New whistleblower regulation for Luxembourg

The Law of 16 May 2023 transposing Directive (EU) 2019/1937 of the European Parliament and of the Council of 23 October 2019 on the protection of persons who report violations of Union law was published in the Mémorial A n°232 of 17 May 2023.

The Law came into force on 21 May 2023.

Authors:
Celine Defay celine.defay@kleyrgrasso.com
Eloïse Hullar eloise.hullar@kleyrgrasso.com

The purpose of the Law is to protect the whistle-blower who reports or publicly discloses information about actual or potential violations obtained in the framework of their professional activities.

Violations that can be reported by the whistle-blower are acts or omissions that are unlawful or contrary to the object or purpose of national or European law. It should be noted that all national law is covered.

Who can be a whistle-blower? Current or former employees (private and public sector) as well as applicants, trainees (paid or unpaid), volunteers, self-employed persons, shareholders, administrators or directors, as well as any person working for contractors, subcontractors and suppliers.

1. Reporting system

The whistle-blower can either report internally through the reporting channels set up by the entity or report externally to the competent authority (e.g. ITM, CSSF, AAA, etc.).

The Law only encourages whistle-blowers to prefer internal reporting before external reporting, when the violation can be effectively remedied internally and there is no risk of retaliation (no prior internal reporting obligation).

2. Employer’s obligation: set up internal reporting channels within the company. In this respect, an internal procedure detailing the access, management and follow-up of reports should be established in accordance with the requirements of the Law.

• Which entities are concerned by this obligation?
• legal entities under private law with 50 or more workers during a period of 12 consecutive months;
• legal entities in the public sector (excluding municipalities with less than 10,000 residents).

For other entities, this is simply an option (the same requirements will apply).

• What is the deadline for implementing internal reporting channels?
• from 17^th December 2023 for private sector entities with between 50 and 249 workers;
• 4 days after the publication of the Law, i.e. 21 May 2023, for private sector entities with 250 or more workers and public sector entities.

3. Whistle-blowers may not be subject to retaliation: Any form of retaliation (including threats or attempts) is prohibited, or even null and void, such as dismissal. In addition to the possibility of claiming the nullity of the measure, the whistle-blower may obtain compensation for the damage suffered.

To benefit from protection, the whistle-blower must fulfil the following conditions:

• have reasonable grounds to believe that the information communicated on violations was true at the time of reporting and that this information falls within the scope of the Law;
• have made a report (internal/external/public disclosure).

There is also a sanction in case of retaliation or abusive procedures against the whistle-blower: a fine from 1.250 to 25.000 EUR.

Penalty pronounced by the competent authority or the Reporting Office (“Office des signalements”) against natural and legal persons in the event of failure to set up channels and procedures for the reporting and follow-up of such reports or of obstructing or attempting to obstruct a report: an administrative fine of between EUR 1,500 and EUR 250,000 (doubled in the event of a repeat offence within 5 years of the last penalty becoming definitive).