The Dutch government recently published for public consultation its proposed amendments to the current legislation on the Whistleblowers Authority (Huis voor klokkenluiders). The draft bill containing the amendments aims to both clarify certain aspects of existing whistleblower legislation and to implement the Whistleblower Directive. The draft bill offers a higher level of protection against retaliation to whistleblowers and widens the group of individuals protected by the bill. It also amends the duties of the Dutch Whistleblowers Authority and designates certain authorities to set up external reporting channels. As the draft bill contains additional requirements for the reporting procedure and follow-up of whistleblower reports, companies will in the future need to review and amend their existing policies when the amended law comes into force.

Background

In July 2016, the Dutch Act on the Dutch Whistleblowers Authority entered into force. It was aimed at increasing the legal protection of whistleblowers and stimulating the reporting of misconduct (see our previous article). As not all EU member states have implemented this type of legislation, the European Parliament, the Commission and various other institutions have since called for EU legislation to achieve a uniform, minimum level of protection for whistleblowers. In October 2019, the Whistleblower Directive was adopted to protect whistleblowers who reveal breaches of EU law in a range of areas, including money laundering, data protection, competition law and environmental protection (see our previous article). Member states will have to transpose the directive into national law by the end of 2021.

The draft bill

The draft bill is primarily aimed at implementing the EU directive by adding the possibility to report breaches of EU law. As incorporation of the directive means covering more than instructions for the internal reporting procedures and the founding of the Dutch Whistleblowers Authority, the draft bill proposes to amend the title of the existing law to "Act on the Protection of Whistleblowers". The recommendations emerging from the recent evaluation of the existing law have not yet been included in this draft bill. The Dutch government has chosen to follow up on the evaluation through a separate legislative procedure.

Broader protection of reporting persons

The draft bill contains several changes to the protection of reporting individuals. First, the group of individuals eligible for protection is expanded. While under the current bill the reporting person is defined as an employee, the draft bill defines the reporting person in line with the directive. This entails that those who work or have worked in a different capacity than as an employee, such as self-employed workers, paid or unpaid trainees or volunteers, will also be protected. The draft bill furthermore introduces a wider scope for the obligation to treat reports confidentially and for the obligation to obtain consent for the disclosure of the reporting person's identity. Under the current law, the Whistleblowers Authority is already bound to these standards, but these will now also apply to all other relevant entities that facilitate reporting, such as the employer or designated authorities. The draft bill also expands the prohibition against retaliation. While under the current legislation this prohibition is laid down in several different laws, the text of the draft bill now also includes the prohibition. In addition, the group of individuals protected against retaliation will be widened. Apart from the reporting person, anyone assisting him or her – such as trust advisors, union representatives or colleagues involved – will also be protected. Furthermore, the prohibition in the draft bill will not only apply when a report is made through an internal or external reporting channel, which is currently the case, but also when a suspicion is publicly disclosed to, for example, the media. However, the threshold for the prohibition against retaliation to be applicable in the case of public disclosure is higher. In line with the directive, the draft bill also introduces a rebuttable presumption that any detrimental action made against the reporting person is related to the report or public disclosure. It also protects the reporting person against civil liability resulting from the report or public disclosure.

Obligations for companies

The directive and its implementation are expected to lead to an increased burden on companies. According to current legislation, companies with more than 50 employees are required to facilitate an internal reporting channel for persons reporting misconduct under national law. In accordance with the directive, companies will now also be required to set up an internal reporting channel for reporting breaches of EU law. According to the draft bill and the accompanying explanatory memorandum, a company may choose to combine the existing internal reporting channel for misconduct with an internal reporting channel for breaches of EU law. However, if the report concerns a breach of EU law, the report must be handled in accordance with the requirements of the directive. If the report concerns a breach of EU law, the entity has to send a confirmation of receipt to the reporting person within seven days and inform the reporting person on progress within three months. When a breach of EU-law is reported, the registering entity is also required to keep a record of all such reports. If the report is submitted verbally, the registering entity is required to either record the report or to transcribe it, subject to the consent of the reporting person.

Authorities

The draft bill also contains several changes to the obligations of the relevant authorities. First, the Dutch Whistleblowers Authority will be able to advise on the reporting of breaches of EU law, and to advise more persons than it currently can, such as third parties assisting the reporting person. In addition, the draft bill allows for the Dutch Whistleblowers Authority to refer individuals for legal or psychosocial support. The authority will also be able to investigate reports of misconduct or breaches of EU law without prior internal reporting to the involved entity. This is currently a requirement for starting an investigation. In line with the directive, the draft bill also designates several other competent Dutch authorities to set up external reporting channels for the handling of reports of breaches of EU law. These authorities are already charged with the supervision and enforcement of EU law, such as the Authority for Consumer and Markets, the Authority for the Financial Markets, the Data Protection Authority and the Central Bank. The designated authorities are required to set up a reporting channel, to register reports, to provide follow-up of reports, to appoint and train personnel, to provide relevant information on their website and to evaluate their reporting policy every three years.

Next steps

The draft bill was open for public comments between 31 July 2020 and 10 September 2020. The responses could lead to amendments to the draft bill. The final bill is expected to require companies to review and possibly amend their whistleblowing policies accordingly. We will therefore continue to closely follow developments and provide updates.