Whistleblowers working in the private or public sector who have acquired information concerning breaches in a work-related context (current, past or future employment relationship), such as:

• salaried workers (including civil servants and State employees);
• self-employed persons;
• shareholders and persons belonging to the administrative, management or supervisory body of an undertaking, including non-executive members;
• volunteers and paid or unpaid trainees; and
• any persons working under the supervision and direction of contractors, subcontractors and suppliers.

The protection also extends to:

• facilitators (natural persons assisting whistleblowers on a confidential basis);
• colleagues or relatives of the whistleblower who could suffer retaliation;
• legal entities that the whistleblower owns, works for or is otherwise connected with in a work-related context;
• persons who have reported or disclosed information on breaches anonymously, but who are subsequently identified and suffer retaliation;
• persons reporting breaches to relevant institutions, bodies, offices or agencies of the European Union.

What can be reported?

As a whistleblower, you can report any breach of national law and/or European Union law, that is to say, acts or omissions that:

• are unlawful; or
• defeat the object or the purpose of the directly applicable rules of national law or European law.

You can communicate any information, including reasonable suspicions, concerning:

• actual or potential breaches; and/or
• attempts to conceal such breaches,

which have occurred or are very likely to occur:

• in the organisation in which you work or have worked; or
• with which you are or have been in contact through your work.

What are the conditions for protection?

In order to qualify for protection against all forms of retaliation, you must:

• have had reasonable grounds to believe that the information on breaches reported was true at the time of reporting and that such information fall within the scope of the law; and
• have made a report:
  • either internally: through the reporting channels of your undertaking or administration;
  • or externally: through the reporting channels of the competent authority;
  • or by way of public disclosure: following external reporting that yielded no satisfactory result.

Internal reporting

If you wish to report breaches of the law, you are encouraged, preferably, to report the breaches in question through internal channels before resorting to external reporting, unless internal reporting may have negative consequences for you (in the form of retaliation by your employer, for example).

Each private sector entity (upwards of 50 employees) and every public sector body (apart from communes with fewer than 10,000 inhabitants and entities employing fewer than 50 workers) is required to provide internal reporting channels and procedures and to ensure that reports are followed up.

Private sector entities employing between 50 and 249 workers may share resources for receiving and following up reports made internally. Their reporting channels must be operational by 17 December 2023 at the latest.

External reporting

If you wish to report breaches of the law, you can do so externally by approaching the competent authority:

• either directly;
• or after reporting the same internally.

Reporting to the Competition Authority

If, as a whistleblower, you wish to report breaches falling within the ambit of the competences of the Competition Authority, you can approach the Authority in French, Luxembourgish, German or English:

• via the secure platform 'Report to the Competition Authority' (Alerter l’Autorité de concurrence) on MyGuichet. This is a procedure requiring no authentication (see under 'Online services and forms');
• by email to: alerte@concurrence.etat.lu;
• by telephone at: (+352) 247 84484;
• in person at the registered office of the Competition Authority.

The platform for reporting to the Competition Authority guarantees the comprehensiveness, integrity and confidentiality of the information provided. Only duly authorised members of staff of the Competition Authority have access to it, and they are bound by the duty of professional secrecy.

The Competition Authority does not make recordings of reports made to it over the telephone, but it may draw up accurate minutes setting out the main elements of the conversation which you can subsequently check, rectify and sign by way of approval.

By the same token, the Competition Authority takes care, with your consent, to keep full and accurate accounts of reports made in person, by way of recordings or minutes.

Follow-up and handling of the report by the Competition Authority

The Competition Authority receives reports falling within its area of competence and ensures that these are followed up.

It may ask the entity to which the report relates, in writing, to provide all such information as it deems necessary, whilst strictly respecting the confidentiality of your identity as the whistleblower.

The Competition Authority takes care, in particular, to:

• acknowledge receipt of the report within 7 days from receipt thereof, unless:
  • you explicitly request otherwise; or
  • there are reasonable grounds to believe that acknowledging receipt of the report would jeopardise the protection of your identity;
• ensure that it is diligently followed up;
• provide you with feedback within 3 months, or 6 months in duly justified cases;
• communicate to you the final outcome of the steps taken in consequence of the reporting, subject to any information falling within the scope of a legal obligation to observe confidentiality, breach of which is punishable under criminal law.

Decisions taken, and penalties imposed, by the Competition Authority

After assessing the matter, the Competition Authority:

• may decide to close the procedure:
  • where the breach is clearly minor (even though other obligations or other procedures may be applied to address the reported breach);
  • in the case of repetitive reports which do not contain any meaningful new information compared to a past report in respect of which the procedure has been closed.

The Competition Authority will then notify you of its decision and of the reasons therefor.

The Competition Authority may impose penalties on the entities (legal persons) to which the report relates.

Fines

The Office for Whistleblowers may, for its part, impose fines on persons who fail to observe the law on the protection of whistleblowers:

• of between EUR 1,250 and EUR 25,000 if they take retaliatory measures or bring vexatious proceedings against whistleblowers;
• of between EUR 1,500 and EUR 250,000 in particular if they impede the making of a report, refuse to remedy a breach or have failed to put in place the required internal reporting channels (the fine may be doubled if the offence is repeated).

Public disclosures

Where, as a whistleblower, you publicly disclose a breach, you are entitled to protection under the law if:

• you have first reported it internally and externally or directly externally, but no appropriate action was taken in response to the report within 3 months from your so doing; or
• you have reasonable grounds to believe that:
  • the breach may constitute an imminent or manifest danger to the public interest (such as where there is an emergency situation or a risk of irreversible damage); or
  • in the case of external reporting, there is a risk of retaliation or there is a low prospect of the breach being effectively addressed, due to the particular circumstances of the case (such as those where evidence may be concealed or destroyed, or where an authority may be in collusion with the perpetrator of the breach or involved in the breach).

Protection against retaliation

No liability attaching to whistleblowers

If you fulfil the conditions for protection of whistleblowers, you will not be breaking the law when you disclose information, and you will not incur any liability:

• as regards the reporting (done internally and/or externally) or the public disclosure, provided you had reasonable grounds to believe that the reporting or public disclosure was necessary in order to reveal a breach of the law;
• as regards the way in which the information reported or publicly disclosed, or access to that information, was acquired (provided that such acquisition or access did not constitute a self-standing criminal offence);
• on account of reports or public disclosures made, including in legal proceedings for defamation, breach of copyright, breach of secrecy, breach of data protection rules or disclosure of trade secrets, or for compensation claims based on private, public, or collective labour law.

In such cases, you may rely on that reporting or public disclosure to seek dismissal of the proceedings.

Prohibited retaliation measures

All forms of retaliation against you as a whistleblower on account of the report made by you, including threats of retaliation and attempts at retaliation, are prohibited.

The following, in particular, are prohibited and automatically null and void:

• suspension of an employment contract, lay-off, dismissal, failure to renew or early termination of a fixed-term employment contract, or equivalent measures;
• demotion or withholding of promotion;
• transfer of duties, change of location of place of work, reduction in wages, change in working hours;
• withholding of training;
• imposition or administering of any disciplinary measure, reprimand or other penalty, including a financial penalty;
• failure to convert a fixed-term employment contract into a permanent one, where you had legitimate expectations that you would be offered permanent employment;
• a negative performance assessment or employment reference;
• early termination or cancellation of a contract for goods or services;
• cancellation of a licence or permit.

The following are likewise prohibited:

• coercion, intimidation, harassment or ostracism;
• discrimination, disadvantageous or unfair treatment;
• harm, including to the person's reputation, particularly in social media, or financial loss, including loss of business and loss of income;
• blacklisting on the basis of a sector- or industry-wide informal or formal agreement, which may entail that the person will not, in the future, find employment in the sector or industry;
• psychiatric or medical referrals.

Action against retaliation measures

As a whistleblower suffering retaliation measures, you have the right, within 15 days following notification of the measures, to apply to the relevant court of competent jurisdiction for a ruling declaring the measures to be null and void and ordering their cessation.

A person who has not pleaded nullity of the retaliation measures, or who has already obtained an order declaring them to be null and void, may still bring a claim for damages.

Reversal of the burden of proof

As a whistleblower suffering detrimental measures, you are automatically entitled to the benefit of a presumption that the measures in question have been taken against you as retaliation for the reporting.

Consequently, it is for the person who has taken the measures to establish the grounds therefor.

Confidentiality and data processing

Confidentiality

The Competition Authority handles all reports in strict confidence as regards the identity of the whistleblower.

The Authority will never disclose:

• either your identity without your explicit consent;
• or any other information from which your identity as a whistleblower may be directly or indirectly deduced.

Where applicable, the Competition Authority will not use or disclose trade secrets for purposes going beyond what is necessary for proper follow-up.

Processing personal data

In order to carry out the tasks assigned to it by law, the Authority may need to process personal data concerning you.

All processing of personal data carried out pursuant to the law on the protection of whistleblowers, including the exchange or transmission of personal data by the competent authorities, is done in accordance with Regulation (EU) 2016/679, hereinafter referred to as the 'General Data Protection Regulation' or the 'GDPR'.

As a public authority processing personal data, the Authority is bound to respect the obligations incumbent on it in its capacity as a data controller.

If you have any questions concerning the processing of your personal data by the Authority, you can contact the Authority's data protection officer (DPO) by letter marked for the attention of the DPO, by telephone (+352 247 84728) or by email at the following address: dpo@concurrence.etat.lu.

Purpose and legal basis for processing

The Authority may be contacted by any whistleblower wishing to report a breach externally, i. e. outside the company where they work. Following an assessment, where necessary, and subject to the obligations in respect of confidentiality, the personal data thus obtained may be processed in the context of the performance of the tasks or investigations falling within the ambit of the Authority's competence.

In that context, the processing of your data is necessary for the performance of a task carried out in the public interest in the exercise of the powers vested in the Authority (Article 6(1)(e) of the GDPR).

Data processed

Reporting can be done via the secure platform MyGuichet.lu. In such cases, for the report to be processed, an email address must be provided, thereby enabling the Authority to give feedback and to ensure that the reports are followed up. Potential whistleblowers must also provide a description of the alleged breach and state who has committed it. It is therefore possible that information relating to the behaviour of other persons, and in particular the perpetrator of the breach or witnesses, are processed.

It is preferable, when describing the breach, to mention only information which is needed in order for the report to be dealt with and, in particular, to refrain from including in it, unless absolutely necessary, sensitive data (within the meaning of Article 9 of the GDPR) concerning the whistleblower or third persons (for example data concerning their health, political opinions or religious beliefs).

Reporting can also be done by telephone or in person. In such cases, other contact details may be collected and the provision of an email address is not necessary.

Categories of recipients

Recipients

Only duly authorised members of staff of the Competition Authority have access to the Authority's secure reporting platform or to the minutes, as the case may be.

In the case of reporting through other channels or via other members of staff of the Authority, the latter are likewise bound to observe confidentiality concerning the identity of the whistleblower or of the person concerned, and will forward the report without delay to the members of staff assigned to handle it.

As regards reporting via the MyGuichet.lu platform, for which the Government IT Centre, (hereinafter referred to as the 'CTIE') is responsible (the latter body acting in the capacity of processor), personal data provided by the whistleblower will be accessible only to persons designated by the CTIE in the context of a request for support or technical assistance.

Potential recipients

Where a report does not fall within the scope of the Competition Authority's competence, the data collected may be forwarded to other competent national authorities or to institutions, bodies, offices or agencies of the European Union having competence within the framework of the cooperation provided for by the law.

Where a report addressed to the Authority is the subject of an investigation into the facts alleged, the persons authorised to access reports will, according to the subject-matter thereof (Digital Markets Act, P2B, anti-competitive practices), forward the report in question to the competent departments within the Authority. If anonymisation is not possible without compromising the Authority's investigation and inspection activities, only the personal data needed for the purposes of the investigation will be transmitted.

Data retention period

Personal data which are manifestly not relevant for the handling of a specific report will not be collected or, if accidentally collected, will be deleted without undue delay.

Personal data obtained via a report which is held by the duly authorised staff to be unfounded and which falls outside the ambit of the Authority’s competence will be deleted without delay.

Personal data obtained via a report shall be kept for 2 months following the closure of the investigation carried out by the Authority in the performance of its respective tasks or of the procedure concerning the facts alleged in the report until the end of the period allowed for lodging an appeal.

Files having a significant heritage value are to be kept for archiving purposes, in the public interest, for longer than those periods of administrative usefulness.

Rights of the persons concerned

Under the GDPR, you have the right:

• to access data concerning you and obtain a copy thereof;
• to obtain rectification of incorrect or incomplete data;
• to object, subject to conditions, to the processing of your data;
• to obtain, subject to conditions, the erasure thereof;
• to obtain, subject to conditions, restrictions of processing.

If you have any questions concerning the processing by the Authority of your personal data, or wish to make any request regarding the exercise of your rights, you can contact the Competition Authority's DPO.

Complaint

If you consider that the processing of your data by the Authority constitutes a breach of the General Data Protection Regulation, you may lodge a complaint with the CNPD.