EU frameworkGDPRNIS 2DORAAI ActWhistleblowing
Recital 37

Recital 37

Directive on the protection of persons who report breaches of Union law · UE 2019/1937

(37)

Effective enforcement of Union law requires that protection should be granted to the broadest possible range of categories of persons, who, irrespective of whether they are Union citizens or third-country nationals, by virtue of their work-related activities, irrespective of the nature of those activities and of whether they are paid or not, have privileged access to information on breaches that it would be in the public interest to report and who may suffer retaliation if they report them. Member States should ensure that the need for protection is determined by reference to all the relevant circumstances and not merely by reference to the nature of the relationship, so as to cover the whole range of persons connected in a broad sense to the organisation where the breach has occurred.

Luxembourg specificity
loi luxembourgeoise du 16 mai 2023 relative a la protection des lanceurs d'alerte

In Luxembourg, the law of 16 May 2023 on the protection of whistleblowers transposes recital 37 very broadly and lists in article 3 every protected category: employees, civil servants, self-employed, shareholders, board members, volunteers, interns, applicants and former staff. The Office des rapports de signalement (OFRS) oversees scope compliance. Any obstruction of a report through wrongful exclusion is criminally sanctioned from 1,250 to 25,000 EUR, doubled in case of repeat offence.

Luxgap practice: your reporting policy must reproduce verbatim the list of protected persons in article 3 of the law of 16 May 2023, and your internal channel must remain open to former employees at least for the civil retaliation limitation period.