Directive (EU) 2019/1937 of October 23, 2019, better known as Whistleblowing Directive, has among its objectives to provide an adequate level of protection to persons who report infringements of Union Law.
In accordance with its article 8, lMember States shall ensure that legal entities in the private and public sectors establish channels and procedures for internal reporting and monitoring, after consulting the social partners and in agreement with them when so established by national law.
What types of entities are affected by the legal obligation to implement an internal reporting channel?
This obligation will be applicable to the following types of organizations:
- Legal entities of the private sector that has 50 or more workers.
- Entities, regardless of the number of workers, that fall within the scope of the following Union acts: Services, products and financial markets and prevention of the money laundering and the financing of terrorism; transportation security and environmental Protection.
- Legal entities of the public sector, including entities owned or controlled by such entities.
In relation to the obligated subjects, it will be at the discretion of the national legislator its expansion or reduction in two cases:
In relation to the private entities, the art. 8.7 of the Directive, establishes that: Following an appropriate risk assessment and taking into account the nature of the entities' activities and the corresponding level of risk, in particular to the environment and public health, Member States may require that private sector legal entities with fewer than 50 employees establish internal reporting channels and procedures.
With regard to the scope of the Public administration, the European legislator provides for the possibility that Member States may exempt from this obligation municipalities with less than 10,000 inhabitants or with less than 50 workers, or other entities mentioned in the first paragraph of this section with less than 50 workers. That is, entities that are owned or subject to the control of public entities.
The Directive, in force since December 17, 2019 is pending transposition into our legal system, which must occur No later than December 17, 2021, at which point it can be applied directly.
However, and in relation to legal entities in the private sector that have 50 to 249 workers, Member States will have an additional period of two years, that is, until December 17, 2023, to dictate the legal, regulatory and administrative provisions necessary to comply with the obligation to establish internal reporting channels.
Do you need to specialize in data protection management and control? We have what you need, Master of Compliance & Data Protection ManagementCome in and get to know him.
