Belgium’s new whistleblowing law

The EU Whistleblowing Directive had to be transposed into Belgian national law by 17 December 2021 at the latest. This deadline was not met by Belgium. The Directive was, however, transposed into Belgian national law for the private sector by the law of 28 November 2022.  Although the Directive is applicable to the private as well as the public sector, the law of 28 November 2022 is only applicable to the private sector. Different legislation has been adopted for the public sector.

A survey of 200 employers in the HR sector showed that more than 1 in 2 companies already have an internal reporting system in place. Only 4 in 10 companies are considering introducing one in response to the new legislation.

Belgian companies with 250 or more workers were required to have such a system in place by 15 February 2023. Belgian companies with between 50 and 249 workers are required to set up an internal reporting channel and procedures by 17 December 2023.

Although the material scope of the Whistleblowing Directive was already extensive and included various areas of public interest in which the reporting person could report breaches of EU law (including public procurement, financial services, product safety, transport safety, protection of the environment, public health, consumer protection, protection of privacy and personal data), the Belgian legislator decided to go further, adding two more areas: tax fraud and social fraud.

From an HR perspective, the expansion of the law’s material scope to include social fraud has a big impact. Despite the fact that the Belgian law does not provide a definition of social fraud, the view of the federal finance department (FPS Finance) is that it has the same meaning as social fraud in the Social Criminal Code. This means that all (possible) breaches mentioned under the Social Penal Code can be reported. According to some, this would also mean that discrimination cases could be reported as the Belgian social inspectorates have jurisdiction in this area.

Belgian law adopts the very broad personal scope. It is not only applicable to (blue and white collar) employees, but also to former or potential employees, self-employed persons, volunteers and interns (whether paid or unpaid), shareholders and persons belonging to the administrative, management or supervisory body (including non-executive members), any persons working under the supervision and direction of contractors, subcontractors and suppliers. The measures for the protection of reporting persons will not only apply to them, but also to facilitators, third persons who are connected with the reporting person and legal entities that the reporting person owns.

The Whistleblowing Directive allows member states to take the necessary measures to prohibit any form of retaliation, including threats and attempts of retaliation. The Belgian legislator has provided that the reporting persons will be protected against retaliation. This includes things like suspension measures, dismissal, demotion, refusal of promotion, change of duties or job, reduction of wages, change of working hours, intimidation, harassment, exclusion, discrimination, non-renewal or the early termination of a fixed-term contract.

Although this was expected, the law of 28 November 2022 does not provide a period during which the protection applies, as is the case for other protections under Belgian employment law.

This protection is granted to the reporting persons on the condition that they have reasonable grounds to believe that the information they reported was correct at the time of the report and fell within the scope of the law, and that the report was made through the channels specified by law (internal reporting, external reporting or public disclosure). It is also stipulated that the reporting person does not lose protection for the sole reason that a report made in good faith ultimately turned out to be incorrect or unfounded.

Any person enjoying this protection who feels threatened or is the victim of retaliation will be able to file a complaint with the Belgian Federal Coordinator, stating the reasons for the complaint.

A person who believes they are the victim of retaliation can also raise the matter before the courts and tribunals including, if necessary, in the context of summary proceedings. The law provides for a presumption of causation between the damage suffered by the reporter as a result of the retaliatory measure and the report itself. It is then for the company that took the measure to rebut this presumption by demonstrating that the measure was based on legitimate grounds (e.g. in the case of dismissal, reasons unrelated to the report, such as performance).

If the victim of retaliation is an employee, the law provides for the award of fixed compensation, the amount of which varies between 18 and 26 weeks’ wages. This compensation cannot be combined with compensation for manifestly unfair dismissal. If the victim is another person, the compensation corresponds to the actual damage suffered and the victim must provide proof of the extent of this damage.

In the event of a report of a breach in the field of financial services, products and markets, the prevention of money laundering and the financing of terrorism, it is stipulated that the employee can request to be reinstated, if their employment contract has been terminated. In addition, the lump-sum compensation amounts to six months’ remuneration in these cases.

Companies in the private sector with at least 50 employees or companies in the financial sector must set up internal reporting channels and procedures. In this process, the social partners (i.e. the works council or, in their absence, the trade union delegation or, in their absence, the CPPW or, in their absence, the employees themselves) must be consulted. The company does not need the approval of the social partners to up reporting channels and procedures.

The internal reporting channels should, at least, be accessible to employees. Companies can decide whether or not to make internal reporting channels available to other persons.  If the company decides to make the policy also applicable to other persons, it will have to make its procedures public (e.g. by posting it on its website).

Internal reporting channels can be managed internally by a reporting manager (whistleblowing officer) or outsourced to a third party, who will then have to provide sufficient safeguards.

The whistleblowing officer may receive notifications and will be responsible for following up on reports, asking for additional information and providing feedback. They are the point of contact for the reporter, who must be kept informed of the progress of the procedure.

Belgian law does not provide for any specific job incompatibilities. It only provides that the reporting manager must be an independent, impartial person or department (i.e. having no conflicts of interest). The reporting manager may not receive instructions on how to handle a specific report and must be able to report directly to the highest level of management on (potential) risks or impediments to the performance of their duties.

The Whistleblowing Directive indicates that depending on the size and structure of the company, this role may be fulfilled by a chief compliance or human resources officer, an integrity officer, a lawyer or privacy officer, a finance director, a director of audit or a member of the board of directors.

Initially, the preparatory documents of the Belgian law provided that the reporting manager should not be in charge of the management of the organization or be part of the management team. This requirement was eventually dropped. After all, sufficient guarantees are already offered through the legal framework, since the internal reporting procedures are drawn up after consultation with the social partners, there is an option to make an anonymous report and the reporter can make a report via an external channel if they do not trust the internal channel. In any case, the company has an interest in providing internal reporting channels and procedures that are supported and trusted by employees.

The Belgian law does not provide specific regulations on how the internal reporting channel should be organised. The Whistleblowing Directive provides that it is up to the legal entity to determine what reporting channel(s) will be set up, as long as the confidentiality of the identity of the reporter is safeguarded. In its recitals, the Whistleblowing Directive specifies that it must be possible for individuals to make a report in writing (by post, via physical complaint boxes or an online platform) or orally (via a special telephone number or other voice messaging service).

Providing multiple reporting channels is recommended, to ensure that the reporter can choose how to report. The survey of 200 Belgian employees mentioned above found that an e-mail address is the most popular internal reporting channel for companies. In addition, a meeting with the reporting manager, a telephone conversation and even a hotline are often provided.

The company is free to indicate which information must be included in the report. Furthermore, a company that employs between 50 and 249 employees can decide for itself whether to allow anonymous reports. If it allows anonymous reports, it must determine the necessary measures to ensure that the report remains anonymous. An anonymous report has the disadvantage that the company is confronted with certain limitations when handling it. However, when a company refuses anonymous reports, the individual who wishes to make an anonymous report may turn to an external reporting channel.

The Belgian law implements the two deadlines provided for by the Whistleblowing Directive without change. First, the confirmation of receipt of the notification needs to be done within 7 days. Second, providing feedback on the report must be done within a reasonable time and at the latest within 3 months from the date of the acknowledgment of receipt. In other respects the company is free to develop a procedure to be followed by the reporting manager, which must, however, take into account the confidential treatment of the report.

The law does not specify the legal instrument that should contain these rules. The company can therefore choose how to do this, whether via the work rules, a collective bargaining agreement or a simple company policy. Amending work rules for this purpose is not recommended, given the rigid procedure that applies to changing these (and any annexes). Instead, a simple policy is recommended, which should be signed by each individual employee to acknowledge receipt (but not agreement). The policy must be drawn up in the appropriate language, in accordance with Belgian labour relations law.

The company must indicate that reporters can also use external reporting channels. The company must provide the contact details of the Federal Coordinator, who is responsible for coordinating reports made via external channels, as well as the authorities to which direct reports may be made.

Companies will have to take measures to secure internal channels to ensure the confidentiality of the reporting person and any third parties mentioned in the reports, and to prevent unauthorised access. The reporting person’s identity will not be disclosed without their express and free consent, unless this is necessary and proportionate under specific legislation in the context of an investigation by national authorities or in the context of legal proceedings, in particular, to protect the rights of a data subject to defend themselves.

Reports – including those made orally – will have to be recorded. When a report is made over a telephone line or a voice messaging system, the report may either be recorded or completely and accurately transcribed. The reporter must then be given the opportunity to approve this transcription. To this end, companies will have to keep a specific register of all notifications they receive.

The law stipulates that reports must be kept for the duration of the contractual relationship between the reporter and the employer. However, the length of time for keeping reports made by third parties – assuming a company chooses to open its internal channels to persons other than its employees – is not specified.

Violations of the Belgian law are punishable by a sanction at level 4 of the scale provided in the Social Criminal Code: i.e. a prison sentence of between 6 months and 3 years and/or a fine of between EUR 4,800 and 48,000; or an administrative fine of between EUR 2,400 and EUR 24,000 (per employee).

The Belgian law entered into force on 15 February 2023, i.e. two months after it was published in the Belgian National Gazette. Companies in the financial sector and companies with 250 employees or more had to set up internal reporting channels and procedures by 15 February 2023. Companies with 50 to 249 employees have until 17 December 2023 to set up internal reporting channels and procedures.