Whistleblower protection and reporting channels in the Netherlands

Yes. As of 18 February 2023, the Whistleblowers Protection Act (in Dutch: Wet bescherming klokkenluiders) ("WPA"), which transposess the EU Directive (2019/1937), came into effect for private companies, although some parts of the WPA are not yet fully implemented. These remaining parts are expected to come into force in 2023.

Yes. One of the differences under the WPA is to broaden the definition of employee to include everyone who is either employed or who is otherwise financially dependent and performs work for payment. This means that in terms of the 50-employees threshold, temporary workers, interns, paid volunteers, and consultants must also be taken into account. Another important difference is that there is no threshold for companies in certain industries such as financial services. These companies are obliged to establish a whistleblowing system even if they only 'employ' one employee. For companies between 50 – 249 employees, some parts of the WPA, such as the obligation to implement an internal whistleblowing reporting channel, will come into force on 17 December 2023.

One of the parts yet to be implemented is the ability to report anonymously.

Companies that fail to implement the measure on time can be confronted with legal sanctions. For example an employee could be forced to implement the channel by the court. The Dutch Whistleblowers Authority can order the same. One of the parts of the WPA that is still to be implemented is to extend special powers to the Dutch Whistleblowers Authority to impose administrative penalties and/or other sanctions.

There are several other legal risks. The WPA allows whistleblowers to first make an external report instead of reporting internally first. Failure to provide for an internal whistleblowing reporting channel increases the risk that employees make their report public, which means that the company is no longer taking the lead in the investigation. Also, besides the Dutch Whistleblowers Authority, several other regulators have been formally appointed under the WPA to handle external reports, such as the regulator for financial services, insurance companies, oil & gas industry, the competition authority and the Dutch Privacy Authority. 

Yes. Based on the WPA, the internal reporting channel must allow employees to report in person at the company’s office; by telephone or through another application that can record the report (if the report is capable of being recorded); and/or in writing (including online). The company must also (i) explain how internal reports are handled within the company; (ii) explain what the definition of wrongdoings is (it is advisable to include examples); (iii) include the name/contact details of the officer where an official report can be made; (iv) explain that the employee can confidentially consult an advisor when in doubt, for example, to make a report; (v) explain that a report can also be made externally and refer to the designated (European) authority; and (vi) provide information about the legal protection the whistleblower enjoys.

The receipt of a report must be acknowledged within seven days and subsequently the reporter must be informed about the how the report was followed up within three months. The company must also ensure that it sets up a register with solid logging & monitoring as well as strict rules on who can access the register, ensure that information is deleted within the legal term, and manage the (cyber) security settings of the register.

There are separate rules about the information that must be provided about possible breaches of Union law.

Companies may decide to allow people other than those who fall under the definition of employee to make an internal report under the WPA.

Yes, the implementation of a new or amended whistleblowing procedure is subject to consent of (i) the works council; (ii) the personnel representation body (PVT in Dutch); or if there is no obligation to establish a works council (for which there is a threshold of 50 regular employees) the consent of more than 50% of the employees must be sought. Oddly, the WPA seems to 'forget' companies that meet the threshold to establish a works council but have failed to do so.

The WPA allows for an external report even if no internal report has been made first. The external report should be made with the Dutch Whistleblowers Authority or with one of the designated external reporting authorities.

Whistleblowers are protected (including a layer of third parties connected to the whistleblower), however, only if the appropriate steps under the WPA have been taken. Making a report immediately available to the public is not allowed or at least a whistleblower may no longer be protected if it was possible to make the report first internally or externally as set out under the WPA.

Companies must be aware of the new definition of breach or wrongdoing under the WPA.

Yes, based on Article 7:658c of the Dutch Civil Code (DCC) there is a prohibition on prejudicing of employees that have in good faith and properly made a report to the employer or an external authority of a suspicion of malpractices within the meaning of the current act. Article 7:658c DCC covers prejudicial actions regarding the legal position of the employee, such as dismissal, demotion, reduction of salary or suspension. The WPA introduces additional legal protection mechanisms against judicial and extrajudicial reprisals against a whistleblower, such as (i) stronger protection from an evidential point of view to be able to appeal to the right not to suffer prejudicial actions; (ii) the definition of prejudicial actions includes all forms of disadvantage (for example bullying, intimidation and refusal to provide a reference); (iii) in case a whistleblower makes a public disclosure, he or she also enjoys protection if the report was made in good faith and the relevant steps under the WPA have been taken; (iv) indemnification from accountability as a consequence of the report.

Yes, the GDPR and the Dutch GDPR Implementation Act must be complied with. Operating a whistleblowing system will inevitably involve processing personal data. Processing data requires a legal basis as laid down in Articles 6 and 9 of the GDPR. Moreover, processing must always be carried out in the least invasive way possible to minimise the impact on the data subject. The principle of data minimisation according to Art. 5 GDPR must be observed. Personal data irrelevant to a specific report must not be collected or must be deleted without undue delay.

Additionally, companies must comply with their information obligation under the GDPR. A reporting channel may also trigger other obligations under the GDPR, such as the obligation to conduct a data protection impact assessment under Art. 35 GDPR. Also in case of processing data related to criminal offences, the requirements of Art. 10 GDPR and Article 32 and 33 of the Dutch GDPR Implementation Act should be taken into account.

No. However, processing personal data, including sharing data between various foreign entities, must comply with the GDPR.

Under the WPA, a legal entity that must comply with the WPA (see above) is required to set up its own internal reporting channel, even when the entity is part of a group of companies. Companies within a group may introduce the same whistleblowing policy (bear in mind the role of co-determination of employees) and may also set up a joint whistleblowing system; however if an employee wishes to make a report at the level of the individual entity this must be possible. Employers with 50 – 249 employees are allowed to share resources with regard to the receipt of reports and any investigation to be carried out.