Recital 65
Directive on the protection of persons who report breaches of Union law · UE 2019/1937
| (65) | As recipients of reports, the authorities designated as competent should have the necessary capacities and powers to ensure appropriate follow-up, including assessing the accuracy of the allegations made in the report and addressing the breaches reported by launching an internal enquiry, investigation, prosecution or action for recovery of funds, or other appropriate remedial action, in accordance with their mandate. Alternatively, those authorities should have the necessary powers to refer the report to another authority that should investigate the breach reported, while ensuring that there is appropriate follow-up by such authority. In particular, where Member States wish to establish external reporting channels at a central level, for instance in the area of State aid, Member States should put in place adequate safeguards in order to ensure that the requirements of independence and autonomy laid down in this Directive are respected. The establishment of such external reporting channels should not affect the powers of the Member States or of the Commission concerning supervision in the field of State aid, nor should this Directive affect the exclusive power of the Commission as regards the declaration of compatibility of State aid measures in particular pursuant to Article 107(3) TFEU. With regard to breaches of Articles 101 and 102 TFEU, Member States should designate as competent authorities those referred to in Article 35 of Council Regulation (EC) No 1/2003 (35) without prejudice to the powers of the Commission in this area. |
In Luxembourg, the Office des rapports de signalement (OFRS) created by the law of 16 May 2023 is the cross-sectoral external authority receiving reports, assessing admissibility and redirecting them to the competent sectoral authority (CSSF, CNPD, ITM, CAA, ILR). The internal channel obligation threshold is 50 employees for the private sector, no threshold for the public sector. Criminal sanctions range from 1,250 to 25,000 EUR, doubled on recidivism, on top of civil compensation for the whistleblower.
Luxgap practice: configure your internal channel with an explicit mapping to OFRS and each LU sectoral authority, so you can document referral within 48 hours when a report exceeds your scope of competence.