Record keeping of the reports
Directive on the protection of persons who report breaches of Union law · UE 2019/1937
Record keeping of the reports
1. Member States shall ensure that legal entities in the private and public sector and competent authorities keep records of every report received, in compliance with the confidentiality requirements provided for in Article 16. Reports shall be stored for no longer than it is necessary and proportionate in order to comply with the requirements imposed by this Directive, or other requirements imposed by Union or national law.
2. Where a recorded telephone line or another recorded voice messaging system is used for reporting, subject to the consent of the reporting person, legal entities in the private and public sector and competent authorities shall have the right to document the oral reporting in one of the following ways:
| (a) | by making a recording of the conversation in a durable and retrievable form; or |
| (b) | through a complete and accurate transcript of the conversation prepared by the staff members responsible for handling the report. |
Legal entities in the private and public sector and competent authorities shall offer the reporting person the opportunity to check, rectify and agree the transcript of the call by signing it.
3. Where an unrecorded telephone line or another unrecorded voice messaging system is used for reporting, legal entities in the private and public sector and competent authorities shall have the right to document the oral reporting in the form of accurate minutes of the conversation written by the staff member responsible for handling the report. Legal entities in the private and public sector and competent authorities shall offer the reporting person the opportunity to check, rectify and agree the minutes of the conversation by signing them.
4. Where a person requests a meeting with the staff members of legal entities in the private and public sector or of competent authorities for reporting purposes pursuant to Articles 9(2) and 12(2), legal entities in the private and public sector and competent authorities shall ensure, subject to the consent of the reporting person, that complete and accurate records of the meeting are kept in a durable and retrievable form.
Legal entities in the private and public sector and competent authorities shall have the right to document the meeting in one of the following ways:
| (a) | by making a recording of the conversation in a durable and retrievable form; or |
| (b) | through accurate minutes of the meeting prepared by the staff members responsible for handling the report. |
Legal entities in the private and public sector and competent authorities shall offer the reporting person the opportunity to check, rectify and agree the minutes of the meeting by signing them.
In Luxembourg, the law of 16 May 2023 on the protection of whistleblowers transposes Article 18 and requires record keeping of every report in compliance with confidentiality, under the oversight of the Office des rapports de signalement (OFRS) as the transversal external authority. Depending on the field, reports may also go to the CSSF (finance), CNPD (data), ITM (labour), CAA (insurance) or ILR (telecom). The threshold is 50 employees for private and public sectors, with no threshold for public bodies. Breaches carry criminal fines of 1,250 to 25,000 EUR (doubled on repeat offence), plus civil compensation.
Luxgap practice: set up a documented retention policy and a timestamped audit trail from the very first report, as the OFRS primarily checks confidentiality and storage duration during an audit.
