The protection afforded by the Act applies to all persons working in the private and public sectors and the self-employed, as well as anyone working under the supervision and direction of contractors, subcontractors and suppliers.
Shareholders and members of a company’s administrative, management or supervisory body, including non-executive members, as well as volunteers and paid or unpaid trainees, can also report a breach.
Reporting persons are also protected in cases where their employment relationship has ended or where the employment relationship has not yet begun, for example where information about violations was obtained during the recruitment process or during pre-contractual negotiations.
The measures to protect reporting persons also apply, where appropriate, to facilitators, third parties who are in contact with the reporting persons and who are at risk of reprisals in a professional context, such as colleagues or relatives of the reporting persons and legal entities belonging to the reporting persons or for which they work, or with which they are in contact in a professional context.
Which reporting persons are eligible for protection?
Reporting persons enjoy the protection provided by law under the following conditions:
they had reasonable grounds to believe that the information reported on the breaches was true at the time of reporting and that this information falls within the scope of the law; and
they made a report either internally or externally, or made a public disclosure in accordance with the law.
Whistleblowers are encouraged to give priority to reporting through internal reporting channels over reporting through external reporting channels when it is possible to remedy the breach effectively internally and they believe there is no risk of reprisals.
Which legal entities need to set up internal reporting channels?
Legal entities governed by private law with more than 50 employees and legal entities governed by public law, i.e. State administrations, public establishments and municipal administrations with more than 10,000 inhabitants, are obliged to set up an internal reporting channel.
Private sector legal entities with between 50 and 249 employees may share resources with regard to the receipt of reports and the follow-up to be carried out. This is without prejudice to the obligations of such entities to maintain confidentiality, provide feedback and remedy the reported breach.
The reporting channel may be managed internally by a designated person or department or provided externally by a third party. The legal entities concerned must make available appropriate information concerning the use of internal reporting channels, as well as clear and easily accessible information concerning external reporting procedures.
The reporting channels must enable reports to be made in writing or orally or both in one of the three administrative languages of Luxembourg.
The competent authorities shall verify the establishment of internal reporting channels with the private sector legal entities falling within their respective spheres of competence.
channels for receiving alerts which are designed, established and managed in a secure manner which guarantees the confidentiality of the identity of the author of the report and of any third party mentioned in the report and which prevents access to the said channels by unauthorised members of staff;
an acknowledgement of receipt sent to the author of the report within seven days of receipt of the report;
the designation of an impartial person or service competent to follow up reports, who may be the same person or service as the one receiving the reports and who will maintain communication with the author of the report and, if necessary, request further information and provide feedback;
diligent follow-up by the person or department designated to follow up reports whose author is identified or identifiable;
a reasonable time limit for providing feedback, not exceeding three months from the acknowledgement of receipt of the report or, in the absence of an acknowledgement sent to the author of the report, three months from the expiry of the seven-day period following the report;
the provision of clear and easily accessible information on reporting procedures to the competent authorities and, where appropriate, to EU institutions, bodies, offices or agencies, as well as appropriate information on the use of internal reporting channels.
Reporting channels must allow reports to be made in writing or orally or both in one of the three administrative languages. It is possible to report orally by telephone or via other voice messaging systems and, at the request of the person reporting, by means of a face-to-face meeting within a reasonable time.
The task of the Reporting Office is to provide information and assistance to anyone wishing to make an internal or external report, explaining the procedures to be followed and gathering information on any shortcomings in the establishment of internal reporting channels.
The Office is also responsible for raising public awareness of existing whistleblower protection legislation and drawing up recommendations on any issue relating to the application of the legislation.
In addition, the Office may notify the competent authorities if it becomes aware of a breach of the obligation to set up internal reporting channels.
Persons wishing to report breaches may report information on violations using external reporting channels and procedures after having reported via internal reporting channels or by reporting directly via external reporting channels.
When the whistleblower wishes to report breaches using the external reporting channel, it is suggested that the authorities in place in many areas be used, such as the Inspectorate of Labour and Mines (ITM) when reporting breaches relating to labour legislation.
External reporting channels allow for both written and verbal reporting. It is possible to report orally by telephone or via other voice messaging systems and, at the request of the reporter, by means of a face-to-face meeting within a reasonable period of time.
Which competent authorities can receive an external report?
Within the limits of their respective tasks and competences, the following authorities, hereinafter referred to, receive external report directly in one of the three administrative languages or in any other language accepted by the competent authority concerned:
Financial Sector Supervisory Commission;
The Supervisory Authority for the Insurance Sector;
The Competition Authority;
Registration Duties, Estates and VAT Authority;
Inspectorate of Labour and Mines;
National Data Protection Commission;
The Centre for Equal Treatment;
The Ombudsman in the context of his task of external control of places where there are persons deprived of liberty;
Ombudsman for children and youngsters;
Luxembourg Regulatory Institute;
Luxembourg Independent Audiovisual Authority;
The Luxembourg Bar association and the Diekirch Bar association;
Chamber of Notaries;
Medical Board;
Nature and Forest Agency;
Water Management Agency;
The Air Navigation Administration;
The National service of the Mediator of consumption;
The competent authorities are responsible for receiving reports, providing feedback and following them up.
Competent authorities are obliged to:
acknowledge receipt of alerts promptly and within seven days of receipt of the report, unless the author of the report expressly requests otherwise or unless the competent authority has reasonable grounds to believe that acknowledging receipt of the report would compromise the protection of the identity of the author of the report;
ensure diligent follow-up of reports;
provide the author of the alert with feedback within a reasonable period of time not exceeding three months, or six months in duly justified cases;
inform the author of the report of the final outcome of the action taken in response to the report, subject to information falling within the scope of a legally sanctioned obligation of secrecy;
forward the information contained in the report to the competent EU institutions, bodies, offices or agencies in good time.
The competent authorities, after duly considering the matter, may decide that an infringement reported is manifestly minor and does not require any further follow-up other than the closure of the procedure. In this case, the competent authorities shall notify the author of the alert of their decision and the grounds on which it is based.
A whistleblower may proceed with a public disclosure and benefit from the protection provided by law, if he or she has first made an internal and external report or directly made an external report, for which no appropriate action has been taken, and when he or she has reasonable grounds for believing:
there is an imminent or obvious danger to the public interest; or
that there is a risk of reprisals with little chance of remedying the breach following an external report.
The law sets out a non-exhaustive list of prohibited reprisals against whistleblowers.
The following in particular are prohibited :
suspension of an employment contract, lay-off, dismissal, non-renewal or early termination of a fixed-term employment contract or equivalent measures;
downgrading or refusal of promotion;
transfer of duties, change of place of work, reduction in salary, change in working hours;
suspension of training;
disciplinary measures imposed or administered, reprimand or other sanction, including a financial penalty;
failure to convert a temporary employment contract into a permanent contract, where the employee had a legitimate expectation of being offered permanent employment;
coercion, intimidation, harassment, or ostracism;
discrimination, disadvantageous or unfair treatment;
negative performance evaluation or work attestation;
prejudice, including damage to the individual’s reputation, particularly on social networks, or financial loss, including loss of business and loss of income;
blacklisting on the basis of a formal or informal agreement at sector or industry level, which may mean that the individual will not be able to find future employment in the sector or industry;
early termination or cancellation of a contract for goods or services;
What recourse is available to whistleblowers who have suffered reprisals?
Most reprisals are null and void as of right.
The author of a report may, within fifteen days following the notification of the measure, request, through an introductory act, that the competent jurisdiction declares the nullity of the measure and orders its cessation.
A person who has not invoked the nullity of the measure or who has invoked it and, where applicable, obtained nullity, may still bring a legal action for compensation for the damage suffered.
In the context of proceedings brought before a court or a competent authority concerning damage suffered by the author of an alert, and provided that the latter establishes that he or she has issued a report or made a public disclosure and that he or she has suffered damage, it shall be presumed that the damage was caused in reprisal for the report or public disclosure. In this case, the person who took the prejudicial action is responsible for establishing the grounds on which the action was taken.
When persons report information about violations or make a public disclosure in accordance with the law, they shall not be considered to have breached any restriction on disclosure of information and shall not incur liability of any kind in respect of such reporting or public disclosure provided that they had reasonable grounds for believing that the reporting or public disclosure of such information was necessary to reveal a breach.
Reporting persons shall not incur any liability in respect of the obtaining of, or access to, information which is reported or publicly disclosed, provided that such obtaining or access does not constitute a separate criminal offence. In the event that such obtaining or access constitutes an autonomous criminal offence, criminal liability shall continue to be governed by applicable national and European law.
Similarly, any other potential liability of whistleblowers arising from acts or omissions not related to the reporting or public disclosure or not necessary to reveal an infringement continues to be governed by applicable national and European law.
In legal proceedings, including for defamation, breach of copyright, breach of secrecy, breach of data protection rules or disclosure of business secrets, or for claims for compensation based on private law, public law or collective labour law, whistleblowers shall not incur any liability as a result of reports or public disclosures. Such persons shall have the right to rely on the report or public disclosure to request that the proceedings be discontinued, provided that they had reasonable grounds for believing that the report or public disclosure was necessary to reveal a breach.
An administrative fine may be imposed by the competent authorities or the Reporting Office on natural and legal persons who:
obstruct or attempt to obstruct a report;
refuse to provide information deemed necessary by the competent authorities, or provide incomplete or false information; or
infringe the confidentiality enjoyed by the authors of a report;
refuse to remedy the breach observed;
fail to establish channels and procedures for internal reporting and follow-up.
The fine can range from €1,500 to €250,000. The maximum fine may be doubled in the event of a repeat offence within 5 years of the last sanction becoming final.
In addition, persons who take retaliatory measures or bring abusive proceedings against the authors of an alert may be punished by a fine of between €1,250 and €25,000.
The perpetrator of a report who knowingly reports or publicly discloses false information may be subject to a prison sentence of between eight days and three months and a fine of between €1,500 and €50,000. The perpetrator of a false report will be held civilly liable, and the entity that has suffered damage may seek compensation before the competent court.