Frequently asked questions

What is the EU Directive 2019/1937 about?

EU Directive 2019/1937 commonly referred to as the whistleblower directive. The Member States of the European Union have two years from December 17, 2019 to implement the new regulations, i.e. until December 17, 2021.Each State and entities in a given country must have a whistleblower protection system implemented...

The scope of the directive also covers employed people who do not have the status of employees to whom the labor code currently applies. Being people employed on the basis of civil law contracts or in uniformed services.

The Directive introduces provisions to protect the disclosure of information in both the public and private sectors, i.e. those who report whistleblowers. Its purpose is to protect whistleblowers against retaliation and reprisals related to reporting irregularities.

It covers infringements of regulations in areas such as trade, public procurement, transport, public health, protection of consumers, privacy and personal data, as well as financial services, products and markets, and the prevention of money laundering and terrorist financing.

Read more

Who has the obligation and must implement the system?

Regardless of the sector, public or private, large and medium-sized companies will have to establish internal mechanisms for reporting and responding to irregularities...

Adapting to the requirements of the directive will mean i.a.: establishing by private entities (e.g. entrepreneurs, commercial companies, etc.) and by public entities (e.g. local government offices, municipal companies, etc.) internal channels for reporting information on infringements of the law by whistleblowers.

Read more

Who is the whistleblower and how is he / she protected?

Resolution of the European Parliament 2016/2224 (INI) of 24 October 2017 defines a whistleblower as a person who reports or discloses truthful information in the public interest regarding illegal or prohibited acts or acts which constitute a threat or cause harm which harm the public interest or jeopardize danger, in general, but not limited to, in connection with a whistleblower's employment relationship in the public or private sector, other contractual (legal) relationship, or activity in a trade union or association...

In the light of Art. 5 point 7 of Directive 2019/1937, a whistleblower is a "reporting person", which means a natural person who reports or discloses public information on violations obtained in the context related to work performed in the public or private sector. Reporting people must have reasonable grounds to believe that the information contained in their report is correct at the time it is made.

The protection of the law covers both people employed on the basis of an employment relationship and those who remain in non-employee employment. In particular, people cooperating under civil law contracts. A self-employed person who at the same time cooperates with another enterprise who learns about infringements of the law in connection with the professional contacts, may also become a whistleblower. A whistleblower can be any natural person who reports irregularities in the context related to the work performed by him.

A whistleblower may be an employee, a self-employed person, a principal, a contractor, a consultant, a volunteer, an intern, an apprentice and an entity with which the employer does not have a legal relationship (eg a candidate participating in the recruitment process). All these people are legally protected and will be able to safely report any irregularities they notice. They will receive a legal instrument to control the legality of the actions of their associates and contractors.

The directive provides all whistleblowers with protection against all possible negative consequences on the part of the employer, in particular dismissal, omission from promotion, demotion, refusal to consent to training, negative annual assessment, non-renewal of the contract and even threats and ostracism.

In accordance with the principle of confidentiality of the identity of people reporting breaches - the signaling system must protect the identity of the reporting person, and unauthorized people cannot have access to their identity.

Read more

How should a whistleblower protection system be implemented?

The directive provides for the implementation of an internal (internal channels) and external (external channels) whistleblower process, which will enable employees and outsiders, such as job applicants and volunteers, to report violations of the law. Violations are to be first reported through its internal reporting channels and procedures before reporting through external channels...

Internal reporting means providing information on breaches within a public or private legal entity. The directive regulates the issue of channels for the transmission of information by whistle-blowers. The procedure for reporting fraud therefore has three stages: first, reports are to be reported in the internal channels through the channels created for this. Everything must be done in accordance with the principle of confidentiality and ensuring that the whistleblower's identity is protected.

It is up to each private and public legal entity to define the type of reporting channels to be set up, for example via the online platform.

Read more

When does the obligation to implement a whistleblower protection system come into force?

17 December 2021 is the date by which the legislator is required to introduce laws, regulations and administrative provisions to implement Directive (EU) 2019/1937 of the European Parliament and of the Council of October 23, 2019 on the protection of persons reporting breaches of the law Union...

Thus, the vast majority of legal entities have less than two years to prepare to meet the requirements imposed by them. Only in the case of private entities, which employ from 50 to 249 employees, the time to implement the directive has been extended - until 17 December 2023.

Detailed deadlines for the implementation of individual channels

17 December 2021:

  • public entities, internal and external channels, however, Member States may decide to exempt municipalities with less than 10,000 inhabitants or entities with fewer than 50 employees from this obligation;
  • private entities employing more than 249 employees.

17 December 2023: private entities with 50 to 249 employees.

Read more

What sanctions does the Directive prescribe to establish?

The directive requires the Member States to establish sanctions for: obstructing reporting, retaliating against whistleblowers, initiating burdensome proceedings against whistleblowers, violating the obligation to keep the whistleblower's identity confidential.

How to implement the Whisby whistleblower protection tool?

Whisby is an online platform that meets all the requirements of the Directive to implement an internal reporting channel for all public and private sector entities. It is a ready-to-run tool in accordance with the EU Directive 2019/1937. To start using the Whisby reporting channel, all you need to do is select a package (Pricing) and provide basic organization data. The channel will be ready within 24 hours.