Luxembourg

The personal scope has not been extended.

The Law of 16 may 2023 only states that the persons who have reported or disclosed information on breaches anonymously but who are subsequently identified and subjected to retaliation shall enjoy the protection provided by this law.

The Law of 16 May 2013 encourages reporting through internal reporting channels before reporting through external reporting channels, where the breach can be addressed effectively internally and where the reporting person considers that there is no risk of retaliation

The obligation to set up internal reporting channels extends to private sector legal entities with at least 50 workers. The minimum threshold of 50 employees must be reached over a period of twelve consecutive months. This obligation is without prejudice to any lower thresholds established in special laws.

Where specific rules concerning the establishment of internal reporting channels are laid down in the provisions referred to in Part II of the Annex to Directive 2019/1937 (on financial services, money laundering and terrorism financing, transport security or environmental protection), the provisions of the law shall apply only to matters not regulated by said provisions.

Art. 6(5) of the Law of 16 May 2023: Entities referred to in paragraph 1 with fewer than fifty employees and municipalities with fewer than ten thousand inhabitants are not required to establish internal reporting channels. However, they are free to set up such channels and procedures in accordance with Article 7.

N/A

1° La Commission de surveillance du secteur financier (The Luxembourg Financial Services Authority – CSSF);
2° Le Commissariat aux assurances (The Luxembourg Insurance Commission – CAA) ;
3° L’autorité de la concurrence (The Luxembourg competition authority) ;
4° L’Administration de l’enregistrement, des domaines et de la TVA (The Luxembourg Registration Duties, Estates and VAT Authority – AED) ;
5° L’Inspection du travail et des mines (The Luxembourg Inspectorate of Labour and Mines – ITM ;
6° La Commission nationale pour la protection des données (The Luxembourg Data Protection Commission – CNPD);
7° Le Centre pour l’égalité de traitement (The Luxembourg Equal Opportunities Centre – CET);
8° Le Médiateur dans le cadre de sa mission de contrôle externe des lieux où se trouvent des personnes privées de liberté (The Mediator, as part of his mission to carry out external checks on places where people are deprived of their liberty) ;
9° L’Ombudsman fir Kanner a Jugendlecher (The Ombudsman for children and youth);
10° L’Institut luxembourgeois de régulation (Luxembourg Regulatory Institute – ILR);
11° L’Autorité luxembourgeoise indépendante de l’audiovisuel (Luxembourg Independent Regulator for Audiovisual Media Services – ALIA) ;
12° L’Ordre des avocats du Barreau de Luxembourg et l’Ordre des avocats du Barreau de Diekirch (Luxembourg and Diekirch Bar Association);
13° La Chambre des notaires (Luxembourg Chamber of Notaries);
14° Le Collège médical (Luxembourg Medical Board);
15° L’Administration de la nature et des forêts (Nature and Forest Administration – ANF) ;
16° L’Administration de la gestion de l’eau (Water Management Administration – AGE);
17° L’Administration de la navigation aérienne (Air Navigation Administration – ANA) ;
18° Le Service national du Médiateur de la consommation (National Consumer Ombudsman Service);
19° L’Ordre des architectes et des ingénieurs-conseils (Order of Architects and Consulting Engineers – OAI);
20° L’Ordre des experts-comptables (Luxembourg Association of Chartered Accountants – OEC);
21° L’Institut des réviseurs d’entreprises (Luxembourg Institute of Auditors – IRE) ;
22° L’Administration des contributions directes. (Luxembourg Direct Tax Administration – ACD)

The procedure and follow-up for reports made to a competent authority are much the same as for internal reports, with a few exceptions: i) The competent authorities may decide that a reported breach is clearly minor and requires no further action other than closure. ii) The competent authorities may not act on a repeat report containing no new information.

The procedure and follow-up for reports made to a competent authority are much the same as for internal reports, with a few exceptions: i) The competent authorities may decide that a reported breach is clearly minor and requires no further action other than closure. ii) The competent authorities may not act on a repeat report containing no new information.

In the event of high inflows of reports, competent authorities may deal with reports of serious breaches or breaches of essential provisions falling within the scope of the Law of 16 May 2023 as a matter of priority (without prejudice to the timeframe set out in art. 19(3), third point.

There is no such provision in the the Law of 16 May 2023.
However, a whistleblowing office has been set up by authority of the Minister of Justice, charged with the following tasks:
– Informing and assisting anyone wishing to make a report, in particular, by explaining the procedures to be followed
– Raising public awareness of whistleblower protection legislation
– Informing the respective competent authorities of any breaches of obligations to set up internal channels of which the office is aware
– Collect, in collaboration with the competent authorities and the judicial authorities, the information needed to draw up the annual report
– Drawing up recommendations on any matter relating to the application of this law
– Carrying out the tasks assigned to it under the external reporting procedure

“Retaliatory measures are automatically null and void.

Persons suffering retaliation may ask the competent court to declare the retaliation null and void and to order it to cease.

Persons not invoking the nullity of the retaliatory measure may still take legal action for compensation for the damage suffered.

Retaliatory measures taken are presumed to be retaliatory. It is, therefore, up to the person taking the prejudicial action to establish the grounds for such action à reversal of the burden of proof in favour of the whistleblower.

Whistleblowers shall not be deemed to have breached any restrictions on the disclosure of information and shall not incur any liability as a result of said disclosure, provided that they had reasonable grounds for believing that the reporting or public disclosure of such information was necessary to reveal a breach under this law.

Whistleblowers shall not be liable for obtaining or gaining access to information that is reported or publicly disclosed, provided that obtaining or gaining access to such information does not constitute a separate criminal offence.

In legal proceedings, including for defamation, breach of copyright, breach of secrecy, breach of data protection rules or disclosure of business secrets, or for claims for compensation based on private law, public law or collective labour law, the persons referred to in Article 2 shall not incur any liability as a result of reports or public disclosures made under this law. Such persons shall be entitled to rely on said report or public disclosure to request that the proceedings be discontinued, provided that they had reasonable grounds for believing that the report or public disclosure was necessary to reveal a breach under this law.”

Administrative fines may be imposed on natural and legal persons who:
1° hinder or attempt to hinder a report;
2° refuse to provide the information required by competent authority, or provide incomplete or false information;
3° breach the duty of maintaining the confidentiality of reporting persons;
4° refuse to remedy the identified breach;
5° fail to establish the channels and procedures for internal reporting and follow-up.
The fine may range from 1,500 euros to 250,000 euros.
The maximum fine may be doubled in the event of a repeated offense within five years from the last final penalty.
Persons who engage in retaliatory measures as provided for in Article 25 of the Law of 16 may 2023 or who initiate abusive proceedings against whistleblowers are subject to a fine ranging from 1,250 to 25,000 euros.

Anyone who knowingly reports or publicly discloses false information may be subject to a prison sentence of between 8 days and 3 months and a fine of between €1,500 and €50,000.

Those making false reports will be held civilly liable. The entity suffering the damage may claim compensation before the competent court for the loss suffered.

N/A