GUIDE TO WHISTLEBLOWING: “VOKSHI & LATA” FOR INTERNATIONAL EMPLOYMENT LAWYER

November 14, 2024

Workplace whistleblowing is essential for transparency and accountability in both public and private sectors.

To ensure protection and define clear procedures, Kosovo has introduced key regulations, including Law No. 06/L-085 on the Protection of Whistleblowers and Regulation (GRK) No. 03/2021. These laws establish the rights of whistleblowers, procedures for reporting violations, and employer responsibilities, in alignment with the EU Directive 2019/1937 to prevent retaliation against those who report public interest breaches.

Prepared by Agnesa Azemi Ademi and Urim Vokshi for International Employment Lawyer, this guide outlines these protections and legal safeguards for whistleblowers in Kosovo.

1. Which body of rules regulates workplace whistleblowing procedures and the status of whistleblowers?

Law No. 06/L-085 On Protection of Whistleblowers regulates whistleblowing, whistleblowing procedure, rights and protection of whistleblowers, and the obligations of public institutions and private entities regarding whistleblowing.

Regulation (GRK) – No. 03/2021 on Determining the Procedure for Receiving and Handling the Cases of Whistleblowing, defines the rules and procedures for receiving and handling the cases of whistleblowing as well as the rights and responsibilities of the responsible officer.

This regulation is in line with Directive (EU) 2019/1937 of the European Parliament and of the Council of 23 October 2019 on the protection of persons who report breaches of Union Law.

2. Which companies must implement a whistleblowing procedure?

A public employer with more than 15 employees, and a private employer with more than 50 employees, are obliged to appoint a responsible official to receive and handle the whistleblowing procedure.

3. Is it possible to set up a whistleblowing procedure at a Group level, covering all subsidiaries whether in-country or overseas?

Yes, it is possible to establish a whistleblowing procedure at a Group level that covers all subsidiaries, whether in-country or overseas. However, the procedure must still comply with local laws in Kosovo. Specifically, Law No. 06/L-085 applies within the territory of the Republic of Kosovo, so any whistleblowing procedures implemented must adhere to the provisions of local law.

4. Is there a specific sanction if a Company fails to set up an internal whistleblowing procedure?

The internal whistleblowing procedure is carried out by the responsible official within the company, who has the obligation to handle whistleblowing.

If the Company does not notify all employees in writing of the rights provided by the Law, and when a company does not appoint the responsible official, then a fine from 500 – 20,000 EUR will be imposed on the company, and a fine from 300 – 2,000 EUR will be imposed on the responsible official.

5. Must employee representative bodies be involved in the implementation of the system?

The internal whistleblowing procedure is carried out by the responsible official within the company, who has the obligation to handle whistleblowing.

6. What information must be provided to the workforce about whistleblowing procedures?

Employers are required to inform employees in writing about their whistleblowing rights, although the law does not explicitly define how or when this information should be provided.

The local law considers it a violation if the employer fails to notify the employee in writing about the rights provided under Law No. 06/L-085 on the Protection of Whistleblowers. So, non-notification is considered a violation, implying that employers must ensure employees are made aware of their rights under this law.

7. Are there local language requirements?

The law that regulates whistleblowing does not specify any particular language requirements.

However, it is important to consider that if a whistleblowing report is made in a non-official language, the individual should be allowed to express themselves fully in a language they are comfortable with. While the law doesn’t mandate a specific language for reporting, there should be accommodations to ensure that the whistleblower can communicate effectively, regardless of the language used.

8. Must an employer manage the reporting channel itself or can it be outsourced to an external provider whether in-country or overseas?

The law that regulates whistleblowing does not specify any particular language requirements.

9. What are the obligations of an employer regarding the protection of data collected through the operation of the whistleblowing procedure?

The personal data of the whistleblower and other individuals involved are processed solely for the purposes outlined in the law. The responsible official and any other individual handling personal data under this Law must do so in accordance with the applicable data protection laws.

If personal data irrelevant to the case is encountered during the handling of information provided by the whistleblower, the responsible official or competent authority must not proceed with such data and must justify its handling.

10. What precautions should be taken when setting up a whistleblowing procedure?

While there is no specific regulation by law regarding the setup of a whistleblowing procedure in Kosovo, it is essential to adhere to general principles such as:

Protected Reporting and Disclosure – ensuring that whistleblowing reports are protected and handled appropriately;
Prohibition of Retaliation – preventing any form of retaliation against whistleblowers;
Protection of Whistleblower Rights – safeguarding the rights of those who report issues;
Confidentiality – maintaining the confidentiality of whistleblowers and their reports;
Personal Data Protection – ensuring the protection of personal data related to the whistleblower; and
Prevention of Misuse – preventing the misuse of the whistleblowing process.

11. What types of breaches/violations can be the subject of a whistleblowing report?

The following breaches/violations can be the subject of a whistleblowing report:

a violation has been, is being, or is likely to be committed;
a person has failed, is failing, or is likely to fail to comply with any legal obligation;
a miscarriage of justice has occurred, is occurring, or is likely to occur;
the health or safety of any individual has been, is being or is likely to be endangered;
the environment has been, is being, or is likely to be damaged;
misuse of official duty or authority, public money, or resources of a public institution has occurred, is occurring, or is likely to occur;
an act or omission by or on behalf of a public institution is discriminatory, oppressive, grossly negligent, or constitutes serious mismanagement; and
information tending to show any matter falling within any of the preceding subparagraphs has been, is being, or is likely to be concealed or destroyed.

12. Are there special whistleblowing procedures applicable to specific economic sectors or professional areas?

Yes, the local law categorises whistleblowing into three types: internal, external, and public:

reporting information to the employer is considered to be internal whistleblowing;
reporting information to a competent authority is considered to be external whistleblowing; and
disclosure of information to the media, non-governmental organisations, through the Internet, at a public meeting, or in any other way that makes information public is considered to be public whistleblowing.

13. When can an individual make an external whistleblowing report or a public disclosure?

The law provides specific situations where external or public whistleblowing is permissible, either after internal reporting or directly, depending on the circumstances:

The whistleblower may make an external whistleblowing report after having performed internal whistleblowing or go directly to external whistleblowing when:
whistleblowing is related to the employer’s manager;
whistleblowing has an urgent character that is associated with serious and immediate danger or irreversible damage;
there are reasonable suspicions that detrimental acts may be taken against the whistleblower or the evidence may be concealed or destroyed if internal whistleblowing is carried out; and
the whistleblower has reasonable suspicion that the internal whistleblowing procedures are not effective.

The external whistleblowing procedure is initiated by reporting information to the Anticorruption Agency.

The whistleblower may also make a public whistleblowing report when:

at the time the whistleblower discloses the information, he or she reasonably believes that he or she will be subject to punishment if he or she makes internal or external reporting;
the whistleblower reasonably believes that the evidence regarding the respective detrimental acts are likely to be concealed or destroyed if the whistleblower reports in the internal or external procedure;
in case of immediate threat to life, public health, safety, environment, or when large or irreparable damage is caused; and
the responsible authorities in internal and external procedure have not taken any relevant action regarding the whistleblowing within a period of six months from the reporting date of the information provided.

These provisions ensure that whistleblowers have multiple avenues to report wrongdoing, especially in situations where internal channels may not be safe or effective.

14. What is the legal definition of a whistleblower?

The law defines a whistleblower as any person who reports or discloses information on threat or damage to the public interest in the context of own employment relationship in the public or private sector.

15. Who can be a whistleblower?

Any employer within a company can be a whistleblower. Whistleblowing rights are not limited to just employees but extend to a wide range of individuals associated with the organisation, such as external or occasional associates, volunteers, in a professional internship or training relationship, a candidate for employment, volunteering activities, professional internship or training; people in a contractual relationship for works, services, or other types of cooperation or use of services of a public institution or private entity, including contracting or subcontracting.

16. Are there requirements to fulfil to qualify as a whistleblower?

Anyone who is employed by a company qualifies as a whistleblower if they report information about wrongdoing. Employment status within the company is the key criterion for being recognised as a whistleblower. Regardless of their role or position within the organisation, any employee who reports information about potential violations, misconduct, or other issues within the company is protected under whistleblowing law.

17. Are anonymous whistleblowing reports admissible?

The law does not specifically address anonymous whistleblowing. However, it does not explicitly prohibit it. Since the law does not prohibit anonymous whistleblowing, it should be considered permissible. The Responsible Officer or designated authority is required to handle anonymous reports with the same level of seriousness and diligence as any other reports.

18. Must a whistleblower have been a direct witness to the breach/violation that they make a whistleblowing report on?

A whistleblower can report any observed violation, regardless of whether they are a direct witness or have merely noticed the issue. The whistleblower is not required to disclose the source of the information they provide.

The employer must investigate the validity of the information and provide evidence that no legal violations have occurred. The whistleblower is not obligated to prove the good faith or authenticity of the information they report.

19. What are the terms and conditions of the whistleblowing procedure?

20. What confidentiality obligations apply?

The Responsible Officer and any other individual who receives or processes whistleblowing reports must maintain strict confidentiality concerning the information related to these reports. They are prohibited from revealing or transmitting this information to third parties, both within and outside the institution, or using it for any other purposes, except in cases where disclosure is required with the whistleblower’s written consent or to fulfill legal obligations. Such obligations may include conducting effective investigations of legal violations, preventing serious risks to Kosovo’s security, public health, safety, or the environment, preventing crime, or prosecuting criminal offenses, or as required by law for the public interest.

The Responsible Officer must obtain written consent from the whistleblower before providing information that could reveal the whistleblower’s identity to any competent authority, particularly if the actions cannot be taken without revealing this identity.

If the law requires the identity of the whistleblower to be disclosed, the Responsible Officer must notify the whistleblower before revealing their identity.

21. Is there a hierarchy between different reporting channels?

There is no legally mandated hierarchy between internal and external reporting channels, meaning that whistleblowers generally have the right to choose whether to report violations internally or externally. However, if effective internal measures can address the reported violations, whistleblowers are encouraged to initially use internal reporting channels. Should the internal reporting not result in remedial action, the whistleblower retains the right to escalate the report to an external reporting office.

22. Must an employer inform external authorities about whistleblowing reports received? If so, in what circumstances?

In cases where whistleblowing involves sensitive areas such as classified information, national security, defence, intelligence, or international relations, the whistleblower is required to submit their report to the designated authority responsible for these specific areas.

23. Can a whistleblower be sanctioned if the facts, once verified, are not confirmed or do not demonstrate a qualifying violation/breach?

No, as we mention in question 26, the whistleblower who reports and discloses information in compliance with the provisions of the Law cannot be subject to criminal or civil liability or disciplinary procedures. In this case, the whistleblower cannot be sanctioned if a fact given by him or her is not a violation.

Any person who may have suffered a harmful action as a result of reporting has the right to ask the competent court for compensation for the damage suffered by the harmful action in accordance with the legislation in force. The protection of whistleblowers is excluded if the whistleblower reports or discloses information that he knows or must know is false.

24. What are the sanctions if there is obstruction of the whistleblower by the employer?

Any action or omission aimed at preventing public interest reporting or disclosure is null and void and the responsible official or any other person in respective cases is criminally prosecuted according to criminal provisions into force in Kosovo.

Additionally, any contractual provision is void, if it attempts to:

prohibit or restrict the making of public interest reporting or disclosure;
exclude or limit the operation of any provision of the Law;
preclude a person from bringing any proceedings under or by the Law; and
preclude a person from bringing a breach of contract claim related to actions taken as a result of public interest reporting or disclosure.

Violations of these provisions result in financial penalties: public institutions or private entities may face fines ranging from 500 – 20,000 EUR, while responsible officials may be fined between 300 – 2,000 EUR.

25. What procedure must a whistleblower follow to receive protection?

Under local law, a whistleblower is entitled to protection if they:

report or disclose information as defined by the law; and
have a reasonable belief that the information reported or disclosed is true.

Also, the person associated with the whistleblower enjoys the same protection as the whistleblower if such person proves that the detrimental act is taken against him/her due to his/her association with the whistleblower.

26. What is the scope of the protection?

The whistleblower who reports and discloses information in compliance with the provisions of the Law cannot be subject to criminal or civil liability or disciplinary procedures.

The whistleblower will be protected from any detrimental act taken against him by the employer due to the whistleblowing under the provisions of this Law, including but not limited to:

dismissal;
suspension from work or of one or more duties;
transfer within or outside the public institution or private entity without his consent;
downgrade in duty;
reduction of payment;
loss of status and privileges;
restriction of promotion;
refusal of the right to attend training;
negative appraisal in an employment relationship;
cancellation of a license or permit;
termination of a contract for goods or services; and
other detrimental acts related to the employment relationship.

27. What enforcement mechanisms apply and what are the possible sanctions for breach of the requirements?

The competent court can impose a fine from 500 – 20,000 EUR to the public institution or private entity as well as respective competent authority if it:

does not protect the whistleblower from any detrimental act or does not undertake all necessary measures to terminate the detrimental act, as well as elimination of any consequence of detrimental act within its competence;
does not notify all employees in writing of the rights provided for by this Law;
does not appoint the responsible official;
does not undertake actions after reporting the information within the deadline determined by this Law;
does not inform the whistleblowers on the outcome of the procedure within the determined deadline;
does not inform the whistleblowers, upon his/her request, about the progress and actions taken in the procedure or does not make it possible for the whistleblower to have access to the case files and to participate in the actions taken during the whistleblowing proceedings;
in case it precludes the whistleblowing, as determined by Article 6 of this Law; and
in case it acts in contradiction to Article 11 of the Law (breach the confidentiality).

Also, the responsible official of the public institution, private entity as well as of the respective competent authority, will be fined from 300 – 2,000 EUR.

28. Are there sanctions for violating a duty to maintain the confidentiality of the identity of a whistleblower? If so, what sanctions apply?

Yes, in case of confidentiality violation (the rules addressed in question 20), the court can impose a fine from 500 –20,000 EUR. Also, the court will impose a fine from 300 – 2,000 EUR on the responsible official of the entity.

29. Are there exemptions from liability for whistleblowers?

30. What support measures are provided to an individual who qualifies as a whistleblower?

The local law guarantees the following rights to whistleblowers:

during the duration of the administrative investigation procedure of whistleblowing;
after completion of the administrative investigation procedure of whistleblowing, to normally perform the functional duties of the whistleblower at his/her employment relationship; and
after termination of the employment relationship of the whistleblower with his/her employer, when, by reasonable circumstances, the whistleblower has requested protection under this Law.

31. What are the risks for a whistleblower who makes a false report or who fails to comply with the whistleblowing procedure?

The protection of whistleblowers is excluded, in case the whistleblower reports or discloses information that he knows or must know is false.

ABOUT COOKIES