Whistleblower

The law protects whistleblowers working in the private or public sector who have acquired information concerning breaches in a work-related context (current, past or future employment relationship), including:

• workers (including civil servants and State employees);
• self-employed persons;
• shareholders and members of a company's administrative, management or supervisory body, including non-executive members, volunteers and paid or unpaid trainees;
• any persons working under the supervision and direction of contractors, subcontractors and suppliers.

It also protects:

• facilitators (natural persons assisting whistleblowers on a confidential basis);
• colleagues or relatives of the whistleblower who could suffer retaliation; and
• legal entities that the whistleblower owns, works for or is otherwise connected with in a work-related context;
• persons who have reported or disclosed information on breaches anonymously, but who are subsequently identified and suffer retaliation;
• persons reporting breaches to relevant institutions, bodies, offices or agencies of the European Union.

Whistleblowers can report any breach of national law and/or European Union law, namely acts or omissions that:

• are unlawful; or
• defeat the object or the purpose of the directly applicable rules of national law or European Union law.

They can communicate any information, including reasonable suspicions, concerning:

• actual or potential breaches; and
• attempts to conceal such breaches,
• which have occurred or are very likely to occur:
  • in the organisation in which they work or have worked; or
  • in another organisation with which they are or have been in contact in the context of their work.

To be protected against all forms of retaliation, the whistleblower must:

• have had reasonable grounds to believe that the information on breaches reported was true at the time of reporting and that such information falls within the scope of the law; and
• have made a report that is either internal (via their company's or authority's reporting channels), external (via the competent authority's reporting channels), or public (following an unproductive external report).

No liability for whistleblowers

Whistleblowers who fulfil the conditions for protection will not be breaking the law when they disclose information and will not incur any liability:

• as regards the reporting (internal and/or external) or the public disclosure, provided they had reasonable grounds to believe that the reporting or public disclosure was necessary in order to reveal a breach of the law;
• as regards the way in which the information reported or publicly disclosed, or access to that information, was acquired (provided that such acquisition or access did not constitute a criminal offence in and by itself);
• on account of reports or public disclosures made, including in legal proceedings for defamation, breach of copyright, breach of secrecy, breach of data protection rules or disclosure of trade secrets, or for compensation claims based on private, public or collective labour law.

In such cases, they may rely on that reporting or public disclosure to seek dismissal of the proceedings.

Prohibited retaliation measures

All forms of retaliation against whistleblowers on account of the report they made, including threats of retaliation and attempts at retaliation, are prohibited.

The following, in particular, are prohibited and automatically null and void:

• suspension of an employment contract, lay-off, dismissal, failure to renew or early termination of a fixed-term employment contract, or equivalent measures;
• demotion or withholding of promotion;
• transfer of duties, change of location of place of work, reduction in wages, change in working hours;
• withholding of training;
• imposition or administering of any disciplinary measure, reprimand or other penalty, including a financial penalty;
• failure to convert a fixed-term employment contract into a permanent one, where the employee had legitimate expectations that they would be offered permanent employment;
• a negative performance assessment or employment reference;
• early termination or cancellation of a contract for goods or services;
• cancellation of a licence or permit;

The following are likewise prohibited:

• coercion, intimidation, harassment or ostracism;
• discrimination, disadvantageous or unfair treatment;
• harm, including damage to the person's reputation, particularly on social networks, or financial losses, including loss of business and loss of income;
• blacklisting on the basis of a formal or informal agreement at sector or industry level, which may imply that the person will not find employment in the future in the sector or industry;
• referral to psychiatric or medical treatment.

Action against retaliation measures

Whistleblowers suffering retaliation measures have the right, within 15 days of notification of the measures, to apply to the relevant court of competent jurisdiction for a ruling declaring the measures to be null and void and ordering their cessation.

A person who has not pleaded nullity of the retaliation measures, or who has already obtained an order declaring them to be null and void, may still bring a claim for damages and interests.

Reversal of the burden of proof

A whistleblower suffering detrimental measures is automatically entitled to the benefit of a presumption that the measures in question have been taken against them as retaliation for the reporting.

It is therefore up to the person who took the measures to provide the reasons for them.

Anyone wishing to report breaches of the law is encouraged to report them internally before resorting to external reporting, unless internal reporting is likely to cause them harm (retaliation by the employer, for example).

Each private sector entity (upwards of 50 employees) and every public sector body (apart from communes with fewer than 10,000 inhabitants and entities employing fewer than 50 workers) is required to provide internal reporting channels and procedures and to ensure that reports are followed up.

Private sector entities employing between 50 and 249 workers may share resources for receiving and following-up reports made internally.

Anyone wishing to report breaches of the law can report them externally to the competent authority, either directly, or after having made an internal report.

Reporting to the Competition Authority

A whistleblower wishing to report breaches of legislation that fall within the remit of the Authority can contact the Authority in French, Luxembourgish, German or English:

• via the secure external whistleblowing platform with the Competition Authority on MyGuichet.lu (no authentication required);
• by email to: alerte@concurrence.etat.lu;
• by telephone on: (+352) 247 84 484;
• in person at the Competition Authority's premises.
• by post (preferably by registered post) in a double envelope: the first envelope, addressed to the Authority, containing the report, inside a second envelope for the attention of the Whistleblower Department. 

The Authority's reporting platform guarantees the completeness, integrity and confidentiality of the information submitted to the Authority. Only authorised staff members of the Competition Authority have access to this information and are required to observe professional secrecy in accordance with the oath they took upon taking up their posts.

The Authority does not record reports made by telephone, but it may draw up a detailed transcript of the conversation, which the whistleblower may subsequently check, correct and sign for approval.

Similarly, the Authority ensures, with the whistleblower's consent, that comprehensive and accurate records are kept of reports made in person, in the form of recordings or minutes.

Follow-up and handling of reports by the Authority

The Authority receives and follows up on reports falling within its remit.

It may request in writing from the entity concerned by the report, to provide all the information deemed necessary, whilst strictly respecting the confidentiality of the whistleblower's identity.

In particular, the Authority shall:

• acknowledge receipt of the report within 7 days of receiving it, unless:
  • the whistleblower expressly requests otherwise; or
  • there are reasonable grounds to believe that acknowledging receipt of the report would compromise the protection of the whistleblower's identity;
• ensure it is dealt with promptly;
• provide the whistleblower with feedback within 3 months, or 6 months in duly justified cases;
• inform the whistleblower of the final outcome of the actions taken as a result of the report, subject to any information falling within the scope of a legal duty of confidentiality, punishable by criminal law.

Confidentiality and data processing

Confidentiality

The Competition Authority handles all reports with strict confidentiality regarding the identity of the whistleblower.

Under no circumstances will the Authority disclose:

• either the identity of the whistleblower without their express consent;
• or any other information from which the identity of a whistleblower may be directly or indirectly deduced.

Where applicable, the Authority shall not use or disclose trade secrets for purposes going beyond what is necessary for proper follow-up.

Processing personal data

For the purposes of carrying out the tasks entrusted to it by the Law of 16 May 2023 on the protection of persons reporting breaches of Union law (whistleblowers), and more specifically concerning the processing of reports, the Authority may need to process personal data relating to you.

Any processing of personal data carried out under the Law on the Protection of Whistleblowers, including the exchange or transmission of personal data by the competent authorities, is carried out in accordance with Regulation (EU) 2016/679, hereinafter referred to as the ‘General Data Protection Regulation’ or ‘GDPR’.

As a public authority processing personal data, the Authority is required to fulfil its obligations as a data controller.

If you have any questions concerning the processing of your personal data by the Authority, you can contact the Authority's Data Protection Officer (DPO) by post addressed to the DPO, by telephone (+352 247 84 728) or by email at the following address: dpo@concurrence.etat.lu.

Decisions and sanctions imposed by the Authority

Following an investigation, the Authority:

• may decide to close the proceedings:
  • in the event of a manifestly minor breach (without prejudice to other applicable obligations or procedures aimed at remedying the reported breach);
  • in the case of repeated reports which contain no significant new information in relation to a previous report for which proceedings have been closed;
    The Authority shall then notify the whistleblower of its decision and the grounds on which it is based.

• may impose sanctions on the entities (legal persons) referred to in the report under the terms of the amended Law of 30 November 2022 on competition.

Fines incurred

The Whistleblowing Office may impose fines on persons who fail to comply with the law on the protection of whistleblowers:

• from EUR 1,250 to EUR 25,000 if they take retaliatory measures or bring frivolous proceedings against whistleblowers;
• from EUR 1,500 to EUR 250,000 in particular if they obstruct a report, refuse to remedy a breach or have failed to establish the required internal reporting channels (the fine may be doubled in the event of a repeat offence).

A whistleblower who publicly discloses a breach is protected by the law if:

• they have first reported it either internally and externally, or directly externally, but no appropriate action has been taken within 3 months of the report; or
• they have reasonable grounds to believe that:
  • the breach may pose an imminent or manifest danger to the public interest (for example, where there is an emergency or a risk of irreversible harm); or
  • in the case of an external report, there is a risk of retaliation or it is unlikely that the breach will be effectively remedied, due to the specific circumstances of the case (for example, where evidence may be concealed or destroyed, or where an authority may be colluding with the perpetrator of the breach or involved in the breach).