Whistleblower

The law protects whistleblowers working in the private or public sector who have obtained information about breaches in a professional context (current, past or future employment relationship), including: 

• workers (including civil servants and state employees);
• self-employed persons;
• shareholders and members of a company’s administrative, management or supervisory body, including non-executive members, as well as volunteers and trainees, whether paid or unpaid;
• any person working under the supervision and direction of contractors, subcontractors and suppliers.

It also protects:

• facilitators (natural persons who assist a whistleblower confidentially);
• colleagues or relatives of the whistleblower who may be subject to reprisals; and
• legal entities owned by the whistleblower, for which they work, or with which they have professional links;
• persons who have reported or disclosed information on breaches anonymously but who are subsequently identified;
• persons who report breaches to the competent institutions, bodies or agencies of the European Union;

It does not protect:

• reports of breaches relating to national security;
• whistleblowers whose communications are covered by: medical confidentiality, lawyer-client privilege, the professional secrecy to which a notary or bailiff is bound, the confidentiality of judicial deliberations, and the rules governing criminal proceedings.

A whistleblower may report any breach of national law and/or EU law, that is to say, acts or omissions which:

• are unlawful; or
• are contrary to the object or purpose of the provisions of national or directly applicable EU law.

They may disclose any information, including reasonable suspicions concerning:

• actual or potential breaches; and
• attempts to conceal such breaches;
• events that have occurred or are highly likely to occur: within the organisation in which they work or have worked, or within another organisation with which they are or have been in contact in the course of their work.

Please note: a whistleblower may not disclose information which they have obtained or to which they have gained access by committing a criminal offence.

To be protected against all forms of reprisal, a whistleblower must:

• have had reasonable grounds to believe that the information reported regarding the breaches was true at the time of reporting and that it falls within the scope of the law; and
• have made a report either internally (via their company’s or public body’s reporting channels), externally (via the competent authority’s reporting channels) or publicly (following an unsuccessful external report).

The CELPL handles all reports whilst strictly maintaining the confidentiality of the whistleblower’s identity.

Under no circumstances will it disclose:

• the identity of the whistleblower without their express consent;
• any other information from which the identity of the whistleblower may be directly or indirectly deduced.

The confidentiality of the whistleblower’s identity may only be lifted in the event of a necessary and proportionate obligation imposed by the amended Act of 8 June 2004 on freedom of freedom of expression in the media or under European Union law in the context of investigations conducted by national authorities or in the context of legal proceedings, in particular with a view to safeguarding the rights of the defence of the person concerned.

In such a case, the CELPL shall inform the whistleblower in writing, stating the reasons, before their identity is disclosed, unless such disclosure would risk compromising the investigations or legal proceedings in question.

Internal reporting

Every organisation in the private sector (with 50 or more employees) and in the public sector (except for local authorities with fewer than 10,000 inhabitants and organisations with fewer than 50 employees) must provide internal reporting channels and procedures and ensure that these are followed up.

Private-sector organisations with between 50 and 249 employees may share resources for receiving and following up on internal reports.

Individuals wishing to report breaches of the law are encouraged to prioritise internal reporting before resorting to external reporting, unless internal reporting risks causing them harm (such as reprisals by the employer).

The Whistleblowing Office, "Office de signalements", which was established in December 2023, can provide information and assistance to anyone wishing to make a report.

External reporting

Individuals wishing to report breaches of the law may make an external report to the competent authority, either directly or after having made an internal report.

Reporting to the CELPL

Whistleblowers wishing to report breaches of legislation falling within the CELPL’s remit may contact the CELPL in French, Luxembourgish, German or English: The CELPL’s reporting platform guarantees the completeness, integrity and confidentiality of the information submitted to the CELPL. Only authorised staff members have access to it and are required to maintain professional secrecy in accordance with their enabling legislation and the oath they took upon taking up their post.

• by email to: alerte@celpl.lu;
• by telephone on: (+352) 26 27 01 01;
• in person at the CELPL’s headquarters (61, route d'Arlon, L-1140 Luxembourg);
• by post.

The CELPL does not record reports made by telephone, but it may draw up a detailed record setting out the main points of the conversation, which the whistleblower may subsequently verify, amend and sign for approval.

Similarly, with the whistleblower’s consent, the CELPL ensures that complete and accurate records of reports made in person are kept, either in the form of a recording or a written record.

In the event of a report being made through other channels or via other members of staff, the latter are also required to maintain confidentiality regarding the identity of the whistleblower or the person concerned and must forward the report as soon as possible to the staff members responsible for handling it.

Follow-up and handling of reports by the CELPL

The CELPL receives and follows up on reports falling within its remit. It may request in writing that the entity concerned by the report provide all the information it deems necessary, whilst strictly respecting the confidentiality of the whistleblower’s identity.

In particular, the CELPL ensures that: Where the CELPL receives a report for which it has no jurisdiction, it forwards it within a reasonable timeframe, confidentially and securely, to the competent national authority. The latter informs the whistleblower.

• to acknowledge receipt of the report within 7 days of its receipt, except where: the whistleblower has expressly requested otherwise; or there are reasonable grounds to believe that acknowledging receipt of the report would compromise the protection of the whistleblower’s identity;
• to follow up on the report diligently;
• to provide the whistleblower with feedback within 3 months, or 6 months in duly justified cases;
• to inform the whistleblower of the final outcome of the actions taken in response to the report, subject to any information falling within the scope of a legal duty of confidentiality punishable by criminal law.

CELPL Decisions and Sanctions

Following review, the CELPL may decide to close the proceedings:

• in the event of a manifestly minor breach (without prejudice to other obligations or applicable procedures aimed at remedying the reported breach);
• in the event of repeated reports containing no significant new information compared with a previous report for which proceedings have been closed; the CELPL shall then notify the whistleblower of its decision and the grounds on which it is based.

Whistleblowers who meet the conditions for protection do not break the law by disclosing information and do not incur any liability: they may therefore rely on that report or public disclosure to request that the proceedings be discontinued.

• in relation to the report (internal and/or external) or public disclosure, provided they had reasonable grounds to believe that the report or public disclosure was necessary to reveal a breach of the law;
• in relation to obtaining the information that is reported or publicly disclosed, or accessing such information (unless such obtaining or access constitutes a separate criminal offence);
• as a result of reports or public disclosures made, including in legal proceedings for defamation, copyright infringement, breach of confidentiality, breach of data protection rules or disclosure of trade secrets, or in claims for compensation based on private law, public law or collective labour law.

Prohibited retaliatory measures

All forms of retaliation, including threats and attempts at retaliation, are, of course, prohibited against whistleblowers on account of the report they have made.

The following are, in particular, prohibited and automatically null and void:

• the suspension of an employment contract, suspension from work, dismissal, non-renewal or early termination of a fixed-term employment contract, or equivalent measures;
• demotion or refusal of promotion;
• transfer of duties, change of place of work, reduction in pay, or alteration of working hours;
• suspension of training;
• disciplinary measures imposed or administered, reprimands or other sanctions, including financial penalties;
• failure to convert a temporary employment contract into a permanent one where the employee could legitimately expect to be offered permanent employment;
• a negative performance appraisal or reference;
• the early termination or cancellation of a contract for goods or services;
• the revocation of a licence or permit;
• coercion, intimidation, harassment or ostracism;
• discrimination, unfavourable or unfair treatment;
• prejudice, including damage to a person’s reputation, particularly on social media, or financial losses, including loss of business and loss of income;
• being blacklisted on the basis of a formal or informal agreement at sectoral or industry level, which may mean that the person will be unable to find employment in the future within that sector or industry;
• being referred for psychiatric or medical treatment.

Action against retaliatory measures

A whistleblower who is subjected to retaliatory measures may, within 15 days of being notified of the measures, apply to the competent court to have the measures declared null and void and to order their cessation.

A person who has not sought a declaration that the retaliatory measures are null and void, or who has already obtained such a declaration, may still bring an action for damages.

The CELPL recommends seeking the services of a lawyer to bring legal proceedings.

Reversal of the burden of proof

A whistleblower who is subjected to prejudicial measures is automatically presumed to have been targeted in retaliation for their report. It is therefore incumbent upon the person who took the measures to establish the grounds for them.

For the purposes of carrying out the tasks entrusted to it by the Act of 16 May 2023 on the protection of persons who report breaches of Union law (whistleblowers) and, more specifically, in relation to the processing of reports, the CELPL may need to process personal data concerning the whistleblower.

Any processing of personal data carried out under the Act on the Protection of Whistleblowers, including the exchange or transmission of personal data by the competent authorities, is carried out in accordance with Regulation (EU) 2016/679, hereinafter referred to as the ‘General Data Protection Regulation’ or ‘GDPR’.

As a body processing personal data, the CELPL is required to comply with its obligations as a data processor.

If you have any questions regarding the processing of your personal data by the CELPL, you may contact the CELPL’s Data Protection Officer (DPO) by post, addressed to the DPO, by telephone (+352 26 27 01 01) or by email at the following address: dpo@ombudsman.lu.

Purposes and legal basis of the processing

The CELPL may be approached by any whistleblower wishing to make a report outside their company or public authority. Following review, where necessary and subject to the confidentiality obligations set out above, the personal data thus obtained may be processed in the course of carrying out tasks or investigations falling within the CELPL’s remit.

In this context, the processing of your data is necessary for the exercise of the public authority vested in the CELPL (Article 6(1)(e) of the GDPR).

Data processed

Reports may be made via email, telephone, post, in person. In the first case, processing the report requires the provision of an email address to enable the CELPL to provide feedback and follow up on the report. Where a report is made by telephone or in person, other contact details may be collected if the whistleblower wishes to receive updates regarding their report. Providing an email address is not essential.

In all cases, the potential whistleblower must also provide a description of the alleged breach and specify who is said to have committed it. It is therefore possible that information relating to the behaviour of other individuals – in particular the perpetrator of the breach or any witnesses – may be processed.

It is advisable, when describing the breach, to include only the information necessary for processing the report and, in particular, to avoid including, unless absolutely necessary, sensitive data (within the meaning of Article 9 of the GDPR) concerning the whistleblower or third parties (for example, data relating to health, political opinions or religious beliefs).

Categories of recipients

Recipients

Only authorised members of the CELPL have access to the reporting platform or to the reports, as applicable.

Where a report is made through other channels or via other staff members, the latter are also required to maintain confidentiality regarding the identity of the whistleblower or the person concerned and must forward the report as soon as possible to the CELPL staff members responsible for handling it.

Potential recipients

If a report does not fall within the remit of the CELPL, the data collected may be forwarded to other competent national authorities or to competent institutions, bodies or agencies of the European Union within the framework of the cooperation provided for in Article 19 of the Act.

Retention period

Personal data that is manifestly irrelevant to the processing of a specific report shall not be collected or, if collected accidentally, shall be erased without undue delay.

Personal data obtained through a report deemed unfounded, or falling outside the CELPL’s remit, shall be erased without delay by authorised staff.

Personal data obtained through a report shall be retained for two months following the conclusion of the investigation conducted by the CELPL in the performance of its respective duties or of the proceedings concerning the facts alleged in the report, until the end of the appeal period.

In accordance with the Act of 17 August 2018 on archiving, records of historical, scientific, cultural, economic or societal interest must be retained beyond these periods of administrative use.

Your rights

You may access your personal data and obtain a copy of it (Article 15 of the GDPR), request the rectification of inaccurate or incomplete data (Article 16 of the GDPR), object to the processing of your data under the conditions set out in Article 21 of the GDPR, request the erasure of your data under the conditions set out in Article 17 of the GDPR, and request the restriction of processing under the conditions set out in Article 18 of the GDPR.

If you have any questions regarding the processing of your personal data by the CELPL or any requests relating to the exercise of your rights, please contact the Data Protection Officer (DPO).

Complaints: If you believe that the processing of your data by the CELPL constitutes a breach of the General Data Protection Regulation, you may lodge a complaint with the CNPD.

Contact

If you have any questions regarding the processing of your personal data by the CELPL, you may contact the CELPL’s Data Protection Officer (DPO) by:

1. post, for the attention of the DPO (61, route d'Arlon L-1140 Luxembourg)
2. telephone on (+352) 26 27 01 01
3. email at the following address: dpo@ombudsman.lu