Whistleblower

External reporting

Applicable legal framework

On May 16, 2023, the Grand Duchy of Luxembourg adopted a transposition law, more precisely the law of May 16, 2023 , transposing Directive (EU) 2019/1937 of the European Parliament and of the Council of 23 October 2019 on the protection of persons who report breaches of Union law (hereinafter the “Law of 16 May 2023” or “the Law”).

This directive aims to create a uniform European legal framework to protect whistleblowers working in the private or public sector who have obtained and reported information about violations in a professional context.

The scope of application of the Law of 16 May 2023 extended the protection of whistleblowers to breaches of national law as a whole. Thus, whistleblowers meeting the conditions of the Law of 16 May 2023 who report breaches of the rules of law, be they administrative or criminal, are therefore protected against any form of retaliation.

The ANA and the status of competent authority

The Article 18 (1) - 17° of the Law of 16 May 2023 designates the Administration de la navigation aérienne (hereinafter “ANA”) as the competent authority receiving reports falling within the scope of the Law.

In accordance with Article 17 of the Law, the ANA must establish independent and autonomous reporting channels for receiving follow-up on breaches.

As the competent authority, ANA is required to receive reports falling within the scope of the Law of 16 May 2023, for the civil aviation sector and within the limits of its own powers and missions (assigned by the law of 21 December 2007 of the Air Navigation Administration). For more information on the missions of the ANA, please consult the dedicated page on the website of the ANA.

You may also contact the Whistleblowing Office, whose missions is to inform and assist in their approach any person wishing to make a report, to obtain general information on the competent authority according to the type of report concerned. The whistleblower may receive confidential advice from the Whistleblowing Office.

Who is concerned?

The Law of 16 May 2023 protects whistleblowers working in the private or public sector who acquired information on breaches in a work-related context (current, past or future work-based relationship), including:

  • the workers (including civil servants and State employees);
  • the self-employed persons;
  • the shareholders and persons belonging to the administrative, management or supervisory body of an undertaking, including the non-executive members, as well as the volunteers and the paid or unpaid trainees;
  • any persons working under the supervision and direction of contractors, subcontractors and suppliers.

It also protects:

  • the facilitators (natural person who assists a whistleblower in a confidential manner);
  • the third persons who are connected with the whistleblowers and who could suffer retaliation, such as colleagues or relatives of the whistleblower;
  • the legal entities that the whistleblower owns and works for or is otherwise connected with in a work-related context;
  • the persons who reported or disclosed information on breaches anonymously, but who are subsequently identified and suffer retaliation;
  • the persons reporting breaches to relevant bodies, offices or agencies of the European Union.

The following are not subject to protection:

  • the reports of breaches relating to national security;
  • the whistleblowers whose relationships are covered by:
    • medical professional privilege;
    • professional privilege between lawyer and client;
    • professional privilege binding notaries or bailiffs;
    • the secrecy of judicial deliberations;
    • the rules governing criminal proceedings.

What can be reported?

The whistleblower may report any breach of national and/or Union law, i.e. acts or omissions that:

  • are unlawful; or
  • defeat the object or purpose of directly applicable provisions of national or European law.

The whistleblower may communicate any information, including reasonable suspicions, about:

  • actual or potential breaches; and
  • attempts to conceal such breaches;

which occurred or are very likely to occur:

  • in the organization in which the whistleblower works or has worked; or
  • in another organization with which the whistleblower is or was in contact through his or her work.

The whistleblower may not disclose information acquired or to which he or she obtained access by committing a criminal offence.

What conditions shall be met to benefit from the protection granted by the Law of 16 May 2023?

In order to be protected against any form of retaliation within the meaning of the Law of 16 May 2023, the whistleblower must:

  • have had reasonable grounds to believe that the reported information on breaches was true at the time of reporting and that such information falls within the scope of the Law of 16 May 2023; and
  • have made either an internal (through the reporting channels of his or her enterprise or administration), an external (through the ANAs reporting channels) or a public (following an unsuccessful external report) report.

Confidentiality and processing of data

Confidentiality

ANA is committed to protecting the whistleblower’s identity within the limits of the applicable laws. In other words, neither the identity of the reporting employee, nor that of any third persons involved will be disclosed without the explicit consent of the whistleblower.

ANA will not disclose:

  • the identity of the whistleblower without his or her explicit consent;
  • any other information from which the identity of the whistleblower may be directly or indirectly deduced.

The confidentiality with respect to the identity of the whistleblower may only be waived where that is a necessary and proportionate obligation under the Law of 8 June 2004 on the freedom of expression in the media or under European Union law in the context of investigations by national authorities or judicial proceedings, including with a view to safeguarding the rights of defense of the person concerned.

In such a case, ANA informs the whistleblower in writing with a rationale before his or her identity is disclosed, unless such information would jeopardize the related investigations or judicial proceedings.

Where such a report does not fall within ANA’s remit, this report is transmitted in a confidential and secure manner to the competent authority referred to in Article 18 of the Law of 16 May 2023. The collected data may be transmitted to other national competent authorities or to bodies, offices or agencies of the European Union that are competent in the framework of the cooperation provided for in Article 19 of the Law of 16 May 2023.

 

Processing of personal data

Purpose of the processing

For the purposes of fulfilling the missions conferred on it by the Law of 16 May 2023, and more precisely concerning the handling of reports, ANA may need to process personal data.

Any processing of personal data carried out pursuant to the Law of 16 May 2023, including the exchange or transmission of personal data by the competent authorities, is carried out in accordance with Regulation (EU) 2016/679, hereinafter “General Data Protection Regulation” or “GDPR”.

As a public authority processing personal data, the ANA is required to fulfil its obligations in its capacity as controller.

Please consult the following link for further information: https://ana.gouvernement.lu/fr/protection-des-donnees.html

Period for which the personal data will be stored

Personal data, regardless of their form, relating to a not admissible report are destroyed without delay. It concerns all elements of the file likely to allow the identification of the whistleblower and, possibly, that of the persons targeted by it.

When a report is admissible but is not followed by disciplinary or legal proceedings, the data relating to this report are kept for three (3) three months after the end of the reporting processing operations and then destroyed. The concerned persons are informed.

When disciplinary or legal proceedings are initiated against the person in question or the author of an abusive report, the data relating to the report are kept until the end of the procedure and its possible contentious consequences or prosecutions.

Afterwards the following rules are respected:

  • the remaining documents in the file that cannot be destroyed must be masked with a black marker on all the elements necessary to guarantee confidentiality;
  • any paper reproduction or computer copy, or distribution is strictly prohibited.

 

Contact DPO

Please contact ANA’s Data Protection Officer (DPO) for any question regarding the processing of your personal data by ANA at the following email address: adm.dpo@airport.etat.lu or by post to:

Administration de la navigation aérienne
DPO
4, rue de Trèves
L-2631 Findel

How should the report be filed with the ANA?

The persons wishing to report breaches of the law may report them externally to the ANA either directly, or after having made an internal report provided that it is possible to address the breach efficiently internally and that they consider that there is no risk of retaliation.

Any person wishing to report breaches of the law that fall within the ANA’s remit, may address  ANA in French, Luxembourgish, German or English: by downloading the ‘Whistleblower Form and sending it by email to whistleblower.externe@airport.etat.lu. Please indicate "CONFIDENTIAL" in the subject line of your email.

The form must contain precise facts, information and/or any document (in whatever form or on whatever medium) likely to substantiate it.

Whistleblowers must identify themselves in the report. Their identity will be treated as confidential.

By way of exception, a report may be anonymous. In this case, the whistleblower provides a non-nominative contact address. It is then processed only if the facts are sufficiently detailed to establish their potential materiality. If the identity of the whistleblower is subsequently revealed as part of the processing of the report, confidentiality is also respected.

The whistleblower may also use the form to request a face-to-face meeting. The meeting will be arranged within a reasonable time.

Follow-up and handling reports by ANA

ANA receives and follows up on the reports falling within its remit. ANA may request in writing that the entity referred to in the report communicate all information it deems necessary, with due regard to the confidentiality of the whistleblower’s identity.

More precisely ANA ensures:

  • to acknowledge receipt of the report within 7 days of the receipt, unless:
    • explicitly requested otherwise by the whistleblower; or
    • there are reasonable grounds to believe that acknowledging receipt of the report would compromise the protection of the whistleblower’s identity;
  • to diligently follow up on the report.

Due to the legal obligation in respect of professional secrecy under Article 11 of the law of 16 April 1979 laying down the general status of civil servants, as amended ANA will not inform the whistleblower on the concrete measures taken following his or her report, unless these measures will be the object of a disclosure in accordance with the applicable legal provisions.

Cooperation

Where ANA receives a report for which it is not competent, it transmits this report within a reasonable timeframe, in a confidential and secure manner, to the national competent authority referred to in Article 18 of the Law of 16 May 2023. The latter informs the whistleblower thereof.

Public disclosures

A whistleblower who publicly discloses a breach is protected by the Law of 16 May 2023 if:

  • the person first reported internally and externally or directly externally, but no appropriate action was taken in response to the report within 3 months following the report; or
  • the person has reasonable grounds to believe that:
    • the breach may constitute an imminent or manifest danger to the public interest (e.g. where there is an emergency situation or a risk of irreversible damage);
    • in the case of external reporting, there is a risk of retaliation or there is a low prospect of the breach being effectively addressed, due to the particular circumstances of the case, such as those where evidence may be concealed or destroyed or where an authority may be in collusion with the perpetrator of the breach or involved in the breach).

Protection against retaliation

Absence of liability of whistleblowers

Whistleblowers who fulfil de conditions for protection do not break the law by disclosing information and do not incur liability of any kind:

  • concerning (internal and/or external) reporting or public disclosure provided that they had reasonable grounds to believe that reporting or public disclosure was necessary for revealing a breach of law;
  • in respect of the acquisition of or access to the information which is reported or publicly disclosed (unless such acquisition or access constitutes a self-standing criminal offence);
  • as a result of reports or public disclosures made, including in legal proceedings for defamation, breach of copyright, breach of secrecy, breach of data protection rules, disclosure of trade secrets, or for compensation claims based on private, public, or on collective labor law.

They have the right to rely on that reporting or public disclosure to seek dismissal of the case.

A penalty of imprisonment of 8 days to 3 months and a fine of between EUR 1,500 to EUR 50,000 may be imposed on a whistleblower who knowingly reported or publicly disclosed false information.

A person making a false report will be liable under civil law. The entity that suffered harm may claim compensation for the damage suffered before the competent jurisdiction.

 

Prohibited retaliation measures

Any form of retaliation, including threats and attempts of retaliation against whistleblowers resulting from their report, is prohibited.

The following are automatically null and void:

  • the suspension of an employment contract, lay-off, dismissal, failure to renew, or early termination of, a temporary employment contract or equivalent measures;
  • demotion or withholding of promotion;
  • the transfer of duties, change of location of place of work, reduction in wages, change in working hours;
  • withholding of training;
  • the imposition or administering of any disciplinary measure, reprimand or other penalty, including a financial penalty;
  • the failure to convert a temporary employment contract into a permanent one, where the worker had legitimate expectations that he or she would be offered permanent employment;
  • the negative performance assessment or employment reference;
  • the early termination or cancellation of a contract for goods or services;
  • the cancellation of a license or permit;

Are also prohibited:

  • coercion, intimidation, harassment or ostracism;
  • discrimination, disadvantageous or unfair treatment;
  • harm, including to the person’s reputation, particularly in social media, or financial loss,  including loss of business and loss of income;
  • blacklisting on the basis of a sector or industry-wide informal or formal agreement, which may entail that the person will not, in the future, find employment in the sector or industry;
  • psychiatric or medical referrals.

 

Action against retaliation measures

The whistleblower who suffers retaliation measures may, within 15 days following the notification of the measures, request the competent jurisdiction to declare the measures null and to order them to cease.

The person who has not invoked the nullity of the retaliation measures or who has already obtained their nullity may, furthermore, claim damages.

ANA recommends the use of the services of a lawyer when taking legal action.

The persons that retaliate or initiate abusive procedures against whistleblowers may be fined between EUR 1,250 to EUR 25,000.

 

Reversal of the burden of proof

The whistleblower who suffers adverse measures automatically benefits from the presumption that these measures have been taken against him or her as a retaliation for the report.

It is therefore for the person who has taken retaliatory measures to establish the grounds therefor.

Whistleblowing

Whistleblower form

Reporting a violation of the legislative or regulatory framework in the civil aviation sector.

Information notice

Information notice for the processing of personal data in connection with the reporting of breaches of national and Union law through external reporting channels to the Air Navigation Authority as competent authority.