Recital 79
Directive on the protection of persons who report breaches of Union law · UE 2019/1937
| (79) | Persons making a public disclosure should qualify for protection in cases where, despite internal and external reporting, the breach remains unaddressed, for instance in cases where the breach was not appropriately assessed or investigated, or no appropriate remedial action was taken. The appropriateness of the follow-up should be assessed according to objective criteria, linked to the obligation of the competent authorities to assess the accuracy of the allegations and to put an end to any possible breach of Union law. The appropriateness of the follow-up will thus depend on the circumstances of each case and of the nature of the rules that have been breached. In particular, a decision by the authorities that a breach was clearly minor and no further follow-up, other than closure of the procedure, was required could constitute appropriate follow-up pursuant to this Directive. |
In Luxembourg, the law of 16 May 2023 on the protection of whistleblowers sets the operational deadlines that materialise the 'appropriate follow-up' of recital 79: acknowledgement of receipt within 7 days, feedback to the whistleblower within 3 months maximum, with an explicit obligation to provide reasoning for the final decision. The Office des rapports de signalement (OFRS) is the transversal authority that will assess the appropriateness of the follow-up, in coordination with the CSSF (finance), CNPD (data), ITM (labour), CAA (insurance) or ILR (telecom) depending on the subject matter. Retaliation against a whistleblower who has publicly disclosed after an inappropriate follow-up exposes to criminal fines of 1,250 to 25,000 EUR (doubled in case of recidivism), cumulative with civil damages.
Luxgap practice: for each report, keep the timestamped trace of the 3 key milestones (D+7 acknowledgement, D+90 feedback, reasoned decision) and a structured record of corrective measures. Without this triple proof, the OFRS will presume the follow-up inappropriate and any public disclosure will become protected.
