The adopted document aims to create mechanisms for the legal protection of employees who report violations, including corruption, which they become aware of in the course of their professional activities. According to the Directive, such mechanisms should provide protection from repressive actions for a wide range of persons, including:

• employees;
• self-employed persons;
• volunteers and interns;
• members of corporate structures, including shareholders and senior management;
• employees of third-party contractors: contractors, subcontractors, and suppliers;
• former and future employees.

The document also provides for the need to protect persons who are in a family, business, or any other relationship with the whistleblower if there is a likelihood that their rights will be violated due to the disclosure of information by the whistleblower.

A person acquires the status of a whistleblower and the right to appropriate protection if they report, on their own behalf or anonymously, illegal activities affecting the interests of the European Union and the principles of the internal market, and violations in areas such as:

• public procurement;
• financial services, products, and markets, as well as the prevention of money laundering and terrorist financing;
• the protection of confidentiality and personal data, as well as network and information security and others.

To obtain legal protection, a person must have reasonable grounds to believe that the information they are reporting was true at the time of filing the complaint and that the disclosure of this type of information is provided for by this Directive, and that the method of disclosure they have chosen has been used in accordance with the provisions of the Directive.

The document provides for three possible ways to report identified violations:

• internal channels within the organization;
• external channels, such as law enforcement agencies;
• public disclosure (media).

The document encourages employees to disclose information about violations primarily through the company's internal channels. Resorting to external channels or public disclosure is recommended only if internal channels have not yielded results or if there is a high probability of repressive retaliation when using internal channels, as well as if the violation may pose an imminent or clear threat to the public interest and requires immediate disclosure. However, the decision on which reporting channel to use should remain with the whistleblower.

Organizations with more than 50 employees are required to establish internal channels for reporting violations. The employer must notify the complainant of receipt of the complaint within seven working days and provide them with information about the actions planned in connection with the complaint within three months of its submission. The channels used to report violations must ensure the confidentiality of the whistleblower's personal data. In addition, organizations are encouraged to train their employees on how to use both internal and external channels for disclosing information.

Among the examples of possible repressive actions by an employer or contractor in response to the disclosure of information about violations, the document highlights:

• restricting access to employment through unjustified dismissal or creating barriers to entering into employment relationships with other employers;
• creating career barriers that block professional development, including refusal to promote or participate in training;
• actions aimed at undermining trust in the whistleblower, such as discrediting them on social media;
• imposing unreasonable financial sanctions, such as withholding bonuses or reducing salaries;
• unjustified revocation of an employee's licenses or permits, and others.

The burden of proving the justification for any actions taken against an employee with whistleblower status lies with the employer.

EU countries must create conditions that provide protection from such repressive actions against persons reporting illegal activities.

In addition, according to the document, a whistleblower should not be considered to have violated any prohibitions on the disclosure of confidential information and should not be held liable for this, provided that the disclosure of the information was necessary to identify the violation. They should also not be held liable for the manner in which the information was obtained, provided that it did not involve acts expressly prohibited by criminal law.

According to the provisions of the Directive, EU Member States must, where necessary, ensure that whistleblowers have access to free legal advice on legal protection against persecution and to legal assistance in criminal and civil proceedings, and that any damage caused to them and expenses incurred are compensated. Whistleblowers will also receive additional protection, for example, it will not be possible to dismiss the applicant until the proceedings have been completed.

Directive 2019/1937/EU was adopted after high-profile scandals such as Cambridge Analytica, the Panama Papers, and Luxleaks, which demonstrated the importance of whistleblowers in exposing crimes, including corruption. According to representatives of the European Commission, most illegal activities in organizations go unnoticed because employees do not report them for fear of losing their jobs or becoming victims of reprisals.

The aim of the Directive is to create a unified system of legal norms in the Member States of the European Union to ensure comprehensive protection for such persons. Once the Directive enters into force, countries will have two years to bring their national legislation into line with its provisions and adopt the necessary regulations establishing uniform requirements for companies to set up a system for whistleblowing and protecting whistleblowers.