Blowing the whistle on inadequate protections: How does the new EU Whistleblower Directive improve on existing legislation?

'Whistleblower' is a widely used term. However, what it means and the protections a whistleblower might receive are by no means universal. Whistleblowers have been a regular presence in the news over recent years, from involvement in the Panama Papers, the FIFA scandal, Cambridge Analytica, President Trump and even Jeremy Kyle. However, the circumstances in which a 'whistle is blown' are not always as headline grabbing as these examples. In very simple terms, a whistleblower can be an employee who, in relatively mundane circumstances, decides to report certain types of wrongdoing in the belief that such disclosure is in the public interest.

On 7 October 2019, in recognition of the need to codify and harmonise minimum protections for those who speak out about alleged wrongdoing, the European Council formally adopted the Directive on the Protection of Persons Reporting on Breaches of Union Law (the "Directive") ¹. EU Member States have two years to transpose the Directive into national law.

The stated purpose of the Directive is "to enhance the enforcement of EU law and policies in specific areas by laying down common minimum standards providing for a high level of protection of persons reporting on breaches". Until now, the type and level of protection provided for whistleblowers across the EU has been patchy and inconsistent.

The Problem

A whistleblower is a valuable resource in the prevention, detection, investigation and prosecution of wrongdoing which may harm the public interest. A decision to make a disclosure in the public interest, or to 'blow the whistle' as it is more commonly known, without the security of meaningful protections, can have devastating consequences for the whistleblower. These can include victimisation, retaliation in the workplace, loss of employment and damage to reputation. There is an obvious benefit in protecting those who decide to report on malpractice and illegality which may harm the public interest and the protections given to such individuals should be effective and properly implemented.

In a press release announcing the formal adoption of the Directive, the EU identified 10 Member States with a 'comprehensive law' protecting whistleblowers: France, Hungary, Ireland, Italy, Lithuania, Malta, The Netherlands, Slovakia, Sweden and the UK. This means that the majority of EU countries do not have effective laws, resulting in a huge inconsistency across the EU. In the eyes of the European Council, this inconsistency has the undesired effect of negatively affecting the functioning of EU policies.

The Directive

The Directive is intended to introduce high-level protections for whistleblowers who report breaches of EU law in certain areas, including financial services, anti-money laundering and terrorist financing, protection of privacy and personal data, protection of the environment, public health and public procurement. It applies to a person working in the private or public sector who is reporting information on breaches acquired in a workrelated context. This includes, for example, self-employed persons, shareholders and contractors. The protections afforded by the Directive extend to those who facilitate the report and other connected persons who may suffer retaliation in a work-related context.

In order to qualify for protection, the person must (i) have reasonable grounds to believe the information reported was true at the time of reporting (and falls within the scope of the Directive), and (ii) report in accordance with the provisions of the Directive, namely internally (within the organisation), externally (to the competent authorities), or in certain circumstances by making a public disclosure (making the information directly available in the public domain).

The Directive requires the introduction of safe channels for internal and external reporting. The internal channels must ensure secure and confidential reporting where the breach can be effectively addressed and where the reporting person does not fear retaliation. The identity of the reporting person must be protected, and access to the information should be appropriately restricted.

For external reporting, each Member State must designate independent competent authorities with adequate resources to receive and follow up on reports.

Both internal and external reports must be acknowledged within seven days of receipt, and the whistleblower informed within a reasonable timeframe of what follow-up action is to be taken. A reasonable time is three months. In the case of an external report involving complex issues, the competent authorities can extend this to six months. Under the Directive, 'follow-up' means any action taken to assess the accuracy of the allegations made and, where relevant, to address the breach reported, for example through an internal enquiry, an investigation or taking no further action. In addition to updating the whistleblower, there is also an obligation to give reasons for the particular follow-up action taken.

Whether reporting internally or externally, clear and accessible information on how to report must be provided. The safe channels must also provide for the report to be made in a variety of ways, including via telephone lines, internet or intranet, and physical meetings.

There are occasions where a whistleblower may make a public disclosure, namely by going straight to the public, for example, the press. Under the Directive, where a public disclosure is made a whistleblower still qualifies for protection where the report was first made internally and/or externally but no appropriate action was taken in response in the relevant timeframe; and he or she had reasonable grounds to believe that (i) the breach may constitute an imminent or manifest danger for the public interest, or, (ii) in the case of external reporting, there is a risk of retaliation or there is a low prospect of the breach being effectively addressed due to the particular circumstances of the case.

Under the Directive, a whistleblower can expect to be protected in the following ways:

• That their identity will not be disclosed without their explicit consent. The exception to this is where it is necessary and proportionate to do so by reason of an obligation imposed under EU or national law. In any event, where a reporting person's identity is disclosed, they must be notified.
• The benefit of measures prohibiting any form of retaliation. Retaliation includes demotion, transfer of duties, change of location of place of work and the withholding of training.
• Access to support measures including access to free comprehensive and independent information and advice. Such support includes access to legal aid and psychological support.
• They shall not be considered to be in breach of any restriction on the disclosure of information and shall not incur any liability as a result of the disclosure (or the obtaining of the information), providing they had reasonable grounds to believe that the report was necessary for revealing a breach, and the obtaining of the information does not constitute a criminal offence.
• The benefit of a rebuttable presumption in proceedings before any court or authority, that any detriment suffered by them was made in retaliation for the report or disclosure.
• The protections under the Directive cannot be waived by agreement or any other means such as a condition of employment.

In an effort to prevent any attempts to subvert the whistleblower protections, the Directive requires Member States to introduce measures to dissuade any attempt to hinder reporting, breach the duty of maintaining confidentiality, bring vexatious proceedings or take retaliatory measures. At the same time, penalties must be introduced to dissuade the making of reports which are known to be false or misleading.

The United Kingdom

As a departing Member State, the UK abstained from the Council's vote on implementation of the Directive. In a letter to the European Scrutiny Committee dated 4th October 2019, the UK Government confirmed that in light of the UK's exit from the EU, it was not required to transpose the Directive into national law². The Government cited concerns about the "overall proportionality" of the Directive and noted that the UK "already exceeds EU minimums in a number of areas of worker rights", but indicated that it would review the impact it had on EU Member States when addressing reforms to UK whistleblower legislation in future.

The UK is one of the 10 Member States identified by the EU as having a comprehensive law in place. In the UK, this is in the form of the Public Interest Disclosure Act 1998 ("PIDA 1998"), but how does PIDA 1998 compare to the Directive and will UK whistleblowing legislation remain adequate in comparison to its European neighbours' legislation?

Extension of categories of person entitled to protection

PIDA 1998 applies to "workers", the definition of which essentially means 'employees'. In contrast, the Directive widens the pool of individuals qualifying for protection to include shareholders, volunteers, contractors and suppliers, non-executive directors and the self-employed. In fact, facilitators and persons connected to the whistleblower who could suffer retaliation are also protected under the Directive.

The Directive goes so far as to also cover candidates or service providers who acquire information on breaches during the recruitment or application process and could "suffer retaliation, for instance in the form of negative employment references, blacklisting or business boycotting."

Establishment of internal and external channels

PIDA 1998 not does impose a legal obligation on employers to establish an internal whistleblowing policy. Only a few public bodies, notably the Financial Conduct Authority ("FCA"), the Prudential Regulation Authority and the National Health Service, have adopted specific whistleblowing processes, and these have been subject to criticism that they are not sufficiently effective.³

Under the Directive, public and private companies with over 50 employees and local authorities serving more than 10,000 people must create formal internal safe reporting channels. The Directive also states that it is possible for Member States to encourage private companies with less than 50 employees to create such channels, although stipulates that these may be subject to less prescriptive requirements.

The Directive requires each Member State to designate authorities competent to receive, give feedback and follow up on reports as is required under the Directive. PIDA 1998 does identify certain categories of person to whom a report can be made, such as to an employer, legal adviser or a person prescribed by an order made by the Secretary of State. The list of prescribed persons is available online via the Department for Business, Energy & Industrial Strategy website⁴ and in general terms, means the regulatory body corresponding to the industry concerned. Beyond this, PIDA 1998 does not impose specific obligations on the recipient of a report, such as a duty to inform the whistleblower of any follow-up action and the basis for that decision.

Protection from liability

Under PIDA 1998, a whistleblower has the right not to suffer "detriment" as a result of making a disclosure. The definition of "detriment" is wide and would include the whistleblower being disciplined in any way.

The Directive specifies that a whistleblower should have immunity from civil liability where they had "reasonable grounds to believe that the reporting or public disclosure of such information was necessary". The Directive also instructs that breach of a whistleblower's legal or contractual obligations – for example, a nondisclosure agreement to which they are a party – should not preclude them from enjoying such immunity.

Legal aid for whistleblowers

PIDA 1998 created a right to compensation for a whistleblower if they suffer detriment as a result of making a disclosure, but it does not include a provision for legal aid for whistleblowers.

In contrast, the Directive specifies that a whistleblower should have access to "comprehensive and independent information and advice, which is easily accessible to the public and free of charge, on procedures and remedies available" and "legal aid in criminal and in cross-border civil proceedings".

Compensation

Under the Directive, a whistleblower must have access to legal remedies and compensation. Damage caused should be compensated in full according to national law and can include actual and future financial losses, legal expenses and intangible damage such as pain and suffering. Compensation must also be real and effective in a way which is proportionate to the detriment suffered, and dissuasive. Remedies established should not discourage any future whistleblowers.

PIDA 1998 also makes provision for compensation. The process involves an assessment of the loss suffered by the whistleblower. There is no element of reward for disclosure. Claims for compensation are usually made before an employment tribunal and can include injury to feelings.

In contrast, in the USA, whistleblowers can receive a 'reward' for their disclosure, namely a sum which does not represent any detriment suffered. This can have the knock-on effect of a potential whistleblower, choosing in which jurisdiction to report based on the 'compensation' which might be awarded.

The FCA is a prescribed person and using it as an example, the publication of the results of a recent request for information under the Freedom of Information Act 2000 revealed that less than 1% of whistleblower complaints to the FCA resulted in an investigation. The figures released have led to some speculation about the ratio of reports to investigations. This includes a suggestion that whistleblowers are being more selective about the regulator to which they make a disclosure.

Whistleblowing is a risky business and a potential reporter might seek to increase the compensation received to include a reward. If this is the case, the terms of the Directive are not going to change this decision-making process.

Enforcement of PIDA 1998

Despite the reputation of PIDA 1998 as one of the more comprehensive pieces of whistleblower legislation, critics have claimed that it "has been shown to offer fewer protections and to place more burdens on whistleblowers than originally envisioned". PIDA 1998 does not protect a whistleblower from retaliation before it occurs, or even as it is occurring. A whistleblower is forced to rely on the possibility of compensation after the retaliation has occurred, often after enduring an expensive and stressful journey through the Employment Tribunal system.⁵

As such, one of the original architects of the legislation, former UK Member of Parliament Lord Touhig, has stated that PIDA 1998 is "dangerous for whistleblowers because people think they have stronger protection under it than they actually do… [it] needs to be thoroughly reviewed."⁶

Conclusion

Although PIDA 1998 has been heralded as one of the world's leading legislative instruments for the protection of whistleblowers, the Directive goes far beyond it. Elements of the Directive could be a solution to some of the problems identified with current UK legislation. It is of note that the Directive sets out the minimum standard to be adopted by Member States and as it stands, PIDA 1998 is lacking in some respects.

However, the Directive also contains onerous provisions that would place a considerable burden on companies and state infrastructure. Whether or not it departs from the EU, the UK needs to build upon existing whistleblower protections to ensure that it retains, and improves, its international gold standard, so that it will "continue to lead the way on these important issues" ⁷. The Directive is a step forward for better whistleblower protections and, in this regard, the UK might benefit from applying the minimum standards it sets out.

Click here to download 'Blowing the whistle on inadequate protections: How does the new EU Whistleblower Directive improve on existing legislation?' 

¹ https://eur-lex.europa.eu/legal-content/EN/TXT/PDF/?uri=CONSIL:PE_78_2019_REV_1&from=EN
² Letter from the Department for Business, Energy & Industrial Strategy to the European Scrutiny Committee, 4 October 2019
³ All-Party Parliamentary Group on Whistleblowing report, July 2019
⁴ https://www.gov.uk/government/publications/blowing-the-whistle-list-of-prescribed-people-and-bodies--2/whistleblowing-list-of-prescribed-people-and-bodies
⁵ Blueprint for Free Speech report, 'Safe or Sorry: Whistleblower Protection Laws in Europe Deliver Mixed Results', 2018
⁶ 'Whistleblowing laws to be overhauled as new claims emerge over NHS trust', The Guardian, 15 February 2013
⁷ See footnote 2.

This publication is provided for your convenience and does not constitute legal advice. This publication is protected by copyright.
© 2019 White & Case LLP