can someone who has applied for a job with us also report a concern about our company

A job applicant can also report a breach

Yes, someone who has applied to an organization but was not hired also falls within the group of people who can report a breach. The whistleblower rules are not limited to people already employed: anyone who has participated in a recruitment or hiring process and obtained information about a breach in that context is counted as a protected reporter. This applies to the job applicant themselves, regardless of whether the application resulted in employment.

In practice, this means that an organization cannot simply dismiss a report from a rejected applicant as 'inadmissible' because no employment relationship was established. What exactly constitutes a breach is described on the page about what constitutes a breach under the whistleblower legislation; this assessment does not change based on who the reporter is. However, it is relevant that the reporter must have obtained the information about the alleged breach in a work-related context — for a job applicant, this is the recruitment process itself, for example something that comes to light during interviews or an assessment. Also, the protection against retaliation here is somewhat more abstract: a rejected applicant has no employment contract that can be terminated, but may for example experience negative effects on a later application or reference, and this falls under the forms of harm that the legislation protects against.

Legal basis: the scope of application of the Directive

That job applicants are included follows from Article 5 of Directive (EU) 2019/1937, in which the definition of 'reporter' explicitly includes persons who obtained information about breaches in the context of a recruitment process or other pre-contractual negotiations, even if no employment relationship was ever established. Article 2 of that Directive describes the material scope within which those breaches must fall. The protection against retaliation resulting from this is set out in Article 19 and the measures to protect against it in Article 21 of the Directive; these provisions have been incorporated into the Whistleblower Protection Act. For processing within an organization, it is also relevant who is allowed to handle a report, as described on the page about who within a company may handle whistleblower reports. For the full, current legislation and background information, the website of the House for Whistleblowers can be consulted.