In October 2019, a directive was adopted to enhance whistleblower protection across the European Union (see our previous article). To implement this directive, the Dutch Senate passed the Dutch Whistleblower Protection Act on 24 January 2023. Among other requirements, the new act amends requirements regarding reporting channels, and enhances protective and supportive measures for reporting parties. The act entered into force on 18 February 2023, except for certain provisions including those on enforcement and anonymous reporting. We highlight some changes introduced by the act that may significantly impact how organisations follow up on whistleblower reports.

Whistleblower Protection Act: effective immediately

Possibly prompted by the European Commission's infringement procedure against the Netherlands for its late implementation, the new act's provisions on internal reporting channels and related employer obligations for "large" private-sector employers (with 250 employees or more) are effective immediately – that is, as of 18 February 2023. Mid-size private sector employers (with 50-249 employees) will need to comply by 17 December 2023. Public employers were already bound directly by the directive's requirements as of 17 December 2021.

What it means for organisations

The new act requires in-scope organisations to make substantial changes to their reporting frameworks and policies. This includes organisations that already complied with previous legislation, the Dutch Whistleblowers Authority Act. Other important changes relate to:

• protective and supportive measures for reporting persons and those assisting them;
• the material scope of reportable "wrongdoing";
• the personal scope of parties eligible to report;
• the possibility of direct external reporting; and
• additional requirements concerning whistleblower channels (see also the Ministry's checklist, in Dutch).

Many large-size employers seated in the Netherlands have already begun amending their internal reporting procedures accordingly. Further to such "formal" implementation, the new act may materially impact the way affected organisations need to handle and manage whistleblower reports.

• Providing feedback – The act requires affected organisations to provide substantive feedback to reporting parties on the organisation's follow-up to their reports, in principle within three months from the date the relevant report was issued. The legislature considers feedback topics to include: updates on internal investigations (including findings, if any); remedial measures taken; or referral to any external authority for investigation. Organisations will often use additional internal measures to guide reporting officers through the process of providing feedback. Fulfilling this feedback requirement will sometimes require complicated, case-by-case assessments.
• Setting up reporting channels – Having a centralised channel alone no longer meets the requirement to set up reporting channels. Local reporting channels must be made available for medium-size (50-249) and large (≥250) EU entities, even if they are part of the same group. To some extent, the centralised function can maintain governance oversight over local reporting channels. The act's enhanced confidentiality requirements may, however, impact central handling, and intra-group sharing, of whistleblower reports. Although the act allows for intra-group sharing of resources, "large-sized" EU subsidiaries may be required to follow up on reports autonomously, unless the reporter provides consent for central follow-up. Organisations may still promote (but not require) reporting at the central level.
• Keeping employee records – The act reverses the burden of proof on any disadvantage reportedly suffered by reporting parties. The employer will need to demonstrate that any such disadvantage is not the result of the relevant report. This requirement may have an impact on employment record keeping, such as administering relevant events and performance reviews.

We expect these and other amendments to require substantial changes in the way companies organise the management of and follow-up to whistleblower reports.

Enforcement

The new act will give investigative and enforcement powers to the investigation department of the Dutch Whistleblowers Authority. Provisions relating to sanctions, however, will only enter into force at a future date, together with those on anonymous reporting. Additionally, individuals with a relevant interest (for example, certain whistleblowers or former employees) may seek a civil order to enforce compliance with the act at any competent district court.

We will provide you with more practical insights in the coming months. Should you have any questions about the Whistleblower Protection Act, please contact any of the experts listed above or one of your own De Brauw contacts.