Whistleblowers who report breaches of legal rules are protected against all forms of retaliation.
A uniform European legal framework has been created to protect whistleblowers in certain fields of action of the European Union.
Luxembourg has 22 competent authorities, including the Competition Authority.
You can approach the Office for Whistleblowers (Office des signalements), to be set up in December 2023, in order to obtain general information concerning the competent authority that can be notified depending on the type of reporting involved.
The Competition Authority gathers reports concerning breaches:
Persons who take retaliatory measures or who bring vexatious proceedings against whistleblowers are liable to a fine of between EUR 1,250 and EUR 25,000.
Whistleblowers working in the private or public sector who have acquired information concerning breaches in a work-related context (current, past or future employment relationship), such as:
The protection also extends to:
The protection in question does not apply to:
As a whistleblower, you can report any breach of national law and/or European Union law, that is to say, acts or omissions that:
You can communicate any information, including reasonable suspicions, concerning:
which have occurred or are very likely to occur:
In order to qualify for protection against all forms of retaliation, you must:
If you wish to report breaches of the law, you are encouraged, preferably, to report the breaches in question through internal channels before resorting to external reporting, unless internal reporting may have negative consequences for you (in the form of retaliation by your employer, for example).
Each private sector entity (upwards of 50 employees) and every public sector body (apart from communes with fewer than 10,000 inhabitants and entities employing fewer than 50 workers) is required to provide internal reporting channels and procedures and to ensure that reports are followed up.
Private sector entities employing between 50 and 249 workers may share resources for receiving and following up reports made internally. Their reporting channels must be operational by 17 December 2023 at the latest.
If you wish to report breaches of the law, you can do so externally by approaching the competent authority:
If, as a whistleblower, you wish to report breaches falling within the ambit of the competences of the Competition Authority, you can approach the Authority in French, Luxembourgish, German or English:
The platform for reporting to the Competition Authority guarantees the comprehensiveness, integrity and confidentiality of the information provided. Only duly authorised members of staff of the Competition Authority have access to it, and they are bound by the duty of professional secrecy.
The Competition Authority does not make recordings of reports made to it over the telephone, but it may draw up accurate minutes setting out the main elements of the conversation which you can subsequently check, rectify and sign by way of approval.
By the same token, the Competition Authority takes care, with your consent, to keep full and accurate accounts of reports made in person, by way of recordings or minutes.
The Competition Authority receives reports falling within its area of competence and ensures that these are followed up.
It may ask the entity to which the report relates, in writing, to provide all such information as it deems necessary, whilst strictly respecting the confidentiality of your identity as the whistleblower.
The Competition Authority takes care, in particular, to:
After assessing the matter, the Competition Authority:
The Competition Authority will then notify you of its decision and of the reasons therefor.
The Competition Authority may impose penalties on the entities (legal persons) to which the report relates.
The Reporting Office may, for its part, impose fines on persons who fail to observe the law on the protection of whistleblowers:
A whistleblower who knowingly reports or publicly discloses false information may be sentenced to a term of imprisonment of between 8 days and 3 months and a fine of between EUR 1,500 and EUR 50,000.
A person making a false report may incur civil liability. An entity suffering damage in consequence of this may claim compensation for the prejudice suffered before a court of law.
Where, as a whistleblower, you publicly disclose a breach, you are entitled to protection under the law if:
If you fulfil the conditions for protection of whistleblowers, you will not be breaking the law when you disclose information, and you will not incur any liability:
In such cases, you may rely on that reporting or public disclosure to seek dismissal of the proceedings.
All forms of retaliation against you as a whistleblower on account of the report made by you, including threats of retaliation and attempts at retaliation, are prohibited.
The following, in particular, are prohibited and automatically null and void:
The following are likewise prohibited:
As a whistleblower suffering retaliation measures, you have the right, within 15 days following notification of the measures, to apply to the relevant court of competent jurisdiction for a ruling declaring the measures to be null and void and ordering their cessation.
A person who has not pleaded nullity of the retaliation measures, or who has already obtained an order declaring them to be null and void, may still bring a claim for damages.
As a whistleblower suffering detrimental measures, you are automatically entitled to the benefit of a presumption that the measures in question have been taken against you as retaliation for the reporting.
Consequently, it is for the person who has taken the measures to establish the grounds therefor.
The Competition Authority handles all reports in strict confidence as regards the identity of the whistleblower.
The Authority will never disclose:
Where applicable, the Competition Authority will not use or disclose trade secrets for purposes going beyond what is necessary for proper follow-up.
In order to carry out the tasks assigned to it by law, the Authority may need to process personal data concerning you.
All processing of personal data carried out pursuant to the law on the protection of whistleblowers, including the exchange or transmission of personal data by the competent authorities, is done in accordance with Regulation (EU) 2016/679, hereinafter referred to as the 'General Data Protection Regulation' or the 'GDPR'.
As a public authority processing personal data, the Authority is bound to respect the obligations incumbent on it in its capacity as a data controller.
If you have any questions concerning the processing of your personal data by the Authority, you can contact the Authority's data protection officer (DPO) by letter marked for the attention of the DPO, by telephone (+352 247 84728) or by email at the following address: firstname.lastname@example.org.
The Authority may be contacted by any whistleblower wishing to report a breach externally, i. e. outside the company where they work. Following an assessment, where necessary, and subject to the obligations in respect of confidentiality, the personal data thus obtained may be processed in the context of the performance of the tasks or investigations falling within the ambit of the Authority's competence.
In that context, the processing of your data is necessary for the performance of a task carried out in the public interest in the exercise of the powers vested in the Authority (Article 6(1)(e) of the GDPR).
Reporting can be done via the secure platform MyGuichet.lu. In such cases, for the report to be processed, an email address must be provided, thereby enabling the Authority to give feedback and to ensure that the reports are followed up. Potential whistleblowers must also provide a description of the alleged breach and state who has committed it. It is therefore possible that information relating to the behaviour of other persons, and in particular the perpetrator of the breach or witnesses, are processed.
It is preferable, when describing the breach, to mention only information which is needed in order for the report to be dealt with and, in particular, to refrain from including in it, unless absolutely necessary, sensitive data (within the meaning of Article 9 of the GDPR) concerning the whistleblower or third persons (for example data concerning their health, political opinions or religious beliefs).
Reporting can also be done by telephone or in person. In such cases, other contact details may be collected and the provision of an email address is not necessary.
Only duly authorised members of staff of the Competition Authority have access to the Authority's secure reporting platform or to the minutes, as the case may be.
In the case of reporting through other channels or via other members of staff of the Authority, the latter are likewise bound to observe confidentiality concerning the identity of the whistleblower or of the person concerned, and will forward the report without delay to the members of staff assigned to handle it.
As regards reporting via the MyGuichet.lu platform, for which the Government IT Centre, (hereinafter referred to as the 'CTIE') is responsible (the latter body acting in the capacity of processor), personal data provided by the whistleblower will be accessible only to persons designated by the CTIE in the context of a request for support or technical assistance.
Where a report does not fall within the scope of the Competition Authority's competence, the data collected may be forwarded to other competent national authorities or to institutions, bodies, offices or agencies of the European Union having competence within the framework of the cooperation provided for by the law.
Where a report addressed to the Authority is the subject of an investigation into the facts alleged, the persons authorised to access reports will, according to the subject-matter thereof (Digital Markets Act, P2B, anti-competitive practices), forward the report in question to the competent departments within the Authority. If anonymisation is not possible without compromising the Authority's investigation and inspection activities, only the personal data needed for the purposes of the investigation will be transmitted.
Personal data which are manifestly not relevant for the handling of a specific report will not be collected or, if accidentally collected, will be deleted without undue delay.
Personal data obtained via a report which is held by the duly authorised staff to be unfounded and which falls outside the ambit of the Authority’s competence will be deleted without delay.
Personal data obtained via a report shall be kept for 2 months following the closure of the investigation carried out by the Authority in the performance of its respective tasks or of the procedure concerning the facts alleged in the report until the end of the period allowed for lodging an appeal.
Files having a significant heritage value are to be kept for archiving purposes, in the public interest, for longer than those periods of administrative usefulness.
Under the GDPR, you have the right:
If you have any questions concerning the processing by the Authority of your personal data, or wish to make any request regarding the exercise of your rights, you can contact the Competition Authority's DPO.
If you consider that the processing of your data by the Authority constitutes a breach of the General Data Protection Regulation, you may lodge a complaint with the CNPD.