Introduction
On 25 July 2024, the Corporate Sustainability Due Diligence Directive (CSDDD) entered into force, marking a new era of corporate accountability for companies’ negative impacts on human rights and the environment. The CSDDD contains provisions on due diligence obligations for large corporations which entail, among others, the development of a due diligence policy and process, the continuous monitoring of businesses’ chain of activities, civil liability for in-scope companies, and sanctions for corporate non-compliance. A key part of achieving these requirements is the effective information channels through which stakeholders can submit legitimate concerns regarding potential or actual adverse impacts. The CSDDD establishes two such channels, one of which directly involves businesses.
At the same time, another important framework for corporate reporting channels has already been established by the Whistleblower Directive (WBD). Through these channels, the WBD ensures the protection of public or private sector workers who have information on breaches of selected Union or national law in a work-related context, the EU whistleblowers. As of 17 December 2023, the WBD has fully entered into force. Now, the CSDDD links its sustainability due diligence discourse with the WBD, going so far as to amend the WBD directly. To this end, this contribution asks how the corporate sustainability narrative impacts the existing whistleblowing requirements and, conversely, whether it is now possible or obligatory to blow the whistle on corporate adverse impacts on labour rights.
EU legislation on reporting channels in private enterprises
Whistleblowing gained ground as a legal concept owing to, among others, repeated requests of the EU Parliament for a legislative proposal on whistleblower protection, a recommendation of the Council of Europe, and case law of the European Court of Human Rights (ECtHR), the latter incorporating whistleblowing in their understanding of the freedom of expression. Additionally, whistleblowing progressed due to the anti-corruption movement, as part of the reason the WBD was enacted, was in response to serious breaches of public interest such as the Panama Papers and the ‘LuxLeaks’ scandal. Influenced by these events, the EU ultimately chose to solidify the concept within EU law rather than letting protection for whistleblowers depend on differing national laws. Thus, the WBD was born. The WBD set up a three-tiered reporting system: internal reporting, external reporting to designated authorities and public disclosure. This contribution zooms in on corporate internal reporting.
The WBD has the status of lex generalis, which means it leaves room for specialized regimes on corporate reporting channels and whistleblower protection. Some examples of these specialized regimes include the investment, nuclear energy and civil aviation sectors. Many of these regimes already existed, developed in response to the financial crisis of 2008. However, they often did not offer clear and comprehensive provisions for whistleblower protection, especially lacking protection against retaliation. They did ensure that many companies had some kind of reporting channel in place. Now, they offer the same (or more) protection, as these sector-specific reporting channels must comply with relevant law and the WBD.
Recently, the CSDDD emerged with the intention of establishing two new, additional reporting channels. Both are considered external reporting channels in WBD-terms. One concerns the ways through which eligible natural or legal persons can raise substantial concerns to the dedicated supervisory authority of a Member State. The second one is relevant to this contribution and encompasses the obligatory complaints procedure for in-scope companies. This corporate reporting channel aims to provide companies with an additional tool that can help them correctly assess their risks and thus comply with the CSDDD’s due diligence obligations while empowering affected persons to voice their concerns to the company concerned directly.
Corporate reporting under the CSDDD and the WBD
In-scope companies
In order to know how the CSDDD impacts the WBD and whether whistleblowing on corporate adverse impacts is now possible, this contribution compares the two directives when it comes to their rules on reporting channels in corporate enterprises. As of 2023, the WBD requires legal entities in the private sector with 50 or more workers to establish internal channels and procedures for reporting. Under certain circumstances, the scope can even be extended to legal entities in the private sector with fewer than 50 workers. The WBD’s scope is significantly broader than that of the CSDDD, which currently targets companies operating in the EU internal market with more than 5000 workers and an average net worldwide turnover of over 1.5 billion euros. These thresholds will be lowered to 1000 workers and an average worldwide turnover of more than 450 million euros by 2029. Still, as the CSDDD only covers the largest companies, the bulk of companies that need to establish an internal reporting channel under the WBD does not fall under the requirements of the CSDDD, at least not directly. However, the CSDDD calls for due diligence along a company’s entire chain of activities. Therefore, through processes such as contractual cascading – by which companies pursue contractual assurances regarding due diligence from their business partners – it can happen that companies would require each other to enable corporate reporting channels. Apart from this, each directive has specific rules for group-level reporting. While the CSDDD provides for and encourages group privileges, the WBD departs from decentralized reporting channels. Nevertheless, it is generally understood that, under the WBD, group-wide whistleblowing channels are allowed to function alongside each company-wide system, and, in any case, medium-sized entities are allowed to pool resources for receiving and investigating reports.
Reporting persons
Under the WBD, only natural persons who work in the private or public sector and have acquired information on breaches, including reasonable suspicions, related to past or present work-related activities can use the reporting channel. Although the WBD’s work-related scope extends further than might be thought, for example, also including self-employed workers, shareholders, volunteers, third persons connected to the reporting person, and persons working under the supervision of contractors and suppliers, it does not come close to the CSDDD’s scope. There, all persons affected or who can provide reasonable grounds to believe that they might be affected by an adverse impact can turn to the corporate reporting channel. Their representatives, such as trade unions and other workers’ representatives, and civil society organisations experienced in environmental adverse impacts, are also included. Both directives contain an element of reason. This element holds that, for the complaint or report to be successful, a reasonable person would need to have made the same decision to report, the report would need to be objectively correct, and the reporting person would need to have been convinced of the accuracy of the information. ‘Reasonableness’ is not to be confused with good faith. Good faith goes one step further, also taking into account the reporting persons’ motive. The two directives are limited to the element of ‘reasonableness’. It is not yet clear whether this element will be interpreted entirely the same under the two directives.
Material scope
Regarding the material scope of the directives, the WBD’s coverage is limited to specific areas regulated by Union and national law, which are listed in the directive’s Annex. The WBD spans only those areas which the EU has the power to regulate. Examples include public procurement, financial services, protection of the environment, and protection of privacy and personal data. Moreover, breaches affecting the internal market and the financial interests of the Union are also targeted. These are included to prevent practices that are not necessarily unlawful but undermine national or Union law objectives. The WBD does not cover infringements of traditional labour law, such as wages and working hours, although the EU reserved the possibility to extend the directive’s scope. In contrast, the CSDDD includes abuse of select international instruments, texts, standards and conventions, as referred to in its Annex. Adverse impacts on labour rights and standards concern, first and foremost, the five fundamental labour rights as defined in the ILO’s 1998 Fundamental Principles and Rights at Work, alongside other staples of labour law such as the right to enjoy just and favourable conditions of work, including a fair wage and reasonable limitation of working hours.
Protection of reporting persons
To conclude the comparison, the protection offered by both directives seems to be virtually the same. Both ask for support and protection of the reporting person through appropriate follow-up, protection against retaliation, reversal of the burden of proof once an appropriate threshold is reached, access to remedies, and confidentiality. Although both reporting procedures provide for anonymous reporting, neither of the directives considers it a necessity. They do insist on confidentiality of the reporting person’s identity as an ex-ante measure to prevent retaliation. There is, however, a difference in the formality of each directive’s protection. The WBD focuses primarily on protecting reporting persons against retaliation in the broadest sense of the word and, to this end, submitting reports triggers protective measures. The CSDDD seems to mainly pursue dialogue between a company and a reporting person, focusing less on the protective element. To illustrate, the directive states the following: “Member States shall ensure that complainants are entitled to […]”, which indicates that protection of the reporting person’s rights would need to be claimed (active) rather than triggered (passive). The CSDDD also proclaims that “companies shall take reasonably available measures to prevent any form of retaliation by ensuring the confidentiality of the identity of the person or organisation submitting the complaint, in accordance with national law.” Following this wording, confidentiality seems to be the only protective measure the CSDDD requires. By that logic, once the identity of the reporting person is known or guessed, a company would not need to take measures to protect the reporting person against retaliation anymore, and the protection of the reporting person would be negated.
Towards the protection of labour rights whistleblowers?
Interaction between the CSDDD and the WBD?
From the previous comparison, we can derive how the CSDDD’s sustainability due diligence discourse interacts with and impacts the WBD’s whistleblower protection. To do this, we need to take into account that the CSDDD also amends the material scope of the WBD. More precisely, it widens the WBD’s material scope so that in the future, EU whistleblowers can report on violations of the provisions of national law that transpose the CSDDD. It is interesting to note that the WBD’s scope is widened by adding to the part of the WBD’s Annex that allows reporting on breaches concerning the ‘protection of the environment’. Again, the way the CSDDD is worded makes it so that it can be questioned whether provisions of national law transposing human rights due diligence obligations fall under the material scope of the WBD.
Although the WBD and the CSDDD seem to serve the same broad, democratic principles of transparency and accountability, based on the previous comparison, their scope and workings do not interlock well or often. While more companies need to establish a corporate reporting channel under the WBD than they do under the CSDDD, with the CSDDD’s chain of activities approach, the CSDDD’s provisions might impact more companies than expected. Regarding the reporting persons, the WBD has the restricting work-related aspect, requiring reporting persons to solely report on work-related activities, while the CSDDD allows all affected persons, natural or legal, to resort to the corporate complaints channel. As for the material scope, what reporting person’s can report on, both have their own Annex, which, as mentioned above, only narrowly overlaps.
In the end, although the two directives clearly give rise to distinct mechanisms, there exists some overlap. A reporting person could use both the procedure of the WBD and the CSDDD under the following circumstances: 1) a breach of law included in the material scope of the WBD can be considered an adverse impact and, 2) the person reporting on this breach is someone with work-related ties to the company providing the reporting channel, and that person is also directly affected by the adverse impact.
Blowing the whistle on labour rights infringements?
Is it now possible to blow the whistle on labour rights violations? Yes and no, depending on some factors. The first is whether one understands ‘blowing the whistle’ in the traditional sense of the word, as enshrined in the WBD, or if one also takes into account the corporate complaints channel of the CSDDD. If one adopts the latter perspective, a reporting person can report on adverse impacts on labour rights and standards under the CSDDD’s complaints channel. That reporting persons would not need to have ties to the company, they would only need to provide reasonable grounds showing that they were affected by the company’s labour rights infringements. The protection of the reporting person would be virtually the same as that foreseen by the WBD, barring the caveat made above. As a result, it would be possible to blow the whistle on labour rights violations.
If one limits the question to whistleblowing under the WBD, the answer is less clear. The right to whistleblowing protection would be limited to persons with ties to the company. That person would have the possibility to report on a breach of a provision of national law transposing the CSDDD. Then a second factor comes into play. If, as mentioned above, only the provisions of the CSDDD related to the environmental aspect fall within the material scope of the WBD, then blowing the whistle on labour rights infringements would not be possible. In contrast, should the material scope of the WBD also include human rights and labour rights infringements – as seems to be intended by the EU legislators since they refer to the CSDDD in its entirety when amending the WBD’s material scope – a reporting person with ties to the company could essentially report on labour law infringements. The only limitation is that they cannot refer to the CSDDD directly in their report, as the WBD only allows reporting on national provisions transposing the CSDDD. Accordingly, a reporting person should frame the breach of law as, for example, a violation of the national law transposing the CSDDD’s due diligence provisions, or the provision to identify and assess actual and potential adverse impacts.
In any case, there exist situations in which a reporting person could blow the whistle on labour law infringements. Moreover, these linkages between the WBD and the CSDDD could in practice increasingly give rise to reporting on labour rights infringements. Companies themselves might voluntarily opt to implement one all-encompassing reporting channel, with a view to administrative efficiency and gathering useful information. This would be possible, but the channel would need to comply with both directives. After all, simply having a whistleblowing channel as required by the WBD does not fulfil a company’s due diligence requirement to establish a complaints procedure under the CSDDD because of their differing scopes. Compliance with soft law standards promoting non-state-based grievance mechanisms, like the UN Guiding Principles and the OECD Guidelines, could be an extra reason to join the two channels. When the corporate reporting channels are not joined, it might also be possible that reporting persons report on human rights due diligence information under the wrong channel, for example when they are confused by what issues they can report on under which channel, or when they only look for the most easily accessible channel. The question does then rise whether a company could discard complaints that are formally not in line with the directives. It is not unthinkable that, under an effet utile-reasoning, reporting on an adverse impact could be considered as implicit reporting on a breach of due diligence provisions, so that companies would need to take into account the labour rights infringement anyway.
Conclusion
In summary, while the CSDDD and WBD both strive to improve corporate transparency, accountability and sustainability, they do so through distinct scopes and separate mechanisms that only partially intersect. Unreservedly blowing the whistle on labour law infringements under the CSDDD remains limited. Conversely, the CSDDD’s complaints procedure, which also installs a corporate reporting channel, does allow for abuse of labour standards and rights to be brought before to the company under similar protective rules. Additionally, joining the WBD and CSDDD channels is possible, assuming that both directives’ objectives and scopes are taken into account. Joining them is also preferable, as having two (or more) mechanisms for corporate reporting is not efficient for the company, nor does it encourage corporate reporting. Until there is a way to realistically install a more inclusive and comprehensive framework that supports a broader whistleblowing scope, including labour rights infringements, the WBD and CSDDD mechanisms will largely function as separate but complementary tools in ensuring corporate reporting. At any rate, in some situations, it is now possible to blow the whistle on labour rights infringements.
