I need to bring my Luxembourg organisation into compliance with recital 98 of Whistleblowing (UE 2019/1937). What are the concrete requirements, the sanctions, and how can Luxgap support me?

Recital 98 Whistleblowing — Recital 98

EU frameworkGDPR NIS 2 DORA AI ActWhistleblowing

CSSF circularsCSSF 22/806 CSSF 25/883 CSSF 25/880 CSSF 25/881 CSSF 25/882 CSSF 20/750 CSSF 12/552 CSSF 11/504 (repealed)CSSF 24/847

Recital 98

Directive on the protection of persons who report breaches of Union law · UE 2019/1937

(98)

Directive (EU) 2016/943 of the European Parliament and of the Council (46) lays down rules to ensure a sufficient and consistent level of civil redress in the event of unlawful acquisition, use or disclosure of a trade secret. However, it also provides that the acquisition, use or disclosure of a trade secret is to be considered lawful to the extent that it is allowed by Union law. Persons who disclose trade secrets acquired in a work-related context should only benefit from the protection granted by this Directive, including in terms of not incurring civil liability, provided that they meet the conditions laid down by this Directive, including that the disclosure was necessary to reveal a breach falling within the material scope of this Directive. Where those conditions are met, disclosures of trade secrets are to be considered allowed by Union law within the meaning of Article 3(2) of Directive (EU) 2016/943. Moreover, both Directives should be considered as being complementary and the civil redress measures, procedures and remedies as well as exemptions provided for in Directive (EU) 2016/943 should remain applicable for all disclosures of trade secrets falling outside the scope of this Directive. Competent authorities that receive information on breaches that includes trade secrets should ensure that they are not used or disclosed for purposes going beyond what is necessary for proper follow-up of the reports.

Luxembourg specificity

loi luxembourgeoise du 16 mai 2023 relative a la protection des lanceurs d'alerte

In Luxembourg, the law of 16 May 2023 on whistleblower protection transposes this logic: Article 2 extends the scope to national law breaches, which mechanically broadens the trade secret disclosures covered compared with the EU baseline alone. The OFRS, as transversal authority, must compartmentalise received trade secrets and any breach of secrecy by an agent exposes to criminal sanctions from EUR 1,250 to EUR 25,000 (doubled in case of repeat offence) in addition to civil liability.

Luxgap practice: configure your channel to separately log items qualified as trade secrets and generate the necessity memo before any transfer to the OFRS, CSSF or CNPD, in order to secure the civil liability exemption in case of employer retaliation.

Luxgap guidance · DPO & CISO

How to comply

The classic trap

Recital 98 articulates the whistleblower directive with Directive 2016/943 on trade secrets. The trap: a company retaliates against a whistleblower not on the report itself, but on the trade secret disclosure that came with it (source code, formulas, margins, client lists). The OFRS and the CNPD will then check whether the disclosure was necessary to reveal the breach: if yes, it is lawful under Article 3(2) of Directive 2016/943 and the unfair competition action fails. If not, the whistleblower loses protection and incurs civil liability.

The necessity test: the ridge line

For a trade secret disclosure to be covered by whistleblower protection, four conditions must be cumulatively met:

The report falls within the material scope of the directive (GDPR, anti-money laundering, public procurement, product safety, public health, etc.).
The whistleblower had reasonable grounds to believe in the truth of the information at the time of reporting.
The trade secret disclosure was necessary: no other way to reveal the breach, and scope limited to what proves the violation.
The channel respects the hierarchy (internal, external OFRS/CSSF/CNPD, then public only in case of failure or imminent risk).

Symmetrically, the OFRS and any competent authority receiving a report containing a trade secret must compartmentalise this information: strict need-to-know access, logging, prohibition of use beyond report follow-up. A leak by the authority triggers its liability and that of the State.

How Luxgap automates this risk

Our Luxgap Trade Secret Shield turns your reporting channel into a vault that automatically distinguishes facts constituting the breach from related trade secret elements, and seals the latter under restricted access before the investigator even accesses them. The tool relies on a specialised AI agent trained on CJEU case law and the EDPB framework to qualify each attachment (source code, R&D formula, client list, commercial margin) and apply the minimisation rule imposed by recital 98.

Automatically classifies each attachment of a report between probative fact and trade secret, based on ISO 27001 A.5.13 taxonomy and Directive 2016/943.
Redacts on the fly passages identified as trade secrets not necessary to the evidence, and keeps the full version under encryption with dual-validation access.
Generates an enforceable necessity memo documenting why disclosing the secret was indispensable to reveal the breach, ready to produce before the labour tribunal or commercial court.
Logs each access to trade secrets with eIDAS-qualified timestamp, agent identity, invoked purpose and consultation duration.
Instantly alerts the DPO and compliance officer when a trade secret is accessed for a purpose beyond report follow-up.
Produces a cryptographically sealed integrity report, enforceable during an OFRS audit or an unfair competition action.

Available as a complement to a Luxgap DPO or CISO mandate or as a standalone SaaS module depending on your scope. Request a custom quote and our teams will prepare a demonstration on a real mixed-reporting case, with a free 48h white audit to measure the robustness of your current channel before any commitment.

Need help with this article?

Our team (lawyers + cyber engineers) gives you the concrete stuff. Reply within 24 business hours.

Recital 98

They trust us

Before we chat