Author: Curzio Fossati
Subcommittee: Academic
Date: 08.05.2023
The main sources of information on crimes for which the EPPO could exercise its competence are the institutions, bodies, offices and agencies of the European Union, as well as the authorities of the Member States (judicial or police authorities).
However, recital n. 49 of EPPO’s Founding Regulation says that “EPPO may also receive or gather information from other sources, such as private parties”. The following recital encourages Member States to provide “effective procedure to enable reporting of possible offences” that fall in the EPPO’s competence and to ensure protection of whistleblowers from “retaliation, and in particular from adverse or discriminatory employment actions”. It also instructs the EPPO to establish internal whistleblower rules.
On June 30, 2021, the College of European Prosecutors adopted these rules, laying down the guidelines on whistleblowing applicable within the EPPO and introducing art. 22a and 22b in the EU Staff Regulation. In particular, art. 22a encourages EU officials to report offences detrimental to Union’s interests they become aware of in the course of the performance of their duties. Art. 22b protects officials who report such offences from adverse consequences of their reporting.
The most relevant European Union’s effort to protect whistleblower is the adoption of the Directive n. 2019/1937 of 23 October 2019, on the protection of persons who reports breaches of EU law.
The Whistleblowing Directive lays down common minimum standard for the protection of persons working in the private or public sector who acquired information on breaches of the Union law in a work-related context and reported them. The material scope of the Directive includes “breaches affecting the financial interests of the Union as referred to in Article 325 TFEU” (art. 2, par. 1, lett. b), so the Directive also applies to the protection of persons who reports offences in respect of which EPPO could exercise its competence.
To implement the Directive, Member States shall ensure that public- and private-sector employers establish channels for receiving internal reports from workers: these internal channels must ensure the confidentiality of the identity of the reporting person and any third party mentioned in the report (art. 7-9). Furthermore, Member States shall ensure that a designated national authority establishes an independent and autonomous external reporting channel (art. 10-14). The Directive guarantees that the identities of workers who report EU law breaches, both through the internal and the external channel, are not disclosed to anyone beyond the authorised staff members competent to receive the reports, without their explicit consent (art. 16). It also provides that any processing of whistleblower’s personal data shall be carried out in accordance with Regulation (EU) 2016/679 and Directive (EU) 2016/680 (art. 17).
The most important provisions of the Directive concern the protection measures for whistleblowers. These measures include: (i) prohibition of retaliations, such as suspension, lay-off or demotion (art. 19); (ii) measures of support, i.e. an effective assistance from competent authorities before any relevant authority involved in their protection against retaliation and legal aid in the related proceedings (art. 20); (iii) measures for protection against retaliation, i.e. the exclusion of any kind of liability in respect of their reporting (art. 21).
The implementation of the Whistleblowing Directive is still ongoing despite the deadline’s expiration in December 2021. Italy has recently adopted the Legislative Decree n. 24/2023, that transposes the Directive into Italian law. ANAC (the Italian anti-corruption authority) has been designated as the authority responsible for implementing the external reporting channel, in compliance with art. 10 of the Directive.
The Italian Decree will enter into force on July 15, 2023 (on December 17, 2023, for companies employing in the last year an average up to 249 workers), and it provides for administrative sanctions for employers who will fail to comply with its provisions. For example, the fine for failure to implement the internal reporting channels ranges from Euro 10.000 to Euro 50.000.
In conclusion, whistleblowers could play a vital role for the functioning of EPPO, and the Whistleblowing Directive is an important legal instrument to protect them, avoiding the chilling-effect of the fear of retaliations. However, this statutory protection must be effectively implemented by public and private employers, who are responsible to adopt efficient internal reporting channels to ensure workers report safely and confidentially.