New whistleblower legislation: what has changed?

Attention employers: On February 18, 2023, the Whistleblower Protection Act (“Wbk”) came into effect. This new law implements the European Whistleblower Directive and replaces the Whistleblowers Authority Act that had been in force since 2016. The Wbk provides whistleblowers with more opportunities to report wrongdoing within a company and includes new, more protective measures for those who report misconduct.

The Wbk applies to employers with at least 50 employees. For many employers in the hospitality sector, this means (new) obligations. They must establish or revise an internal reporting procedure in accordance with the Wbk.

This article outlines the key changes introduced by the Wbk and explains the practical implications for employers.

Purpose of the Wbk

The aim of the Wbk is to provide better protection for whistleblowers. It seeks to promote greater integrity in the workplace, a safer environment for reporting, and the resolution of social wrongs. A whistleblower is someone who, either anonymously or not, exposes or discloses wrongdoing within a company or organization.

Who can report?

The Wbk significantly broadens the scope of whistleblower legislation. A larger group of individuals is now recognized as a “reporter.” Previously, only regular employees could make a protected report of wrongdoing. Under the Wbk, anyone who has a work-related relationship with the organization being reported on can make a protected report. This includes not only employees, but also volunteers, freelancers, interns, temporary workers, and suppliers.

Importantly, it is not necessary for the working relationship to exist at the time of the report. A report may also be made based on information obtained during a potential working relationship (e.g., a job application process) or a terminated working relationship.

What can be reported?

A whistleblower may file a report under the Wbk if there is a suspicion of wrongdoing. The definition of “wrongdoing” has been expanded under the Wbk. It now includes:
(i) a breach of an EU regulation or directive, or (ii) a situation in which the public interest is at stake.

1.  Breach of EU Law:
This refers to specific areas of EU law requiring stronger enforcement, such as consumer protection, data protection, and anti-money laundering regulations.

2.  Public Interest:
This includes (the risk of) violating legal provisions or internal rules of an employer with a statutory basis. This includes applicable collective agreements, internal codes of conduct, or company policies. It also refers to improper conduct that poses a danger to public health, safety, the environment, or the proper functioning of public services or companies. Think of serious breaches of integrity such as fraud and corruption that have a significant public impact.

If only personal interests are involved, it does not qualify as a public interest. There must be a situation that goes beyond individual concerns or personal disputes.

In both cases, only a reasonable suspicion of wrongdoing is required. The whistleblower does not need to provide hard evidence. However, the report must be credible, and the whistleblower must have reasonable grounds to believe the information was correct at the time of reporting.

Internal and external reporting procedures

Reports under the Wbk may be made either internally or externally. Employers are required to have an internal reporting procedure. While this was already mandatory under the previous law, the Wbk sets stricter requirements. An internal reporting procedure must include:

-  Acknowledgement of receipt within 7 days of the report;
-  Feedback to the whistleblower within 3 months regarding the assessment of the report and any follow-up actions;
- Clear instructions on how a report can be made anonymously through one or more independent officers within the organization.

In addition, employers are required to keep a record of internal reports.

Reports can also be made externally to a designated authority. Besides the Whistleblowers Authority, the Wbk designates other industry-specific bodies, such as the Netherlands Authority for Consumers & Markets and the Healthcare and Youth Inspectorate.

A major change in the Wbk is that whistleblowers are no longer required to report internally first. They may now report directly to an external authority. However, internal reporting is still considered the preferred route.

If a company is part of an (international) group, it is sufficient to have a central reporting procedure. However, each subsidiary with at least 50 employees must have its own point of contact for reports and investigations.

Protection for the whistleblower

If a report is made properly, the employer may not disadvantage the whistleblower as a result of the report. This is known as the prohibition of retaliation. It covers all forms of disadvantage, including serious actions like suspension or dismissal, as well as more subtle actions like intimidation, bullying, denial of promotion, or relocation. Even threats or attempts at retaliation are prohibited.

Importantly, the protection also applies to others who support the whistleblower, such as colleagues or confidential advisers.

Taking action under the Wbk

As mentioned, the Wbk came into force on February 18, 2023. Employers with 250 or more employees must already comply. Employers with 50 to 250 employees have until December 17, 2023, to update their internal reporting procedures in line with the new law.

Employers must involve the works council or employee representative body in the process of establishing or amending the internal reporting procedure. Their consent is required.

Lastly, the Wbk imposes an information obligation on employers. This means that employees must be informed —either in writing or electronically —about the internal reporting procedure; how to report externally; the legal protections in place for whistleblowers.

This information must be clearly communicated and easily accessible —for example, by posting it on the company intranet.

In short: time to take action!