Implementing directive 2015/2392 - Commission Implementing Directive 2015/2392 on Regulation 596/2014 as regards reporting to competent authorities of actual or potential infringements of that Regulation - Main contents

EN

Official Journal of the European Union

L 332/126

Persons reporting actual or potential infringements of Regulation (EU) No 596/2014 (whistle-blowers) to competent authorities may bring new information to the attention of competent authorities and assist the latter in detecting and imposing sanctions for market abuse offences. However, whistleblowing of infringements may be deterred by fear of retaliation, discrimination or disclosure of personal data. Adequate arrangements regarding whistleblowing are hence necessary to ensure the overall protection and the respect of the fundamental rights of the whistle-blowers and the accused persons. Persons who knowingly report wrong or misleading information to competent authorities should not be considered as whistle-blowers and thus should not enjoy the protection mechanisms.

Anonymous reporting should be allowed by competent authorities and the protection mechanisms of this Directive should also apply where an anonymous whistle-blower decides to reveal its identity to the competent authority at a later stage. Whistle-blowers should be free to report either through internal procedures, where such procedures exist, or directly to the competent authority.

Dedicated staff members of the competent authorities, who are professionally trained, including on applicable data protection rules, would be necessary in order to handle reports of infringements of Regulation (EU) No 596/2014 and to ensure communication with the reporting person, as well as following up on the report in a suitable manner.

Persons intending to report actual or potential infringements of Regulation (EU) No 596/2014 should be able to make an informed decision on whether, how and when to report. Competent authorities should therefore publicly disclose and make easily accessible information about the available communication channels with competent authorities, about the applicable procedures and about the dedicated staff members within the authority dealing with reports of infringements. All information regarding reports of infringements should be transparent, easily understandable and reliable in order to promote and not deter reporting of infringements.

In order to allow for effective communication with its dedicated staff it is necessary that the competent authorities have in place and use different communication channels that should be user-friendly and allow for written and oral, as well as electronic and non-electronic communication.

It is important that the procedures for the protection of persons working under a contract of employment, irrespective of the nature of their working relationship and whether they are paid or not, who report infringements or are accused of infringements of Regulation (EU) No 596/2014 protect such persons against retaliation, discrimination or other types of direct or indirect unfair treatment. Unfair treatment can take very different forms depending on the circumstances. Thus individual cases need to be assessed through dispute resolution rules or judiciary procedures available under national law.

Member States should ensure that competent authorities have in place adequate protection procedures for the processing of reports of infringements and reported persons' personal data. Such procedures should ensure that the identity of every reporting and reported person is protected at all stages of the procedure. This obligation should be without prejudice to the necessity and proportionality of the obligation to disclose information when this is required by Union or national law and subject to appropriate safeguards under such laws, including in the context of investigations or judicial proceedings or to safeguard the freedoms of others, including the rights of defence of the reported person.

It is highly important and necessary that dedicated staff of the competent authority and staff members of the competent authority who receive access to the information provided by a reporting person to the competent authority comply with the duty of professional secrecy and the confidentiality when transmitting the data both inside and outside of the competent authority, including where a competent authority opens an investigation or an inquiry or subsequent enforcement activities in connection with the report of infringements.

Member States should ensure the adequate record-keeping of all reports of infringement and that every report is retrievable within the competent authority and that information received through reports could be used as evidence in enforcement actions where appropriate. Member States should ensure the compliance with Directive 95/46/EC of the European Parliament and of the Council (2) and national legislation transposing Directive 95/46/EC.

Protection of personal data of the reporting and reported person is crucial in order to avoid unfair treatment or reputational damages due to disclosure of personal data, in particular data revealing the identity of a person concerned. Hence, in addition to the national data protection legislation which transposes Directive 95/46/EC, competent authorities should establish adequate data protection procedures specifically geared to the protection of the reporting and reported person that should include a secure system within the competent authority with restricted access rights for authorised staff only.

Transmission of personal data connected to reports of infringements by the competent authority could be necessary to evaluate a report of infringements and to undertake the necessary investigation and enforcement actions. When transmitting data within the competent authority or to third parties, competent authorities should preserve the confidentiality to the maximum extent possible in accordance with national law.

The rights of the reported person accused of an infringement of Regulation (EU) No 596/2014 should be protected in order to avoid reputational damages or other negative consequences. Furthermore, the rights of defence and access to remedies of the reported person should be fully respected at every stage of the procedure following the report. Member States should ensure the right of defence of the reported person, including the right to access to the file, the right to be heard and the right to seek effective remedy against a decision concerning the reported person under the applicable procedures set out in national law in the context of investigations or subsequent judicial proceedings.

The regular and at least biannual (once every two years) review of the procedures of competent authorities should guarantee that these procedures are adequate and state of the art, and thus serving their purpose. For this purpose, it is important that competent authorities evaluate their own experiences and exchange experiences and good practices with other competent authorities.

Given that detailed rules on the protection of whistle-blowers would make it more difficult for Member States to ensure compatibility and operational fit with their national systems, including administrative, procedural and institutional aspects, some flexibility is needed for the implementing act. Such flexibility would best be achieved through a directive, rather than a regulation and hence a directive appears to be the most appropriate instrument in order to allow Member States to adapt the reporting of infringements regime efficiently into their national systems including the institutional framework.

Given the fact that Regulation (EU) No 596/2014 enters into application on 3 July 2016, it is appropriate that the Member States transpose and apply provisions pertaining to this Directive from 3 July 2016.

The measures provided for in this Directive are in accordance with the opinion of the European Securities Committee,

‘reporting person’ means a person reporting an actual or potential infringement of Regulation (EU) No 596/2014 to the competent authority;

‘reported person’ means a person who is accused of having committed, or intending to commit, an infringement of Regulation (EU) No 596/2014 by the reporting person;

‘report of infringement’ means a report submitted by the reporting person to the competent authority regarding an actual or potential infringement of Regulation (EU) No 596/2014.

providing any interested person with information on the procedures for reporting infringements;

receiving and following-up reports of infringements;

maintaining contact with the reporting person where the latter has identified itself.

the communication channels for receiving and following-up the reporting of infringements and for contacting the dedicated staff members in accordance with Article 6(1), including:

the procedures applicable to reports of infringements referred to in Article 5;

the confidentiality regime applicable to reports of infringements in accordance with the procedures applicable to reports of infringements referred to in Article 5;

the procedures for the protection of persons working under a contract of employment;

a statement clearly explaining that persons making information available to the competent authority in accordance with Regulation (EU) No 596/2014 are not considered to be infringing any restriction on disclosure of information imposed by contract or by any legislative, regulatory or administrative provision, and are not to be involved in liability of any kind related to such disclosure.

that reports of infringements can also be submitted anonymously;

the manner in which the competent authority may require the reporting person to clarify the information reported or to provide additional information that is available to the reporting person;

the type, content and timeframe of the feed-back about the outcome of the report of infringement that the reporting person can expect after the reporting;

the confidentiality regime applicable to reports of infringements, including a detailed description of the circumstances under which the confidential data of a reporting person may be disclosed in accordance with Articles 27, 28 and 29 of Regulation (EU) No 596/2014.

they are separated from general communication channels of the competent authority, including those through which the competent authority communicates internally and with third parties in its ordinary course of business;

they are designed, set up and operated in a manner that ensures the completeness, integrity and confidentiality of the information and prevents access to non-authorised staff members of the competent authority;

they enable the storage of durable information in accordance with Article 7 to allow for further investigations.

written report of infringements in electronic or paper format;

oral report of infringements through telephone lines, whether recorded or unrecorded;

physical meeting with dedicated staff members of the competent authority.

an audio recording of the conversation in a durable and retrievable form; or

a complete and accurate transcript of the conversation prepared by the dedicated staff members of the competent authority. In cases where the reporting person has disclosed its identity, the competent authority shall offer the possibility to the reporting person to check, rectify and agree with the transcript of the call by signing it.

an audio recording of the conversation in a durable and retrievable form; or

accurate minutes of the meeting prepared by the dedicated staff members of the competent authority. In cases where the reporting person has disclosed its identity, the competent authority shall offer the possibility to the reporting person to check, rectify and agree with the minutes of the meeting by signing them.

reporting persons have access to comprehensive information and advice on the remedies and procedures available under national law to protect them against unfair treatment, including on the procedures for claiming pecuniary compensation;

reporting persons have access to effective assistance from competent authorities before any relevant authority involved in their protection against unfair treatment, including by certifying the condition of whistle-blower of the reporting person in employment disputes.