39  

B.Lack of sufficient protection at national and at EU level

C.Lack of effective implementation: low awareness and socio-cultural factors.

A.    Fear of retaliation 

A.1.    Under-reporting is due primarily to the fear of retaliation

Fear of retaliation has a chilling effect on potential whistleblowers: when protection is not available or certain, individuals are dissuaded from reporting. 

According to the 2017 Special Eurobarometer on Corruption 40 around one in three of all Europeans (29%) think that people may not report corruption because there is no protection for those reporting it – a percentage that has only slightly decreased compared to the 2014 survey (31%). In response to the question of the OPC about the reasons why workers do not report wrongdoing, the factors most commonly selected were fear of legal and financial consequences. Similarly, in response to the question which aspects they consider important for effective whistleblower protection, respondents mentioned as the most important measures to protect against retaliation at work. Transparency International France (2015) found that 39% of employees who did not report did so out of fear of retaliation 41 .

Qualitative evidence about this link can be drawn from numerous investigations of disasters, where authorities found that workers were aware of the underlying problems, but failed to report them. The official investigation into a rail crash in the UK in 1988, which killed 35 and injured 484 people, revealed that an inspector had seen the loose wiring but had said nothing because he did not want “to rock the boat” 42 . The public inquiry into a series of explosions that in 1988 destroyed the Piper Alpha oil platform in the North Sea with the loss of 167 lives, found that “workers did not want to put their continued employment in jeopardy through raising a safety issue which might embarrass management” 43 . Another such example was the release in 2010 from an industrial reservoir in Hungary of 800 million of litres of caustic sludge, resulting in environmental disaster and loss of lives, where the employees knew about looming problems but had been threatened with dismissal by the plant’s director if they went to the authorities 44 .

A.2    Fear of retaliation is often well-founded

The first Global Business Ethics Survey 45 conducted with more than 10,000 workers in the private, public, and not-for-profit sectors in 13 countries, showed that 33% of the workers observed misconduct, of which 59% reported the misconduct, with 36% of these experiencing retaliation. Based on the Global Business Ethics Survey, it has been estimated that improving whistleblower protection would entail a direct prevention of retaliation of 7% of the workforce employed in the sectors covered by the survey 46 . In the US, the 2013 National Business Ethics Survey, taken with a representative sample of private sector employees at all levels, found that 41% of workers said they had observed misconduct on the job. Of these, 63% reported what they saw. Not all of these are in need of whistleblower protection. However, of those who reported they saw, 21% said they experienced retaliation 47 .

A.3    Retaliation can take many forms and have severe repercussions on whistleblowers

As reflected in international guidelines 48 retaliation can occur in many different forms, including threat of reprisal, suspension, lay off or dismissal, demotion or loss of opportunities and transfer of duties, coercion, intimidation or harassment, ostracism at the workplace, discrimination, damage to property dismissal, destruction of property, assault and even murder. Forms of retaliation specific to non-employees in the work-based context include early termination or cancellation of contract of services, licence or permit, loss of business, loss of income, blacklisting on the basis of a sector or industry-wide informal or formal agreement, which entails that the person will not, in the future, find employment in the sector or industry they were educated or trained for, with an impact on their future employment or damage to their reputation. Retaliatory actions may also be taken by co-workers of the reporting person or against relatives of the reporting person who are also in a work-based relationship with the reported person.

Examples of different types of retaliation can be found in the ECtHR case law assessing whether such retaliation constitutes interference with the individuals' right to freedom of expression. For instance, in some of these cases, retaliation took the form of dismissal, of refusal of promotion; a premature termination of employment or non-renewal of contract 49 . Typical cases of retaliation are also identified in the study carried out for the Commission by Milieu on “Estimating the economic benefits of whistleblower protection in public procurement” 50 .

Research demonstrates the severe repercussions that retaliation can have on both the mental and the physical health of whistleblowers (e.g. depression and symptoms analogous to post traumatic stress, but also physical pain and diseases) 51 .

B.    Lack of sufficient protection at national and at EU level

B.1    National level

The lack of a comprehensive legal framework ensuring effective protection to whistleblowers in EU Member States is one of the main factors for underreporting and fear of retaliation.

Only ten Member States (FR, HU, IE, IT, LT, MT, NL, SK, SE and UK) have a comprehensive law offering a full set of guarantees to ensure that, once whistleblowers report, they have legal and procedural tools to avoid or minimise the negative consequences. While differences persist between them, those countries provide for a dedicated legal framework including a majority of best practices and key recommendations of the Council of Europe 52 . In the remaining nineteen Member States 53 , the protection granted is partial and only granted in specific sectors (i.e. financial services), for reporting specific types of violations (i.e. fraud or corruption), only to public or private workers or only against limited forms of workplace retaliation or is not regulated at all.. Within Member States’ legal orders, rules on whistleblower protection are often scattered across different laws (anti-corruption laws, public service laws, labour codes, criminal codes and sector-specific laws, such as competition laws and financial/banking laws). This fragmentation creates legal uncertainty which has a dissuasive effect, as potential whistleblowers cannot be confident that they will enjoy the protection of the law 54 . Moreover, a large number of Member States do not require the existence of internal or external reporting channels, which makes very complicated the protection of confidentiality but also the follow-up of the reports.

These gaps and this fragmentation of protection mean that, in many situations, individuals who draw attention to a wrongdoing they witness are not effectively protected against retaliation. Piecemeal national approaches do not offer sufficient protection of whistleblowers. An example is the Luxembourg law which only covers whistleblowing on corruption. This law could not be used to protect the “Luxleaks” whistleblowers. Moreover, the different national courts which assessed their case outside this framework of protection, reached very different conclusions, which shows the legal uncertainty on the scope and conditions for whistleblower protection persisting in the national level. Remedying legal uncertainty was precisely one of the main objectives of the Irish legislator, who, in 2014, abandoned the previous sector-by-sector approach and adopted a single comprehensive legislative act.

In some Member States draft proposals for legislation on whistleblower protection are currently under discussion at government level or in the national Parliaments. However, these reforms are likely to be incomplete, incremental and uncoordinated. In some cases, draft legislative proposals, even if adopted, may not result in major changes or protection would still be provided on an ad hoc basis through piecemeal provisions within one or more laws.

Insufficient protection within a single Member States and divergence of the national legal frameworks contribute to underreporting and have spill-over impacts on other Member States and the EU as a whole.

Even if a Member State has a comprehensive legal framework, its protection is limited to its own jurisdiction 55 while a whistleblower may choose a different country to report or the information reported may be passed across national boundaries by authorities in one jurisdiction to authorities in another (examples of cross-border whistleblowing are the employees of banks in some Member States who may wish to give information to tax authorities of other Member States or situations such as “Luxleaks”). Uneven protection may thus dissuade reporting and can result in gaps in the protection of whistleblowers who work for foreign based companies or in another Member State than the one whose law governs their employment relationship and who risk “falling through the cracks”. Examples: i) a French company moving to Greece, whose law on whistleblower protection does not apply to the private sector, would normally maintain its corporate policy 56 , based on French law, which provides for extensive whistleblower protection. But if the employees feel reassured and blow the whistle, in the end, they will remain unprotected; ii) a person working in France for a subsidiary of a Greek company who blows the whistle and suffers retaliation from his/her Greek employer would not receive protection under French law.

Finally, uneven protection across the Member States increases economic costs for companies established in more than one EU country, which need to adjust their internal arrangements and train their employees accordingly.

B.2    European level

At EU level, the protection provided is also piecemeal: there are a limited number of legislative instruments 57 that provide for reporting channels and certain elements of protection in varying degrees, and only in specific areas (most instruments concern financial services, others are related for instance to anti-money laundering, transport safety, environmental protection or the equality acquis). The sectorial protection offered at EU level is thus very limited in scope, aimed at ensuring enforcement of specific EU instruments and not even covering the whole areas concerned. 

Moreover, the level of protection provided by EU law is limited: the existing provisions merely seek to encourage whistleblowing by essentially requiring – in most cases – Member States: i) to establish channels for reporting violations of the relevant rules; ii) to guarantee confidentiality and (iii) to take measures for the protection of whistleblowers from employment-related retaliation, and other types of unfair treatment. They therefore do not provide a definition of the scope ratione personae of the protection, do not define the conditions for granting protection, do not specify the forms of protection to be granted, and do not specify the possible remedial measures against retaliation.

C.    Lack of effective implementation: low awareness and socio-cultural factors

A lesson learnt from the existing implementation of national systems is that legislation is not enough. It needs to be complemented by measures of awareness and information to the public. In the workshops organised by the Commission, Member States' experts underlined the need for awareness-raising campaigns and the added value of producing guidelines to employers and employees.

Potential whistleblowers who witness illegal activities and who feel safe to report them may not do so, simply because they do not know where and how to report. The 2017 Special Eurobarometer on corruption 58 found that 49% of respondents would not know where to report corruption if they were to experience or witness corruption (an increase of 5 points compared to the 2014 survey). Just under half (47%) said that they would know where to report it.

Only 15% of all respondents to the Commission’s OPC had knowledge of existing rules on whistleblower protection in their country of residence or establishment. In response to the question about factors that raise awareness of whistleblower rights and procedures for effective whistleblower protection, one of the two factors they most commonly selected were state-led information and awareness-raising campaigns on the rights of whistleblowers (75% of respondents).

Further barriers contributing to underreporting by whistleblowers are linked to socio-cultural factors such as the belief that reporting the wrongdoing would be futile and not be followed up, the loyalty to the employer 59 or deep-rooted negative social perceptions of whistleblowers as “sneaks”, “informers” and “snitches”, resulting in their harassment and ostracism. 60 Asked about the reasons why workers do not report wrongdoing, respondents to the OPC identified the fear of bad reputation as the third most important reason (45% of respondents) 61 .

2.5    Identification of acts and areas where whistleblower protection needs to be introduced as an enforcement tool of EU law

EU policy areas and acts where the introduction of whistleblower protection would be necessary and proportionate are to be identified based on the following criteria: i) there is a need to enforcement; ii) underreporting by whistleblowers is a key factor affecting enforcement, and iii) violations of EU law may cause serious harm to the public interest. The areas below are those identified based on currently available evidence as fulfilling these criteria.

2.5.1.    Acts and areas where the added value of EU whistleblower protection as an enforcement tool of EU law is already acknowledged 62  

In a number of EU acts and policy areas, the legislator has already acknowledged the added value of whistleblower protection as a key tool to encourage reporting and enhance upstream the collection of information that enforcement bodies need to detect violations of EU law.

The financial services are an area where the EU legislator has sought to provide for whistleblower protection in all relevant instruments. Another such area is the prevention of money laundering and terrorist financing 63 , the EU legislator has sought to put in place systems to facilitate reporting of violations.

In other areas, elements of whistleblower protection have been introduced in some key acts. For instance, in the area of transport safety, such elements have been introduced in instruments related to civil aviation and maritime transport; in the area of environment protection, in an instrument related to the safety of offshore oil and gas operations.

Any initiative to strengthen whistleblower protection at EU level would need to ensure consistency amongst existing EU rules and align them to common high standards 64 .

2.5.2.    Areas where the necessity of introducing EU whistleblowing rules as an enforcement tool of EU law is proven 

(I)    The protection of the EU budget

The protection of the financial interests of the EU is a core area in which enforcement of EU law needs to be strengthened. A lack of enforcement of financial rules not only causes a decrease of the revenues or the budget as a whole, which in turn leads to inefficient provision of public services, but it can also distort public investments and growth and reduces economic performance. While at national level fraud, corruption and other undue appropriations are types of violations of law that affect national expenditure, they can also heavily affect the financial interests of the Union – by affecting the collection of EU revenues (e.g. fraud to customs duties), the use of EU expenditures (e.g. fraud to structural funds) or the management of EU assets(e.g. EU buildings) 65 .

In 2016, RAND Europe estimated that corruption costs the EU between EUR 179bn and EUR 990bn in GDP terms per year 66 . According to the 2016 EY 14th Global Fraud Survey on corporate misconduct, 67 some EU Member States are within the first 30 top ranking countries.

The Commission estimated that the financial interests of the Union are potentially adversely affected to an amount of EUR 4 billion yearly due to fraud, corruption and other related offences 68 . The total of all offences against the financial interests of the Union 69 in the Member States reported in 2016 (fraudulent or not, regarding EU expenditures or revenues) was 17,030 offences, involving a total damage of about EUR 2.9 billion. OLAF opened, in 2016, 219 investigations on fraud affecting the EU budget, and concluded 272 investigations, which resulted in 346 recommendations for recovery of EUR 631.1million 70 .

In this area, whistleblowers are one of the sources through which OLAF receives reports about suspicions of related irregularities. Where the whistleblowers are EU staff, they enjoy the protection offered by the Staff Regulations, including against retaliation 71 . However, all other reporting persons who may suffer retaliation from their employer in connection with their reporting to OLAF are protected in accordance with the applicable national law, when such protection exists in national law.

Acknowledging this deficiency at EU level, the EPPO Regulation encourages Member States to provide, in accordance with their national law, effective procedures to enable reporting of possible offences falling within the EPPO's competence and to ensure protection of the persons who report such offences from retaliation, and in particular from adverse or discriminatory employment actions 72 .

The role of the whistleblowers in reinforcing the fight against fraud and the need to set up measures enhancing prevention and deterrence was also highlighted by the European Court of Auditors in its October 2017 Audit brief on Fighting fraud in EU spending, which mentions that whistleblowing measures are much less costly and time‐consuming than the lengthy process of fraud detection, investigation and prosecution 73 .

Tax evasion and tax fraud of particular revenues linked to the EU budget hamper the financial interest of the EU and may also lead to inefficiencies in terms of competitiveness of businesses across the EU. The Commission has established in the last decade a large number of actions aimed at supporting national authorities to investigate and prosecute fraudsters that try to escape their tax obligations, taking advantage of the fact that tax officials cannot recover taxes themselves outside their national borders. Notwithstanding, fraud relating to the VAT, one of the sources of income of the EU budget, is still one of the most widespread types of tax fraud which go unreported. Even if by nature it is difficult to assess the magnitude of VAT fraud, it is estimated that out of the EU VAT gap 74 estimated at almost EUR 160 billion revenue losses each year 75 , EUR 50 billion would be due to VAT fraud alone 76 . .

(II)    Areas crucial for the proper functioning of the internal market

a) Public procurement

Lack of enforcement of EU rules on public procurement has two dimensions. On the one hand, fraud and corruption can occur in the context of procurement carried out by the EU institutions and bodies (breach of the EU Financial Regulation and its rules on procurement). A large share of OLAF’s investigations in 2014-2016 related to fraud in public procurement, mainly in relation to structural funds and external aid. The costs of corruption risk in EU public procurement across all sectors was estimated at EUR 5 billion per year 77 .

On the other hand, fraud and corruption can be linked to national public procurement. In many sectors such as energy, transport, waste management, social protection and the provision of health or education services, public authorities are the principal buyers 78 .While insufficient enforcement of rules on public procurement occurs at national level, it creates distortions of competition across the EU, increases costs for doing business, violates the interests of investors and shareholders and, overall, lowers attractiveness for investment, thus affecting the proper functioning of the internal market. In 2014, the EU reinforced rules seeking to ensure that public contracts are consistently awarded in an open, fair, and transparent manner across the EU and introduced minimum harmonised public procurement standards for the award of public contracts by or on behalf of Member States’ authorities 79 .

Despite these legislative efforts, unlawful practices still occur in public procurement. A 2017 study carried out for the Commission provides evidence on how whistleblowers effectively contribute to the detection of such practices by disclosing information that may not be readily available 80 . This study estimated the loss of potential benefits due to a lack of whistleblower protection in the area of public procurement alone to be in the range of EUR 5.8 to EUR 9.6 billion each year for the EU as a whole.

b) Competition

EU competition policy aims to protect the efficient functioning of markets from competition distortions whether originating from Member States (distortive State aid), market players (distortive unilateral or coordinated behaviour), or mergers that would significantly impede effective competition. The estimated direct benefits of interventions by the Commission during 2017 in the cartel and merger areas alone range from 3.9 to 6.2 billion euros.  This illustrates the magnitude of harm that breaches of the EU competition rules have on EU consumers and public interests.

The ability to detect infringements of antitrust rules, circumventions of the merger rules (e.g. early implementation of a non-approved merger) or illegal state aid (e.g. in the context of fiscal measures) is crucial to ensure the proper enforcement of EU competition rules. In order to increase the detection possibilities, measures have already been undertaken to facilitate and incentivise companies and individuals with insider information to report potential wrongdoings to the Commission. The Leniency Programme has been a very successful tool to uncover secret cartel arrangements that may otherwise go undetected. Companies however increasingly weigh the benefits of immunity from fines or leniency reductions against the risk of important payments in follow-on private damage actions. The digitalisation and globalisation of markets have also resulted in complex business models and distribution systems that would nowadays often require insider knowledge to detect and successfully investigate.

In order to strengthen the fight against cartels and other antitrust violations, the Commission introduced in March 2017 an online tool that can be used to anonymously alert the Commission of breaches of antitrust law 81 . This new communication channel gives whistleblowers the possibility to report illegal practices in full anonymity but does not offer protection to them if their identity becomes known to those who might take retaliatory action against them. Moreover, experience shows that the ability to interact directly with an identified whistleblower allows for a more efficient and successful investigative process. Effective protection for whistleblowers would encourage and enable the individuals to come forward without fearing retaliation.

In the area of antitrust, the Commission shares the responsibility of enforcing the EU competition rules with national competition authorities. Only a very limited number of those have similar anonymous communication tools in operation. The introduction of protection of whistleblowers at Member State level would therefore have a significant impact on the ability of those authorities to detect and bring infringements of EU competition law to an end. It would also strengthen the incentives for companies to come forward and report cartels under leniency programmes themselves rather than risking detection through whistleblowing.

c) Aggressive tax planning schemes

Tax schemes that amount to evasion or avoidance negatively affect the proper functioning of the internal market.

Whilst tax evasion involves violations of the law, taxpayers who engage in tax avoidance act against the spirit and purpose of the tax provisions with the intention of reducing their tax bill. In this context, aggressive tax planning consists in taking advantage of the technicalities of a tax system or of mismatches in the interaction between two or more tax systems for the purpose of reducing tax liability 82 . The outcome of such situations could give rise to unfair tax competition and extensive tax evasion, distorting the level-playing field between companies that manage to avoid paying their fair share of taxes and other companies that do not have access to the same cross-border tax planning possibilities (mostly domestic and/or smaller firms) 83 . OECD found in 2013 that multinational companies pay as little as 5% in corporate taxes thanks to aggressive strategies to reduce tax liability, whilst smaller businesses pay up to 30% 84 . Moreover, profit-shifting results in loss of tax revenues for Member States and for the EU as a whole (estimated to about EUR 50-70 billion per year) 85 . The “Luxleaks” scandal illustrated the distortions of competition resulting from such tax schemes (as EU companies not located in Luxembourg could not benefit from these arrangements) and their consequences for the overall budget of the EU.

A 2017 European Parliament study 86 estimated that the schemes uncovered by the “Panama Papers” had a budgetary impact (revenue loss) of approximately EUR 19 billion across eight Member States. The revenue loss for the entire EU-28 was estimated at EUR 109-237 billion, with a mid-point of EUR 173 billion 87 . It estimated the volume of tax base shifted by companies in these eight Member States in 2015 at EUR 88 billion. The cascade effects of tax losses for Member States include less public money being available to invest in support for economic growth, job creation and public services 88 .

Moreover, aggressive tax arrangements have in certain cases other elements of criminality. Europol 89 examined the link between the use of offshore schemes and criminality and found 3469 probable matches to organised crime and other criminal activities in the Panama Papers database. It also found 516 names linked to organised criminal gangs, 388 names connected to VAT fraud operations and 116 names linked to suspicion of terrorist activities in Europe. Many of these schemes are used for money laundering.

Tax authorities often find it challenging to detect tax schemes amounting to evasion or avoidance. These are usually structured in several steps and, in most cases the discovery of one step would not allow the authorities to substantiate the existence of an infringement of the law or of tax avoidance. The cross-border dimension of many such schemes complicates the situation and reduces tax authorities' chances of unilaterally uncovering violations of the law, other breaches or harmful elements. As a result, evasion and avoidance can remain undetected or may be revealed with such delay that the authorities can no longer react.

The Commission has recently proposed rules to improve transparency and the exchange of information in the field of taxation 90 and to create a fairer corporate tax environment within the EU 91 . These initiatives are expected to reinforce the integrity and strengthen the level of protection of the internal market against practices that distort competition.

Recent scandals such as the “Panama Papers”, the “Paradise Papers” and “Luxleaks” have shown that whistleblowers can bring substantial volumes of cases of tax evasion or avoidance to the knowledge of the tax authorities and beyond. Moreover, empirical evidence shows the effect of whistleblowing in deterring the criminal use of offshore banking services and the resulting tax evasion. A 2017 study investigated the effect of the leaks of customer information from banks in tax havens on the stock prices of banks that are known to provide such services. Its findings suggest that such a leak lowered market expectations about the future earnings of tax haven banks that assist foreign customers with tax evasion. Thus, an increase in the perceived probability of a leak should be expected to deter the demand and supply of criminal offshore banking services 92 .

EU whistleblower protection would therefore be a complementary tool to increase Member States' effectiveness in identifying evasive and/or abusive schemes that could otherwise go undetected and would help deter such schemes, thus overall contributing to ensuring the proper functioning of the internal market.

(III)Environmental protection

In order to achieve effective protection of the environment, the EU legislator introduced dissuasive penalties for environmentally harmful activities, which typically cause or are likely to cause substantial damage to the air, including the stratosphere, to soil, water, animals or plants, including to the conservation of species. In 2008, the EU adopted legislation establishing common rules on criminal offences and made it possible to use effective methods of investigation and assistance within and between Member States. Despite these regulatory efforts, undetected malpractices affecting the protection of the environment in the territory of the EU remain a challenge 93 . These are linked to persistent environmental problems, such as diffuse water pollution, poor urban air quality, unsatisfactory waste treatment, and species and habitats in decline. There is also a serious incidence of environmental crime 94 and a high number of environmental complaints to the Commission 95 and petitions to the European Parliament. The costs of non-implementation are estimated at 50 EUR billion per year 96 .

In the area of the EU waste legislation, illegal trade in waste may account for 10-15% of the EU market in waste and violations of waste management legislation accounted, in 2015, for 20% of EU environmental infringement cases 97 . Examples of breaches include non-compliance of waste facilities with waste permit conditions (e.g. receiving more waste than is permitted or different kinds of waste than are permitted) or illegal waste shipments, often under cover of misleading or falsified documentation 98 .

Moreover, as evidenced by past environmental accidents, weaknesses in enforcement of EU law in one Member State may also have a ricochet effect in the protection of the environment, which negatively affects several territories of the EU. The industrial pollution caused by the ILVA steel plant in Italy (one of the largest in Europe) 99 had direct impacts on the mortality rate related to cancer and respiratory diseases in the area 100 .

In January 2018, the Commission acknowledged that evidence-gathering, detecting and addressing environmental crimes remains a challenge and needs to be supported and reinforced. It thus launched specific measures to help national authorities promote, monitor and enforce compliance with EU rules on activities that can cause environmental harm 101 .

The EU legislator had already considered whistleblower protection as a factor contributing to better enforcing EU sectorial rules on environment 102 , but the introduction of such protection appears necessary to ensure effective enforcement of the majority of the EU environmental acquis, whose violations can cause serious harm to the public interest. “Dieselgate” showed that the lack of whistleblower protection in a single Member State 103 can have cross-cutting and wide-ranging consequences across the EU, including on the environment and on public health – with studies calculating, for instance, that excess emissions from rigged diesel cars cause about 5,000 premature deaths annually across Europe 104 .

(IV)    Nuclear safety

Ensuring that Europe has the highest standard of nuclear safety has been a key policy priority of the Union. Europe has adopted in recent years one of the most advanced nuclear safety regulatory frameworks in the world. While implementation and supervision remains largely at national level, the impacts of nuclear accidents are of cross-border nature. Recent accidents outside Europe and reports concerning breaches of standards have weaken public confidence in the sector.

Whistleblower protection is therefore an important tool that would contribute to support the prevention and deterring of breaches of Euratom rules on nuclear safety, radiation protection, responsible and safe management of spent fuel and radioactive waste. The application of the enhanced whistleblower protection in the field of nuclear safety and radiation protection would be complementary to the robust existing provisions of the revised Nuclear Safety Directive on the effective nuclear safety culture, and in particular Article 8 b (2) (a) which requires that the competent regulatory authority and the licence holder to take measures that include in particular, management systems which give due priority to nuclear safety and promote, at all levels of staff and management, the ability to question the effective delivery of relevant safety principles and practices, and to report in a timely manner on safety issues.

Protecting whistleblowers in the area of nuclear safety would help avoiding situations where there are delays in the reporting of malpractices, including defects in the assembly of key components for the nuclear power plants' safety and safeguards obligations. Delays would be avoided if employees were certain of being protected against sanctions and/or retaliation when exposing bad practices as soon as they hear about them. Moreover, enhanced whistleblower protection in this area would also increase the trust of the general public against on the robustness of the safety measures established in Europe.

(V)Product safety, consumer protection, public health

According to EU legislation, only safe products can be placed into the EU internal market 105 . Businesses must only place products which are safe on the market, inform consumers of any risks associated with the products they supply and make sure any dangerous products present on the market can be traced so they can be removed to avoid any risks to consumers. The Commission keeps a list of dangerous products found across Europe and information is collected in the Rapid Alert System, which facilitates the rapid exchange of information between the national authorities of 31 countries and the Commission on dangerous products found on the market. If a manufacturer or distributor finds out that one of their products on sale is dangerous, they have to inform the competent national authority. Moreover, product safety is ensured through EU instruments on manufacturing of products 106 .

Hence, the primary source of evidence-gathering on safety of products is mainly businesses, complemented by the investigations and audits of competent enforcement authorities. Information coming from employees and suppliers in the area of product safety has, thus, a high added value, since they are much closer to the source of possible unfair and illicit manufacturing, import or distribution practices of non-compliant products. Yet, there is insufficient reporting in relation to non-compliant products and unfair practices by companies that knowingly undercut EU product rules 107 posing risks to human life. To date, still too many non-compliant products are placed on the EU market. 78% of respondents in the public consultation on the internal market for goods considered that this is because of companies' deliberate choice to exploit market opportunities at lowest costs, 33% ranked this unwillingness to comply even as the main reason for the high non-compliance rates observed.

An area where lack of enforcement on product safety has proven dangerous to human beings is car manufacturing. In 2009, following a fatal accident with a Lexus sedan in the US, Toyota issued several recalls, assuring customers that it was addressing the “root cause". The automaker later admitted that it had been concealing and minimising related problems 108 . The Dieselgate is another example of how car manufacturing malpractices can have high monetary and non-monetary impacts on society.

Malpractices in the production of medical devices have also been reported as generating high risks to human health. A product safety scandal that came to light in 2010 concerned a French company that had made breast implants with industrial-grade silicone which had doubled the rupture rate of other implants and could cause medical problems. Press reports suggest that about 300,000 women in as many as 65 countries were affected 109 . 

The role of whistleblowing in strengthening enforcement of rules in product safety was clearly acknowledged in the United States, where in the wake of the scandals over lead paint found in toys and other toy recalls, the Consumer Product Safety Act was amended, amongst others, to include whistleblower protections 110 .

Whistleblower protection is also necessary to enhance the enforcement of EU rules related to marketing and use of sensitive and dangerous products, including firearms, explosives precursors and defence-related products 111 . In particular it could address the fraudulent intra-communitarian acquisition of defence-related products, weapons and firearms where violations often imply a diversion from the legal to the illegal market. The point of diversion originates in the legal market: illicit acts such as an armourer who would irregularly deactivate weapons or who would provide a fake deactivation certificate, a trader making false declarations of export or a gun or sport shop submitting a falsified authorisation to acquire weapons when buying firearms in another Member State. It tends to be facilitated by corruption, forged documents, poor regulation, monitoring or enforcement and appropriate export control. Persons who acquire insider information about such violations in their work-related context can facilitate the work of specialised investigators in this area and more generally help detect and prevent such violations.

Another area where lack of enforcement relates to product safety and public health is the area of tobacco products. While EU legislation is in place, shortcuts in prevention of fraud are persistent. Fraud and illicit trade in cigarettes 112 evidences insufficient enforcement of EU legislation on excise duties in tobacco products 113 but also negatively affects the compliance with the EU Tobacco directive aimed at ensuring the proper functioning of the internal market for tobacco and related products, while ensuring a high level of health protection 114 . At the same time, the annual EU-wide tax loss due to cigarette smuggling is estimated to be approximately 11.3 billion euros relating to a loss in the EU excise duties 115 .

In the pharmaceutical area, whistleblowers play an important role in unmasking violations and supporting enforcement. There have been cases where health care professionals revealed that pharma companies falsified manufacturing protocols, did not comply with clinical trial requirements, infringed advertising rules or provided payments to doctors. Some inspections of pharmaceutical companies or of their suppliers have been taking place on the basis of such information. A relevant example of whistleblowing was the disclosure, in 2009, of problems with Mediator, a weight-loss drug, the use of which led to the death of at least 500 people and to cardiovascular problems for thousands more people in France 116 . The public revelation by a doctor of the gravity of the Severe Acute Respiratory Syndrome (SARS) virus in 2003 is an example of whistleblowing that potentially saved millions of lives. According to the World Health Organization, the SARS outbreak led to 8,098 cases and 774 deaths 117 .

Since 2013, the European Medicines Agency (EMA) has received 43 reports on various issues, from the manufacturing of medicines to the conduct of clinical trials 118 . To further encourage such reports about, among other, pharmaceutical malpractices, EMA adopted in 2017 an internal policy on handling the information received by external sources disclosing improprieties that may have an impact on the authorisation, supervision and maintenance of medicinal products in the area of EMA activities 119 . This policy aims to complement the existing policy on whistleblowing applying to EMA staff. One of the policy principles is to ensure confidentiality of information from external sources and protection of personal data.

(VI)Food and feed safety and animal health and welfare

While the General Food Law Regulation 120 has been found to have achieved its core objectives, namely a high level of protection of human life and consumers' interests in relation to food and the effective functioning of the internal market, 121 there are still national differences in the implementation and enforcement of the EU legislative framework. Past experience has demonstrated the valuable role of whistleblowers in strengthening enforcement in the area of food chain. In 2016, the Commission became aware through whistleblowers of illegal practices in the tuna sector and immediately launched several actions including through the EU Food Fraud Network. In the cases of contamination of eggs and egg products with fipronil in 2017, first information concerning the suspicion of fraud at the root of the incident was communicated by a whistleblower to a national food safety service 122 . Examples of retaliation for whistleblowing have also been documented. For example, in Germany, a truck driver gave information to the police about the transport of rotten meat, uncovering one of the biggest scandals of its kind. He was presented, in 2007, with the Golden Badge for Moral Courage by the Federal Minister for Agriculture but he still lost his job 123 .

The added value of whistleblower protection in this area has been documented by some Member States. The UK Food Standards Agency, for example, reported that in 2012 it had handled 81 cases originating from whistleblowers, a marked increase from the 54 cases received in 2011, which was largely due to improved procedures for receiving reports 124 .

Animal health and welfare is another area where protection of whistleblowers is key to detection and prevention of violations of EU law with high negative consequences. For example, during the1990s in Germany, the veterinarian who publicly disclosed the symptoms in cattle that suggested animals had the Bovine spongiform encephalopathy, a neuro-degenerative fatal brain disease that may be passed to humans by infected meat (the “mad cow disease”) lost her job. Her internal reporting was ignored and the infected meat entered into the food chain 125 . Cases of severe breaches of animal welfare rules are also typically revealed by “insiders” who witness such malpractice 126 .

(VII)Transport safety

In the area of transport safety, malpractices that remained hidden and led to tragedies have been in the origin of the development of national and EU legislation on whistleblower protection. For example, one of the events triggering the adoption of the UK law was the capsizing in 1987 of a ferry operating between Belgium and the UK with the loss of 193 passengers and crew, where the official inquiry found that workers knew about the malpractice that had contributed to the loss of the vessel but were either too scared to speak up or the concerns they had expressed had been ignored 127 . 

In maritime transport, the EU has progressively developed policies of the safety of both passenger and merchant ships in response to several major shipping accidents since the 1990s. The EU has also prioritised work on effective aviation safety standards. Regulation 376/2014 was designed to ensure a high level of safety in civil aviation by introducing reporting systems and providing for certain measures of whistleblower protection. The EU has also created safety agencies dealing with the different transport modes: the European Aviation Safety Agency , the European Railway Agency and the European Maritime Safety Agency.

Given the acknowledged added value of whistleblower protection in preventing transport safety violations, EU whistleblower protection should also be provided in other transport modes, such as road and railway transport. This need is illustrated by investigations on accidents at national level. For example, following the railway accident in 2016 in Croydon, UK, in which 7 people were killed and 19 seriously injured, the official investigation report found that drivers had failed to report incidents amongst others because they feared retaliation, and recommended encouraging a ‘just culture’ inside the organisation 128 .

(VIII)Protection of privacy and personal data and security of networks

Regulation (EU) 679/2016 on the protection of personal data (General Data Protection Regulation, 'GDPR') 129 and Directive 2002/58/EC on the protection of privacy in the electronic communications sector 130 (so-called 'e-privacy Directive') protect the fundamental right to private life with regard to the processing of personal data.

Despite the robust oversight system put in place by the Union legislation (i.e. through national data protection authorities and the mandatory presence of data protection officers within public authorities, and within companies in certain cases), whistleblowers remain a particularly valuable source of information to unmask certain types of infringements which are particularly harmful to the public interest - e.g. where the processing is likely to result in a high risk to the rights and freedoms of natural persons, or consists in regular and systematic monitoring of data subjects on a large scale, or consists of processing on a large scale of “special categories of data” pursuant to Article 9 of the GDPR (such as data revealing political opinions, religious or philosophical beliefs, racial or ethnic origins, sex life or sexual orientations, etc.).

The recent Cambridge Analytica scandal shows by itself the scale of harm to the public interest that breaches of the EU data protection rules (e.g. acquisition of data without consent of the – tens of millions - individuals concerned, use of the personal data for a different purpose than the one for which it was collected) can entail 131 . The scandal came to light thanks to the revelations made to The Guardian and to The Observer by whistleblower who was a former Cambridge Analytica employee.

As to the security of networks, the ongoing digital transformation, which allows both European consumers and business to benefit from better services and significant cost-reductions, poses as well new threats to the security of the European society and economy. A 2016 study revealed that the number of security incidents across all industries rose by 38% in 2015, which accounted as the biggest increase since 2004, while at least 80% of European companies have experienced at least one cybersecurity incident 132 .

Directive (EU) 2016/1148 on the security of network and information systems 133 (so-called 'NIS Directive') is aimed at building EU resilience to cyber-incidents and better protecting the internal market. It promotes a culture of risk management by introducing incident notification and security requirements for companies providing essential services across many sectors 134 and sub-sectors (e.g. energy, health, transport, banking) and providers of key digital services 135 .

Whilst the Directive introduces the possibility for businesses to establish structural dialogues with public authorities about cyber-security vulnerabilities 136 , economic operators are often reluctant to share potentially disruptive vulnerabilities and report significant incidents, due to the concern that their reputation could be harmed and the value of the company decreased. For example, in 2016 Yahoo disclosed that three years before a data breach compromised more than 1 billion accounts. However, only one year after, Yahoo shared the actual size of the attack, revealing that the data theft affected 3 billion accounts 137 .

For this reason, whistleblowers informing public authorities responsible for the enforcement of the NIS Directive about cyber-malpractices, unmanaged vulnerabilities or significant incidents could facilitate a timely and complete sharing of information by companies. As a result: (i) private entities could be further incentivised to invest into securing their network and information systems; (ii) public authorities could contribute to incident response and risk mitigation in a more effective manner; (iii) public authorities could acquire a more comprehensive overview of risks and incidents hampering the economy and take appropriate counter-measures.

2.5.3.    Areas where the case for introducing EU whistleblowing rules as an enforcement tool of EU law could be made in the future – need for "future-proof" EU action

The present identification of EU acts and areas where the introduction of whistleblower protection appears necessary is based on currently available evidence. It is possible that, in the future, evidence comes to the fore substantiating the need for whistleblower protection as a means of strengthening the enforcement of EU law also in other EU areas or legislative acts (including future acts).

For this reason, any EU action should be “future-proof”, e.g. it should allow for flexibility in this regard, providing for a review process.

2.6    Baseline scenario 

Maintaining the status quo would entail no new action taken at EU level. EU Member States would be the primary source of protection of whistleblowers and the existing sectorial instruments of EU law as implemented. Any improvements would be left to the discretion of the Member States. The Commission would pursue the monitoring of the transposition and the enforcement of existing sectorial rules; continue monitoring the developments at national level in the context of the EU Semester and continue supporting research and promoting the exchange of good practices.

As illustrated in the subsection 2.4.B above, gaps in national protection and legal uncertainty resulting from fragmentation and divergence of protection across the EU persist and are not addressed in a satisfactory way by the existing EU or national rules on protection of whistleblowers.

Some of the gaps in protection identified are expected to be addressed in the future, as a number of Member States 138 are currently considering adopting legislation with a view to introducing or improving whistleblower protection.

However, in the absence of any EU action guaranteeing minimum harmonisation across the Member States, it is likely that reforms in the Member States will be incomplete and uncoordinated, maintaining the current uneven level of protection and divergences between countries, as well as legal uncertainty. As illustrated by recent unsuccessful attempts to introduce new rules on whistleblower protection in various Member States 139 , it is not certain that all envisaged reforms will succeed. Secondly, the scope and impact of the reforms will vary. In some cases, the draft legislation, if adopted, will result in comprehensive coverage of both the public and the private sector. In other cases, however, the draft proposals, even if adopted, may not result in major changes or protection would still be provided on an ad hoc basis through piecemeal provisions within one or more laws 140 .

The transposition and implementation by Member States of sectorial EU law introducing rules on whistleblower protection might have a spill-over effect resulting in the setup of reporting channels or provision of protection also in other areas not covered by these instruments. However, there are no indications about the likelihood of such a development.

Hence, under the baseline scenario, due to the increase of the national sectorial legislation in the next 5 years, the number of employers in the EU that provide whistleblower support (including reporting channels) to their employees on a voluntary basis is expected to increase between 5% and 15% in the next 5 years 141 .

In summary, even if in the medium short-term Member States are expected to further develop legislation due to national developments or transposition of EU law, there is still a clear risk that those Member States which do not have effective complete frameworks of protection in place will not remedy the drivers described in the section above. Protection provided in law to whistleblowers would not be consistent across Europe, and would not effectively achieve the objectives of combating under-reporting and fear of retaliation.

In terms of protection of the financial interests of the Union, in absence of a reinforced system of protection of whistleblowers, the ‘VAT gap’ (among other loss in EU revenues), in the Member States, is estimated to amount to EUR 175 billion in 2017 and is expected to rise to EUR 217 billion by 2027.

As ancillary negative effect, businesses operating in several EU countries would continue to experience unfair competition due to insufficient enforcement.

3.Need for action at EU level

3.1    Subsidiarity: why is the EU better placed to take action?

The rationale for an EU initiative aimed at reinforcing whistleblower protection would be to improve enforcement of EU law so as to enhance the proper functioning of the internal market and the implementation of certain EU policies and to safeguard the financial interests of the Union and the EU budget at large. Section 2 evidences that the existing whistleblower protection at national and EU level is not sufficient to address underreporting as one of the causes of weak enforcement of EU law. Currently most Member States offer protection only in a piecemeal way and the level of protection varies. The protection at EU level is also limited, as existing rules only apply to specific sectors and offer limited protection.

Insufficient protection of whistleblowers in a given Member State can have a negative impact on the functioning of various EU policies in that Member State, but also spill-over impacts in other Member States, as set out in section 2.2. The following table summarises the strength of potential spill-over impacts of insufficient enforcement in the areas identified as necessitating the introduction or the strengthening of whistleblower protection.

Table 3.1 Strength of spill-over impacts of breaches of Union law

While, as described under the baseline scenario, the situation in some Member States is expected to improve, gaps and unevenness of protection will persist, as even these improvements will be limited to certain areas or types of wrongdoing, leading to different types and levels of protection from one Member State to the other. This means that the cross-border impacts will also persist. It is therefore clear that only EU action can address unevenness of protection, ensuring a consistent high level of protection across the EU.

Also as regards the protection of financial interests of the Union, it is clear that fraud and illegal activities affecting them cannot be dealt with by Member States acting alone. The Treaty itself presumes, in Articles 310(6) and 325(1) and (4) TFEU, the necessity of EU legislative action for setting out equivalent and deterrent measures to protect EU financial interests against illegal activities. Hence, EU action is warranted.

For the above reasons, the improvement of enforcement of EU law cannot be sufficiently achieved by Member States acting alone or in an uncoordinated manner. This can only be achieved by action at EU level, providing minimum standards of harmonisation on whistleblower protection. Moreover, only EU action can provide coherence and align the existing EU sectorial rules on whistleblower protection.

3.2    Legal bases

As indicated above, there is no legal basis in the Treaties specifically allowing the EU to regulate whistleblower protection in general.

In particular, an initiative based on the protection of fundamental rights, notably freedom of expression, cannot be pursued since the EU Charter of Fundamental Rights cannot serve as a standalone legal basis 142 . Moreover, although fraud and corruption are rather common types of violations of EU law which cause harm to the public interest in key policy areas and have clear spill-over impacts in terms of hampering the proper functioning of the internal market, the fight against those type of violations has no self-standing legal basis in the Treaties.

However, certain Treaty articles can serve as legal basis for instruments aimed at strengthening whistleblower protection as a means of improving the enforcement of EU law: Articles 292, 50, 325 and 114 TFEU 143 . Article 153(1)(a) and (b) TFEU could also be used to regulate aspects of whistleblower protection relating to the improvement of the working environment to protect workers’ health and safety and to working conditions. The initiatives based on these Articles are summarised as follows:

Table 3.2 Summary of the scope of the initiatives that could be based on available legal bases

4.Objectives

The general objective (increasing the reporting rate of violations of EU law) will be achieved by providing legal clarity and certainty on the legal framework and ensuring effective protection against retaliation in all Member States. When compared to the baseline scenario, this is expected to lead to a reduction of the level of violations of EU law, as more illegal activities will be prevented, reported, investigated and prosecuted.

The general objective will, in turn, have ancillary benefits such as support of good governance, increase of businesses’ competitiveness, of transparency in the EU, as well as of protection of fundamental rights under the Charter. In this respect, any implementation of the general objective would enhance freedom of expression, as well as increase reporting and deterrence of fundamental rights violations within the implementation of EU law.

5.Policy Options

5.1    Design of the policy options – Common minimum level of protection

In light of the enforcement challenges identified in section 2, the main differences of design of the policy options revolve around the material scope of application, e.g. what can be reported in terms of violations or abuses of EU law that would trigger the protection of whistleblowers.

All the other elements, e.g. (1) personal scope, (2) obligation to establish reporting channels, (3) safeguards for the reporting and the reported persons, (4) measures against retaliation (5) measures to ensure the effectiveness of the framework for whistleblowers, are common to all the policy options.

The rationale is that, besides establishing in which areas of EU law enforcement needs to be reinforced by whistleblower protection, all policy options need to counter the drivers of underreporting as established in Section 2. In particular:

·fear of retaliation is addressed by the measures of protection against retaliation. Some of these are aimed at preventing retaliation, such as the overall obligation to set up a clear legislative framework prohibiting retaliation; the obligation to provide for internal and external reporting channels; to guarantee confidentiality; to ensure access to information and impartial advice. Others are targeted to the situation where the whistleblower has already suffered retaliation and aim at providing as full a remedy as possible.

·lack of knowledge of where and how to report is countered by the obligations to establish reporting channels and to ensure access to information and independent advice;

·the sense of futility that has a dissuasive effect on whistleblowers is addressed by the obligations imposed on national authorities to follow up on the reports and give feedback.

Therefore, any policy option should promote or provide for minimum standards, ensuring that Member States introduce essential components of an effective and balanced legal framework that protects whistleblowers who genuinely aim to safeguard the public interest whilst safeguarding the rights interests of persons that may be prejudiced by the reports.

Accordingly, every policy option introduces the same common elements of protection based on the principles provided in the Council of Europe Recommendation 144 and the ECtHR case-law on freedom of expression enshrined in Article 10 ECHR, as well as further international standards and good practices 145 and EU fundamental rights and rules (e.g. data protection) 146 .

1.Personal scope (Principles 3 and 4 of the CoE Recommendation): the retained options have a broad personal scope. They cover both the public and the private sector and grant protection both to workers in standard employment relationships as well as to part-time workers, fixed-term contract workers or persons with a contract of employment or employment relationship with a temporary agency, and to a wider population of persons in a work-based relationship, such as self-employed persons providing services, freelance, contractors, sub-contractors and suppliers, given that, as indicated in Section 2.2, these broader categories can be key for exposing violations of the law and may suffer different forms of retaliation. Shareholders and persons in managerial bodies will also be included for the same reasons.

The personal scope will also include further categories of reporting persons who do not rely on their work-related activities economically but who may nevertheless suffer retaliation, such as volunteers and unpaid trainees. More generally, the options would ensure that the need for protection is determined by reference to all the relevant circumstances and not merely by reference to the nature of the relationship, so as to cover the whole range of persons connected in a broad sense to the organisation where the breach has occurred, including in particular candidates for employment or for providing services to an organisation who acquired the information on breaches of law during the recruitment process or other pre-contractual negotiation stage.

2.Obligation to establish reporting channels (Principles 12 to 17). Member States should:

·ensure that private entities and public authorities establish internal reporting mechanisms (including following consultations with workers’ representatives where appropriate), meeting the requirements set out in the Council of Europe recommendation;

·provide for external reporting channels to competent national authorities or the competent EU authority where relevant;

These obligations will ensure that the information gets to those people most able to investigate and with powers to deal promptly with the problem.

3.Safeguards for the reporting and the reported persons (Principle 18), in particular:

·ensuring the confidentiality of the data of the reporting person: reassuring workers that they will be protected may not always be enough, thus offering confidentiality can provide the added reassurance someone may need to speak up;

·protection of the personal data of both the reporting and the reported person;

·respect of the rights of defence of the reported person (including the right to access to the file, the presumption of innocence, the right to be heard and to seek effective remedy): this is crucial in order to avoid unfair treatment or reputational damages (Principle 10);

·a tiered use of reporting channels (principles 14, 17 and 24): the reporting persons should be required to first use the internal channels, i.e. report to their employer; only if this does not work – or could reasonably not be expected to work – report to the competent authorities, and only as a last resort to the public/media. This safeguard aims to ensure that the information gets to the persons who can contribute to the early and effective resolution of risks to the public interest as well as to prevent unjustified reputational damages from public disclosures 147 . At the same time, it provides the necessary flexibility for the reporting person to choose the most appropriate channel depending on the individual circumstances 148 and allows for the protection of public disclosures taking into account democratic principles such as transparency, and fundamental rights such as freedom of expression and media freedom, whilst balancing the interest of employers to manage their organisations and to protect their interests 149 with the interest of the public to be protected from harm, in line with the criteria developed in the ECtHR case-law 150 ;

·to enjoy protection, the reporting persons should reasonably believe the information they disclose to be true (Principle 22): This is an essential safeguard against malicious/abusive disclosures, ensuring that those who deliberately and knowingly report false information do not enjoy protection. At the same time, it ensures that protection is not lost solely on the basis that the reporting person was mistaken as to its import or that the perceived threat to the public interest has not materialised, provided he/she had reasonable grounds to believe in its accuracy; in a similar vein, the reporting persons should be entitled to protection under an EU legislative initiative if they reasonably believe that the information they report falls within its scope.

4.Ensure the protection of reporting persons against retaliation

·Remedial measures against work-related retaliation (Principles 21 and 26): It is important to ensure that the reporting persons have at their disposal legal actions (“remedial measures”) which provide them with effective access to legal review, decision and remedy for retaliation broadly defined, e.g. against any act or omission occurring in the work-based context which causes them detriment.

As mentioned in detail in Section 2.2, retaliation can take many forms and varies depending on the legal nature of the work-based relationship. The appropriate remedy will be determined by the kind of retaliation suffered. Typical remedial measures (the types of remedy will vary between legal systems) include actions for reinstatement, compensation for financial loss, award of damages. Of particular importance for whistleblowers are interim remedies pending the resolution of legal proceedings that can be protracted. These could be ordered by a court to stop threats or continuing acts of retaliation, or prevent forms of retaliation that might be difficult to reverse after the lapse of lengthy periods, such as dismissal, and that can ruin financially the individual;

·reversal of burden of proof, i.e. in a prima facie case of retaliation, the person who took the adverse measure against the reporting person carries the burden to demonstrate that this was not related to the reporting (Principle 25);

·prohibition of “gagging clauses”: no term or clause in any contract or agreement between individuals and the person or body for whom they are working can be relied on to preclude them from reporting or penalise them for having done so (Principle 11);

·right of the reporting persons to rely on having made a report in accordance with the rules of the Directive as a defence in proceedings against them under civil, criminal or administrative law, for instance for breach of confidentiality, copyright, data protection, defamation 151 (Principle 23).

It should be kept in mind that the choice of legal remedies is based on the specific risks faced by whistleblowers. Under certain national frameworks and in certain cases, there are administrative processes to protect and compensate reporting persons suffering retaliation 152 . Notwithstanding such possibilities, it is important that whistleblowers have at their disposal judicial relief and remedies, so as to contest the retaliatory actions in court, whereby it falls upon the courts to decide, based on all the individual circumstances of the case, whether they meet the conditions of the applicable rules.

5.    Ensure the effectiveness of the framework for whistleblowers:

·Imposition of sanctions against persons who hinder reporting; retaliate against reporting persons; bring vexatious proceedings against reporting persons or breach the duty of maintaining the confidentiality of the identity of reporting persons, as well as sanctions against reporting persons who make malicious or abusive reports including measures for compensating persons affected by a malicious or abusive report;

·obligation of those who receive reports through internal or external channels to follow up on the reports within a certain timeframe and give feedback to the whistleblowers: this is necessary to reassure potential whistleblowers that the system is actually working (Principles 19 and 20) 153 ;

·Obligation of national authorities to publish information on the legislative framework in place for the protection of whistleblowers (Principle 27) 154 ; 

·Provision for review by national competent authorities of their procedures for receiving reports and their follow-up regularly and for review by the Commission of the implementation of the initiative (Principle 29).

As all the above are minimum standards, in all the options, Member States would retain the possibility of adopting higher standards of protection for the reporting persons.

In addition, in all the options, Member States would retain the possibility to apply further measures to facilitate or encourage whistleblowing, which go beyond the core standards promoted by the ECtHR/CoE, such as rewards.

Notably, in some non-EU jurisdictions the reporting is encouraged by monetary rewards to persons who report information that leads to successful actions (one well-known example is the US Securities and Exchange Act). However, such systems have not been adopted in the majority 155 of Member States 156 , because they are seen as shifting the purpose of the reporting away from the public interest to the personal gain of whistleblowers, thus making whistleblowing appear as a commercial transaction, which may discredit whistleblowers in general 157 . Additionally, the introduction of such rewards might be considered as running counter to ECtHR case law, according to which whistleblowing “motivated by a personal grievance or a personal antagonism or the expectation of personal advantage, including pecuniary gain, would not justify a particularly strong level of protection” 158 .

5.2    Assessed policy options

As evidenced by the problem definition, beyond the specific scope of protection and measures to combat retaliation, the impact assessment needs to ascertain in which areas of EU law introducing whistleblower protection is necessary to strengthen enforcement and whether such objective could be fulfilled through regulatory or non-regulatory actions.

The following policy options have been assessed 159 :

1.Policy option 1: Baseline scenario - maintaining the status quo;

2.Policy option 2: a Commission Recommendation providing guidance to Member States on key elements of whistleblower protection complemented by flanking measures to support national authorities;

3.Policy option 3: a Directive introducing whistleblower protection in the area of the financial interests of the Union complemented by a Communication setting a policy framework at EU level, including flanking measures to support national authorities ;

4.Policy option 4: a Directive introducing whistleblower protection in specific areas of EU law;

a.Sub option of policy option 4: a Directive under policy option 4 complemented by a Communication setting a policy framework at EU level, including flanking measures to support national authorities;

Discarded options

Further policy options were discarded following a preliminary assessment:

- A legislative initiative based on Article 50(2)(g) TFEU aimed at enhancing the integrity of the private sector by introducing minimum standards for setting up reporting channels.

The main reasons for which this option is discarded are its limited scope of application and of the protection granted. Setting up reporting channels based on minimum standards would reassure workers that it is safe and acceptable for them to internally raise concerns and would likely increase the ability of those in charge of the organisation to take steps in time to prevent damages to the company’s economic performance and business reputation. However, while such legislative initiative would facilitate the early detection of wrongdoing, and may even have a dissuasive effect on potential wrongdoers and enhance consumers’ trust and protection, only the private sector actors would be covered. In addition, a legislative initiative in this area would only allow to require setting up of internal reporting channels within private law entities, while the availability and design of external reporting channels (i.e. to the competent authorities) and the availability and forms of protection of whistleblowers against retaliation would be left to the discretion of Member States laws. This outcome would undermine the overall effectiveness and rationale of the measure in light of the shortcomings identified in the problem definition.

- A legislative initiative under Article 153(1)(a) and (b) TFEU has also been discarded. Such initiative would regulate aspects of whistleblower protection relating, respectively, to the improvement of the working environment to protect workers’ health and safety, and to working conditions and would provide protection to workers reporting on violations of both national and EU law.

The personal scope of such an initiative would be very limited. It would only cover employees and would leave unprotected other types of potential whistleblowers, such as self-employed persons, contractors or suppliers, who, according to evidence available 160 and international standards 161 , also need protection against retaliation. It would also not allow for protection of all the different categories of persons referred to in the Council of Europe Recommendation. The limited personal scope would thus constitute a main gap in the protection of whistleblowers at EU level. By excluding from protection crucial categories of potential whistleblowers, such an initiative would also have limited effectiveness in terms of improving the enforcement of EU law.

The limited personal scope would not be compensated by a more extensive protection. Article 153 TFEU would not offer any additional protection in comparison to the policy options retained in this Impact Assessment and, in particular, an initiative based on this Article would not allow providing for any further measure against retaliation. On the contrary, the overall protection offered under Article 153 TFEU might be even more limited, as rules for the protection for whistleblowers against criminal, civil and administrative proceedings could only be granted if required to protect the safety and health of employees in the working environment. Moreover, obligations on Member States to put in place reporting channels or to properly investigate the reports would seem to go beyond the proper scope of the notion of safety and health at work.

Article 153 TFEU would also not be a suitable legal basis for harmonising Member States’ rules defining what constitutes legitimate whistleblowing.

Finally, an initiative based on Article 153 TFEU could result in imposing burdens on employers which would not be justified by the resulting ancillary benefits in terms of improving enforcement of EU law. The focus on the protection of the workers' health and well-being and their working conditions could mislead employees and entail a substantial increase of the number of reports on work-related individual grievances (and thus higher costs for the employer linked to the investigation of such reports), while it would not translate into a higher rate of detection of breaches of EU law.

Overall, a legislative initiative based on Article 153, extending protection also to situations where there is no cross-border dimension or other spill-over impact, where there is no connection with EU law or with the financial interests of the EU, would be a far-reaching – and consequently also quite costly – EU regulatory intervention, which does not appear to meet the requirements of proportionality.

5.2.1    Policy option 1: Baseline scenario – maintaining the status quo

Maintaining the status quo would entail no new action taken at EU level. Member States' legislations would be the primary source of protection of whistleblowers together with the existing sectorial instruments of EU law. The Commission would pursue the monitoring of the transposition and the enforcement of existing sectorial rules; continue monitoring the developments at national level in the context of the EU Semester and its anti-corruption policy, and continue supporting research and promoting the exchange of good practices.

If, on the one hand, some Member States are currently reviewing or adopting new legislation on whistleblower protection, on the other hand, the national reforms are not coordinated and a number of Member States still have weak or no whistleblower protection. The gaps in protection and the legal uncertainty resulting from fragmentation and divergence in protection across the EU would not be addressed in a satisfactory way by the existing EU rules on protection of whistleblowers, which are sectorial and mainly in place to ensure enforcement of specific EU instruments whilst providing for varying and rather limited protection.

Maintaining the status quo would therefore not address the fear of retaliation, the lack of sufficient protection at national and at EU level and the lack of effective implementation, so ultimately it would not resolve the problem of underreporting. A detailed explanation is contained in Section 2.

5.2.2.    Policy option 2: Commission Recommendation providing guidance to Member States on key elements of whistleblower protection complemented by flanking measures to support national authorities

This option would consist of a Commission Recommendation to Member States aimed at setting out key standards (notably drawn from the Council of Europe 2014 Recommendation) and promoting best practices identified at national and international level. The main objective would seek to overall raise the level of protection of whistleblowers in the Member States and promote greater convergence of national approaches. The Commission would monitor the implementation of the Recommendation and assess deficiencies in implementing national measures through specific country recommendations under the European Semester.

In order to bring added value as compared to the Council of Europe Recommendation, the Commission would complement the initiative with flanking initiatives to support national authorities in implementing its Recommendation. These measures would, in particular, address the sense of futility that may dissuade individuals from reporting, the lack of awareness on how and where to report and the legal uncertainty about their rights if they blow the whistle, as well as increase trust in the effectiveness of the framework on whistleblower protection.

A further measure targeted to combat the above drivers of under-reporting would be involving the European Network of Ombudsmen. In a large number of cases where corruption is carried out by public officials, reports by whistleblowers may not trigger a proper investigation due to deficiencies in the independent auditing system and follow-up of the reports. In case of inaction by national authorities, whistleblowers may not be aware of the further steps to follow and may need independent advice and guidance.

As part of its strategy for an effective enforcement of EU rules, set out in its Communication "EU Law: Better Results through Better Application", the Commission will support effective national remedies to EU citizens and strengthen its cooperation with the European Network of Ombudsmen. The members of this Network could handle, according to their competence, complaints in cases of maladministration for failure to act upon whistleblower reports, namely in cases where reports by whistleblowers did not trigger a proper investigation and follow-up at national level. The European Ombudsman could draw a report on the information that Network's members may provide to it regarding activities and inquiries on whistleblower protection and forward that report to the Commission and the European.

5.2.3    Policy Option 3: Directive introducing whistleblower protection in the area of the financial interests of the Union, complemented by a Communication setting a policy framework at EU level, including flanking measures to support national authorities 

Policy option 3 would consist of a Directive based on Article 325 TFEU aimed at strengthening the protection of the financial interests of the Union and would set out minimum standards of harmonisation on reporting channels and protection to individuals reporting fraud, corruption and other illegal activities affecting the financial interests of the Union. The rationale of this policy option is to enhance enforcement in a core competence area of the EU: introducing whistleblower protection would enhance upstream the reporting of illegal activities and facilitate their detection by national and EU enforcement mechanisms. It would also complete the system of protection of the financial interests of the Union, built on the EPPO's criminal investigations and prosecutions and OLAF administrative investigations.

While the Directive would include all the measures of protection listed in Section 5.1, the protected disclosures, i.e. the cases in which whistleblowers would be granted protection, would be limited to fraud, corruption and other violations of the EU budget.

Moreover, the Commission would accompany the Directive with a Communication setting out flanking measures to support effective whistleblower protection and promoting best practices identified at national and international level (similarly as under option 2).

5.2.4    Policy option 4: Directive introducing whistleblower protection in certain areas of EU law

Policy option 4 would consist of one single Directive based on Articles 114 and Article 325 TFEU 162 setting out minimum standards of harmonisation of whistleblower protection and affording protection not only to individuals reporting fraud, corruption and other illegal activities affecting the financial interests of the Union (Option 3) but also to those reporting about violations of EU law related to the proper functioning of the internal market as well as in other areas such as in the field of environmental protection, food safety, animal health and welfare, product and transport safety, consumer protection, public health and protection of privacy and personal data. 

Option 4 would thus be targeted at those violations of EU law which could result in serious harm to the public interest in the form of detriment to the financial interests of the EU and more generally the finances of the Member States (EU budget, EU funds, tax evasion and avoidance, public procurement, competition, financial services) or to the welfare of the public at large (environmental protection, nuclear safety, food safety, animal health and welfare, product and transport safety, consumer protection, public health, protection of privacy and personal data and security of network and information systems).

Option 4 has thus the broadest scope of all options assessed: it covers all the areas in which whistleblower protection has been identified as necessary to reinforce the detection, investigation and prosecution of violations of EU law that can lead to serious harm to the public interest. It would also fill the gaps and bring consistency to the existing EU legislation providing whistleblower protection in the financial services sector. It would also strengthen the enforcement of EU law in the field of privacy and data protection, environmental protection, nuclear safety and transport safety, where few instruments contain rules on whistleblower protection, as well as in the areas of public procurement, tax evasion and avoidance, food and product safety, public health and consumer protection, protection of privacy and personal data and security of network and information systems, where currently there are no such rules but where whistleblower protection is proven to be necessary.

5.2.5    Policy Option 4 Sub option 1: Directive under policy option 4 complemented by a Communication setting a policy framework at EU level, including flanking measures to support national authorities

Under this sub-option, the Commission would accompany the legislative instrument under option 4 with a Communication and flanking non-regulatory measures as under option 3. The

Communication will promote an effective, comprehensive approach to whistleblower protection and thus encourage Member States to ensure coherence and legal certainty within the national legal frameworks, based on the principles developed by the Council of Europe in its 2014 Recommendation on Protection of Whistleblowers, and the case law of the European Court of Human Rights on the right to freedom of expression.

5.3 Summary of the policy options

6.Impact of the Policy Options: Assessment

6.1    Methodology and baseline

The following criteria have been used in order to determine the impacts of each policy option:

üEffectiveness in meeting the policy objectives: to which extent the policy options address the general and specific objectives established in Section 4.

üEconomic costs: (i) impact on the legal system of Member States and (ii) economic burdens for public and private employers as well as for Member States in terms of adapting to the new legislation.

üFeasibility: legal and non-legal constraints to implement effectively the policy option.

The effectiveness of each of the options is measured towards the fulfilment of the general objective as established in the problem definition, i.e. to address under-reporting so as to improve the enforcement of EU law. This parameter is in turn measured as regards the achievement of the specific objectives: (i) increase the protection of whistleblowers, (ii) enhance legal certainty and clarity and (iii) reinforce awareness. The fulfilment of the specific objectives would lead to, in the medium to long term, to an increase of the reporting rate and unmasking of wrongdoings by ensuring effective whistleblower protection.

The quantification of the impacts (i.e. economic costs and benefits) of each policy option is limited, due to lack of information. A specific external study 163 has been commissioned to assess the impacts of the implementation of each of the policy options both in terms of qualitative quantitative impacts. Moreover, information on overall impacts of the policy options, particularly in certain aspects of the internal market, is complemented by other information sources 164 .

While all employees and other types of categories of individuals on a work-based context can be offered protection provided report a protected disclosure, not all the private entities will have the obligation to establish internal reporting channels. Accordingly, the reference to “employer” in this section refers to public authorities as well as large and medium-sized companies and costs have been calculated only taking into account the impacts on this type of companies. Generally, the proposed measures are not expected to have an impact on medium-sized enterprises (see detailed analysis on the SME test in Section 7 and Annex 11). Businesses in the private sector with less than 50 employees are excluded a priori from the obligations to establish internal reporting channels in accordance with the Commission’s better regulation principles 165 , with the exception of small and micro companies operating in the area of financial services or those vulnerable to money laundering and terrorist financing.

This section defines costs in two areas: (a) estimating: the main administrative costs for Member States (i.e. cost for transposition and enforcement of the legislation) and (b) implementation costs (compliance with the requirements provided by the new legislation as employers in the public and private sector).

The quantification of the administrative costs for Member States is calibrated to the current legal situation (i.e. baseline scenario) in each Member State. Therefore, the new legal requirements under the policy options would not impose additional costs to those Member States whose national law already mirrors the specific requirements of the policy option. For those Member States are currently preparing new legislation on whistleblower protection, the quantification has been made as regards the status quo, without taking into account future developments, since the outcome of the legislative procedures is uncertain and could be minimal.

The implementation (i.e. compliance) costs relate to the obligation of employers in the private and public sector to establish effective reporting channels as well as to follow-up on reports received. These costs are divided into one-off implementation costs and recurrent implementation costs based on estimates of the duration of time that employers will spend on tasks related to the changes in the legislation and following-up on reports. The costs have been estimated for private employers and public sector employers by multiplying the number of employers affected by the legislation by the cost factors described above (time is costed at the labour cost of the amount of time taken for each activity).

The one-off costs related to implementation of new legislation are divided as follows:

·The cost to employers to interpret the new legislation and develop workplace policies which align with the legislation;

·The cost to employers to set-up internal reporting channels to comply with the new or amended legislation; and

·The cost to develop or amend training materials to ensure staff is aware of reporting channels and what constitutes a protected disclosure.

The annual operational costs are determined according the following parameters:

·Providing internal reporting channels (estimated to cost one hour of staff time per report; the number of reports per person is assumed to increase as the strength of protection increases);

·Providing outsourced internal reporting channels (estimated to cost €1.5 per person per year, based on consultations with hotline providers and other experts);

·Investigating and managing cases (estimated to take an average of two days of staff time per report for both internal and outsourced internal reporting channels); and

·Providing annual training that ensures that potential whistleblowers are aware of how to report and are confident that they will not be retaliated against for reporting (estimated at half an hour of training per worker per year). The proportion of workers who receive training to ensure they are aware of the violations of law and reporting channels is assumed to vary by the strength of protection available in a Member State.

As regards the benefits, there is no data available in the EU quantifying the specific benefits due to a causality link between whistleblower protection and better enforcement of law. The data presented is, thus, based on modelling with a series of presumptions assuming that the positive impact of increasing whistleblower protection will in turn increase the number of reports and will improve enforcement of EU law, with a certain degree (i.e. percentage) of recovery of misused revenues of the EU budget. In terms of benefits, data modelling focused on those areas where violations of EU law lead to economic loss for public finances. In the area of public procurement, for example, data modelling is based on a combination of different parameters, including the index of level of fraud in a Member State, the average level of public funds spent and most accepted presumption of international research studies (i.e. Global Fraud Report) which advocate that whistleblower protection can uncover 40% of corruption or fraud.

The increase of the number of reports is based on data provided by research 166 and estimated as regards 2022 to allow for (a) time for legislation to be adopted and then transposed into national laws and (b) time for reporting channels to be set up and publicised. However, it is assumed that not all the reports will lead to cases relating to effective violations.

6.2    Assessment of the Impacts

While the degree of their social and economic impacts may vary from one option to the other, all options have positive impacts in the following dimensions:

Social impact

The major social impact of reinforcing a system of protection of whistleblowers at EU level is better enforcement of EU law and deterrence of illegal or abusive activities 167 by increasing the reporting 168 . Besides preventing and addressing ensuing risks, reinforcing protection of whistleblowers will contribute to better working conditions and well-being of workers. The positive outcome is reinforced if effective accompanying measures – awareness-raising, promotion and training – are deployed.

üImpact on citizens

Based on the Global Business Ethics Survey, it has been estimated that improving whistleblower protection would entail a direct prevention of retaliation of 7% of the workforce employed in the sectors covered by the survey 169 . If it is assumed that this percentage remains the same for the workforce in the areas covered by the policy options under this impact assessment, especially options 3 and 4, moving to a stronger or more extensive obligation would enhance the level of protection. The introduction of strong protection will concern, on average, 40% of the total workforce who were previously unprotected (around 60 million workers) and improves the level of protection for nearly 20% of the workforce (around 26 million workers). Overall, the largest increase in the number of employers providing protection is in Germany, Poland and Spain 170 . This is due to the large number of employers in these countries and the lack of coverage of the national legislation in the baseline scenario 171 . 

üImpact on businesses

Although the set of measures linked to the creation of an EU system of protection for whistleblowers would involve specific costs to public and private employers, the large scale of the benefits outweigh the costs. Among other factors, it would contribute to a healthy competitive business environment at EU level, by making it harder for companies to acquire competitive advantages through inappropriate methods. Law-abiding companies will, therefore, find it easier to compete and their attractiveness for investors would increase.

Positive impacts on good governance and long-term organisation performance are also expected to materialise. The legislative options ought to have a positive impact in the long run on organisational performance in those Member States where they raise the level of protection provided to whistleblowers in law. Moreover, they would reinforce the ability of companies to prevent as well as repair damage to their reputation to a significant extent by publicly clearing up any misunderstandings about what might have happened, or by describing steps taken as follow up to the whistleblowing. One fifth (20%) of business organisations responding to the open public consultation cited improvements to companies’ economic performance as a benefit of rules obliging public and private organisations to protect whistleblowers.

The costs linked to a disproportionate increase of the number of reports to be assessed are mitigated by the fact that whistleblower protection remains linked to the public interest. The reference to serious harm to the public interest makes clear that reports related to individuals' personal grievances or working conditions, where there is no wider public interest, do not qualify for protection.

Economic impact

A comprehensive system of whistleblower protection will have a positive impact in terms of recovery of illicit activities against the EU budget. While it is not possible to ascertain the exact benefit of whistleblower protection in terms of recovery of revenues, an estimation of the potential benefits putting in place a robust whistleblower regime could amount to EUR1.75 billion over 10 years 172 .

For example, a reinforced system of protection of whistleblowers would contribute to diminishing the “VAT gap” in the Member State, which, as explained in Section 2, is estimated to amount to EUR 175 billion in 2017 and to rise to EUR 217 billion by 2027 in the absence of policies addressing this issue. In terms of customs duties, limited data is available.

In addition to the benefits relating to the fraud against EU revenues, in terms of fighting corruption, the potential gains are also substantial. In 2014, the European Commission estimated that the total cost of corruption in the EU is of EUR 120 billion per year. More recent estimates, based on a different methodology, raise this figure to EUR 817 billion – EUR 990 billion, which is 4.9% – 6.3% of GDP 173 . Whistleblower protection is a key element of a successful anti-corruption framework, as it can help overcome problems related to detection and act as a deterrent. In a scenario where EU legislation on whistleblowing is effectively implemented, the level of corruption across the EU will reduce the current risk estimated at EUR 179 billion – EUR 256 billion.

Impact on fundamental rights 174

With the exception of the baseline scenario, all policy options aimed at increasing the current level of protection for whistleblowers will have a positive impact on fundamental rights as provided by the Charter, especially with regard to:

·Freedom of expression and right to information (Article 11 of the Charter): Insufficient protection of whistleblowers against retaliation discourages citizens from reporting. In consequence the public’s right to access information is affected. Media, and especially investigative journalism, depend on others to provide the information they later convey to the public. Those sources who, due to their position inside companies and public bodies, have first-hand knowledge about the threats to the public interest risk retaliation if exposed. Therefore a stronger protection of whistleblowers should increase the legal certainty and encourage whistleblowing also to the media. Even if direct public disclosures (including whistleblower reports to the media) are to be limited only to certain specific scenarios (i.e. only the situations when use of usual reporting channels internally and/or externally is not possible or would not achieve a desired goal), strengthening the protection of whistleblowers from retaliation and clarifying the conditions of protection should overall support freedom of expression.

·Any of the policy options will also have a positive impact on the right to fair and just working conditions (Articles 30 and 31 of the Charter) because a higher level of protection for whistleblowers would be secured through establishing of reporting channels and improving protection against retaliation in the work-based context. Depending on the scope of the measures and as far as they increase reporting and preventing illegal activities there may be impacts on health care (Article 35 of the Charter), environmental protection (Article 37 of the Charter), consumer protection (Article 38 of the Charter) and the general principle of good administration.

The higher level of protection of fundamental rights as described may interfere with the protection of other fundamental rights. In this regard a balanced approach is necessary to maintain the right to private life and to the protection of personal data (Articles 7 and 8 of the Charter) of whistleblowers but also of the reported persons, the presumption of innocence and the rights of defence of the latter (Articles 47 and 48 of the Charter). The freedom to conduct a business (Article 16 of the Charter) might also be affected by any of the initiatives imposing obligations that come with implementation costs to employers. However, any of the potential limitations those fundamental rights resulting from the policy options would comply with the conditions provided for in Article 52(1) of the Charter 175 .

Finally, through the implementation of policy options 3 and 4, the EU will establish the necessary link through secondary EU legislation to monitor compliance of the Charter (Article 51(1) of the Charter). These options are thus bound to have positive effects also on the respect of all fundamental rights, in the context of implementation of EU law.

6.3    Analysis of the policy options

6.3.1.    Policy Option 2: Commission Recommendation providing guidance to Member States on key elements of whistleblower protection complemented by flanking measures to support national authorities

A. Views of stakeholders

Few of the stakeholders consulted consider this option to address fully the problem definition and its drivers. Existing non-regulatory measures set by international organisations such as the Council of Europe have not triggered a high overall increase of national legislation in EU Member States. While prompting some changes in certain Member States, the Council of Europe Recommendations have not triggered policy responses in others.

While some stakeholders have noted that non-regulatory measures may contribute to improve the implementation of existing national legislation by bringing clarity and awareness-raising 176 and could potentially also guide 177 those Member States currently envisaging national legislation on whistleblower protection, the majority of stakeholders underlined the lack of enforceability as the main factor reducing the effectiveness of this policy initiative 178 . In the workshops organised by the Commission with Member States' experts and in response to the OPC, a few Member States expressing a clear preference for EU soft-law measures and promotion of good practices.

B. Effectiveness in meeting the policy objectives

Policy option 2 could improve the status quo, since it would draw upon and promote key principles already established in international instruments while at the same time proposing a broader range of standards and further guidance. It would moreover aim at influencing new legislation in Member States and encouraging uptake of good practices, especially in those countries that are actively seeking to extend and improve their legislation in this area. It could encourage more consistent systems of protection and reduce the uneven protection among Member States.

The Recommendation would also raise awareness about the added value of whistleblowing and support showcasing the contribution of whistleblowers to exposing threats or harm to the public interest, thus helping to fight negative social perceptions. It would thus contribute to tackling the socio-cultural factors contributing to underreporting by whistleblowers.

Nonetheless, a Recommendation, even if supplemented by flanking measures, comes inevitably with the risk of low up-take by the Member States and only limited improvement in deterrence for illegal activities related to the internal market of the EU would be expected 179 . A non-regulatory approach alone is not expected to significantly add value because there are other similar soft law international instruments by international organisations (e.g. Council of Europe) and these have not triggered harmonisation across the EU.

A non-regulatory action is only expected to increase by 8% the number of reports of wrongdoings across the EU in the next 5 years (until 2022) 180 . The protection of whistleblowers would remain largely different depending on the sector, the type of wrongdoing and depending on the country where the disclosure is made.

C. Economic impacts

(I)Impact on the legal system of Member States.

Assuming that the Recommendation is taken up only by those Member States already having a broad system of protection or those Member States who are currently in the process of drafting legislation, the cost to public authorities to provide regulatory and advisory functions is assumed to remain the same as in the current baseline scenario i.e. EUR 15 million.

(II)Costs: economic burdens for public and private employers as well as for Member States in terms of adapting to the new legislation.

The costs are summarised as follows:

The highest cost is related to training, which amounts to a total of EUR 88 million 181 for both the public and the private sector, including annual training. However, it is not certain that all employees under this policy option, and particularly those working in the public sector, would need a new training each year, which would accordingly decrease substantially the total amount of costs.

Additional costs under this policy option are also expected to arise linked to the divergences in national legislation on whistleblower protection across the EU. Due to the maintenance of the level of legal fragmentation across the EU, the compliance costs of companies operating in multiple Member States (facing additional legal complexity and need to adjust their internal policy and training) would increase. Moreover, as evidenced in Section 2, there would be no improvement towards a healthy competition in the internal market, so that related costs due to corruption and bribery, albeit difficult to quantify, would persist.

D. Feasibility

The legal constraints of this policy option are marginal, since non-regulatory tools do not need the agreement of EU institutions (i.e. Council of the EU or the European Parliament). However, due to its non-binding nature, its overall impact will be limited.

6.3.2.    Policy Option 3: Directive introducing whistleblower protection in the field of the financial interests of the Union complemented by a Communication providing guidance to Member States on key elements of whistleblower protection as well as flanking measures to support national authorities

A. Views of stakeholders

In the Commission OPC, when asked about negative impacts for other EU countries and the EU as a whole resulting from uneven whistleblower protection, respondents identified the protection of financial interests of the EU as one of the two top areas (60% of respondents) where such impacts materialise. In response to the general question about areas in which rules on whistleblower protection are beneficial, whistleblower protection was cited by 82% of respondents as contributing to the proper management of public (national and EU) funds. Similarly, on the specific question about the areas in which the EU should offer more support to Member States for the protection of whistleblowers, 84% of respondents cited the good management of (national and EU) funds.

Participants at the Member States' expert workshops of June and November 2017 could see the added value of enlarging whistleblower protection to report on wrongdoings related to the financial interests of the EU but considered that this option could lead to different rules for national and EU funds, which might create legal complexity and uncertainty for whistleblowers. More generally, pursuing such a sectorial approach would not address fragmentation.

B. Effectiveness in meeting the policy objectives

By enhancing the fight against fraud and illegal activities affecting the financial interests of the Union, policy option 3 addresses the shortcomings identified in Section 2 with respect to the lack of investigation and prosecution of core offences against the EU budget. This policy option would be consistent with the general objective of improving the enforcement of EU legislation with a particular focus on fighting corruption and fraud. At the same time, option 3 would cover an area where, as indicated in Table 3.1., spill-over impacts of insufficient enforcement are very strong.

According to the data of the external study, under this policy option, the Directive envisaged would have as a consequence that over 250,000 employers would move from having no protection measures in place to providing a strong protection for whistleblowers and would cause an additional 150,000 employers that already provide some protection to enhance it further. By facilitating and encouraging reporting, the Directive under option 3 would enhance upstream the reporting of suspected fraud cases and other unlawful acts affecting the Union's financial interests and facilitate their detection by national and EU enforcement mechanisms, including EPPO criminal investigations and prosecutions and OLAF administrative investigations. Such an instrument would substantially increase the number of reports related to the fight against fraud and corruption against all EU revenues and expenditures covered by or due to the EU budget.

Data from the external study established that under this policy option, the annual number of reports of wrongdoing (in the area of the protection of the financial interests of the Union) would multiply by 185% in 5 years (2022), from EUR 1.3 million to EUR 2.4 million.

However, the Directive under this option would be yet another sectorial EU legislation and would not meet the specific objective of addressing the current legal fragmentation and legal uncertainty for whistleblowers. This uncertainty and the fear of retaliation in case the information reported would not qualify for protection are likely to decrease the overall effectiveness of the measure, limiting the potential benefit in terms of increasing reporting rates.

This Directive could give rise to a dual level of protection (EU versus national budget), if Member States would not align national provisions on the reporting of illegal activities affecting their national budget as well. This factor could be mitigated by the guidance that could complement the legislative instrument, in the sense that national authorities could, based on this guidance, extend protection to other areas of EU law but also to fraud and corruption linked to the national budget. The effectiveness in other areas outside the financial interests of the Union, in the same terms as under policy option 2, remains uncertain. The non-regulatory measures would have the same impacts on socio-cultural factors contributing to underreporting as under option 2.

C. Economic impacts

(I)Impact on the legal system of Member States.

As described above, a number of Member States already provide for some form of protection in the area of fraud and/or corruption, and national anti-corruption authorities already function as an external channel for reporting wrongdoing related to fraud to EU and national budget. Nonetheless Member States would need to implement further reporting channels for tax avoidance and provide for protection when the wrongdoing relates to this issue. However, the increase of costs as regards the expenditure on the overall justice system is not expected to be high; it is estimated at EUR 34 million, which is nearly EUR 19 million higher than in the baseline scenario. The largest costs are estimated to be in Spain 182 , Latvia and Cyprus, since these are the Member States which currently do not have in place any legal framework for whistleblowing and will need to introduce a large number of legislative changes. The UK and France, given the strength of their legislation, will be the countries with less associated costs.

(II)Costs: economic burdens for public and private employers as well as for Member States in terms of adapting to the new legislation.

In terms of one-off implementation costs for employers in the public and the private sector  183 the costs for the public sector would amount to EUR 204.7 million while for the private sector (large and medium-sized companies) they would amount to a total of EUR 542 million 184 .

The annual operational costs to introduce internal reporting channels for the public sector and the private sector would amount to EUR 284.4 million and EUR 916 million respectively. The costs are summarised as follows:

The total amount of one-off costs for both the public and private sector is EUR 764.7 million while the annual implementing costs amount to EUR 1.2 billion. This amount includes a cost of providing training of EUR 722 million, which is based in asking each employee to spend 30 minutes per year on training about what to do when wrongdoing is observed or suspected. This costs, which corresponds to a substantial aggregate cost is destined at combating lack of awareness and other socio-cultural factors. However, it is not certain that all employees under this policy option, and particularly those in the public sector, would need a new training annually, which would accordingly decrease, substantially, the total amount of costs.

Feasibility

For the adoption of a legal instrument, Article 325 TFEU only requires a qualified majority at the Council. Moreover, since a large majority of Member States have already in place legislation regarding whistleblower protection in the area of fraud, the legal challenges to adopt this policy initiative are not significant. Implementation would be moreover facilitated by the Communication including guidance to national authorities.

6.3.3.    Policy option 4: Directive introducing whistleblower protection in certain areas of EU law

A. Views of stakeholders

The overwhelming majority of stakeholders are in favour of a legislative EU instrument which would have the broadest possible scope. Stakeholders have also drawn attention to the specific EU policy areas where enforcement weaknesses have been identified in this impact assessment.

In the Commission’s OPC, in response to the question in which areas the EU should support Member States to better protect whistleblowers, the top four areas cited by respondents were:

·fight against fraud and corruption (95% of respondents);

·fight against tax evasion and avoidance (93% of respondents);

·protection of environment (93% of respondents); and

·protection of public health and safety (92% of respondents).

In the targeted consultation conducted by the Commission in 2017 with the members of the Platform on tax good governance concerning whistleblowing in the field of taxation, fourteen out of the eighteen responses indicated that whistleblowing in tax matters should not be protected only through tax-specific rules, rather respondents would instead prefer horizontal legislation across all sectors, whether this is addressed by EU legislation (10 respondents) or national legislation (4 respondents).

As mentioned in section 1, the European Parliament has repeatedly called for a horizontal legislative proposal establishing a comprehensive common regulatory framework, whilst in in the area of taxation, the Council encouraged the Commission to explore the possibility for future action at EU level.

In the workshops organised by the Commission with Member States' experts and in response to the OPC, a few Member States drew attention to the need for any EU legislative initiative to respect the principle of subsidiarity, raising concerns about the existence of a legal competence for a horizontal approach.

B. Effectiveness in meeting the policy objectives

As indicated previously, the Treaties do not provide a legal basis for regulating the protection of whistleblowers in a horizontal way. By providing whistleblower protection in a large area of the internal market and other core EU policy areas (as described in Section 5) as well as in the area of protection of the financial interests of the Union, the EU legislator would address the enforcement weaknesses identified which can cause serious harm to the public interest. In addition to contributing to the proper functioning of the internal market and the effective realisation of other EU policies, it would also overall enhance transparency and accountability (both of the private and the public sector) and contribute to fair competition and a level-playing field in the internal market.

Policy option 4 targets through its broad scope the specific policy objectives of increasing legal clarity and certainty, increasing the level of reporting and reducing retaliation If legislation was adopted in 2017, targeted data of the external study provides for an expected increase of more than 200% in the annual number of reports made by whistleblowers in 2022.

The Directive under this option would bring consistency across the existing EU sectorial rules on whistleblower protection, in particular in the field of financial services. Moreover, it would contribute to better enforcement in those areas where EU sectorial legislation needs to be complemented or where there is no protection of whistleblowers at all. It is thus clear that such a legislative instrument with a broad scope is particularly apt to address the current fragmentation.

Moreover, contrary to the discarded option consisting of an instrument aimed at safeguarding workers' health and well-being, option 4 is clearly focused on key EU interests, so that its scope can be considered balanced and proportionate. In fact, option 4 would cover, in addition to an area where, as indicated in Table 3.1, spill-over impacts of insufficient enforcement are very strong (financial interests of the Union), also further areas where such spill-over impacts are strong (because they affect the proper functioning of the internal market or result in risks that go beyond national borders).

The benefits of whistleblower protection in each and every specific area are difficult to quantify due to the lack of specific data. The positive impact on the fight against fraud and corruption has already been quantified in Option 3. Some other EU sectorial legislation in the area of the internal market provides for estimations of data in terms of benefits. For example, in the impact assessment of the implementing Directive providing whistleblower protection as a tool to enforce the Market Abuse Regulation, it was estimated that annual benefits in terms of reduction of market abuse would reach EUR 2.7 billion annually. Annual costs were estimated at EUR 300 million (plus in the first year estimated one-off costs of EUR 320 million to comply with the information obligations) 185 .

The amount of fraud to public procurement that countries could recover potentially if a system of effective protection was in place is illustrated in the figure below. For example, in the case of the UK, the amount of public funds that could be potentially recovered with an effective whistleblower protection, are estimated between EUR 1.7 and 2.9 billion annually.

Figure 6.1: Estimated potential benefits (EUR millions) by country

The benefits of a better enforcement of EU law in other non-financial areas are more difficult to quantify since consequences may take the form of risks for the environment, public health etc. By way of example, in the area of environmental protection, the Deepwater Horizon disaster demonstrated how far-reaching the consequences of a single accident can be, particularly as regards maritime and coastal pollution: 11 people lost their lives, an estimated 4.9 million barrels (660,000 tonnes) of oil were spilled into the sea and a state-of-the-art drilling rig, valued at US 560 million, was written off as a total loss in the disaster. The oil spill occasioned a response effort involving 48,000 people, 6,500 vessels and 125 aircraft at its peak. Total damages are estimated to reach tens of billions of dollars. In early 2011, BP estimated its costs related to the accident (including costs incurred by the end of 2010 and estimated obligations for future costs) at 40.9 billion dollars. The company committed to pay US$20 billion over a three and a half year period into a Trust Fund out of which legitimate claims are met 186 .

This policy option, nonetheless, does not target the drivers of underreporting linked to lack of awareness and hostile social perceptions towards whistleblowers (see Section 2).

C. Economic impacts

(I)Impact on the legal system of Member States.

Although the material scope of application is different from option 3, the number of employers that would be targeted by both measures across the EU would be similar 187 . This is why the increase of costs as regards the expenditure on the overall justice system is not expected to be high, and would also amount to EUR 34 million under policy option 4.

As in option 3, the largest costs are estimated to be in Spain, Latvia and Cyprus.

(II)Costs: economic burdens for public and private employers as well as for Member States in terms of adapting to the new legislation.

The amount of one-off implementation costs for employers in the public and the private sector are similar both in options 3 and 4. This is due to the fact that the number of private and public companies caught by both policy options would be similar.

However, options 3 and 4 diverge regarding the annual operational costs, as a broader scope of application entails a broader scope for violations of law to be reported and, potentially, a higher number of cases to be analysed and followed up by employers. On this basis, the costs for both the public sector and the private sector would amount EUR 1,336.6 million, which represents an increase of 11% of the costs as compared to option 3.

The costs are summarised as follows:

The total amount of one-off costs for both the public and private sector is EUR 747.8 million while the annual implementing costs amount to approximately EUR 1.34 billion. This later amount also includes a cost of providing training of EUR 722 million, and similar considerations should be as described under option 3.

D. Environmental impact

Effective whistleblowing channels and protection that increase the probability of violations being reported are expected to have a positive environmental impact, in particular by:

-Reducing the risk of specific events that result in environmental damage, such as negligence or malpractice that causes large scale pollution of water, air or soil;

-Reducing the loss of habitat, impact on wildlife protection, and other environmental damage caused by corruption and other violations related to the protection of the natural environment, management of waste, protection of animal welfare, illegal trade in wildlife, etc.

E. Feasibility

The feasibility of the legal instrument should not be considered as legally complex. The legal bases envisaged provide for an ordinary procedure of adoption under qualified majority. Moreover, this policy option follows the approach adopted so far in existing instruments of EU law, which is to facilitate whistleblowing and protect whistleblowers as a means of strengthening compliance with EU law. In addition, the broad scope of this policy option would address the expectations of stakeholders and other EU institutions.

Nonetheless, unlike options 2 and 3, this policy option would not be accompanied by a Communication by the Commission and measures to support implementation, which could affect the overall effectiveness of the measure.

6.3.4.    Policy option 4 Sub option 1: Directive under policy option 4 complemented by a Communication providing guidance to Member States on key elements of whistleblower protection as well as flanking measures to support national authorities

This sub-option would provide for effective implementation of whistleblower protection at national level. The proposed Directive would be accompanied by a Communication which would encourage Member States to ensure coherence and legal certainty within the national legal framework and promote measures that can contribute to effective protection on the ground. The non-regulatory measures would have the same impacts on socio-cultural factors contributing to underreporting as under options 2 and 3.

In the short term, the increase in awareness and knowledge on how to report violations or abuse of EU law, alongside increased knowledge of the protection afforded to whistleblowers, is expected to lead to an increase in the number of reported cases 188 . This increase in the reporting of violations, alongside the rise in the number of trained individuals who can investigate cases, will lead to an increase of investigations and prosecutions/actions against violation or abuse of EU law. The increase in knowledge of the whistleblowers' rights is also likely to increase the number of whistleblowers who contest retaliatory actions against them.

The situation is expected to evolve further over time. The increase in prosecutions and punishment for violations of EU law and for retaliation against whistleblowers is expected to have a dissuasive effect both on future violations and on retaliation against whistleblowers. This will ultimately lead to a relative decrease in the number of reported cases and investigations and prosecutions/punishment for violations of EU law and retaliation.

6.4    How do the options compare?

The table below compares the impacts of the policy options rated in accordance with the following criteria:

Limitations:

vFor the calculation of the benefits derived from an increase of enforcement of EU legislation and a consequent reduction of violations, the conversion into points of the qualitative assessment of the impacts transformed is used for the sole purpose of comparing options. Therefore, the total value of benefits derived from an increase on the reporting rate for a given policy option must be interpreted in relation to the other options, rather than as an accurate estimate of the actual increase of enforcement of EU law that a given policy option would cause.

vThe assumptions have a certain degree of approximation and subjectivity. To mitigate this shortcoming, the methodology, the model and the input data were discussed and validated with external experts 190 .

The table below summarises the qualitative scores for each main assessment criteria and each option. All criteria were given the same weight.

7.Identification of the preferred option: Option 4, sub option 1 – Analysis    and overall impacts

7.1    Analysis 

The analysis in the Section above evidences that Option 4, sub option 1, is the most suitable option to address underreporting and at the same time lack of protection and legal fragmentation as well as lack of awareness, and to fulfil the overall objective of ensuring the protection of whistleblowers as an upstream component of the enforcement of EU law.

The scope of Option 4, sub option 1, covers all areas where whistleblower protection has been identified as necessary and justified to better enforce EU law and where violations of EU law can cause serious harm to the public interest. The aim of establishing minimum standards of protection of whistleblowers is to enhance the proper functioning of the internal market and prevent and deter serious harm to the public interest caused by violations of financial services, EU competition rules and distortions of competition in public procurement, tax evasion and tax avoidance and violations of EU law in core policy areas of importance for the completion of the internal market, such as environmental protection, nuclear safety, food and product safety, consumer protection, public health and transport safety, protection of privacy and personal data and security of network and information systems. Additionally, this option contributes to the fight against corruption and fraud affecting the financial interests of the Union. The overall ancillary benefit would be that of promoting a healthy competitive businesses environment, transparency across the EU and the protection of EU fundamental rights.

The legislative instrument envisaged would also ensure consistency within the existing EU sectorial rules already providing for elements of whistleblower protection, particularly in the financial services area and prevention of money laundering and terrorist financing, while preserving, where relevant, the specificities of these instruments. The compliance costs of the preferred option, as compared to the other policy options, are the highest. However, Section 6 explains that it would also generate the highest benefits, which would outweigh the costs 191 .

7.2    A balanced approach

The Directive providing for minimum standards of protection for whistleblowers will include all those areas of EU law where:

1.there is a need to enhance enforcement;

2.there is a causality link between introducing whistleblower protection and increasing the reporting rate of violations or abuse of EU law;

3.violations or abuse of EU law correspond to serious harm the public interest.

The Commission Communication will promote good practices at national level and set out flanking measures, to promote the effectiveness of the whistleblower protection. This combination of regulatory and non-regulatory action would thus respond to each and every single driver which currently leads to a high level of underreporting by potential whistleblowers. The right balance would be achieved by combining the benefits of all policy options:

·The benefits of specifically targeted non-regulatory actions under option 2;

·The emphasis on the protection of the EU budget and feeding relevant national and EU enforcement mechanisms, under option 3;

It is also the only one that can bring consistency in existing EU sectorial legislation and enhancing enforcement in core areas related to the proper functioning of the internal market and in the field of environmental protection, nuclear safety, food safety, animal health and welfare, product and transport safety, public health and consumer protection, protection of privacy and personal data and security of network and information systems, where spill-over impacts of violations of EU law are strong.

Moreover, the preferred option best addresses the concerns expressed by stakeholders, including an overwhelming majority of the citizens and the European business organisations who contributed to the Commission’s OPC 192 .

A balanced approach is also ensured in terms of burdens on national authorities. The focus on the enforcement of EU law (unlike the discarded option based on Article 153 TFEU) means that individual reports about issues that are not related to the public interest would not be encouraged, as they would not be considered protected disclosures.

7.3    Measures of whistleblower protection granted by the preferred option

The Directive would in one single instrument introduce the minimum common standards set out in detail in Section 5.1, summarised under the main categories:

oObligations to establish reporting channels; 

oSafeguards for the reporting and the concerned persons; 

oProtection of reporting persons against retaliation; 

oEnsuring the effectiveness of the framework for protection of whistleblowers.

The Communication would promote good practices at national level and set out flanking measures to be taken by the Commission, so as to significantly contribute to ensuring the effectiveness of the whistleblower protection.

7.4    Proportionality of the preferred option

The preferred option is consistent with the principle of proportionality:

·The Impact Assessment shows that enhancing protection of whistleblowers will have an overall positive impact on the enforcement of EU law and the revenues of the EU through an increased detection of fraud of VAT, customs and other EU revenues;

·The main current gaps at national and EU level resulting in a fragmented and obscure system not providing for an effective protection of whistleblowers will be addressed;

·The costs of implementation (i.e. compliance with the requirement to establish internal channels) for the medium-sized and large businesses are to be considered minimal (see Section 7.7), while the benefits in terms of competitiveness and compliance with the law Appear to be substantial. Small and micro-companies will be exempted from the obligation to establish internal reporting channels 193 . Potential whistleblower working for those types of companies will be nevertheless protected and will be able to report externally to national authorities directly;

·Administrative costs for Member States will be relatively small due to the low cost of implementation of the legal provisions, since a large majority of Member States already have in place a sectorial legal framework and competent authorities, where applicable. Non-regulatory measures facilitating an effective implementation of the legislative instrument will also contribute to reducing this type of costs;

7.5    Legal basis of the preferred option

The Directive under the preferred option will be based on Articles 114(1) and 325 TFEU in combination with Articles 16, 33, 43, 50, 53(1), 62, 91, 100, 103, 109, 168, 169, 192 and 207 TFEU and the provisions of the Treaty establishing the European Atomic Energy. These legal bases would allow to enhance the enforcement of Union law:

(I)by introducing new provisions of whistleblower protection so as to safeguard the proper functioning of the internal market, the correct implementation of Union policies related to product safety, transport safety, protection of the environment, food safety, animal health and welfare, public health, consumer protection, protection of privacy and personal data and security of network and information systems, and the financial interests of the Union;

(II)to ensure consistent high standards of whistleblower protection in sectorial Union instruments where relevant rules already exist.

7.6    Coherence with existing and future EU rules 

Existing EU sectorial rules on whistleblower protection seek to encourage whistleblowing as a means of improving enforcement of EU law in the areas concerned by essentially requiring Member States:

(I)to establish channels for reporting violations of the relevant rules guaranteeing, amongst others, confidentiality for the individuals concerned;

(II)to take measures for the protection of whistleblowers from employment-related retaliation, referring to threats or hostile action, adverse or discriminatory employment actions and other types of unfair treatment.

The Directive would reinforce the protection provided in all these instruments.

Finally, while the preferred option covers areas where, based on the data currently available, strengthening whistleblower protection is justified to enhance enforcement of EU law, this coverage may need to be reviewed in the future. To ensure that the scope of the Directive under the preferred option remains up to date, the Commission would monitor any possible need, in any future Union law where whistleblower protection is relevant and could contribute to more effective enforcement, to extend its scope to further areas or Union acts. If evidence emerges which substantiates the need for extending whistleblower protection also to other areas and legislative acts (including future acts), the Directive will allow for the necessary flexibility, by providing for a review process. This will also be given consideration when the Commission reports on implementation of the Directive, explained under Section 8 of this Impact Assessment.

7.7    Impact on SMEs

Under the preferred option, while whistleblowing protection is offered to all persons in a work-based context reporting information within the scope of application of the Directive, the obligation to establish internal channels in the private sector would be imposed only to medium-sized and large businesses.

The fact that small and micro companies are exempted from including internal channels does not entail that individuals working in those types of businesses would not be protected. Rather, due to the size of the company, it is more adequate for the individual to directly report externally to competent authorities.

The costs/benefits analysis of the preferred option 196 for medium-sized companies can be summarised as follows:

·Average costs per medium sized enterprise can be broken down into two types: average implementation cost (one-off) amounting estimated at EUR 1,374 and average annual operational cost estimated at EUR 1,054.6 197 .

·While overall costs appear significant, the individual cost per business does not appear to be highly burdensome in economic terms (with incremental annual costs estimated at less than 0.01% for the average EU added value medium-sized enterprise turnover in all Member States) 198 .

·The benefits on the other hand are expected to be highly counted. The employers will benefit from improved disclosure of violations of EU law and the long-run performance and productivity gains associated with good governance standards, where now they are lacking. Moreover, the working conditions will improve, which for workers means higher feeling of security and transparency and thus higher health and wellbeing. An enhanced system of protection of whistleblowers will generally result in a reduction of costs generated by fraud, bribery and lack of legal compliance, which overall increases the competitiveness in the Internal Market.

8.Monitoring and Evaluation

In the proposed legislation, the Commission will include a commitment to submit an implementation report assessing the situation of transposition to the European Parliament and the Council 2 years after the deadline of transposition. This will ensure that there is a sufficient period of time to evaluate the new legislation and that data is collected to determine the level of implementation of Member States as well as the effective EU added value.

An additional report evaluating the effectiveness, efficiency and overall coherence in enforcing EU law would be submitted 6 years after the deadline for transposition, taking into account the implementation report cited above and statistics submitted annually by Member States. The report shall allow for a review also as regards the material scope of application of the Directive. This way, if, in the future, evidence comes to the fore substantiating the need for whistleblower protection as a means of strengthening the enforcement of Union law also in other areas and legislative acts (including future acts) the Commission will consider, within this report, the need for additional measures, including, where appropriate, amendments with a view to extending whistleblower protection to further areas or Union acts

In order to carry out an evaluation in this regard, benchmarks are established to reflect progress both in the transposition and in the implementation of the future Directive:

üBenchmark as regards the state of transposition of the Directive in the Member States between years 1 to 3, after the transposition deadline: 30% of the Member States should correctly transpose and implement the Directive. This benchmark will be mainly measured based on the transposition report due on the second year after transposition as well as the reports coming from the civil society organisations and internal organisations

üBenchmark as regards the increase of the number of reports between years 1 to 5 after the deadline of transposition: 10% increase of the number of reports. This benchmark will be mainly measured based on the annual data submitted by the Member States and complemented with the data provided by other actors, such as OLAF.

üBenchmark as regards the outcome of the whistleblower cases reported, particularly as regards cases of retaliation: a decrease of retaliation cases 5-10% from year 1 to 5 after transposition deadline. This benchmark will be mainly measured based on the annual data submitted by the Member States and complemented with the data provided by other actors, such as OLAF.

üBenchmark as regards perceptions on the futility of reports as established in the EU Eurobarometer on Corruption: 10% decrease from years 1-5 after transposition deadline.

üBenchmark as regards the awareness of citizens on the existence of a system of whistleblowing protection and where to report in their Member State: 10% increase from years 1-5 after transposition deadline.

Benchmarks cannot be established as regards the baseline scenario since currently Member States do not – or very rarely – collect data on whistleblower protection. Therefore benchmarks are established from the first year after the transposition deadline.

In order to feed the future implementation report and to assess the targeted benchmarks, the future Directive will include an obligation to Member States to collect data on the number of whistleblowers reports, on the numbers of procedures triggered as a result of reporting by whistleblowers, on the areas of law concerned, as well as on the outcome of the procedures and their economic impact in terms of recovery of funds and on reported cases of retaliation. This set of data will in turn feed the current reports of OLAF and could be complemented by the reports of EPPO and the EU Ombudsman.

Secondly, the above data collection will be complemented by other relevant sources of data, such as the Commission’s Eurobarometer on Corruption and the implementation reports of the existing EU sectorial legislation providing whistleblower protection.

Finally, other tools provided by external stakeholders, such as NGOs, think tanks and consultants, will also be used, if relevant. Independent academic research and studies on whistleblowing in the EU can usefully complement the data collection exercise in order to have a contextualised set of information.

Furthermore, in the evaluation report the Commission would include a list in which its specified: a) between years 1 to 5 of transposition, the Union instruments not included in the Directive that had included a reference to the applicability of the Directive and (ii) list of areas that would need to be included in the scope of application of the Directive, since there is a need to enhance enforcement and whistleblowing protection is yet not provided in that area. For point (ii), in order to determine the areas, the Commission could base its assessment in the sectorial reports on implementation or impact assessments.

All these tools and gathering of data would enable the Commission to evaluate the effectiveness and efficiency of the new system of protection of whistleblowers, contributing to the general assessment of whether support on implementation is further needed in order to ensure an effective, proportionate and dissuasive action against violations of EU law.

Table 8.1. Monitoring of specific and operational objectives

(1)      2016/2224(INI).

(2)       http://www.consilium.europa.eu/en/press/press-releases/2016/10/11-ecofin-conclusions-tax-transparency/

(3)    For instance, at the second Annual Colloquium on Fundamental Rights on "Media pluralism and Democracy" in November 2016, key stakeholders highlighted that whistleblowers need confidentiality of their communications with journalists, but also that if their identity is revealed (which is increasingly the case as a result of surveillance and metadata analysis) they need protection against retaliation;. http://ec.europa.eu/information_society/newsroom/image/document/2016-50/2016-fundamental-colloquium-conclusions_40602.pdf

(4)      A petition launched by Eurocadres gathered over 81,000 signatures and the support of over 80 relevant organisations https://act.wemove.eu/campaigns/whistleblowers

(5)      In its Communication of 5 July 2016 on further measures to enhance transparency and the fight against tax evasion and avoidance (COM (2016) 451).

(6)       https://ec.europa.eu/commission/state-union-2016_en

(7)       https://ec.europa.eu/info/test-strategy/strategy-documents_en

(8)      2017/C 18/02.

(9)      Communication of 8.12.2010 "Reinforcing sanctioning regimes in the financial services sector".

(10)       https://ec.europa.eu/info/publications/2017-european-semester-country-specific-recommendations-commission-recommendations_en

(11)      See Annex 7 on relevant provisions and guidelines at international level.

(12)       https://www.coe.int/t/dghl/standardsetting/cdcj/CDCJ%20Recommendations/CMRec(2014)7E.pdf  

(13)      The Member States offering comprehensive protection are France, Hungary, Ireland, Italy, Lithuania, Malta, the Netherlands, Sweden, Slovakia and the United Kingdom. In Cyprus and Latvia whistleblowers have practically no protection and in the remaining 17 Member States whistleblowers are only partially protected (i.e. only in certain sectors, such as financial services or only in the public sector or only against limited forms of retaliation). Annex 6 provides a detailed analysis of national systems of protection.

(14)

      http://ec.europa.eu/newsroom/just/item-detail.cfm?item_id=54254  

(15)      The 1998 UK law on whistleblowing was adopted in the wake of major incidents, where the official enquiries revealed that workers had known about the malpractice which had caused them but had been too scared to speak up. The 2014 Irish law was adopted in response to the Irish banking crisis and the Mahon enquiry (the biggest public enquiry ever held in Ireland, lasting from 1997 to 2012), related to corruption of politicians and public servants linked to planning permissions.

(16)      Fraud is a deliberate act of deception intended for personal gain or to cause a loss to another party.

(17)      Corruption takes many forms, such as bribery, trading in influence, abuse of functions, but can also hide behind nepotism, conflicts of interest, or revolving doors between the public and the private sectors. Although its nature and scope may differ from one Member State to another, it harms the EU as a whole by lowering investment levels, hampering the fair operation of the internal market (by creating business uncertainty, slowing processes, and imposing additional costs) and reducing public finances.

(18)      Directive (EU) 2017/1371, of the European Parliament and of the Council, of 5 July 2017, on the fight against fraud to the Union's financial interests by means of criminal law.

(19)      See, for example, channels established by the OLAF to report about information on fraud or other serious irregularities with a potentially negative impact for EU public funds.

(20)      PWC (2007) Economic crime: people culture and controls, the 4th biennial Global Economic Crime Survey, http://www.whistleblowers.org/storage/documents/pwc_survey.pdf  

(21)      Association of Certified Fraud Examiners, Global Fraud Study 2016. Summary available on-line at http://www.acfe.com/rttn2016/about/executive-summary.aspx#  

(22)      US Department of Justice, ‘Justice Department Recovers $ 2.4 Billion in False Claims Cases in Fiscal Year 2009; More than $ 24 Billion Since 1986’, Press Release, 19 November 2009,     http://www.justice.gov/opa/pr/2009/November/09-civ-1253.html

(23)      Kroll (2014 and 2016), Global Fraud Report. New York: Kroll.

(24)      Public Concern at Work (2010): Where’s whistleblowing now? 10 years of legal protection for whistleblowers, page 15, available at: https://www.pcaw.org.uk/content/4-law-policy/4-document-library/report-10-year-where-s-whistleblowing-now-10-year-review-of-pida.pdf  

(25)      2017 report of the Italian Anti-corruption agency, available at: http://www.ufwhistleblowing.it/wp-content/uploads/2017/06/ANAC_WB_Rapporto_2017  

(26)      Transparency International, Speak up report 2017, page 6, available at: https://transparency.ie/sites/default/files/17.12.13_speak_up_report_ie_final.pdf

(27)      The right to freedom of expression is enshrined in Article 10 of the European Convention on Human Rights (ECHR) – to which all EU Member States are parties – and in Article 11 of the Charter. According to Article 52(3) of the Charter "in so far as this Charter contains rights which correspond to rights guaranteed by the Convention for the Protection of Human Rights and Fundamental Freedoms, the meaning and scope of those rights shall be the same as those laid down by the said Convention". The interpretation of the right to freedom of expression enshrined in Article 10 ECHRs therefore binding as regards the interpretation of the same right enshrined in Article 11 of the Charter.

(28)      Besides the Recommendation of the Council of Europe, see for instance UNODC (2015) Resource Guide on Good Practices in the Protection of Reporting Persons https://www.unodc.orgsuppli/documents/corruption/Publications/2015/15-04741_Person_Guide_eBook.pdf ; OECD 2010 Good practice guidance on internal controls, ethics and compliance; Transparency International (2013) “International principles for whistleblower legislation”.

(29)

The 2016 Global Business Ethics Survey, conducted with more than 10,000 workers in the private and public sector in 13 countries (amongst France, Germany, Italy, Spain and the UK) found that employees in supplier companies (i.e. companies that supply goods or services to other organisations) were more likely to observe bribery and corruption (20%) than employees in non-supplier companies (12%).

(30)      Such as action for restoring a cancelled licence, permit or contract; compensation for other suffering incurred, for instance for financial loss, or award of damages for suffering or pain caused.

(31)      This approach is also taken by Member States. For example, Section 43K of PIDA grants protection to employees, as well as certain workers, contractors, trainees and agency staff who raise concerns about wrongdoing, risk or malpractice which it is in the public interest to disclose.

(32)      Views to be found in Brown, A.J. (2013). Towards “Ideal” Whistleblowing Legislation? Some Lessons from Recent Australian Experience. E-Journal of International and Comparative Labour Studies 2(3), pp 153–82.

(33)      Technologia (2015) Fraudes, malversations, lanceurs d’alerte… Comment réagissent les salariés français? http://www.technologia.fr/blog/wp-content/uploads/2015/12/LanceursdAlerteDef.pdf

(34)      Public Concern at Work (2013) Whistleblowing: the inside story. A study of the experiences of 1,000 whistleblowers http://www.pcaw.org.uk/content/4-law-policy/4-document-library/Whistleblowing-the-inside-story-FINAL.pdf  

(35)      Ibid.

(36)      Lewis, D., D’Angelo A., Clarke, L. (2015) The independent review into creating an open and honest reporting culture in the NHS, quantitative research report, Surveys of NHS staff, trusts and stakeholders

(37)       https://ec.europa.eu/taxation_customs/sites/taxation/files/platfrom_wistlebolowers.docx.pdf  

(38)      See report available at: http://ec.europa.eu/commfrontoffice/publicopinion/index.cfm/Survey/getSurveyDetail/instruments/SPECIAL/surveyKy/2176

(39)      A more extensive analysis is provided in Annex 8.

(40)      Ibid. footnote 36.

(41)      Transparency International (2015), “Lanceurs d’alerte”: quelle perception de la part des salariés? https://transparency-france.org/wp-content/uploads/2016/04/R%C3%A9sultats-sondage-Harris-Interactive.pdf  

(42)      Investigation into the Clapham Junction railway accident. Anthony Hidden, Q.C. 1989     http://www.railwaysarchive.co.uk/documents/DoT_Hidden001.pdf , accessed on 6 July 2017.

(43)    Cullen, The Hon. Lord W. Douglas (1990), The public inquiry into the Piper Alpha disaster. London: H.M. Stationery Office.

(44)    Transparency International (2013), “Whistleblowing in Europe: Legal protections for whistleblowers in the EU”: https://www.transparency.org/whatwedo/publication/whistleblowing_in_europe_legal_protections_for_whistleblowers_in_the_eu .

(45)    ECI (2016), Global Business Ethic Survey, Measuring Risk and Promoting Workplace Integrity http://www.boeingsuppliers.com/2016_Global_Ethics_Survey_Report.pdf . The Global Business Ethic Survey is industry-financed.

(46)       http://www.world-psi.org/sites/default/files/documents/research/en_whistleblower_protection.pdf

(47)       http://www.world-psi.org/sites/default/files/documents/research/en_whistleblower_protection.pdf

(48)      See for instance UNODC (2015) Resource Guide on Good Practices in the Protection of Reporting Persons https://www.unodc.org/documents/corruption/Publications/2015/15-04741_Person_Guide_eBook .pdf ; Council of Europe 2014 Recommendation; OECD (2016)

(49)      Dorssemont, F., Lorcher, K., Schomann, I., (2013): The European Convention on Human Rights and the Employment Relation (2013), Hart Publishing, Oxford; page 240. Vogt v. Germany 17851/91, judgment of 26 September 1995; Fuentes Bobo v. Spain, 39293/98, judgment of 29 February 2000; D. Otto v. Germany, 27547/02, judgment of 24 November 2005; T. Lahr v. Germany, 16912/05, judgment of 1st July 2008; Heinisch v. Germany, 28274/08, judgment of 11 July 2011.

(50)    Milieu (2017). As an example of such a case, a controller at the National Forestry Centre in Slovakia, who had reported, in 2010, the intended misuse of public funds in the tendering of a project in the value of EUR 700,000, was fired and remained unemployed for years as she could not find work in other companies. It was only in 2016 that the courts made a final decision that her dismissal was illegal. She was later offered to return to the Centre, but not as a comptroller.

(51)      See in detail in Annex 8.

(52)    On the key aspects of a comprehensive protection provided by the Council of Europe, see Annex 7.

(53)    Annex 6 provides a comparative analysis of the different national systems of whistleblower protection based on key elements of protection as provided by the Council of Europe.

(54)      The Commission’s OPC investigated the significance of factors that raise awareness of whistleblower rights and procedures for effective whistleblower protection. One of the two factors most commonly selected were a clear definition in law of the threats to public interest covered by whistleblower protection (75% of individuals and 63% of organisations).

(55)      The protection provided by Member States' laws is in most cases limited to their own jurisdiction or to employment contracts under their own law. There are some exceptions in countries such as UK and Ireland, whose laws apply to workers with UK/Irish employment contracts regardless of the geographical location of the malpractice and regardless of whether the breach of a legal obligation arises under their law or the applicable law of another country.

(56)      According to the information provided in the ICF study (Annex 13), large businesses under the jurisdiction of third-country legislation (e.g. US-listed firms) may be compelled to have whistleblower arrangements when operating in the EU even if that is not required in the Member State where they operate.

(57)      See Annex 6 for a detailed analysis.

(58)      See footnote 38.

(59)      See ICF's Study for more details (Annexes 13-14).

(60)      Transparency International (2013), Whistleblowing in Europe: Legal protections for whistleblowers in the EU.

(61)      See also the Nyberg Report which investigated the causes of the collapse of the banking sector in Ireland, and identified the ostracism that workers and potential whistleblowers faced as contributing to the underlying causes of the crisis: “there may have been a strong belief in Ireland that contrarians, non-team players, fractious observers and whistleblowers would be informally (though sometimes even publicly) sanctioned or ignored, regardless of the quality of their analysis or their place in organisations; Nyberg Report (2011), Misjudging risks: causes of the systemic banking crisis in Ireland. Report to the Commission of investigation into the banking sector in Ireland      http://www.bankinginquiry.gov.ie/Documents/Misjuding%20Risk%20-%20Causes%20of%20the%20Systemic%20Banking%20Crisis%20in%20Ireland.pdf

(62)      All these instruments are presented in detail in Annex 6.

(63)      Directive (EU) 2015/849 of the European Parliament and of the Council of 20 May 2015 on the prevention of the use of the financial system for the purposes of money laundering or terrorist financing, amending Regulation (EU) No 648/2012 of the European Parliament and of the Council, and repealing Directive 2005/60/EC of the European Parliament and of the Council and Commission Directive 2006/70/EC and Regulation (EU) 2015/847 of the European Parliament and of the Council of 20 May 2015 on information accompanying transfers of funds and repealing Regulation (EC) No 1781/2006 (OJ L 141, 5.6.2015, p. 1–18).

(64)      Where these instruments are addressed to Member States and relevant legal bases are compatible.

(65)      According to Article 325 TFEU, the obligation to protect the Union's financial interests is shared between the EU and the Member States and therefore the power of investigation of EU bodies also encompass the enforcement of national law not linked with EU law (for example national law, against VAT fraud not directly implementing EU legislation). See further explanations at https://ec.europa.eu/anti-fraud/about-us/mission_en

(66)      RAND (2016), The Cost of Non-Europe in the area of Organised Crime and Corruption, Annex II – Corruption, http://www.europarl.europa.eu/RegData/etudes/STUD/2016/579319/EPRS_STU%282016%29579319_EN.pdf .  

(67)    EY (2016), Corporate misconduct – individual consequences,     http://www.ey.com/Publication/vwLUAssets/EY-corporate-misconduct-individual-consequences/$FILE/EY-corporate-misconduct-individual-consequences.pdf .

(68)      Information provided in the impact assessment for an initiative to protect the financial interests of the EU, http://europa.eu/rapid/press-release_IP-13-709_en.htm .  

(69)    Annex 10 details further data on fraud and corruption against the EU budget.

(70)    OLAF Report 2016, https://ec.europa.eu/anti-fraud/sites/antifraud/files/olaf_report_2016_en.pdf . This figure is not a direct indication of the overall level of fraud in EU spending, but rather a conservative estimate, given that the level of recovery recommended by OLAF depends on the scope and scale of the investigations concluded in a given year.

(71)    The Staff Regulations of officials and Conditions of Employment of other servants of the European Union include, since 2004, rules on whistleblowing, setting out procedures for reporting any fraud, corruption or serious irregularity, and providing protection to whistleblowers from adverse consequences.

(72)    Council Regulation (EU) 2017/1939 implementing enhanced cooperation on the establishment of the European Public Prosecutor's Office (the "EPPO Regulation"), recital 50.

(73)     https://www.eca.europa.eu/Lists/ECADocuments/AB_FRAUD_RISKS/AB_FRAUD_RISKS_EN.pdf  

(74)    The VAT gap is an approximation of the government revenue lost to tax evasion and tax avoidance (but also includes bankruptcies, financial insolvencies and miscalculations) https://ec.europa.eu/taxation_customs/business/tax-cooperation-control/vat-gap_en  

(75)    European Commission - Press release VAT Gap: Nearly €160 billion lost in uncollected revenues in the EU in 2014 Brussels, 6 September 2016 http://europa.eu/rapid/press-release_IP-16-2936_en.htm

(76)      Study by EY, 2015, Implementing the ‘destination principle’ to intra-EU B2B supplies of goods: https://ec.europa.eu/taxation_customs/sites/taxation/files/docs/body/ey_study_destination_principle.pdf

(77)     https://ec.europa.eu/taxation_customs/business/tax-cooperation-control/vat-gap_en .

(78)    In the area of public procurement, every year over 250,000 public authorities in the EU spend around 14% of GDP on the purchase of services, works and supplies.

(79)    See for example Directive 2014/24/EU of the European Parliament and of the Council of 26 February 2014 on public procurement.

(80)    Milieu (2017), on “Estimating the economic benefits of whistleblower protection in public procurement” https://publications.europa.eu/en/publication-detail/-/publication/8d5955bd-9378-11e7-b92d-01aa75ed71a1/language-en  

(81)

      http://www.jonesday.com/European-Commission-Launches-Competition-Law-Anonymous-Whistleblower-Tool-04-25-2017/?RSS=true

(82)    For instance, taxpayers may benefit from low tax rates or double deductions or ensure that their income remains untaxed by making it deductible in one jurisdiction whilst this is not included in the tax base across the border either. The increased mobility of capital and persons in the internal market exacerbates the opportunities for taking advantage of the way that disparate national tax systems interact with each other

(83)    Multinational enterprises in high tax countries pay around 30% less tax than comparable domestic firms and benefit from a competitive cost advantage that can allow them to gain market shares and raise entry barriers to the detriment of other firms. https://ec.europa.eu/info/sites/info/files/file_import/european-semester_thematic-factsheet_curbing-agressive-tax-planning_en.pdf

(84)     http://www.oecd.org/tax/oecd-urges-stronger-international-co-operation-on-corporate-tax.htm .

(85)

   Data gathered from European Parliament Study: “Bringing transparency,    coordination and convergence to corporate tax policies in the European Union – I -Assessment of the magnitude of aggressive corporate tax planning at:

http://www.europarl.europa.eu/RegData/etudes/STUD/2015/558773/EPRS_STU%282015%29558773_EN.pdf .Taxpayers may try to reduce their tax bill by moving their tax residence and/or assets to a low-tax jurisdiction. Such practices distort the market because they erode the tax base of the State of departure and shift future profits to be subject to tax in the low-tax jurisdiction of destination. If taxpayers move their tax residence out of a certain Member State, this State will be deprived of its future right to tax revenues of these taxpayers, which in turn affects the overall EU budget since Member States contributions are lower.

(86)

      http://www.europarl.europa.eu/cmsdata/111503/Riondet%20Europol%20QA%20edited.pdf . 

(87)    The study focused on a sample of eight Member States: Cyprus, Czech Republic, Denmark, France, Germany, Poland, Spain and United Kingdom. The study methodology was based on desk research, stakeholder interviews in Member States and microeconomic simulations using the OECD Orbis dataset which contains financial data for over 44 million globally. The study does not estimate the tax revenue impact of the schemes revealed in the Panama Papers but makes estimates on similar schemes.

(88)    The study provided a ‘conservative’ estimate that 1.5 million jobs could have been created with the budget lost by national authorities. Starting from the average revenue loss of EUR 173 billion, assuming an average of EUR 50,000 cost per job and 1:1 basis into government expenditure to create jobs an additional 3.5 million jobs could have been created with the lost revenue.

(89)     https://www.publicintegrity.org/2016/12/01/20500/panama-papers-have-had-historic-global-effects-and-impacts-keep-coming , https://www.publicintegrity.org/2016/12/01/20500/panama-papers-have-had-historic-global-effects-and-impacts-keep-coming ; https://www.theguardian.com/news/2016/dec/01/panama-papers-europol-links-3500-names-to-suspected-criminals ; http://www.europarl.europa.eu/cmsdata/111503/Riondet%20Europol%20QA%20edited.pdf  

(90)    Council Directive 2011/16/EU of 15 February 2011 on administrative cooperation in the field of taxation and repealing Directive 77/799/EEC(as amended).

(91)    Council Directive (EU) 2016/1164 of 12 July 2016 laying down rules against tax avoidance practices that directly affect the functioning of the internal market (as amended); Proposal for a Council Directive on a Common Consolidated Corporate Tax Base, COM/2016/0683 final - 2016/0336; Proposal for a Council Directive on a Common Corporate Tax Base, COM/2016/0685 final - 2016/0337.

(92)    Johannesen, N, and Stolper, T.B.M., (2017), The deterrence effect of whistleblowing – an event study of leaked customer information from banks in tax havens,     http://voxeu.org/article/deterrence-effect-whistleblowing

(93)    Commission Environmental Implementation Review http://ec.europa.eu/environment/eir/country-reports/index_en.htm .

(94)    Combined estimates from the OECD, the UN Office on Drugs and Crime, UNEP and INTERPOL on the monetary value of all environmental crime show that it is the 4th largest international crime.

(95)    According to the report of the 2018 Commission Communication on EU actions to improve environmental compliance and governance, the number of complaints per year is around 600 or higher. http://ec.europa.eu/environment/legal/pdf/COM_2018_10_F1_COMMUNICATION_FROM_COMMISSION_TO_INST_EN_V8_P1_959219.pdf  

(96)     http://ec.europa.eu/environment/enveco/economics_policy/pdf/report_sept2011.pdf . The cost elements include, amongst others, environmental and health costs, unrealized benefits in the green industries, market distortions and administrative costs for industry.

(97)     http://efface.eu/sites/default/files/publications/PB%203%20Case%20Study%20Policy%20Brief%20-%20Waste%20-%20UniRoma.pdf  

(98)    The “Land of Fires” case in Campania (Italy) is an example of the illegal dumping of toxic waste perpetrated in the 1980s and 1990s by organised crime, http://efface.eu/sites/default/files/publications/EFFACE_synthesis-report_final_online.pdf

(99)    The plant has not always been fully compliant with health and safety and environmental regulations, releasing pollutants with environmental impacts on the air, soil and water as well as on the health of workers and people living in the area and leading to action by Italian authorities and the Commission.

(100)    Lucifora, A., Bianco, F., Vagliasindi, G.M., (2015), Environmental and corporate miscompliance: A case study on the ILVA steel plant in Italy.

(101)

   These actions, which will be implemented over 2018-2019, aim to help inspectors and law officers to combine forces, encourage professional training and improve information to Member States and practitioners. http://ec.europa.eu/environment/pdf/19_01_2018_news_en.pdf  

(102)    The Directive on safety of offshore oil and gas operations underlines the importance of establishing and encouraging adequate means for confidential reporting and the protection of whistleblower to ensure that no safety concerns are overlooked or ignored, in order to reduce the occurrence of major accidents. This increases the protection of the marine environment and coastal economies against pollution.

(103)    The case was reported by researchers to US authorities, while investigations point to the fact that internal reporting was made but not-followed up.

(104)     https://phys.org/news/2017-09-dieselgate-deaths-europe-year.html#jCp

(105)    Directive 2001/95/EC of the European Parliament and of the Council of 3 December 2001 on general product safety.

(106)    See wide EU legislation on product requirements addressed to manufacturers: https://ec.europa.eu/growth/single-market/ce-marking/manufacturers_en  

(107)    Contribution to the public consultation on the Internal market for goods – Compliance and Enforcement initiative to reduce the number of non-compliant products in the Single market, November 2016, IndustriAll trade Union, see also: https://news.industriall-europe.eu/Article/64  

(108)     http://www.nytimes.com/2010/09/19/business/19autos.html  

(109)     http://www.bbc.com/news/health-16391522  

(110)     https://www.kmblegal.com/resources/consumer-product-safety  

(111)      Council Directive 91/477/EEC on control of the acquisition and possession of weapons; Regulation (EU) No 258/2012 implementing Article 10 of the United Nations’ Protocol against the illicit manufacturing of and trafficking in firearms, their parts and components and ammunition, supplementing the United Nations Convention against Transnational Organised Crime (UN Firearms Protocol), and establishing export authorisation, and import and transit measures for firearms, their parts and components and ammunition.

(112)    Data retrieved from Euromonitor International: (2015). “Tobacco Industry Illicit Trade Penetration”.

(113)    Council Directive 2011/64/EU, of 21 June 2011, on the structure and rates of excise duty applied to manufactured tobacco.

(114)    Directive 2014/40/EU on the approximation of the laws, regulations and administrative provisions of the Member States concerning the manufacture, presentation and sale of tobacco and related products.

(115)     http://eur-lex.europa.eu/legal-content/en/TXT/?uri=CELEX:52013SC0274  

(116)

      https://www.legifrance.gouv.fr/affichJuriJudi.do?idTexte=JURITEXT000032450774

(117)    OECD (2016), Committing to Effective Whistleblowers Protection,     http://www.oecd.org/corporate/committing-to-effective-whistleblower-protection-9789264252639-en.htm  

(118)    https://www.raps.org/regulatory-focus%e2%84%a2/news-articles/2017/4/ema-board-adopts-new-policy-on-whistleblowing

(119)     http://www.ema.europa.eu/docs/en_GB/document_library/Other/2017/03/WC500224494.pdf  

(120)      Regulation (EC) No 178/2002 of the European Parliament and of the Council of 28 January 2002 laying down the general principles and requirements of food law, establishing the European Food Safety Authority and laying down procedures in matters of food safety, (OJ L 31, 1.2.2002, p.1).

(121)      Commission Staff Working Document, "The REFIT evaluation of the General Food Law (Regulation (EC) No 178/2002)", SWD(2018)38 final, dated 15.1.2018.

(122)     https://ec.europa.eu/food/safety/rasff/fipronil-incident_en

(123)    http://www.dw.com/en/whistleblowers-in-germany-loved-hated-poorly-protected/a-19228525

(124)     https://www.food.gov.uk/sites/default/files/multimedia/pdfs/incidents-report-2012.pdf  

(125)      Deiseroth, D. (2001): “Whistleblowing in Zeiten von BSE: der Fall der Tierärztin Dr. Margrit Herbst”

(126)    For example, in February 2018, Belgian supermarket chains stopped deliveries from a Spanish pork giant following revelations of shocking animal abuse http://www.independent.co.uk/news/uk/home-news/morrisons-amazon-uk-spanish-sausages-el-pozo-pigs-animal-equality-animal-welfare-farming-a8195571.html; http://www.xpats.com/belgian-supermarkets-pull-ham-following-photos-animal-abuse ; also see case reported in France on violation of rules on space and sanitary requirements, http://www.lemonde.fr/planete/article/2017/05/30/nouveau-scandale-sanitaire-dans-un-elevage-de-160-000-poules-pondeuses_5135716_3244.html ; in 2018 in Spain a case of animal suffering involving “deformed, diseased and dying” pigs in a centre producing meat products, http://www.independent.co.uk/news/uk/home-news/morrisons-amazon-uk-spanish-sausages-el-pozo-pigs-animal-equality-animal-welfare-farming-a8195571.html  

(127)    UK Department of Transport, mv Herald of Free Enterprise, Report of Court No. 8074, Formal Investigation, 1987, pp. 13-14, www.maib.gov.uk/cms_resources.cfm?file=/hoffefinal.pdf .; Public Concern at Work, UK Submission to Transparency International Whistleblower Protection Research Project (UK: January 2013), pp. 1, 15.

(128)      The report of the Rail Accident Investigation Branch (RAIB) available at: https://www.gov.uk/raib-reports/overturning-of-a-tram-at-sandilands-junction-croydon  

(129)      Regulation (EU) 2016/679 of the European Parliament and of the Council of 27 April 2016 on the protection of natural persons with regard to the processing of personal data and on the free movement of such data, and repealing Directive 95/46/EC (General Data Protection Regulation), (OJ L 119, 4.5.2016, p. 1–88).

(130)      Directive 2002/58/EC of the European Parliament and of the Council of 12 July 2002 concerning the processing of personal data and the protection of privacy in the electronic communications sector (OJ L 201, 31.07.2002, p. 37–47).

(131)      The Trump campaign was allegedly able to harvest raw data from up to 87 million Facebook profiles to direct its messaging and influence voters.

(132)      PWC, Global State of Information Security Survey, 2016 and http://news.sap.com/pwc-study-biggest-increase-in-cyberattacks-in-over-10-years/

(133)      Directive (EU) 2016/1148 of the European Parliament and of the Council of 6 July 2016 concerning measures for a high common level of security of network and information systems across the Union

(134)      Annex II of the NIS Directive covers entities active in the sectors of electricity, oil, gas provision, air transport, rail transport, water transport, road transport, banking, financial market infrastructures, health sector, drinking water supply and distribution, digital Infrastructure.

(135)      Annex III of the NIS Directive covers entities providing online marketplace, online search engine and cloud computing service.

(136)      For instance, by enabling operators to voluntary notify cyber-security incidents.

(137)       https://www.nytimes.com/2017/10/03/technology/yahoo-hack-3-billion-users.html  

(138)      The Member States currently in the process of preparing legislation/amending their existing one: BE, BG, CZ, HR, EL, ES, LV, PL and SK.

(139)      Recent attempts to adopt new legislation in Bulgaria, Denmark and Germany were unsuccessful.

(140)      For instance, the amendments to the Belgian Federal law on Integrity and Ethics currently pending before the parliament would only extend the personal scope of the law–which only applies to public servants – to the police sector.

(141)      Nonetheless, any policy initiative to strengthen whistleblower protection is bound to have positive effects on freedom of expression as well as on the respect of other fundamental rights, in the context of implementation of EU law

(142)      For a specific analysis on the legal bases, see Annex 9. Depending on the scope of application of the future initiative, they could be combined with Treaty articles related to other areas, such as Articles 16, 33, 43, 50, 53(1), 62, 91, 100, 103, 109, 168, 169, 192 and 207 TFEU and the provisions of the Treaty establishing the European Atomic Energy

(143)      Some of the principles contained in the Council of Europe Recommendation are not taken up, as they are not relevant for the EU legislator but rather addressed to the national ones (for instance, on providing a special scheme for reporting information related to national security – Principle 5 –).

(144)      These include standards reflected in the UN Convention against Corruption, in the G20 Compendium of best practices and guiding principles for legislation on the protection of whistleblowers and in the OECD (2016) Report Committing to Effective Whistleblowers Protection.

(145)      A table presenting in detail the correspondence with the principles of the Council of Europe Recommendation can be found in Annex 12.

(146)      Along these lines, the Parliamentary Assembly of the Council of Europe has asserted that there should be protection from penalty for public disclosures “where internal channels either do not exist, have not functioned properly or could reasonably be expected not to function properly given the nature of the problem raised by the whistleblower”; Resolution 1729, adopted 29 April 2010, arts. 6.1.2, 6.2.3.

(147)      The Council of Europe Recommendation (Principles 8 and 17) encourages internal reporting and reporting to regulators, as they are the ones closest to the problem and best able to address it, but does not establish an order of priority between the different channels, noting that, in the end, the individual circumstances of each case will determine the most appropriate channel. At the same time, according to Principle 24, where an employer has put in place an internal reporting system and the whistleblower has made a disclosure to the public without resorting to the system, this may be taken into consideration when deciding on the remedies or level of protection to afford to the whistleblower.

(148)      Businesses and business associations taking part in the Commission’s OPC and Business Europe (in its position paper of 20 July 2017) argued strongly in favour of a tiered use of channels so that the employer has the opportunity to address the issue before any external disclosure.

(149)      The criteria developed in this case law for determining whether retaliation against whistleblowers making public disclosures interferes with freedom of expression are: whether the person who made the disclosure had at his/her disposal alternative channels for making the disclosure; the public interest in the disclosed information; the authenticity of this information; whether the disclosure is made in good faith; detriment to the employer; the severity of the sanction imposed on the whistleblower and its consequences.

(150)      Such a defence is provided in the form of a “qualified privilege” in some Member States (ex. UK) whilst in others it is even given the title of a "whistleblower status” (ex. Greece).

(151)      An example of such processes is Slovakia’s law, according to which employers may take no action against a “protected reporter” without the employee’s consent as well as permission from the Labour Inspectorate. Employers must demonstrate there is no link between the action and the employee having reported misconduct. The Inspectorate must decide on cases without “undue delay” or within a maximum of 30 days. Employers and employees have the right to appeal. On the other hand, the so-called status of “public interest witness” provided for under Greek law is in fact merely a procedural defence for whistleblowers reporting corruption, in cases of complaints lodged against them for the offences of perjury, false accusation and defamation. The relevant provision of the Code of Criminal Procedure provides that, if the whistleblower provided information that contributes substantially to the revealing and prosecution of corruptions, was not personally involved in any way in the offences and did not aim to benefit him/herself by reporting the wrongdoing, the public prosecutor can designate him as “public interest witness” and abstain from prosecution, if it is deemed that such prosecution would not serve the public interest. This protection is extremely limited, as it only concerns criminal prosecution and not claims for civil damages, for example, for defamation.    

(152)      The obligation of authorities to follow-up on reports can be perceived as a form of protection, as it shifts the burden of responsibility to pursue the matter from the reporting person to the competent authority. Timely and regular feedback is also considered as an important aspect of protection; see UNDOC (2015).

(153)      Whilst EU legislative initiative could oblige national authorities to publicize the relevant rules, promoting awareness raising more generally or training judges and competent authorities could be the subject of recommendations and flanking support measures.

(154)      One Member State that provides for rewards is Slovakia

(155)      By way of example, the report on the review of the UK law on whistleblower protection explicitly states that such a system of rewards "would not change the cultural landscape in a positive way".

(156)      Stakeholders consulted, including whistleblowers themselves, were against introducing such standards at EU level for similar reasons, taking into account also the particularly negative perceptions of whistleblowers in some national contexts, which date back to social and political circumstances resulting in distrust towards ‘informers’. Business associations were also against them on the grounds that they would encourage abusive reports and create mistrust in the workplace.

(157)      ECtHR, No. 28274/08, Case Heinisch v. Germany, Judgement of 21 July 2011, para. 69.

(158)      The options analysed in this impact assessment differ from the options examined in the ICF study (Annex 14), to the extent that the latter are formulated without reference to specific Treaty Articles.

(159)      See in detail above, sections 1 and 2.2.

(160)      See notably the Recommendation of the Council of Europe, the UN Resource guide on good practices in the protection of reporting persons, and position expressed by stakeholders in consultations.

(161)      Combined with Treaty articles related to the relevant specific areas, i.e. Articles 16, 33, 43, 50, 53(1), 62, 91, 100, 103, 109, 168, 169, 192 and 207 TFEU and the provisions of the Treaty establishing the European Atomic Energy

(162)      See Annexes 13 – 14, for the overall results of the study, including Section on costs and benefits.

(163)      See, for example, the report of Milieu on a detailed analysis of the benefits of whistleblowing in the area of public procurement, https://publications.europa.eu/en/publication-detail/-/publication/8d5955bd-9378-11e7-b92d-01aa75ed71a1/language-en , as well as specific information relating to national data provided in the preparatory impact assessments of national legislation on whistle protection in Ireland and Sweden

(164)      See in Section 7.7 a further explanation on the exemption of obligations to small companies.

(165)      According to the information provided by Transparency international to the European Commission, following the adoption of legislation in IE, there was an increase of 240% of the number of individuals requesting for advice.

(166)    The study “Whistleblower laws and corporate fraud: Evidence from the US” (Adriana, S., Cordis, Elizabeth M. Lambert, Department of Accounting, Finance and Economics, Winthrop University, US, 2017) analysed whether whistleblower laws which protect private employees from retaliation are effective for deterring corporate fraud. The comparison was made between US States with different levels of protection and indicated that whistleblower laws that protect private employees reduce the prevalence of corporate fraud by increasing the probability that corporate malfeasance is detected and punished. The deterrent effect of whistleblower laws is broadly consistent with standard arguments from the economic theory of crime.

(167)      See data under Section 2, on national experiences after introducing a comprehensive system of protection.

(168)       http://www.world-psi.org/sites/default/files/documents/research/en_whistleblower_protection.pdf

(169)    Italy was initially included in the gathered by ICF. However, policy options will no longer have a large impact in Italy due to the recent adoption of legislation on 15 November 2017.

(170)      See Annex 14, on the ICF study, Section 6.5.2.

(171)      ICF data on the external study indicates that recovery of revenues through an effective system of protection of whistleblowers could help recovering an amount up to 40% of the total loss.

(172)      European Commission (2014). EU Anti-Corruption Report; RAND (2016), The Cost of Non-Europe in the area of Organised Crime and Corruption, Annex II – Corruption. RAND developed an approach to modelling costs of corruption in terms of lost economic output.

(173)      The impacts on fundamental rights are examined in particular in light of the Fundamental Rights "Check List" in the Communication from the Commission on the Strategy for the effective implementation of the Charter by the European Union (COM (2010)573 of 19 October 2010).

(174)      Any limitations of fundamental rights must be provided for by law, respect the essence of those rights and freedoms, meet objectives of general interest recognised by the Union or the need to protect the rights and freedoms of others and comply with the principle of proportionality, i.e. they must be appropriate and necessary to meet the objective.

(175)

   For example, amongst business associations responding to the Commission’s OPC, support for EU legally binding minimum standards was not as high as amongst other stakeholders’ groups. Out of a total of 40 responses, 20 selected EU legislation as preferred option, 14 solely national law and 5 considered that no legislation is needed. Some business organisations put forward that legislation at EU level would bring an added value to existing national legislation and voluntary company-level compliance measures which already provide sufficient and carefully balanced protection.

(176)    National experts from a large number of Member States which are currently in the process of considering or drafting legislation on whistleblower protection were keen to have the European perspective.

(177)    Participants at the experts’ workshop of 7 June noted, for instance, that non-regulatory measures such as a Commission recommendation would not be suitable or sufficient to address the problems resulting from lack of adequate whistleblower protection.

(178)    The conclusion is drawn from the evolution of the implementation of other non-binding pieces of legislation under international law, such as the 2014 Council of Europe Recommendation.

(179)    See Annex 4 on analytical methods on how this % was calculated.

(180)    The amount is composed by EUR 23 million for development of training materials (internal time costs) and EUR 65 million for delivery of annual training (cost of employee time).

(181)    The costs to employers in Spain are based taking into account national legislation, and do not include an assessment of any regional law on whistleblower protection. Therefore the number of employers affected in Spain may be an over-estimate of the true number.

(182)    For a detailed explanation of the numbers, see Section 6.4 of the ICF report Annex 14.

(183)    These costs would not however affect public bodies and private companies in the same manner in all Member States. For example, the fact that a Member State such as France is closely aligned would not entail costs for the employers located in that Member State.

(184)    Commission’s impact assessment accompanying the proposal for a Directive of the European Parliament and of the Council on criminal sanctions for insider dealing and market manipulation, http://ec.europa.eu/internal_market/securities/docs/abuse/SEC_2011_1217_en.pdf  

(185)    Impact assessment accompanying the proposal for a Directive on safety of offshore oil and gas operations.

(186)    For a detailed explanation of the number, see Section 6.4 of the ICF report – Annex 14.

(187)    This is evidenced by data provided by national authorities responding to the targeted stakeholders' consultation.

(188)      The legislative options retained (as compared to the discarded options) do not present issues in terms of subsidiarity and therefore, subsidiarity has not been included as a criterion to compare the options (i.e. all options would score the same). The trade-offs between the areas covered, the costs and the protection granted in terms of overall citizens covered by the policy option are analysed under the parameter of proportionality.

(189)      The methodology of the external contractor's study is set out in detail in Annex 3 and Annex 15.

(190)      In the US, research estimates that between 1997 and 2001, the ratio of benefits to costs of whistleblower provisions was between 14/1 and 52/1, with a mean of 33/1. While the US system is not identical as in the preferred option and may include additional incentives for whistleblowers, those figures give an idea of the order of magnitude of the net benefits. See available data at: http://www.world-psi.org/sites/default/files/documents/research/en_whistleblower_protection.pdf  

(191)      See Annex 2 for a detailed description on the consultation with stakeholders.

(192)      See the analysis below on SMEs, where costs are not disproportionate and benefits are overall presented in terms of competitiveness and reduction of costs of medium and large businesses operating in different EU Member States linked to compliance of divergent legal systems.

(193)      See for example, the obligations under Directive 2014/56/EU of the European Parliament and of the Council of 16 April 2014 amending Directive 2006/43/EC on statutory audits of annual accounts and consolidated accounts.

(194)    This option allows for flexibility of the future Directive to the regimes of whistleblowing protection already established at national level. For example, under the Swedish Law small and micro companies are not automatically excluded from the obligation to provide for internal channels and need to perform a risk assessment to evaluate its needs in the light of its activities. Depending on the nature of these activities, the employer may have to put in place specific measures to facilitate internal reporting. In the Netherlands, the system allows for reporting to the trade unions as an alternative measure to internal reporting channels for small and micro companies.

(195)    For a detailed explanation of the specific costs, see the section relating to the SME test under Annex 11.

(196)    See, in Annex 11, a specific case study for Sweden, based on the information provided in their impact assessment when drafting the national law on whistleblower protection. While the figures of the case study differ from the ones presented in the Impact assessment due to a different calculation of the labour costs, the Swedish case also evidences that the impact on medium-sized companies would be low.

(197)    Added value of medium-sized companies is estimated according to the Commission to amount up to EUR 5.568.737. The EU28 data on SME (non-financial business economy) is available at http://ec.europa.eu/DocsRoom/documents/22382/attachments/10/translations