The Luxembourg Whistleblower Protection law
The Luxembourg transposition of the EU Whistleblower Protection Directive is now in force.
This means it has completed the transposition of the EU Whistleblower Protection Directive's requirements for protecting whistleblowers who report violations of European and national laws.
The EU Directive requires private sector employers regularly employing at least 250 employees, and public sector employers regularly employing at least 50 employees, to establish a secure, confidential whistleblowing channel by the relevant deadlines.
To learn the latest developments and specific details on Luxembourg’s whistleblowing laws, including deadlines for action, complete this form and receive its data sheet.
Download now
The Luxembourg Whistleblower Protection law
Like all other members of the European union, Luxembourg is required to transpose the EU Whistleblower Protection Directive into its national law, which will become the Luxembourg Whistleblower Protection law. The EU Directive obliges businesses with 50 employees or more to have a reporting channel for a broad spectrum of potential whistleblowers, and forbids reprisals against whistleblowers. The deadline for transposition was 17th December 2021, which Luxembourg did not meet.
What is the current status of the Luxembourg Whistleblower Protection law?
There is currently no national Luxembourg Whistleblower Protection law. The country has a number of industry-specific regulations, most notably the CAA/CSSF Procedures requiring credit institutions and (re-)insurance companies to implement a whistleblowing system.
On 12 January 2022, the Government of Luxembourg announced that a draft law, Draft Law 7945, had been presented by the Minister of Justice to transpose the EU Directive into Luxembourg law. The proposal extends the scope of application of the Directive beyond reports of violations of EU law to include Luxembourg national law. Interestingly, it also states that whistleblowers, who have knowingly notified or publicly disclosed false information may be subject to imprisonment and a fine. While not required by the EU directive, Luxembourg plans to set up a whistleblower office under the authority of the justice ministry, which will help companies implement the new rules.
The draft law states that it will enter into force on the fourth day following its publication in the Official Gazette. At that point, the approximately 150 private entities in Luxembourg that have 250 employees or more will immediately need to comply with the draft law and the Whistleblowing Directive. Private entities with between 50-249 employees will have until 17 December 2023 at the latest.
The Government of Luxembourg revealed The Luxembourg Whistleblower Protection Law draft, Draft Law 7945, announced 12 January 2022, would transpose, and go further than, EU Whistleblower Protection Directive requirements. Luxembourg currently has no whistleblower protection in its national laws, except whistleblowing industry specific regulations, such as the CAA/CSSF Procedures.
What to do while awaiting the Luxembourg Whistleblower Protection law
Given that larger companies will immediately have to comply with the Luxembourg Whistleblower Protection law once it comes into effect, most will need to start preparations now. Until the national law is adopted, the EU Directive itself is a good place to start. It sets a number of minimum standards that will apply in all member states and to all organisations with more than 50 employees. Companies can familiarise themselves with these minimum requirements (see below), and look for a solution that helps them comply.
- A secure channel for receiving whistleblower reports must be put in place.
- Acknowledgment of the receipt of the report must be provided to the whistleblower within seven days.
- An impartial person or department must be appointed to follow up on the reports.
- Records must be kept of every report received, in compliance with confidentiality requirements.
- There must be diligent follow-up of the report by the designated person or department.
- Feedback about the report follow-up must be given to the whistleblower within three months.
- All processing of personal data must be done in accordance with the GDPR.