Dejan Jasnic · Co-founder & Compliance Lead, Trusty · 20+ years anti-fraud & compliance · ACFE Swiss Chapter Board
What is a whistleblower? A whistleblower is a person who reports or publicly discloses information about wrongdoing that they learned about through their work. EU law calls this person a reporting person (Article 5(7) of Directive (EU) 2019/1937). This guide explains the meaning of the term, who qualifies, how a report can be made and what protection applies.
Whistleblower meaning: the legal definition
In everyday language, a whistleblower is someone who exposes misconduct inside an organization. The EU Whistleblowing Directive gives the term a precise legal meaning. A reporting person is a natural person who reports or publicly discloses information on breaches acquired in the context of their work-related activities (Article 5(7)).
Two elements matter. First, the information must concern a breach: an unlawful act or omission, or one that defeats the purpose of the rules (Article 5(1)). Second, it must come from a work-related context. Reasonable suspicions count, and so do attempts to conceal a breach (Article 5(2)).
Who can be a whistleblower?
Almost anyone with a work relationship to an organization can be a whistleblower (Article 4). This includes:
- employees and civil servants;
- self-employed people, such as freelancers and consultants;
- shareholders and members of management or supervisory bodies;
- volunteers and paid or unpaid trainees;
- people working for contractors, subcontractors and suppliers;
- former employees and job applicants.
Protection also extends to people around the whistleblower. These are facilitators who help with the report, colleagues or relatives who could suffer retaliation, and legal entities connected to the whistleblower (Article 4(4)).
What can a whistleblower report?
The directive covers breaches of EU law in listed areas (Article 2). Examples are public procurement, financial services, money laundering, product safety, transport safety and environmental protection. Food safety, public health, consumer protection and data protection are included too. So are breaches affecting the EU budget and competition and state aid rules.
National laws may go further (Article 2(2)). Germany, for example, also protects reports of criminal offences and of certain administrative offences (Section 2 of the HinSchG). Read more about the types of whistleblowing and what falls outside the scope.
How can a whistleblower report?
A whistleblower has three routes:
- Internal reporting: through the organization’s own whistleblowing channel (Article 7).
- External reporting: to a competent national authority, either after an internal report or directly (Article 10).
- Public disclosure: making the information public, for example through the media, under strict conditions (Article 15).
A public disclosure is protected only in certain cases. One case is an internal or external report that led to no appropriate action in time. Another is an imminent or manifest danger to the public interest. Our guide to external whistleblowing explains how national authorities handle reports.
What protection does a whistleblower receive?
A whistleblower is protected if they had reasonable grounds to believe that the information was true and within the scope of the directive when they reported it (Article 6(1)).
Retaliation is prohibited in any form, including threats and attempts (Article 19). Examples are dismissal, demotion, withheld promotion, negative performance assessments, intimidation, discrimination and blacklisting. If a whistleblower suffers a detriment after a report, retaliation is presumed. The person who took the measure must then prove that it was duly justified (Article 21(5)).
The identity of the whistleblower must not be disclosed beyond the staff authorized to handle reports without their explicit consent (Article 16). Anonymous whistleblowers who are later identified and suffer retaliation are protected too (Article 6(3)). Read more about whistleblower protection.
Typical whistleblower situations at work
Whistleblowing is not limited to spectacular scandals. Typical situations include:
- an employee who notices that required safety tests on a product were skipped;
- a finance team member who sees payments that may hide bribery or money laundering;
- a supplier’s employee who learns that waste is being disposed of illegally;
- an IT employee who discovers that a serious personal data breach is being covered up.
In each case, the person learned of the problem through their work. That is what makes them a whistleblower in the legal sense.
Why organizations need a whistleblowing channel
Whistleblowers can reveal problems that management would not otherwise see. A trusted internal channel lets your organization hear about them first and act before damage occurs. Private companies with 50 or more workers must have one under Article 8 of the directive. Our whistleblowing channel guide explains the obligations and requirements.
What is a whistleblower, and what is not?
Not everyone who complains is a whistleblower in the legal sense. So what is a whistleblower, and where are the limits? Three distinctions help:
- Personal grievances: a dispute that affects only the person reporting, such as a conflict with a colleague, may be handled through other procedures where national law allows (recital 22).
- No work-related context: a customer or neighbor who learns of a problem outside any work relationship is not a reporting person under the directive (Article 5(7)). Other laws may still protect them.
- Knowingly false reports: a person who knowingly reports false information is not protected and may face penalties (Article 23(2)).
In short, a whistleblower reports a breach they learned of through their work, on reasonable grounds.
Conclusion
A whistleblower is a person who reports wrongdoing they learned about at work. EU law protects them when they have reasonable grounds to believe the information is true. Employees, contractors, volunteers and even job applicants can qualify. With whistleblowing software from Trusty, your organization runs a secure, confidential channel without an IT project, from 49 EUR per month.
Related reading: Types of whistleblowing and Whistleblower protection under EU law.
Frequently asked questions
A whistleblower is a person who reports wrongdoing they learned about through their work. They can report inside the organization, to a competent authority or, under strict conditions, to the public.
Yes, if they had reasonable grounds to believe the information was true when they reported it (Article 6(1)). Knowingly false reports are not protected, and Member States must set penalties for them (Article 23(2)).
Whether anonymous reports must be accepted and followed up depends on national law (Article 6(2)). Anonymous whistleblowers who are later identified and suffer retaliation are still protected (Article 6(3)).
Employers must not retaliate, and courts presume retaliation when a detriment follows a report. Member States must also give whistleblowers access to information, advice and assistance from competent authorities (Articles 20 and 21).
FROM 49 EUR PER MONTH
Trusty Whistleblowing: a reporting channel compliant with the EU Whistleblower Directive, live in minutes with no IT project. From 49 EUR per month, 7-day free trial.