Directive (EU) 2019/1937 on the protection of persons who report breaches of Union law: what are impacts on data protection?

As far as Luxembourg is concerned, the whistleblowing Directive is subject to a draft bill n°7945 which is still under discussion. It aims at protecting whistleblowers from all forms of retaliation.

Although the law has not yet been passed, entities subject to the application of these new provisions must prepare for their application in order to be ready to implement this new framework as of December 2023. The recent Opinion of the Luxembourg Data Protection Authority (the “CNPD”) dated 22 October 2022 on Bill n°7945 helps to identify key issues.

What are the measures that can already be anticipated to set up internal whistleblowing schemes?

Whistleblowing data will fall under the scope of the GDPR. Section 3(7) of the Bill defines a whistleblower as a "natural person who reports or publicly discloses information about violations that it has obtained in the course of its professional activities", while Section 2 of the Bill defines a very broad personal scope of employment relationships that form the basis of the "professional context" in which the information may be obtained.

Data privacy is therefore crucial in the implementation of alert systems.

1. Preconditions for the implementation of an internal reporting procedure

Processing whistleblower data requires the processing to be legitimated and based on one of the condtions of Article 6 of the GDPR.

Legal basis – There are only two relevant legal bases for the processing of data in this context. A distinction has to be made based on whether the entity has more than 50 employees or less than 50 employees.

If a company has more than 50 employees, the setting up of an internal whistleblowing system is mandatory: therefore the processing of personal data is necessary for compliance with a legal obligation (Article 6.1 c) of the GDPR).

However, if the company has less than 50 employees, the law does not required the setting up of an internal alert canal. It remains, however, possible on a voluntary basis, meaning that the entity will have no other option than to rely on its legitimate interests (Article 6.1 f) of the GDPR). In such a case, entities need to ensure that their internal processes comply with the GDPR. It may be necessary, depending on a case-by-case analysis, to perform a data protection impact assessment (DPIA) prior to its implementation. In addition, staff delegation in companies with more than 15 employees will need to be involved in the implemtation process according to Article L. 261-1 of the Luxembourg Labour Code.

Technical and organisational security measures – The internal and external reporting channels are, in principle, intended to be used by natural persons as whistleblowers and therefore generate de facto the processing of personal data. The Bill set up minimal requirements (Articles 7 and 17) which need to be read in conjunctionwith Article 32 of the GDPR. Given the risk to whithleblowers’ rights and freedoms as well as of third parties that can be mentioned in the alert, it seems appropriate for data controllers to provide for the pseudonymisation and encryption of personal data when this is possible and necessary in view of the technical constraints, in the context of data processing by authorised staff members.

The CNPD also considers it necessary to set up a logging system, which contributes to compliance with the obligation to secure any processing of of personal data, in accordance with Articles 5 and 32 of the GDPR.

Section 22 of the Bill also introduces an ex ante protection measure to preserve confidentiality of the identity of the whistleblower from "any person other than the authorised personnel who are competent to receive or follow up on reports. The prohibition on disclosure also applies to "any other information from which the identity of information from which the identity of the person making the report may be directly or indirectly inferred".

In order to follow up on alerts, it is necessary to communicate information about the content of an alert to other staff members of the legal entity. However, the CNPD recommends that the person or department receiving the alert should, before forwarding it to other staff members, anonymise the report, in particular the identity of the person who reported the matter and, to the extent possible in the context of the investigation of the alert, of third parties mentioned in the alert.

Access restrictions – Depending on the case, data subjects' rights to access, rectification or erasure may be restricted so as to protect other data subjects' rights and freedoms. For example, these individuals may not be able to obtain information on the identity of a whistleblower by exercising their access right.

The CNPD considers also that it would be necessary, to ensure the confidentiality of the author of the report, to provide for a proportional limitation of the right of access and the right to information of persons within the meaning of Article 23 of the GDPR.

2. Outsourced internal procedures with external service providers

Many companies will consider using outsourced services to implement whistleblowing systems. Even if the procedure is outsourced with an external tool using applications/software or external providers, these systems will still be construed as internal reporting channels. In such a case, additional safeguards must be considered.

Technological aspect - Regardless of the chosen IT solution, it must be compliant with Luxembourg law. However, as the scope of the Luxembourg bill on the protection of individiuals reporting violations is broader than the one of the whistlblowing Directive, the provider must ensure the the IT tool is in line with national requirements.

Reliability - It is necessary to ensure that the provider is reliable.

To this end, it is fundamental to have a contractual framework for the relationship in place that fulfils the requirements listed in Article 28 of the GDPR (choosing only processors that offer sufficient guarantees in terms of technical and organisational security, pre-contractual due diligence, details of the processing, only process on the documented instructions of the controller, etc.).

The issue of location of data, access to data and transfer of data can also become an issue and must be analysed with due care.

3. New challenges for data controllers to face

The implementation of whistleblowing schemes requires that the entity is already mature in its compliance processes in order to be able to best understand the specifics of the whistleblowing Directive requirements. Entities will have to update their privacy policies and notices accordingly.

To ensure the chosen system is fully compliant with the GDPR, entities must consider the following, step by step:

• Internal system or outsourced system?

• Where the data will be located and whether a transfer of data can occur.

• A system or process that follows strict security measures including measures to ensure the reporter’s identity is not disclosed either accidentally or illegally.

• A system or process that allows personal data deletion when and where necessary and not keeping data for longer than is necessary. - Employees and third parties have been trained regarding the use of the whistleblower system and their rights.

Article provided by INPLP member: Michel Molitor and Virginie Liebermann (Molitor Avocats a La Cour, Luxembourg)

Discover more about the INPLP and the INPLP-Members

Dr. Tobias Höllwarth (Managing Director INPLP)