The EU Directive on the protection of persons who report breaches of Union law – the whistleblowing directive – was published in the Official Journal of the EU in November and will come into force on 16 December 2019. Member states must then pass legislation by 17 December 2021 to implement its provisions into their own jurisdictions.

Given the current political uncertainty, we do not know whether the UK will take any steps to implement the directive – and if so, to what extent. The UK is one of only ten member states who have comprehensive legal protection for whistleblowers; for those that do, the protection is concentrated within the financial services sector. UK legislation largely complies with the more substantive provisions of the directive but there will still be an opportunity for employers to think about where they could review their policies and procedures. Employers might want to look at:

1. Who is covered by their policy? The directive is substantially broader than the UK Public Interest Disclosure Act 1998 (PIDA). It extends protection to include (amongst others) self-employed individuals, shareholders, non-executives, volunteers and trainees – not just employees and workers.

2. Changing the way individuals report concerns: whilst PIDA focusses on protecting whistleblowers from dismissal and/or detriment, the directive goes further and requires employers to establish mechanisms and procedures for individuals to report concerns through internal channels. This can be done orally (including the right to request a meeting) and the reporter must have their confidentiality protected.

3. How to deal with reports? Reports must be followed up diligently and there are specific timeframes for acknowledging, investigating and responding to reports. Feedback must be given to the reporter.

4. Obligation to introduce whistleblowing arrangements: organisations with more than 50 employees will need to introduce the directive’s requirements (member states have an extra two years to introduce rules for organisations with 50 to 249 staff, i.e. by 17 December 2023). Currently there is no legal obligation on organisations (outside of regulated sectors such as financial services or the NHS) to have any whistleblowing arrangements. With a requirement falling on much smaller employers to introduce these arrangements, there will be a need for more training and upskilling of junior staff. Employers will need to think about where the responsibility will sit to implement and oversee these arrangements.

The directive applies to reporting breaches of European legislation only, whilst PIDA applies to disclosures of a much broader category of failures or wrongdoing. It is a guess as to how far a new UK government might go towards implementing the directive’s provisions, and whether implementation would be strictly in line with the directive’s minimum requirements (rather than incorporating the directive’s provisions within PIDA’s broader category of protected disclosures). If the UK leaves the EU, the political parties have said they will not roll back on workers’ rights or levels of protection, so this may be one of the early tests to see if the UK keeps up with the EU’s levels of worker protection.