Whistleblowing protection and investigations best practice

The EU Whistleblowing Directive came into effect on 16 December 2019. As the UK left the EU before the its implementation it does not need to implement it. However, the Directive remains relevant in the UK, particularly for global companies seeking to establish a consistent approach to whistleblowing across the organisation.

Key aspects

A comparison of some of the key features of whistleblowing protection in the UK and the EU are set out below:

• Who is protected as a whistle-blower? The Directive has a wider scope than the UK regime in that it protects self-employed people, shareholders and board members (including non-executives), as well as "facilitators" (individuals connected to the whistle-blower). The UK regime applies to those falling within the extended definition of “worker” (including LLP members).
  
  
• What constitutes a relevant disclosure? Protection under the Directive relates to breaches of EU law that fall within specified sectors. UK protection focuses on categories of wrongdoing (including criminal offences and breach of a legal obligation) and is not limited to sectors.
  
  
• Test for disclosure to be protected? The focus in the UK is on the subjective belief of the whistle-blower, whereas the Directive focuses on whether the person had "reasonable grounds" to believe that there were grounds for a whistleblowing disclosure (i.e. there is also an objective element). In the UK, there is an additional element that the disclosure must be, in the reasonable belief of the whistle-blower, in the public interest.
  
  
• Reporting channels: Under the Directive, organisations with 50 or more employees in the private sector are required to establish internal reporting channels. (This threshold does not apply to certain entities, such as those in the financial services sector, which are required to have reporting channels regardless of their size.) There is no equivalent requirement in the UK, except for specific requirements applying to regulated firms in the financial sector.  The Directive and UK regimes are similar in that reporting through internal channels is encouraged in the first instance, with escalation to certain external channels in particular circumstances.
  
  
• Confidentiality: The Directive states that the identity of the whistle-blower must not be disclosed without explicit consent to anyone beyond those dealing with the report, unless this is necessary and proportionate in the context of the investigation. This is similar to the position in the UK which has emerged through case law (the law does not expressly protect the identity of whistle-blowers). Confidentiality is always a key consideration in internal investigations.
   
• Record keeping: The Directive prescribes obligations to keep records of reports. There is no explicit requirement to do so in the UK, but it happens in practice (e.g. in HR records).
  
  
• Timeframes: The Directive prescribes specified timeframes for dealing with disclosures and providing feedback to the whistle-blower. There is no equivalent timeframe in the UK and no requirement to give feedback regarding action envisaged or taken.
  
  
• External oversight: The Directive requires Member States to designate a competent national authority to establish user-friendly external reporting channels. There is currently no national authority in the UK with such a remit (although the charity Protect provides support and advice to whistle-blowers and organisations).
  
  
• Retaliation: Member States must take measures to ensure that whistle-blowers are protected against retaliation under the Directive. This protection already exists in UK whistleblowing law. 

Reform

There have been calls to modernise UK whistleblowing legislation to preserve its status as a leading example of a country providing comprehensive whistleblowing protection. 

In March 2023, the UK government launched a review of the current whistleblowing framework seeking evidence on the effectiveness of the current regime in meeting its original objectives.  Its outcomes are intended to inform government policies on the development and improvement UK whistleblowing law. The review will also examine the definition of “worker” for whistleblowing purposes.

In May 2023, the Financial Conduct Authority announced that it would be taking a number of actions to improve the confidence of whistle-blowers, including: sharing further and more detailed information with whistle-blowers on how it’s acted on their information; improving the use of information provided by whistle-blowers across the FCA; and improving how it captures information from them. 

In general, employees will not feel confident about blowing the whistle if they do not trust the integrity of the investigation process which may be triggered as a result, so all companies have an interest to ensure that whistleblowing protection is fit for purpose.

Emmanuelle Ries specialises in cross-border employment issues. She advises on secondments and contractual arrangements and on workplace investigations and disputes. She serves on the Advisory Council of the French Chamber of Commerce in Great Britain.

Caroline Day is an investigations expert. She advises organisations and individuals in complex criminal and regulatory cases. She has experience in conducting internal investigations on behalf of corporate clients in connection with misconduct allegations. She advises in cases involving enforcement authorities including the SFO, FCA, CMA, and other regulatory bodies. Her work is often sensitive, high-profile, and multi-jurisdictional.