Whistleblowing
Procedure for reporting to the CAA breaches of the legislative and regulatory framework applicable to the insurance sector
- Additional Information about the protection of whistleblowers can be found here.
- Weitere Informationen zum Hinweisgeberschutz finden Sie hier.
- Weider Informatiounen zum Whistleblowerschutz kënnt Dir hei fannen.
Who can be a whistleblower within the meaning of the law of 16 May 2023 to the CAA and benefit from protection against reprisals?
Any person acting in good faith, and specifically persons who work or have worked for entities in the Luxembourg insurance sector, may report to the CAA in a confidential and secure manner possible breaches of national or European law applicable to the insurance sector, committed by or in relation to persons subject to the supervision of the CAA. Reporting to the CAA should not, however, be used if there are reasonable grounds for believing that the information reported is not true. Persons with knowledge of facts likely to constitute a crime or an offence (e.g. illegal exercise of activities in the insurance sector) are invited to make a report to the State Prosecutor.
For what type of alert may the Whistleblowing form be used?
The Whistleblowing form is intended for alerts falling within the CAA's remit and in particular provided for by:
• Article 4, letter o), of the law of 7 December 2015 on the insurance sector, as amended, as well as
• Article 8-3 of the law of 12 November 2004 on the fight against money laundering and terrorist financing, as amended
May clients of service providers in the insurance sector use the whistleblowing procedure? The whistleblowing procedure is intended primarily for employees, former employees, self-employed persons, persons working under the supervision of contractors, subcontractors or suppliers, volunteers, paid or unpaid trainees, shareholders and members of the administrative, executive or supervisory bodies [a professional/an entity] of the insurance sector.
However, where a customer has a dispute with a professional in the insurance sector that they wish to resolve without going to court, they are invited to lodge a claim under the out-of-court complaint procedure (see also CAA Regulation No. 19/03 of 26 February 2019).
How is the declaration made and what protection is provided by the law?
The law provides a non-exhaustive list of prohibited reprisals against whistleblowers. Before contacting the CAA, whistleblowers working for a professional in the insurance sector are advised to first use the existing internal whistleblowing procedure within the professional.
The CAA will only consider declarations made in French, German, Luxembourgish or English submitted either: via the "Whistleblowing" form which should be sent by e-mail to the following address: whistleblowing@caa.lu; or, if a written declaration is not possible, the whistleblower may call 226911-1 during office hours and be put in touch with a member of its authorised staff. Telephone calls are not recorded. On request, and for reporting purposes only, whistleblowers may request a face-to-face meeting with an authorised member of CAA staff. The CAA may request written or oral confirmation of information that has been provided in an incomplete or imprecise manner. If additional information is not provided within the time limit set, the CAA may not be able to provide the author with feedback.
The CAA will acknowledge receipt of the alert within seven days and, apart from exceptional circumstances, will provide feedback on the admissibility of the alert within 3 months. In view of the regulations applicable to the CAA, which prohibit the disclosure of any confidential information concerning undertakings or individuals, the CAA cannot provide information on the action taken on a declaration, except where the law allows possible sanctions to be made public.
What information does the CAA require from the whistleblower?
The whistleblower's name and contact details are important elements to facilitate the processing of the information and to allow the CAA to contact the whistleblower in case of additional questions.
The whistleblower must have reasonable grounds for believing that the information he sends to the CAA and all the allegations it contains are sincere and true.
Obviously, documents corroborating these revelations may also be provided. In the case of anonymous reporting, however, the CAA recommends that supporting documents be attached to the report.
Will the CAA examine the declaration even if the whistleblower has not first used the internal whistleblowing procedure with the professional?
Yes, but the whistleblower is nevertheless invited to transmit the alert internally first. Entities with 50 or more employees must set up an internal whistleblowing channel managed in a secure manner that guarantees the confidentiality of the identity of the whistleblower and any third party mentioned in the whistleblowing report. This reporting channel must allow written and/or oral reports to be made in one of the three administrative languages, without prejudice to entities allowing the use of additional languages. It must be possible to report orally by telephone or via other voice messaging systems and, at the request of the author of the alert, by means of a face-to-face meeting within a reasonable time.
Will the identity of the whistleblower be disclosed, in particular to his or her employer?
The CAA undertakes to protect the identity of the whistleblower within the limits of the applicable legislation. In other words, neither the identity of the employee who made the alert, nor that of any third parties possibly involved, will be communicated to the professional concerned. The identity of the whistleblower and third parties will only be disclosed in circumstances where this becomes unavoidable by law (for example, because of the CAA's obligation to inform the State Prosecutor if the facts are likely to constitute a crime or an offence, or in the context of criminal proceedings against the entity where the declarant may, where appropriate, be called as a witness). Despite all the precautions taken, it cannot be totally ruled out that the employer may discover the identity of the whistleblower by cross-checking information, but the CAA will of course do everything in its power to protect the whistleblower.
How is my personal data processed?
The information collected on the "Whistleblowing" form is recorded in a CAA computer file for follow-up purposes. You can consult information on the processing of personal data under the "data protection" tab and exercise your right to access, rectify, delete, object to or limit the processing of your personal data by contacting the CAA. By post: Commissariat aux Assurances, 11, rue Robert Stumper, L-2557 Luxembourg; by email: whistleblowing@caa.lu or dpo@caa.lu. You may also lodge a complaint about the processing of your data with the CNPD.
The institutions and bodies of the Union inform the persons concerned when they process personal data.
Do whistleblowers have any means of action in the event of reprisals and who can they contact?
Any reprisal as specified by the law is null and void. The person concerned must apply to the competent court within 15 days to have it established. It may also take legal action to obtain compensation for the damage suffered. The Office for whistleblowers (13, rue Erasme, Centre administratif Pierre Werner, L-1468 Luxembourg; see also https://mj.gouvernement.lu/) provides information and assistance to anyone wishing to make an internal or external alert.