Whistleblower protection and reporting channels in Belgium

Yes, the "whistleblower directive" 2019/1937 of the European Parliament and Council was transposed in Belgium into two laws, one for the private sector, and the other for the (federal) public sector:

• the Act of 28 November 2022 on the protection of reporters of breaches of Union or national law established within a legal entity in the private sector (hereinafter “the Act”) ; and
• the Act of 8 December 2022 on the reporting channels and protection of those who report of integrity violations in the federal public authorities and in the integrated police.

The following questions in this guide will be answered taking into account the legal dispositions applicable to the private sector (i.e. the Act of 28 November 2022 on the protection of reporters of breaches of Union or national law established within a legal entity in the private sector) and not those applicable to the public sector.

The Act imposes on legal entities with fifty or more employees in the private sector the obligation to establish, after consultation with social partners, channels and procedures for the internal reporting and of the violations targeted by the Act and for following up on such reports.

Failure to comply with the provisions of Chapter 3 of the Act (establishing an internal reporting channel and following up reports) is punishable in the Social Penal Code by a Level 4 sanction, being either a six-month to three years prison sentence and a criminal fine of EUR 600 to EUR 6000 or either one of those penalties alone, or an administrative fine of EUR 300 to EUR 3000.  

Yes, as mentioned in question n° 2 legal entities in the private sector with fifty or more employees must establish an internal reporting channel.

Companies are free to choose how they organise the reporting channel. However, The Act does prescribe certain elements that must be provided for in the reporting channel. For example, they must ensure that the reporting system set up ensures the confidentiality of the identity of the reporter and any third parties named in the report, and access by unauthorised personnel must be excluded. The reporting system that is set up must also allow reports to be made orally or in writing, or both, etc.

The reporting channel must be clearly written out, but the employer is free to decide what type of document this would be written out in (e.g. the employment regulations, a separate policy, etc.).

Yes, as mentioned in question n° 2 the legal entities obliged to establish an internal reporting channel have to consult the social partners (i.e. the employee representatives) when doing so.

 No. However, the disclosing of irregularities/misconduct should not lead to the unnecessary disclosure of protected confidential information.

Yes, the Act protects reporters/whistleblowers from all forms of retaliation if they had reasonable grounds to believe that the reported information about breaches at the time reporting was accurate and that the information fell within the material scope of the Act.

The Act confirms that any processing of personal data under the Act, including the exchange or transfer of personal data by the competent authorities or the Federal Coordinator must be done in accordance with the General Data Protection Regulation ("GDPR"). Furthermore, the Act commands that personal data that is clearly not relevant to the processing of a specific report, not be collected, or, if collected unintentionally, be deleted immediately.

No, however the basic principle of the directive is that each legal entity sets up its own reporting system. Nevertheless, the Directive and the Act do provide, under certain conditions, for the possibility on the one hand of joining forces by sharing resources or, on the other hand, of partly outsourcing the reporting system.