- What are we talking about?
Belgium was supposed to implement the EU Whistleblowing Directive 2019/1937 by 17 December 2021. Two draft bills are expected to be presented to the federal Parliament in the second quarter of 2022, one for the private sector and the other for the federal public sector.
The Directive aims for establishing internal and external whistleblowing channels and a more uniform protection of whistleblowers against (threats or attempts of) retaliation.
2. Whom are we talking about?
A whistleblower is anyone reporting information on violations of EU law which they observe in their work-related activities: employees but also self-employed people, freelancers, consultants, contractors, suppliers, volunteers, unpaid trainees and job applicants.
The whistleblower will be protected if (s)he has reasonable grounds to believe the information reported was true at the time of reporting and that this information falls within the scope of the legislation.
It will be up to the individual or legal entity responsible for any act of retaliation (e.g. dismissal, unfair treatment, etc.) to demonstrate that there is no link with the report made by the whistleblower.
3. Precisely, what type of reporting is protected?
The material scope of the Directive is limited to specific areas of EU law, i.e. public procurement, financial services, anti-money laundering and counter terrorist financing, product safety, transport safety, environmental protection, nuclear safety, public health, food and feed safety, animal health and welfare, consumer protection, protection of privacy and personal data, and security of network and information systems.
It also applies to breaches relating to EU competition rules, breaches harming the EU’s financial interests and, in view of their negative impact on the proper functioning of the internal market, to breaches of corporate tax rules or arrangements whose purpose is to obtain a tax advantage that defeats the object or purpose of the applicable corporate tax law.
The Belgian legislator may broaden this scope.
4. Who is obliged to establish internal channels and procedures for reporting and follow-up of reports?
- All private companies of more than 50 employees
(Note that, normally, companies between 50 to 249 employees won’t be obliged to establish such internal channel before 17 December 2023),
- All state and regional administrations and all local municipalities (if not exempted by the Belgian legislator),
- SMEs operating in the field of financial services or vulnerable to anti-money laundering or counter terrorist financing
These entities must designate a person or a department (in-house or externalized) who will be responsible for receiving (in writing or orally) – with an acknowledgement of receipt within 7 days- and following up on the reports (within 3 months), as well as to provide clear and accessible information about those procedures and the conditions under which reports can be made externally to competent authorities.
The designated person/department must be impartial and guarantee the confidentiality of the identity of the whistleblower, as well as any third party mentioned in the report.
According to the Directive, the choice of the designated person/department depends on the structure of the entity, but, in any case, their function should be such as to ensure independence and absence of conflict of interest. In smaller entities, this function could be a dual function held by a company officer well placed to report directly to the organisational head, such as a chief compliance or HR officer, a legal or privacy officer, a CFO, a chief audit executive or a member of the board. However, pursuant to the current draft bill for the private sector, the designated person/department should not be part of the management team.
4. What about external reporting channels?
In general, a whistleblower should first report information to his/her employer using internal reporting channels. However, a whistleblower can also choose to go directly to the competent authorities when the internal channels were used but did not function properly or could not reasonably be expected to function properly (for example because of a fear of retaliation or concerns about confidentiality)
Authorities that will be identified by the Belgian legislator will be charged with receiving and following up on such external reports within 3 months (extendable to 6 months in case of complex cases).
5. So, what to do?
- Identify whether you need, or wish, to establish an internal channel and, if so, who will run it (internally or externally).
- Establish channels (e.g. by post or through an online platform) and procedures for internal reporting and for follow-up, and after having informed and consulted the employees’ representatives (i.e., the representatives in the works council, the trade union delegation or the committee for prevention and protection in the workplace, depending on the size of the company) or the employees directly about such an internal channel, as recently recalled by the Central Council for the Economy and the National Labor Council in their joint opinion over the draft bill for the private sector
- Last but not least, don’t forget that any processing, exchange or transmission of personal data must be carried out in accordance with the provisions of the GDPR. So, be sure to get in touch with your Data Protection Officer or privacy advisor in due time.
The Whistleblowing Directive is available here:
https://eur-lex.europa.eu/legal-content/EN/TXT/HTML/?uri=CELEX:32019L1937&from=en
The joint opinion of 30 November 2021 of the Central Council for the Economy and National Labour Council is available here:
https://www.ccecrb.fgov.be/p/fr/936/transposition-de-la-directive-lanceurs-d-alerte-