Whistleblower protection:

Commission must finally lead by example

The legal framework: binding obligations, not optional principles

The EU has put in place a strong legislative framework providing for balanced and effective protection of whistleblowers. Directive (EU) 2019/1937 on the protection of persons who report breaches of Union law (the Whistleblower Protection Directive) was adopted in October 2019, in the aftermath of major scandals such as LuxLeaks, the Panama and Paradise Papers, Dieselgate and Cambridge Analytica.

As the Commission has always underlined:

“The Whistleblower Protection Directive sets minimum EU standards for ensuring a high level of protection to persons who report information on breaches of EU law that can harm the public interest, of which they become aware in the context of their work (‘whistleblowers’). Whistleblowers’ reports can lead to the detection, investigation and prosecution or sanctioning of violations of EU law that would otherwise remain hidden, causing serious harm to society and the public interest in general”.

Also recalling:

“Making sure that whistleblowers are properly protected is essential to encourage reporting that can help prevent and address breaches of EU law and therefore make EU law more effective. By protecting people who report breaches of EU law, the Directive contributes to promoting the EU values of rule of law, fundamental rights and democracy, thereby strengthening transparency and accountability and safeguarding the freedom of expression enshrined in Article 11 of the Charter of Fundamental Rights of the European Union (…).

Yet, those who “raise the alarm” often risk their career and their livelihood and, in some cases, suffer severe and long-lasting financial, health, reputational and personal repercussions. Fear of retaliation dissuades people from coming forward with their concerns. The effective protection of whistleblowers against retaliation is essential to safeguard the public interest, protect freedom of expression and media freedom (because whistleblowers are essential as sources for investigative journalism) and more generally promote transparency, accountability and democratic governance”.

The adoption of the Whistleblower Protection Directive was rightly hailed as a breakthrough. For the first time, the Union established a common baseline of rights and obligations, recognising whistleblowing not as a marginal employment issue, but as a cornerstone of accountability and democratic governance.

The persistent gap between declared principles and lived reality reflects a clear failure of managerial and institutional responsibility, for which accountability must be assumed at the appropriate levels.

A renewed momentum at EU level — Commission must lead by exemple

At the request of the Commission, acting in its capacity as guardian of the Treaties, on 6 March 2025, the Court of Justice of the European Union (CJEU) condemned five Member States for failing to transpose Whistleblower Protection Directive within the required timeframe, underscoring the binding nature of whistleblower protection obligations under EU law.

In this respect, R&D wishes to pay particular tribute to the colleagues of DG JUST for their competence, determination, dedication and leadership, which have made it possible to implement actions that set a benchmark for the entire institution and of which we can all be legitimately proud.

“Quis custodiet ipsos custodes ?

This judgment powerfully reinforces the duty of exemplarity incumbent upon the European Commission and the EU institutions.

However, no member of staff can seriously claim that this much-praised approach is effectively implemented within the Commission’s services: this is not a matter of perception or communication; it is a matter of responsibility.

The persistent gap between declared principles and lived reality reflects a clear failure of managerial and institutional responsibility, for which accountability must be assumed at the appropriate levels.

It would be untenable, and institutionally damaging, to sanction Member States for failing to comply with Whistleblower Protection Directive while tolerating gaps, delays or ineffective implementation of whistleblower protection within the EU administration itself.

The credibility of the Union’s action, the authority of its law and the trust of citizens and staff alike depend on the Institutions’ ability to apply to themselves, fully and without reservation, the standards they impose on others.

Leading by example is not a rhetorical choice; it is a legal, political and moral obligation.

On 25 August 2025, the European Commission launched a public consultation on its forthcoming Action Plan on Whistleblower Protection, as part of its broader evaluation of Whistleblower Protection Directive. This evaluation will assess its implementation across all Member States in terms of:

• · effectiveness,
• · efficiency,
• · relevance,
• · coherence,
• · and EU added value.

R&D strongly urges the Commission to organise an equivalent consultation and social dialogue process concerning the implementation of Article 22a of the Staff Regulations and the corresponding Commission implementing guidelines on whistleblowers.

Article 22a Staff Regulations: an obligation without sufficient protection

The legal framework established by Article 22a of the Staff Regulations is particularly stringent:

Any official who, in the course of or in connection with the performance of his duties, becomes aware of facts which give rise to a presumption of the existence of possible illegal activity, including fraud or corruption, detrimental to the interests of the Union, or of conduct relating to the discharge of professional duties which may constitute a serious failure to comply with the obligations of officials of the Union, shall without delay inform either his immediate superior or his Director-General or, if he considers it useful, the Secretary-General, or the persons in equivalent positions, or the European Anti-Fraud Office (OLAF) direct”

Therefore, for EU staff, whistleblowing is framed not merely as a right or an option, but as a legal obligation.

As the Commission has always rightly confirmed, making the reporting of serious irregularities a right rather than an obligation would mean that members of staff would equally have the right not to report serious irregularities that they become aware of. This would be prima facie incompatible with an official’s duty of loyalty to the institution, which derives from Articles 11 and 12 of the Staff Regulations. Clearly, a right not to report serious irregularities would be detrimental to the fight against fraud and therefore to the interests of the Communities.

More generally, by making whistle-blowing an obligation, the Staff Regulations make it clear that reporting of illegality is considered a crucial tool in the control and internal governance, rather than simply a safety valve for sensitive officials.

In this respect, the EU General Court has confirmed that officials may incur disciplinary liability if they fail to report suspected irregularities.

This obligation was most recently reaffirmed in the Commission Decision on combating all forms of harassment, in order to explicitly confirm that no member of staff may passively witness harassment or inappropriate behaviour by “looking the other way” and considering that it is “not their business”, thereby leaving the victim alone against the perpetrator.

At the same time, the very essence of any whistleblowing mechanism is to protect workers against retaliation. This creates an inherent tension: remaining silent for fear of retaliation may expose officials to disciplinary sanctions, while reporting exposes them to professional and personal risks.

This makes it absolutely essential to ensure, in practice and not merely on paper, that when an official reports in accordance with Article 22a, they “shall not suffer any prejudicial effects on the part of the institution”.

A system that is formally protective, but practically ineffective

Despite the formal safeguards in place, both R&D’s experience in assisting staff and the Commission’s own replies to parliamentary questions cast serious doubt on the real effectiveness of the current whistleblowing framework.

Based on data provided by the Commission in response to several parliamentary questions, over a period of several years:

• · only three cases involved staff members invoking whistleblower status under Articles 24 or 90 of the Staff Regulations;
• · OLAF registered five cases of internal whistleblowing involving Commission staff since 2015;
• · only one investigation was actually opened.

Just as the number of recognised harassment cases remains alarmingly residual, so too does the number of recognised whistleblowers.

These figures :

• – do not reflect exemplary working environments; they demonstrate a systemic inability, or unwillingness, to identify, acknowledge and effectively protect victims and reporting persons, thereby perpetuating a culture of silence and impunity; 
• – fuel a perception of institutional inaction and reinforce the belief that whistleblowing procedures are ineffective and highly risky for those who use them.

Restrictive guidelines, insufficient awareness and, above all, a lack of trust in the system appear to be the main causes of this underutilisation.

The whistleblower protection in EU institutions must be duly reinforced

The 2019 Commission Decision on administrative inquiries and disciplinary proceedings introduced a new provision on the protection of whistleblowers. While this was a step in the right direction, it has not remedied the structural shortcomings of the existing Guidelines.

However, for R&D, only a comprehensive and far-reaching review of the present rules which is both necessary and overdue, can address these deficiencies. The transposition and implementation of the Whistleblower Protection Directive provide a unique opportunity to do so.

The far-reaching review that R&D is requesting must not be a cosmetic exercise, but a genuine structural reform.

Strong and credible whistleblower protection within EU institutions is essential to:

• · ensure transparency and accountability;
• · combat fraud, corruption, harassment, mismanagement and abuse of power;
• · and restore citizens’ trust in the EU administration.

It is worth recalling, once again and without ambiguity, that it would be unacceptable and deeply paradoxical if individuals reporting irregularities in Member States were afforded stronger protection than EU staff reporting misconduct within the EU institutions themselves. Such a situation would only reinforce perceptions of hypocrisy.

It should be unnecessary — and is indeed disquieting — to have to recall that, under well-established case-law, EU institutions are legally bound to ensure coherence and consistency between their internal practices and the standards they impose on Member States through EU legislation and policy action.

Remaining faithful to its constructive approach, R&D does not limit itself to highlighting the deficiencies of current procedures, but consistently complements its criticisms with motivated, concrete and operational proposals aimed at improving their effectiveness.

Proposals put forward by R&D

1) First and foremost, what is required is a fundamental change in institutional CULTURE: combating all forms of harassment and ensuring effective whistleblower protection are inseparable struggles against the same enemy: a culture of silence and impunity

Just as was already the case in the fight against all forms of harassment, any reform of these rules must avoid degenerating into a purely bureaucratic exercise, devoid of substance and real effect.

It must be underlined that effective whistleblower protection has at least two essential components:

• – what happens to the whistleblower after the report is made,
• – what concrete and timely measures are taken to address the wrongdoing reported.

As regards the latter, as it has been rightly underlined, whistleblowing can only be considered effective to the extent that the questionable or wrongful practice (or omission) is terminated, at least in part, as a direct result of whistleblowing and within a reasonable time frame.

However, time and again, when scandals erupt, the reflex appears to be not accountability or corrective action, but the stigmatisation of the whistleblower. The whistleblower is treated as a suspect, even as a traitor who has breached an alleged duty of loyalty, rather than as someone who has acted in the public interest by exposing serious misconduct.

This approach reflects a profound misunderstanding of the notion of loyalty. Loyalty to the institution can never mean loyalty to wrongdoing, to silence, or to the concealment of breaches of the law. On the contrary, true loyalty lies in upholding the rule of law, the values of the Union and the public interest. Whistleblowers do not betray the institution; they serve it by enabling it to correct failures, restore integrity and preserve its credibility.

That is exactly why, in organisations where a culture of secrecy and a hierarchy-driven structure prevail, or where speaking out is discouraged or penalised rather than encouraged, formal rules and procedures, including anti-harassment procedures and whistleblower regulations, may formally exist, but they remain structurally insufficient and risk being reduced to purely cosmetic safeguards.

In the absence of a clear, explicit and sustained assumption of responsibility by management, such frameworks are bound to fail in practice.

Effective whistleblower protection cannot be achieved through formal compliance alone.

It requires active ownership, accountability and leadership at all hierarchical levels, starting with top management. Where leadership fails to assume this responsibility, the failure is not technical or procedural; it is political. And it is the institution, its credibility who ultimately bear the consequences.

This is why a profound cultural change is required, one in which reporting wrongdoing is recognised as a contribution to the public interest, not as an act of disloyalty.

Such a change presupposes that Commission does not merely tolerate whistleblowing, but take responsibility for acting upon it, addressing the reported misconduct decisively and protecting those who have come forward.

It is precisely this deep and visible cultural change that R&D is calling for.

It is this very same cultural change that will finally render procedures to combat all forms of harassment effective. To this day, the activation of formal procedures for harassment cases remains too often obstructed by bureaucratic approaches within the administration, as well as by the fears of victims and witnesses who, out of legitimate concern about retaliation, refrain from initiating any formal steps.

This situation perpetuates, once again and always, an intolerable culture of silence and impunity.

As long as fear prevails over protection, and procedural formalism over institutional responsibility, neither whistleblower protection nor anti-harassment mechanisms can fulfil their purpose.

Breaking this vicious circle is not a technical challenge, it is a matter of governance, responsibility and political will: without this change, the rules will continue to exist on paper, while victims remain unprotected and wrongdoing unaddressed.

Staff representation also bears a responsibility and has a role to play in shaping and influencing work culture

Trade unions can and must contribute to improving responsiveness to whistleblowing and harassment, as consistently demonstrated by experts in labour law and whistleblower protection.

In this respect, the EU Whistleblower Protection Directive explicitly recognises this role by referring to trade unions among the authorities that may be designated to receive reports of breaches. This recognition is not symbolic: it reflects a shared responsibility to ensure that whistleblowing mechanisms are trusted, effective and followed by concrete action.

Ultimately, whistleblower protection is a test of institutional responsibility. Where reports are ignored, delayed or neutralised, responsibility has failed, regardless of how advanced the formal rules may appear on paper.

2) Changing the Commission’ institutional culture is essential, but it must be followed by a fundamental reform of the rules themselves

To ensure effective protection, in the context of the reform of the rules concerning implementing rules of article 22a to 22c of the Staff Regulations, the Commission should, in particular:

• · update and publish the data concerning recognised whistleblower cases and the follow-up given to them;
• · conduct a comprehensive benchmark analysis of whistleblowing procedures across all EU institutions, agencies and bodies, with a view to applying the best practices identified to Commission staff and, in its capacity as guardian of the Staff Regulations, actively ensuring the establishment of a common, consistent and enforceable approach across all EU institutions, agencies and bodies;
• · any unnecessarily restrictive or punitive interpretation of the condition relating to the whistleblower’s good faith must be strictly avoided. In accordance with Articles 5 and 6 of  the Whistleblower Protection Directive, which require only that the reporting person had reasonable grounds to believe that the information reported was true at the time of reporting and with the principle of effectiveness of EU law, the reversal of the burden of proof must apply: good faith must be presumed, must be presumed as a matter of principle and it is for the administration to demonstrate, on the basis of clear, objective and substantiated evidence, that one of these criteria is not fulfilled. Any doubt must benefit the whistleblower.  It should be openly confirmed that staff members are not required to establish the reality of the alleged wrongdoing, nor do they lose the protection afforded to them solely because a suspicion reported in good faith subsequently proves to be unfounded. This principle is fully consistent with the case-law of the EU Courts on whistleblower protection;
• · any attempt, explicit or implicit, to discourage recourse to OLAF, to privilege internal channels as a default or preferred option, or to cast doubt on the legitimacy of direct reporting to OLAF constitutes a breach of Article 22a of the Staff Regulations and undermines the effectiveness of whistleblower protection. Such practices must be explicitly prohibited and sanctioned. As confirmed by the case-law of the EU General Court, an EU official is fully entitled to inform OLAF directly, without prior notification to a superior, and such conduct cannot be regarded as less reasonable, less honest or less loyal than reporting first through internal hierarchical channels. Any interpretation or practice suggesting otherwise is legally unfounded and must be expressly excluded;
• · ensure a broad and non-restrictive interpretation of the conditions laid down in Article 22b of the Staff Regulations concerning recourse to external authorities, including the President of the Commission, the Court of Auditors, the Council, the European Parliament and the European Ombudsman;
• · ensure, with regard to the possibility of public disclosure, that in accordance with Article 15 of the Whistleblower Protection Directive and the settled case-law of the European Court of Human Rights, notably Guja, Heinisch and Bucur and Toma, on which the EU Courts have expressly modelled their own criteria, where internal or external reporting channels are ineffective, inadequate, compromised or structurally incapable of addressing the reported irregularities, public disclosure is authorised and effectively protected, and is neither restricted, discouraged nor neutralised in practice. Indeed, whistleblowers cannot be considered infringing any restriction on disclosure of information imposed by law or by contract signed with the Commission (so-called “gagging” clauses) and will not be held liable for disclosing information;
• · ensure, in accordance with Article 16 of Whistleblower Protection Directive, the strict and continuous protection of the whistleblower’s identity at all stages of the procedure. Any breach of confidentiality must give rise to effective, proportionate and dissuasive sanctions, including disciplinary measures where appropriate. In this regard, according to the settled case-law of the General Court, the non-disclosure of the informant’s identity does not, in itself, render a disciplinary procedure unlawful, provided that the person concerned is able to effectively exercise their rights of defence. The Commission’s disciplinary framework explicitly provides for such protection of informants, in full compliance with due process guarantees.
• · ensure significantly reduced timeframes at each stage of the procedure, as it is unacceptable to leave reporting persons in uncertainty for months;
• · guarantee that recognised whistleblowers are not only protected from detriment, but that their merits are positively recognised in career development and progression;
• · ensure strict and enforceable safeguards, in particular, though not limited to, during appraisal, certification, promotion and appointment procedures. In accordance with Articles 21 and 23 of Whistleblower Protection Directive, read in conjunction with Articles 22a and 24 of the Staff Regulations, and in application of the principle of reversal of the burden of proof, any detriment suffered by a reporting person shall be presumed to constitute retaliation. The full burden of proof lies with the administration, which must demonstrate, on the basis of clear, objective and substantiated evidence, that the measure was objectively justified, proportionate and entirely unrelated to the report and the disclosure.
• · where such retaliation nevertheless takes place, appropriate redress will be offered to the whistleblower. This may include compensation of a financial nature;
• · sanction with appropriate disciplinary measures any hindering or attempted hindering of reporting, any form of retaliation, vexatious proceedings or breaches of confidentiality;
• · pursuant to Articles 8, 9 and 20 of Directive (EU) 2019/1937, establish a clearly identified and genuinely independent interlocutor, comparable to the Chief Confidential Counsellor, vested with full guarantees of independence and directly attached to the political level, responsible for providing confidential advice, assistance and support to any colleague considering reporting potentially reprehensible conduct, and for accompanying reporting persons throughout the entire procedure, including protection against retaliation;
• · ensure that DG HR provides, without delay, all necessary assistance and protection measures, including facilitating transfers where whistleblowers request them in order to escape hostile working environments; In order to ensure such mobility, the intervention of the Appointing Authority at central level, on the basis of Article 7 of the Staff Regulations, is absolutely indispensable. This is the only way to ensure effective protection for a whistleblower, whose situation cannot, under any circumstances, be treated as a case of ordinary mobility. This requirement is fully in line with Article 20 of Directive (EU) 2019/1937, which obliges EU Institutions to provide effective support measures to reporting persons, including appropriate assistance and protection against retaliation. It would therefore be wholly inappropriate, and indeed unacceptable, to expect a whistleblower who considers it necessary to be transferred to another Directorate-General or Service to merely contact the HR services of their own DG or the career guidance service in order to receive advice aimed at identifying posts corresponding to their profile and professional aspirations. Such an approach ignores the specific risks and vulnerabilities inherent in whistleblowing situations and fails to meet the standards of effective protection required under EU law.
• · the future of whistleblower protection also depends on sustained and structured efforts in education and awareness-raising as conducting staff awareness campaigns highlighting the importance of ethical reporting and the role of whistleblowers, providing continuous training on the rights, obligations and protections associated with whistleblowing. These efforts are essential to embed a lasting culture of integrity within our Institution and to ensure that whistleblowing is understood as a responsibility and a legal obligation rather than a source of stigma or risk.

Conclusion

In light of the above, R&D formally requests that negotiations be opened without delay with staff representation, in full respect of the principles of social dialogue, in order to carry out the deep, credible and effective review that the current whistleblower protection procedures urgently require.

The protection and positive recognition of whistleblowers constitute a decisive test of the Commission’s credibility, integrity and capacity to lead by example. This is not a marginal or technical issue, but a core question of governance, accountability and respect for fundamental values.

The Commission must therefore move beyond declarations of principle and ensure, through concrete, visible and enforceable measures, that whistleblowing is not merely tolerated or passively shielded from retaliation, but is explicitly recognised as a legitimate and valuable contribution to the public interest, institutional integrity and the rule of law.

Only by fully assuming this responsibility within its own services can the Commission credibly claim the moral authority to demand the same standards from the Member States, and restore the trust of staff and citizens alike.

Anything less would amount to maintaining a system that is formally compliant yet practically ineffective, a situation that is no longer acceptable.

Anything less would perpetuate a culture of silence and impunity that is incompatible with the Union’s values.

Only by doing so can the Commission credibly claim to lead by example

Cristiano SEBASTIANI,

President