So the EU is working on a new regulation for whisteblowers.
Original intention: Protecting whistleblowers from legal consequences.
It turns out that the current draft says that they have to: Report it first inside the company, if that doesn't help, inform the local authorities, and only in cases where they have to fear heavy revenge by those, they are allowed to give their material to media.
Zapp made a piece about that: https://www.ndr.de/fernsehen/sendungen/zapp/Kaum-Schutz-fuer-Whistleblower-Neue-EU-Richtlinie,whistleblower134.html