I need to bring my Luxembourg organisation into compliance with recital 46 of Whistleblowing (UE 2019/1937). What are the concrete requirements, the sanctions, and how can Luxgap support me?

Recital 46 Whistleblowing — Recital 46

EU frameworkGDPR NIS 2 DORA AI ActWhistleblowing

CSSF circularsCSSF 22/806 CSSF 25/883 CSSF 25/880 CSSF 25/881 CSSF 25/882 CSSF 20/750 CSSF 12/552 CSSF 11/504 (repealed)CSSF 24/847

Recital 46

Directive on the protection of persons who report breaches of Union law · UE 2019/1937

(46)

Whistleblowers are, in particular, important sources for investigative journalists. Providing effective protection to whistleblowers from retaliation increases legal certainty for potential whistleblowers and thereby encourages whistleblowing also through the media. In this respect, protection of whistleblowers as journalistic sources is crucial for safeguarding the ‘watchdog’ role of investigative journalism in democratic societies.

Luxembourg specificity

loi luxembourgeoise du 16 mai 2023 relative a la protection des personnes signalant des violations du droit

In Luxembourg, the law of 16 May 2023 on the protection of whistleblowers enshrines the media channel as a legitimate disclosure route and grants the Office des rapports de signalement (OFRS) the role of transversal authority, without prejudice to the competence of the CSSF (finance), CNPD (data), ITM (labour), CAA (insurance) and ILR (telecom). Retaliation against an employee who spoke to the press is punishable by criminal fines of 1,250 to 25,000 EUR, doubled in case of repeat offence, in addition to full civil compensation.

Luxgap practice: before any HR measure targeting an employee whose organisation has been named in a publication, have the timing and rationale validated by your DPO and keep timestamped proof that the decision is unrelated to the alert, failing which the burden of proof reverses before the labour court.

Luxgap guidance · DPO & CISO

How to comply

The classic trap

Recital 46 explicitly recognises that whistleblowers who turn to investigative journalists benefit from the directive's protection. In practice, organisations discipline or dismiss an employee after a press article reveals wrongdoing, assuming public disclosure forfeits protection. The opposite is true: Article 15 of the directive authorises public disclosure under conditions, and ECHR case law (notably Guja v. Moldova) grants reinforced protection to journalistic sources. The OFRS and the ITM may be seized of retaliation claims even where the alert reached the media first.

Three operational reflexes imposed by this recital

Never treat a press leak as automatic misconduct: first verify whether the author attempted internal or external reporting, or whether a serious threat justified direct disclosure.
Protect the identity of potential sources: even a post-publication internal investigation aimed at unmasking the source constitutes indirect retaliation and is sanctionable.
Document an internal policy that explicitly mentions the media channel as a legitimate route of disclosure in the cases listed under Article 15, to avoid the reflex-dismissal trap.

How Luxgap automates this risk

Our Luxgap Retaliation Sentinel makes invisible retaliation impossible by continuously monitoring HR, IT and access signals that follow any alert or media publication citing your organisation. The tool combines a multilingual press-watch AI agent, your Workday or Sopra Steria HR Suite exports, your Microsoft Entra ID logs and your HR Jira tickets to detect any suspicious correlation between a report and an adverse measure within 24 hours.

Scans Luxembourg and European media in real time (Paperjam, Reporter.lu, Le Quotidien, Politico, EUObserver) to flag publications citing your organisation and trigger a reinforced protection mode.
Automatically detects adverse HR measures (reassignment, access revocation, downgraded review, salary freeze, sidelining) occurring within 24 months after a registered report.
Computes a retaliation presumption score based on timing, hierarchical proximity and statistical deviation from usual HR practice, aligned with Article 21(5) of the directive on the reversed burden of proof.
Generates an investigation file ready to deliver to the OFRS or the ITM, timestamped and cryptographically sealed, to demonstrate the employer's good faith or, conversely, to materialise the retaliation.
Alerts the DPO and the compliance officer instantly via Teams or Slack as soon as a correlation is detected, with an immediate action recommendation.

Available as part of a Luxgap DPO or CISO mandate or as a standalone SaaS module depending on your scope. Request a tailored quote and our teams prepare a demonstration on your real HR data, with a free 48-hour blind audit to measure your exposure to indirect retaliation before any engagement.

Need help with this article?

Our team (lawyers + cyber engineers) gives you the concrete stuff. Reply within 24 business hours.

Recital 46

They trust us

Before we chat