With this new regulation (a European directive to be transposed into Belgian law), the European Union wanted to offer better protection to persons who report violations of EU law (“whistleblowers”). The European Union wanted to guarantee them a minimum level of protection.

Various studies show that whistleblower protection has a purely economic added value (in addition to the ethical benefits). Companies that have a whistleblower policy are able to detect internal fraud or abusive situations more quickly. They also create a culture of transparency and communication that benefits overall productivity. The importance of such culture is also becoming increasingly important when recruiting new employees. This is a crucial point of interest in the current “war for talents”.

These rules apply to all public entities. In the private sector, they apply to businesses with 50 employees or more. All EU Member States were required to transpose the original directive into their national law by 17 December 2021. The directive allowed a postponement until 17 December 2023 for small private businesses (less than 250 employees).

The Belgian law effectively transposing the European directive for the private sector was published in the Belgian Official Gazette on 15/12/2022 and entered into force two months after its publication date. Small private businesses could use the postponement option. By the end of 2023 they had to take the necessary steps to set up an internal notification channel.

However, many companies did not wait until the end of 2023 to set up their internal notification channel, protecting whistleblowers offers other advantages than simple compliance.

Anyone who is aware of violations or abuses in a professional context can report them. It applies not only to people who are connected to a company as employees, but also to freelancers, shareholders, managers, volunteers and trainees. Contractors, subcontractors and suppliers must also have the possibility to file a report. Whistleblowers should have reasonable cause to believe that the information is accurate on the moment of filing their report.

The directive implies at least protection for reports related to the following areas: public procurement, financial services, products and markets, anti-money laundering and counter terrorist financing, product safety and compliance, transport safety, environmental protection, radiation and nuclear safety, food and feed safety, animal health and welfare, public health, consumer protection, protection of privacy and personal data, and security of network and information systems. A report can also be filed when the EU’s financial interests are at stake or when there’s a risk of disrupting the European single market.

The Belgian legislator added social and tax fraud to this list. Several companies deliberately choose to extend the reporting options to, for example, violations of their own code of ethics or code of conduct. Such an extension facilitates the reporting and improves its functioning.

The directive provides three reporting channels:

• Internal channel:

Through this channel, the report is sent to a specially designated person within the company (the Whistleblower Officer). This person should be impartial and have direct contact with the company’s senior management, e.g. compliance officer, head of human resources, a legal expert or privacy officer, finance director, audit officer, board member, etc.

The Whistleblower Officer ensures that the identity of the whistleblower remains confidential at all times. It is not mandatory to fill this position internally. The Whistleblower Officer can also be external to the organisation.

Giving access to this channel to other professional partners than employees (freelancers, shareholders, contractors, etc.) is not mandatory, but it is recommended. As a company, you want to be aware of any problems. The whistleblower platform we provide offers this type of internal channel.

• External channel:

This is a reporting channel controlled by the government.

• Public disclosure:

This refers to contacting mainstream media (who then relay the information) or public fora such as Wikileaks.

The regulation assumes that internal reporting is the preferred channel, and that the external channel or public disclosure is an alternative only if necessary.

Additional conditions apply specifically to public disclosure. For example, a report must have been filed through an internal or external channel (but remain unanswered) or must be justified by very specific circumstances (e.g. danger to the public interest or risk that people from the external channel are involved in the violation).

The whistleblower should be careful not to disclose more information than necessary to expose the violation or irregularity. Once the report has been made, the whistleblower must receive an acknowledgement of receipt (within 7 days) and a follow-up period on the report (3 months) starts running.

The directive leaves that choice to the member states. The Belgian legislator  makes a distinction between companies with less than 250 employees and companies with 250 employees or more. Only the latter are obliged to follow up anonymous reports. This does not mean that companies with less than 250 employees won’t be allowed to do so. This is even recommended. In practice: anonymity is often a lever to at least start the conversation with the whistleblower.

The regulation protects whistleblowers from any form of retaliation, which basically means any negative treatment to the whistleblower. However, companies retain the right to evaluate their employees. If the employee in question is a whistleblower, it will be up to the company to prove that any action (in case of a poor evaluation) is not related to the report that has been filed.

A good implementation process makes use of the technical possibilities available to enable (anonymous) reporting without relying exclusively on them. It takes into account the legal framework (e.g. privacy, social and criminal law), but also creates a social consensus within an organisation. This is the only way to successfully implement a whistleblower system. Paradoxically, a successful implementation will make a whistleblower system partly unnecessary in practice. If an organisation is transparent, ethical and communicative, employees will tend to speak up directly to each other about deviant behaviour, without the need for formal procedures.