Internal Whistleblowing in the US after Digital Realty Trust v Somers: Any Lessons to be Learnt from Europe?

Abstract

The US Supreme Court, in Digital Realty Trust, Inc. v Somers, held that employees, who only report securities law violations internally, are not whistleblowers and therefore do not qualify for whistleblower anti-retaliation protection under the Dodd-Frank Act. This decision is based on an accurate statutory interpretation and reflects a clear policy preference towards external whistleblowing in aid of the US Securities and Exchange Commission’s (SEC) enforcement efforts. Despite the strong incentive to have fraudulent practices and violations reported to the SEC, employees that only make internal reports should not be left without protection. On the other side of the Atlantic Ocean, a different approach is observed with more emphasis on internal reporting as the first course of action for potential whistleblowers. European countries tend to prioritise resolving potential issues through internal reporting channels before involving external regulatory authorities. This emphasis on internal reporting is rooted in the belief that it promotes a culture of trust and accountability within companies. Digital Realty Trust v Somers clarified the scope of whistleblower protection under the Dodd-Frank Act, but also initiated a much-needed discussion about the different paths available to whistleblowers and the factors that should be taken into consideration before a decision is made to report externally or internally. Although in principle there is no right or wrong decision, there are some lessons to be learnt in the US and the examples of the UK, France and the EU should not be overlooked considering how interconnected and interdependent our society is.

1. INTRODUCTION

Whistleblowing has gradually received much attention and has been in the centre of academic and policy debates worldwide. The financial crisis of 2008 and the scandals of the previous decades have demonstrated the importance of whistleblowing as an accountability and good corporate governance mechanism. It is considered an important enforcement tool in the fight against mismanagement and corruption. Although its importance does not go unrecognised, the legal frameworks at an international level are divergent, as every country has its own approach as to the process, level of protection and remedies available to potential whistleblowers.

The US Supreme Court decision in Digital Realty Trust v Somers does not look promising for internal whistleblowers in the country. A first reading of the decision indicates that whistleblowers reporting internally cannot be protected under the Dodd-Frank Wall Street Reform and Consumer Protection Act of 2010 (Dodd-Frank).¹ In the European continent, at least in the countries that have adopted comprehensive legislation on whistleblowing, the framework seems to encourage whistleblowers to report internally first. As it becomes apparent, this decision has brought back to the surface the issue of cultural differences in relation to regulation and whistleblowing policy in particular.

The aim of this article is to reflect on the recent decision of the US Supreme Court and its implications for whistleblowers in the US, before moving to discuss the approach taken in Europe in relation to internal whistleblowing. France, as a Member State of the European Union (EU), is directly governed by the EU Whistleblowing Directive,² while the UK, though no longer part of the EU, still aligns with certain EU standards. Notably, UK multinationals and businesses trading with the EU need to adhere to the principles of the EU Directive. Moreover, as a member of the Council of Europe, the UK is encouraged to follow the EU Directive’s principles through formal recommendations,³ underscoring the Directive’s continued relevance in shaping the UK’s whistleblowing framework.

2. THE DECISION OF THE SUPREME COURT OF THE US IN DIGITAL REALTY TRUST V SOMERS

Paul Somers was employed by Digital Realty Trust, Inc., a real estate investment trust company. From 2010 to 2014 he served as a Vice President of Portfolio Management at the company’s location in California. In 2014, Somers filed a lawsuit against the company claiming that he was wrongfully terminated in violation of the Dodd-Frank’s whistleblower protections. In particular, he alleged that he was fired, because he reported his concerns about possible securities law violations to the senior management team. He reported to his superiors within the company that his supervisor had eliminated internal controls in violation of the Sarbanes-Oxley Act of 2002 (SoX)⁴ and that the supervisor had hidden millions of dollars in cost overruns on a Hong Kong development. Mr Somers only reported his concerns internally and did not go externally, ie to the Securities and Exchange Commission (SEC). The company sought to dismiss Mr Somers’ claim on the ground that he could not be protected under Dodd-Frank, as protection is granted to individuals, who report securities law violations to the SEC (externally), not internally (to the senior management). In other words, he was not a ‘whistleblower’, as defined in the Act, and thus not entitled to protection under its provisions.

Before 21 February 2018 and the Supreme Court’s decision, the US courts had faced the same problem, but there was no unanimity in their conclusions.⁵ In 2013, the Court of Appeals for the Fifth Circuit decided that employees should report to the SEC in order to be entitled to the anti-retaliation protection offered by Dodd-Frank.⁶ Two years later, in 2015, the Court of Appeals for the Second Circuit took a different approach granting protection under Dodd-Frank to internal whistleblowers.⁷ Therefore, in essence, the Supreme Court had to find a Solomonic solution and resolve the split between the Second, Ninth and Fifth Circuits concerning whether the Dodd-Frank’s anti-retaliation provision covered only persons who had reported securities violations to the SEC or whether it also included persons who had made internal complaints without making a complaint to the SEC.

Basically, Mr Somers through his lawsuit asked the US District Court for the Northern District of California, inter alia, for the whistleblower status under Dodd-Frank to be recognised for him even though he only reported internally.⁸ His ex-employer moved to dismiss his claim stating that he cannot be regarded as a whistleblower under §78u-6(h), because the alleged wrongdoing was not reported to the SEC. The District Court found that the definition of the whistleblower was ambiguous, and it accorded the Chevron deference to a 2011 SEC rule where the SEC had given an explicatory definition for the term entailing that a whistleblower can also report internally.⁹

The Court of Appeals for the Ninth Circuit reaffirmed that the Chevron deference should apply to the case and, in addition, it stated that a better reading of the statutory provisions shows that whistleblowers are the ones that report internally.¹⁰ As it becomes apparent, the Second, Fifth, and Ninth Circuits adopted different approaches as to whether Dodd-Frank’s whistleblower protection only extends to employees who internally report information to supervisors or if whistleblowers must report to the SEC to receive protection.

The US Supreme Court had a different opinion on the question compared to the two previous Courts that examined Mr Somers’ complaints. In particular, it stated that ‘when a statute includes an explicit definition, we must follow that definition’.¹¹ The meaning of the term ‘whistleblower’ is to be determined under §78u-6(h) of Dodd-Frank’s anti-retaliation provision. The definition provided in the Dodd-Frank Act is: ‘any individual who provides … information relating to a violation of the securities laws to the Commission’.¹² The definition is closely connected with the three clauses of §78u-6(h)(1)(A) that provide protection to the whistleblower against employment discrimination.

The Supreme Court’s opinion is that the first provision (the definition) answers the question of who a whistleblower is: a whistleblower is an employee that reports violations of securities laws to the SEC. The protection that is offered then by the three clauses described above is the conduct that is protected against instances of employment discrimination. As a result, the reporting person should firstly qualify as a whistleblower and then invoke the protection offered under the Dodd-Frank Act. In a nutshell, the Supreme Court argued that whistleblowers should report to the SEC in order to receive the protection under Dodd-Frank Act. Instead, if they only report internally, they will not be considered as whistleblowers and will not thus be protected.

The Supreme Court recognised the importance of the enactment of Sarbanes-Oxley (SoX) and Dodd-Frank Acts following scandals, collapses and notorious cases of mismanagement. Both Acts offer protection to whistleblowers that come forward with important information in the fight against corporate fraud. However, the two Acts have different approaches in relation to the definition and the protection accorded to the whistleblower. SoX adopts a broader definition of whistleblower, covering employees that report to the SEC, any other federal agency or to their employers.¹³ On the other hand, the Dodd-Frank Act contains a more restrictive definition, indicating that a whistleblower can only be an employee that reports their concerns to the SEC.¹⁴

The Supreme Court has clearly showed its intention to respect the will of the Congress when enacting the Dodd-Frank Act. When the Act was enacted, the Congress desired to improve SEC’s enforcement ability and to facilitate the recovery of money from financial fraud.¹⁵ In the case of SoX, the Congress had a different mindset and was seeking to disturb the culture of secrecy in the corporate world that was not really facilitating whistleblowing.¹⁶ Its aim was to define whistleblower in a broader sense, so that both internally and externally reporting employees were covered. As a result, the Supreme Court decided not to go against the will of the Congress by deciding that the employee that only reports internally and does not get in touch with the SEC cannot seek protection under the Dodd-Frank Act.

The decision of the Supreme Court, apart from its impact and significance for the US, is interesting for countries in the European continent as well. In Europe, the reporting system, traditionally, follows a three-tier model whereby the whistleblower should report internally in the first place, then to the authorities if the internal reporting system does not react or does not exist and, as a last solution, the whistleblower can denounce the wrongdoing to the public.¹⁷ This European model is mirrored in different legislations, such as the UK Public Interest Disclosure Act 1998 (PIDA), which is incorporated as Part IVA of the Employment Rights Act 1996 (ERA 1996), and the French legislation Law Sapin II of 2016 (recently modified by the Waserman Law).¹⁸ In the next part, the consequences of the decision of the US Supreme Court for whistleblowers are described in more detail.

3. THE CONSEQUENCES OF THE DECISION FOR WHISTLEBLOWERS IN THE US

In the post-Somers era, the whistleblower that reports internally, and not to the SEC, is not entitled to protection from retaliation under the Dodd-Frank whistleblower provisions.¹⁹ As Justice Ginsburg noted, ‘Dodd-Frank delineates a more circumscribed class; it defines whistleblower to means a person who provides information relating to a violation of the securities laws to the Commission’.²⁰ The strict interpretation of the term ‘whistleblower’ under Dodd-Frank can also be seen in a decision of the District Court of New Jersey on 19 April 2018. The Court decided that a whistleblower providing testimony to the Financial Industry Regulatory Authority (FINRA) is not protected under Dodd-Frank as he failed to provide information directly to the SEC, even though FINRA is actually overseen by the SEC.²¹ This stance of the US courts is an important obstacle for the creation of a strong culture of internal reporting within the US corporate world.

Whistleblowers have the possibility to be protected under SoX, if they report internally. The Act was adopted by the US Congress in response to the scandals of Enron, WorldCom and the other notorious cases of failing corporations.²² Section 404 requires public companies to strengthen their internal accounting controls and to strengthen the internal reporting culture. Section 806 of the Act provides a private cause of action for employees who raise complaints of securities fraud and face retaliation.²³ Thus, the whistleblower, when reporting a violation of securities law, may avail for protection under the protective umbrella of SoX.²⁴ Nevertheless, practice has shown that the protection offered under SoX is not effective.²⁵ Research suggests that whistleblowers who follow internal procedures are less likely to suffer retaliation, as internal disclosing is increasingly recognised as a legitimate way to raise concerns, rather than an act of disloyalty.²⁶ Despite this, the remedies for whistleblowers are less attractive in comparison with the remedies of the Dodd-Frank Act.²⁷

The bounty programme of the Dodd-Frank Act seems to be the ‘Pandora’s Box’ in our case. The financial rewards that SEC may grant to a successful whistleblower are inconsistent with the internal risk controls mandated by SoX.²⁸ As mentioned above, section 404 obliges employers to adopt extensive internal controls. Employees, from the lower ranks, up to the higher levels, are required to report internally any violation that are aware of. The aim of this intensive internal reporting system is to detect and correct wrongdoings internally avoiding any exposure to the authorities or to the public.²⁹ This system also encourages reporting to the authorities as a platform for establishing good cooperation between the company and the authorities in order to be treated with more leniency at the time that penalties will be imposed. The anti-retaliation provisions of SoX protect employees that choose to report not only to the authorities but also internally. The employees are required to report internally and, if no action is taken, they should then report to the SEC or other federal enforcement agencies.³⁰ However, as it can be seen, post-Somers internal reporting seems to be undermined rather than encouraged.³¹

The judgement of the Supreme Court in Somers comes in line with the enforcement mechanisms that the US government uses. It is a long-standing Anglo-Saxon legal tradition to allow citizens to assist the enforcement authorities in the conduct of their duties.³² The most important example of this practice is the qui tam writ developed under common law early in the thirteenth century.³³ It is not the purpose of the present contribution to analyse the use of qui tam writ in the common law tradition, but it is worth mentioning that the qui tam writ served as the basis for the US False Claims Act of 1863 that had the purpose of addressing the problem of fraud during the American Civil War.³⁴ The Lincoln government gave incentives to the American citizens to sue everyone that committed fraud against the interests of the US government.³⁵ The False Claims Act suits have also been used during the 2008 financial crisis in order to sanction companies committing fraud.³⁶ The important characteristic of a qui tam suit is that it entitles the plaintiff to at least 15% and up to 30% of the amounts recovered.³⁷

The reliance of the US legislator on private enforcement became evident with the enactment of the Dodd-Frank Act. In response to the market collapse of 2008 and the subsequent failure of banks and financial institutions, the US Congress decided that a regulatory reform was necessary.³⁸ In order to confront that crisis, the Congress adopted a comprehensive regulatory package.³⁹ Central role in this regulatory package was given to the Dodd-Frank Act that demonstrated the Congress’s belief that ‘financial institutions cannot be left to regulate themselves, and that without clear rules, transparency, and accountability, financial markets break down, sometimes catastrophically’.⁴⁰ The Congress’s intention, through the introduction of the Dodd-Frank Act, was to ‘motivate those with inside knowledge to come forward and assist the Government to identify and prosecute persons who have violated securities laws and recover money for victims of financial fraud’.⁴¹

In the realisation of this intention, emphasis was given to the incentivising of employees to report securities violations to the SEC.⁴² In a press release in 2018, the SEC proposed amendments to the whistleblower-related rules, following the Supreme Court’s decision in Somers.⁴³ On 23 September 2020, the SEC voted 3-2 to adopt amendments to Rule 21F, which became effective on 7 December 2020. A uniform definition of ‘whistleblower’ was established covering only those who report to the SEC and this definition applies to all aspects of Rule 21F, including the award program, heightened confidentiality requirements and the employment anti-retaliation protections. The engagement with a company’s internal compliance systems maintains its importance and will be taken into account by the SEC when determining the size of the award, although employees do not receive whistleblower protection unless and until they file a report to the SEC. As it can be clearly seen, the amendments show that the SEC clearly wishes to comply with the Supreme Court’s ruling and will not insist on its previous position about the protection of internal whistleblowers.

4. THE FRENCH APPROACH TO INTERNAL WHISTLEBLOWING

Whistleblowing has not always been considered a welcome topic for discussion in France. The concept of whistleblowing brings back negative memories to French citizens, as it reminded them of the Nazi occupation of the country and the Vichy regime.⁴⁴ The term ‘whistleblowing’ is translated as ‘lancement d’alerte’, known also as ‘delation’, a word that has negative connotation in relation to the act of informing.⁴⁵ Interestingly, when the influence of SoX became evident in France, the National Commission of Information and Liberties (CNIL—Commission Nationale de l’Informatique et des Libertés) characterised the system of whistleblowing (for the professionals) as an organised system of professional denunciation (using the term ‘delation’ in particular).⁴⁶ As a result, CNIL had not authorised the creation of whistleblowing rules for the French companies that were listed in New York. This position of the CNIL was problematic for French companies, as they were confronted with a dilemma: on the one hand, the French government was not supportive of the idea of whistleblowing procedures and policies, while, on the other hand, they had to comply with the rules about whistleblowing under SoX and the Listing Rules.

Despite the initial resistance to the SoX, France allowed its companies to introduce whistleblowing systems and procedures, in compliance with the SoX provisions.⁴⁷ Following this, France gradually adopted several legal dispositions related to whistleblowing and especially for the banking and financial sector.⁴⁸ In 2016, the Law of 9th December related to transparency, the fight against corruption and the modernisation of economic life (also known as the Law Sapin II) was enacted in an attempt to unify the legal regime of whistleblowers in France.⁴⁹ The Law Sapin II was recently modified by the Waserman Law (to be analysed below) to comply with the transposition of the EU Whistleblowing Directive. The Law Sapin II, following the case-law of the European Court of Human Rights (ECtHR) in Strasbourg, adopted a three-tiered system for reporting. This would be the focus of the next paragraphs and then the changes brought by the Directive’s transposition will be analysed.

As mentioned above, with whistleblowing receiving increasingly more attention internationally, the French government was obliged to reconsider its approach towards whistleblowing. To that end, the French State Council (Conseil d’Etat) was asked to prepare a study on the existing French legislation on whistleblowing and the possibility of enacting a new Law on whistleblowing (horizontal legislation). In its report delivered on 25 February 2015, the French State Council proposed that all public and private entities should be obliged to enact internal whistleblowing structures, which would allow whistleblowers to report internally and the competent persons would take care of the reported wrongdoings.⁵⁰ The report continued by mentioning that alternative channels for making disclosures should exist, only if the internal reporting structures did not respond to their concerns within a reasonable amount of time or if it is not possible for whistleblowers to make use of the internal reporting systems. In these two occasions, the whistleblowers should have the possibility to report to the authorities and, if the authorities did not respond to their concerns, they could proceed with reporting to the public.⁵¹

The French State Council, taking into consideration the case-law of the ECtHR and being inspired by the legislation of the UK and Ireland,⁵² put forward a three-tiered model for reporting that needs to be developed and implemented in practice.⁵³ The Strasbourg Court, in its landmark case of Guja v Moldova,⁵⁴ mentioned six criteria that, if fulfilled, will protect whistleblowers under Article 10 of the European Convention of Human Rights and the right to freedom of expression. One of these criteria is the channel of disclosure. The employees should address their concerns internally at first. If the concerns are not treated appropriately, they can report to the authorities. If the authorities are not responsive either, they can make their disclosures to the public as a last resort. The English legislation follows the same logic in principle, but with a slight procedural difference. More specifically, the statute incentivises internal reporting, as there are less requirements for getting protection.⁵⁵ The Law Sapin II, which was introduced based on the recommendations made by the State Council, adopted this three-tier model, in a stricter way though, as it made it obligatory for employees to report internally first. Only in exceptional situations, whistleblowers could report directly to the designated authorities or to the public.

Overall, Sapin II was a comprehensive and horizontal law on whistleblowing. By horizontal, it is meant that the law protects whistleblowers in every sector of interest and not in one specific sector. In Article 6, the definition of the term ‘whistleblower’, along with its main characteristics, is: a physical person that discloses or reports, in a disinterested manner and in good faith, a crime or a misdemeanour, a gross and evident failure to comply with duly ratified treaties or any measure adopted by an international organisation pursuant to a duly ratified treaty, a violation of a law or a regulation, or an important threat or prejudice to the public interest for which he became personally aware.⁵⁶ From this definition, it becomes apparent that the whistleblower should not be necessarily a worker, but any physical person who does not have a work-based relation with the report made. Article 6 refers only to physical persons and excludes legal persons such as non-governmental organisations.⁵⁷

The definition in Article 6 appears in contrast with Article 8 of the same statute.⁵⁸ Article 8 outlines the channels for disclosure that whistleblowers should use, in first place, in order to address their concerns.⁵⁹ This obligation limits the categories of people that can be whistleblowers, as it specifically refers to blowing the whistle in an employee–employer relationship. This contradiction did not go unnoticed and it was brought by the French Senators before the French Constitutional Court (Conseil Constitutionnel).⁶⁰ The applicants argued that the confusion created between Articles 6 and 8 is contrary to the constitutional objectives of accessibility and intelligibility of the law.⁶¹ These constitutional objectives derive from Articles 4, 5, 6 and 16 of the Declaration of the Rights of Person and the Citizen of 1789, under which the legislator is obliged to adopt provisions that are sufficiently precise.⁶² In addition, the applicants raised the point that the definition in Article 6 is not precise enough. They argued that this imprecision is contrary to the principle of legality for misdemeanours and crimes, as expressed in Article 34 of the French Constitution⁶³ as well as contrary to the principles of equality and proportionality of sanctions. The definitional ambiguity in Article 6 was concerning as it was related to the criminal irresponsibility of the whistleblower under Article 7 of the French law (it should be clear who can be a whistleblower in order to avail of criminal law protection).⁶⁴

The French Constitutional Court decided that the definitional criteria of the term ‘whistleblower’ are not imprecise responding to the matter that the definition does not have clear and precise elements.⁶⁵ In addition, the Constitutional Court decided that the difference between Article 6 and the use of the term ‘physical’ person with the reference to an employee–employer relationship in Article 8, when it comes to the reporting procedures, does not violate the Constitution and the aforementioned constitutional objectives.⁶⁶ The Court highlighted that, even though Article 6 defines the whistleblower as any physical person, Article 8 restricts the protection offered by the Law Sapin II only to the employees or contractors of a company when they report illegalities or irregularities related to their workplace.⁶⁷ The fact that the definition in Article 6 does not only make specific reference to employees or contractors, but extends its scope to every physical person, does not render the provision unintelligible.⁶⁸ In effect, the text of the French law reflects an attempt that the broad definition adopted does not only apply to cases related to Article 8, but also to other whistleblowing procedures that had been proposed by the legislator outside the professional framework, such as the civil obligation to report a crime.⁶⁹

Internal whistleblowing, as designated by the Law Sapin II, had received positive reactions by French academics and scholars,⁷⁰ although it was considered to be a strict requirement for whistleblowers as the French legislation basically obliged whistleblowers to report internally first.⁷¹ The procedural rules were clear and precise in an effort to ensure that whistleblowers know what they have to do, in order to ensure that their concerns will be heard and they will be effectively protected.⁷² In addition, whistleblowers are offered the opportunity to refer themselves to the Advocate for Human Rights (Défenseur des droits), in case they need help in choosing the appropriate channel for their disclosures.⁷³ The choice of the French Law for internal reporting was a conscious and strategic decision, which was justified by the advantages that this type of reporting entail.

The internal reporting requirement is an advantage as the employer is obliged to put in place an appropriate internal reporting system in order to encourage their employees to blow the whistle internally and not externally.⁷⁴ In that sense, the employers are responsible for the existence of a mechanism of effective internal control, which will also operate without any problems.⁷⁵ This mechanism shall ensure that the company complies with the relevant legislation and regulations alongside the principles that have developed to strengthen corporate governance.⁷⁶ Whistleblowing is an essential tool for the effectiveness of a company’s internal control as it helps in identifying instances of fraud, corruption and mismanagement and ensures that they are addressed and tackled with accordingly.⁷⁷ Enhancing internal reporting permits the company to avoid any possible exposure and negative publicity, as a result of disclosures made by its employees to the media.⁷⁸ Once a problem is reported internally, the company has the opportunity to rectify it without the involvement of the authorities and before the news reach the newspapers’ headlines or the general public.⁷⁹

Another important advantage for internal reporting in the Law Sapin II was the protection of information, especially in the banking and financial sector. France, similarly, to many other western European countries, sanctions the divulgation of confidential information under criminal law provisions.⁸⁰ The process of whistleblowing presents a necessary conciliation between public and private interests, such as the need to inform the public but at the same time to protect confidential information. For this reason, Sapin II gave priority to internal reporting over the possibility to report to the authorities and to the public.⁸¹ In this way, a balancing exercise is conducted between the protection of the confidential information and the right of information of the public. Only if employers choose to disregard the disclosure of their employees or if they try to turn against them, whistleblowers are allowed to blow the whistle externally. Otherwise, internal reporting is the most proportionate and appropriate course of action, so that any damage caused to the employers are kept to the minimum.⁸²

This section could not be concluded without referring to the changes brought in France recently by the transposition of the Directive 2019/1937 on the protection of persons who report breaches of EU law. In March 2022, France promulgated its new law on whistleblower protection, in order to transpose the Directive on the protection of whistleblowers in the French legal order. The Waserman Law relies on the Law Sapin II, the Directive and the report of 29 July 2021, which evaluated the impact of the Law Sapin II, but contains a number of new elements.⁸³ First, whistleblowers are immune from criminal liability for offences committed in order to gather evidence regarding public interest concerns, as long as they became aware of the information in a lawful manner.⁸⁴ For example, if they see a report about their company being involved in tax fraud on the company’s intranet/server to which they have legitimate access (information obtained ‘in a lawful manner’), they can dig into the intranet to gather further evidence about the fraud, without having to face further charges for theft or computer fraud. Furthermore, whistleblowers can obtain financial assistance with their legal fees, and in some cases, living expenses (from the offending organisation, via an application submitted to a judge) in the event that they are victimised (ie discriminated, dismissed or harassed) and/or they are the victim of a strategic lawsuit against public participation (SLAPP).⁸⁵

If anyone victimises whistleblowers as a result of them raising concerns—employer, colleagues or anyone else—they may face civil and/or criminal sanctions (up to three years of imprisonment and a fine of 45.000 euros).⁸⁶ Additionally, if a SLAPP lawsuit is brought against whistleblowers, the claimants may face a fine of 60.000 euros.⁸⁷ There is a positive duty for French regulators to help whistleblowers both psychologically and financially. The French Ombudsman received increased powers, which allow them to undertake further investigations, make recommendations and intervene in court cases as well as advise whistleblowers on whether or not they qualify for protection.⁸⁸ Finally, class actions can be brought from a group of employees against their employer, if they were victimised for raising public interest concerns.

In addition, the definition of the whistleblower is broader than before, as it does not include the ‘good faith’ requirement anymore and only requires the absence of financial motives. Protection is not only offered to whistleblowers, but also to everyone related to them, such as facilitators, colleagues or even family. Furthermore, as indicated above, protection is reinforced with more measures to support the whistleblower. The new Waserman Law stipulates that whistleblowers can choose whether to report internally or to the authorities, as the obligatory internal reporting has been removed. This change occurred due to the need for compliance with the EU Directive on the protection of whistleblowers. The French law is now fully compliant with the reporting procedures which the whistleblower should follow. As the adoption of the new French law is recent, there are no details on how the new law will operate. Nevertheless, the freedom of the whistleblower to choose where to report (internally or to the authorities) will liberate them from the burden of going inside at first, and then to the authorities. This change will also force businesses to work towards a better and safer internal reporting system in order to keep the whistleblowers inside and to avoid public attention (the authorities).

This historical analysis of the French legislation on whistleblowing reporting mechanisms and protections is deliberate; it demonstrates that Europe is still in the process of shaping its approach in relation to whistleblowing and this is why we are likely to experience significant changes, not only in the spirit but also in the letter of the relevant legal provisions. Such changes can also be implemented within a short period of time as well. The advent of the EU Directive has been a driving force for such changes and recalibrations, due to the fact that it requires a very careful reflection by the Member States’ governments as to what they want to achieve with the new whistleblowing framework that they have to put in place, how far they want to go with this framework and to what extent they can put in place a set of mechanisms that will work efficiently. In the case of France, the jury is still out there to determine whether the new Law is an improvement compared to Sapin II, let alone the ‘the best protection for whistleblowers in Europe’ as presented by MP Sylvain Waserman. What is definite is that France made a clear policy choice when transposing the Directive into the French legal order; this was to go beyond the minimum base of protections provided, aiming at amending the shortcomings of the previous legislative framework.

5. THE UK APPROACH

The UK has been considered a pioneer, amongst the countries of the European continent, having adopted legislation on the protection of whistleblowers as early as 1998. The PIDA 1998 provides protection at different levels depending on the reporting channel the whistleblowers have chosen to use.⁸⁹ The three-tiered disclosure structure⁹⁰ implemented by PIDA has been positively received at an international level and has been extensively replicated by numerous countries, mainly because of its ability to promote internal reporting, and also to encourage organisations to introduce whistleblowing procedures that will ensure transparency and accountability in the workplace.⁹¹

According to this tiered system, there are three different avenues available to whistleblowers for making disclosures. The first tier includes sections 43C, 43D and 43E ERA 1996 that regulate internal disclosures made to the employers, to legal advisers and a Minister of the Crown, respectively. The second tier includes section 43F ERA 1996 and provides that a disclosure can be made to a person prescribed by the Secretary of State, which refers to independent authorities and competent bodies to receive protected disclosures.⁹² The third tier falls under sections 43G and 43H ERA 1996 that stipulate that disclosures can be made, in limited circumstances only, to any other person, for example, the public or the media.

Before proceeding, it is worth exploring a couple of issues raised by the above-described three-tier system. Firstly, section 43C(2) ERA 1996 offers a valuable clarification in relation to the above system and provides that workers are to be treated as having made disclosures to their employer if they follow a procedure that the employer has authorised, even if the disclosure is actually made to someone else (for instance, an independent person or organisation). In the case of Brothers of Charity Services v Eleady-Cole⁹³, a concern was raised through a confidential telephone support line operated by an Employee Assistance Programme on behalf of the employer. The Employment Appeal Tribunal confirmed that the disclosure was protected under section 43C(2) ERA 1996, as the Employee Assistance Programme was contracted to submit anonymised information to the employer.

Secondly, section 43D ERA 1996 protects workers seeking legal advice about their concerns and inevitably reveal to their advisers, detailed information about the issues relevant to the disclosure they want to make. Legal advisers⁹⁴ cannot make a protected disclosure, pursuant to section 43B(4) ERA 1996, as they are bound by professional privilege. It would have been very helpful if there was a body, which would be available to provide specialist advice, counselling and support to potential whistleblowers, such as the proposed Office of the Whistleblower,⁹⁵ but this has not happened yet. The creation of such an Office would offer invaluable help to workers considering making disclosures and would raise awareness about whistleblower protection and the legislation currently in place.⁹⁶

Thirdly, workers, who make disclosures in good faith to a person (or class of persons) prescribed for this purpose by the Secretary of State are protected under section 43F(1) ERA 1996. When making such disclosures, workers must reasonably believe that the matter falls within the remit of the prescribed person and the information provided is substantially true. These conditions are important, because if the matter raised is not within the remit of the recipient, then this person is not obliged to refer it to the appropriate authority.⁹⁷

The lowest threshold of justification is for disclosures made directly to the employer or a responsible person. Speaking to the employer refers to any person senior to the worker—not a colleague though—who has been expressly or implicitly authorised by the employer as having management responsibility over the worker. This provision ensures that the employers are made aware of a specific conduct or practice, and they have the opportunity to investigate it. Subsection 1b allows a qualifying disclosure to be made to some other person (ie not the employer) whose conduct has led to a failure, or to a person or organisation legally responsible for this failure. The workers must show that they reasonably believed that the relevant failure related to the conduct of the other person or to a person in respect of which the other person has legal responsibility.

By virtue of section 43C(2) ERA, a worker, who in accordance with an authorised procedure, makes a qualifying disclosure to a person other than his or her employer is to be treated for the purposes of the legislation as having made the qualifying disclosure to the ‘employer’. The provision refers to a wide range of people, such as a health and safety representative, a union official, a parent company, lawyers, external auditors, or to a commercial reporting hotline.⁹⁸ This flexibility is important because it allows workers to approach someone other than their direct employer, potentially facilitating internal resolution of issues without the need to escalate to external bodies. By providing this protection, section 43C(2) encourages employees to report wrongdoing internally first. In practice, this can help employers to address problems before they become public or escalate further, while workers making disclosures under this section are protected from suffering any form of detriment (such as dismissal, reduction in duties or other negative treatment) as a result of making the disclosure.⁹⁹

The highest threshold is in relation to section 43H, which should meet a threshold requirement of being exceptionally serious. The further away that disclosures move from individuals within the company itself, and the closer they get towards the public at large, the higher the threshold. This is justified by the fact that the importance of the disclosure made needs to be measured against the potential damage that such disclosure will cause to the company, or the people associated with that company. For instance, no protection was afforded to the workers in Smith v Ministry of Defence¹⁰⁰. In this case, a group of workers on a site near a nursery discovered that a colleague had a conviction for indecently assaulting a girl. When the management refused to yield to their concerns about working with them, the group took their information to the press. Following their dismissals, the Tribunal ruled that their disclosure had not been reasonable because there was no evidence of any immediate danger, the employer’s whistleblowing procedure had not been followed and the workers could have explored other options for their disclosure before reporting directly the press.

The Parliamentary Assembly of the Council of Europe has made the point that that sections 43C(2) and 43G(3)(f) demonstrate that, when the employers have internal disclosure procedures in place, it is much easier for them to defend claims.¹⁰¹ When judging the reasonableness of a disclosure, both provisions require the court or tribunal to have regard to the whistleblower’s compliance with any procedures authorised by the employer. Therefore, both the employer and worker can benefit from compliance with internal procedures, and this is why the tiered system in place gives priority to internal whistleblowing as the model that needs to be followed in the UK. It requires workers to comply with less requirements for making a protected disclosure than in the case of external disclosure.¹⁰² If whistleblowers report to their employer, under section 43C ERA 1996, they only have to prove good faith. On the contrary, if they report to a competent authority, apart from good faith, they have to prove that they reasonably believe that the relevant failure falls within any description of matters in respect of which that person is so prescribed, and that the information disclosed, and any allegation contained in it, are substantially true.

PIDA does not oblige organisations to have a whistleblowing procedure for internal disclosures; it lies at the discretion of the employers to implement a whistleblowing procedure to handle such disclosures. However, certain sectors have developed specific frameworks to encourage or mandate robust whistleblowing systems. For instance, the Financial Conduct Authority requires financial institutions to have dedicated whistleblowing channels in place, including appointing a senior manager to oversee whistleblowing procedures and ensuring employees are informed of their rights.¹⁰³ Similarly, the National Health Service (NHS) has established a comprehensive whistleblowing policy that encourages NHS staff to raise concerns safely, supported by the Freedom to Speak Up initiative, which includes training and support for whistleblowers.¹⁰⁴ These sector-specific approaches highlight a move towards formalised whistleblowing mechanisms in high-stakes industries, even in the absence of a universal requirement under PIDA.

At the same time, it is worth noting that workers, who make use of external whistleblowing, are almost completely unprotected against dismissal if their organisation already has a whistleblowing procedure in place.¹⁰⁵ For instance, in the case of Jeffrey v London Borough of Merton¹⁰⁶, the Employment Tribunal held that the disclosure of allegations using a website, which was set up by the claimant to communicate their grievances about recruitment issues, meant that the disclosure was not protected because the claimant did not use the respondent’s whistleblowing procedure. The worker that makes a wider disclosure will only be protected if it was reasonable to have been made in this way: for instance, in the event that the whistleblower considers that their qualifying disclosure has not been satisfactorily addressed (or is unlikely to be) by the internal and regulatory disclosure framework established by sections 43C–43E.

Section 43G ERA provides for disclosure to an entirely outside body, such as the police or the press (external disclosure). The test for wider disclosures is designed to perform a delicate balancing act between the public interest and the need for confidentiality. For a disclosure to be protected, individuals must show that they have a reasonable belief that their concern is substantially true, that they are acting in good faith, that they are not raising a concern for personal gain, that they have a valid cause to go wider and that their actions (in making the disclosure more widely) are reasonable in all the circumstances.¹⁰⁷ The latter means that the reasonableness test includes considerations, such as the identity of the person to whom the disclosure is made, the seriousness of the reported failure, whether the disclosure would breach confidentiality owed by the employer to someone else, the action taken by the prescribed person to whom the disclosure was previously made and where the disclosure had already been made to the employer, that it was made in accordance with the employer’s relevant procedure for reporting such concerns.¹⁰⁸ In the case of Kay v Northumbria Healthcare NHS Trust,¹⁰⁹ the Employment Tribunal found that the letter written by the claimant amounted to a protected disclosure under section 43G ERA 1996 and that he had acted out of a personal motive because he had previously made a disclosure to the respondent. The Tribunal also held that the claimant was not aware of any other way he could raise their concerns other than having to resort to the wider disclosure he made. In determining this, the Tribunal would consider whether any internal procedure was followed by the worker or not. If the worker did not follow the appropriate procedure, it will be harder to show that the disclosure was reasonable.¹¹⁰

Under section 43H, where concerns are exceptionally serious, individuals can go straight to the media if appropriate, as was confirmed in Collins v National Trust (2005). In this case, the Employment Tribunal ruled that, in exceptionally serious circumstances, a disclosure to a local newspaper of a confidential report about dangers on a public beach was protected. However, there is, as in section 43G, the provision that the whistleblower will not be protected if the purpose of the disclosure was personal gain. It covers not only payments of money, but benefits in kind, even if the benefit did not go directly to the worker but to a member of his family, provided that its purpose was personal gain.¹¹¹

Looking at the other side of the coin, it is much better for businesses to have control of a whistleblowing process and investigate internally at an early stage, in order to deal properly with an issue and prevent further damage, rather than to leave a worker with no option but to raise any issues externally, most likely at a later stage, by which time matters may have escalated. It is encouraging that more and more companies are looking into the introduction of whistleblowing policies and reporting channels, so that potential whistleblowers are encouraged to consider sharing their concerns internally at first. The Whistleblower Directive, which will be discussed in the next section, contributes to the creation of a momentum for companies, in particular multinational that operate in multiple jurisdictions.

6. THE EU DIRECTIVE AND THE DEVELOPMENT OF AN EU APPROACH

Recent scandals, such as the Luxleaks, the Panama Papers and the more recent Pandora Papers, have demonstrated how important whistleblowers can be in detecting and preventing breaches of EU law before they have any harmful effect to the public interest and the welfare of society. At the same time, lack of effective whistleblower protection at the EU level can negatively impact the functioning of EU policies in a Member State but can also spill over to other countries and the EU as a whole. A 2017 study carried out for the European Commission estimated the loss of potential benefits, due to a lack of whistleblower protection, in the area of public procurement only, to be in the range of €5.8 to €9.6 billion each year for the EU.¹¹² This is why on 16 April 2019, the European Parliament and the European Council have agreed to adopt new rules that set the standard for protecting individuals, who blow the whistle on breaches of EU law, from dismissal, demotion and other forms of retaliation. The initial proposal by the European Commission was made in April 2018 and, after one year of intense deliberations, the time was right to take this initiative forward. It is worth noting that in 2013 the European Commission rejected a request by Members of the European Parliament (MEPs) to introduce EU whistleblower protection laws; clearly the time was not right back then, and more deliberations and preparatory discussions had to take place.

The Commission’s original proposal promoted the idea of internal whistleblowing, making it mandatory for reporting persons to first use internal reporting channels, in order to get protection. The rationale was that ‘[i]t is vital that the relevant information reaches swiftly those closest to the source of the problem, most able to investigate, and with powers to remedy it, where possible’.¹¹³ Despite the existence of exceptions,¹¹⁴ there were concerns about this obligation, as the exceptions were seen as too subjective and open to interpretation, not covering all possible scenarios and doomed to create inconsistencies across the Member States.¹¹⁵

The Directive is not very prescriptive in relation to where internal disclosures should be made¹¹⁶; it only refers to ‘institutional procedures’, thus leaving it at the discretion of the Member States to provide more details in their national laws. Prima facie, the model that the Directive adopts is based on a ‘three-tier’ system for making protected disclosures. This tiered system bears a great resemblance to the one that Ireland has in place, which shows a clear preference towards internal reporting. According to this system, the first course of action for potential whistleblowers is to report using the internal channels and, only if reporting internally is not an available option, then reporting can be made to the competent authorities. If such reporting is not a viable choice either, then the reporting person can disclose the information directly to the public through the media or internet platforms.¹¹⁷ However, a more careful look reveals that the Directive does not endorse the same strict hierarchical order regarding the channels that whistleblowers can use for their disclosures.¹¹⁸ To put it simply, there is no obligation to report internally first and whistleblowers can report directly to the authorities first, according to Article 10 of the Directive, bypassing their employer’s established procedures. Internal channels are an additional option, not an exclusive resource.

As discussed in the negotiations between the European Parliament and the European Council, a more flexible approach, compared to the Proposal for the Directive, is more preferable in relation to whether it is necessary to report internally first or go to the authorities.¹¹⁹ As pointed out in the European Commission’s impact assessment, a considerable number of studies have shown that most workers will choose to report internally first, even in countries where it is not mandatory.¹²⁰ In addition, allowing whistleblowers to use external channels directly was seen as a form of incentivising organisations to set up effective internal whistleblowing mechanisms that workers actually trust and use. Therefore, it was decided that there is no pressing need to put in place an obligation for whistleblowers to report internally first.

It needs to be noted, though, that making a disclosure to the public remains the last resort for whistleblowers and should be considered when the other two alternatives are not effective.¹²¹ This is why two strict conditions need to be met in order for a disclosure made directly to the public to be legally protected; namely, there must be an ‘imminent or clear danger to the public interest or irreversible damage’, should the disclosure not happen immediately.¹²² More guidance is needed as to what exactly constitutes an imminent danger or an irreversible damage, because otherwise it will be hard for whistleblowers to be in a position to know in advance whether they will be protected or not, if they choose to make a disclosure to the public. Apart from the fact that they will lose the protective shield of the law, they might be exposed to civil, or even criminal, charges connected to breaches of confidentiality or secrecy towards their employers.¹²³ No doubt that more emphasis is given, even subtly, towards internal reporting and the use of internal reporting channels, at least before considering the media.¹²⁴

One more issue that needs to be addressed is the extent to which the Directive covers all parties involved in a disclosure and offers real protection to them. It is well-established that one of the most significant features of PIDA is that it provides an avenue for protecting a wide range of persons by extending the meaning of workers in section 43K(1) beyond the definition in section 230(3) of the ERA 1996. For the purposes of the ERA 1996 (as amended by the PIDA 1998), the scope of the term ‘worker’ can extend to agency workers, home workers, NHS doctors, dentists, as well as trainees on vocational or work experience.¹²⁵

For instance, the Directive does not expressly protect individuals who have not (yet) used the dedicated channels to make a report, but instead have talked to colleagues, managers or the Human Resources Department (HR), even though they could suffer unfair treatment aimed at discouraging them from making a ‘formal’ report, or as a ‘pre-emptive strike’ to circumvent legal protection.¹²⁶ The Directive on the protection of persons who report breaches of Union law does not protect a whistleblower who does not use the internal reporting mechanisms as described in Articles 8 and 9. The reporting person should report to a designated person or department as designated to be afforded protection. It is quite common for whistleblowers to report issues to their line manager or the HR, rather than through the reporting channels. This might be due to the fact that they do not have sufficient information/evidence about the incident they want to report, they are not familiar with the dedicated reporting channels and how to use them or they do not realise that what they are reporting is actually a wrongdoing falling within the scope of whistleblowing legislation. Additionally, before making a disclosure, reporting persons may want to seek advice from colleagues or their supervisors or they may have questions about the procedure that needs to be followed. Therefore, the protection afforded should be extended to attempted and perceived whistleblowers as well.¹²⁷

7. EXTERNAL VS INTERNAL WHISTLEBLOWING: A QUESTION WITHOUT AN ANSWER

We now turn to the key issue of internal versus external reporting and the question of which system is more efficient and effective.¹²⁸ As it has become apparent from the foregoing discussion, there is no real comparison between the US approach and UK, French and EU perspectives. The respective systems follow different philosophies, procedures, enforcement mechanisms, but also have different priorities, which are reflected in the methodology adopted in their frameworks. The US emphasises the protection of the financial markets and the financial services sector, with the SEC playing a leading role as a watchdog and with monetary rewards as an additional motivation mechanism. In Europe, there has been fragmentation and lack of a coordinated approach. The UK has been one of the pioneers in establishing disclosure channels, France has followed this example, and recently the EU Directive reflects an attempt to move towards an EU or a pan-European framework. However, the delays in the transposition of the Directive by the majority of the EU Member States indicate that it will take time to achieve consistency and uniformity, so it is still early to talk about an EU approach.

Whistleblowing is all about transparency, accountability, good governance and an open corporate culture. There is already a plethora of legislative provisions, methods of protection, models of encouragement and rewards; having an ‘one size fits all’ is not a requirement nor a means to an end. What is more crucial is to achieve more active engagement of companies in this discussion, so that internal whistleblowing is placed on the correct basis to be evaluated and compared with external whistleblowing. Part of the problem is that on several occasions companies seem to be more concerned with saving their own reputations rather than engaging effectively with whistleblowers and dealing with the reported issues. As a result, instead of the role and the value of whistleblowers being recognised and reaffirmed, they are treated as a threat.

From a policy perspective, internal reporting is essential in order to deter, detect and halt unlawful conduct that may harm shareholders and undermine the future of the company. Companies that have more internal whistleblowing activity do not necessarily have more problems nor should they be considered as weak in terms of corporate governance standards and structures.¹²⁹ On the contrary, greater reporting volumes often reflect more open communication channels in the company and represent opportunities to identify and resolve issues before they are reported externally or uncovered by the regulatory authorities. Reporting internally through the designated channels is a sign of a healthy and open organisational culture. If there is no policy or no reporting channels in place or if whistleblowers do not have confidence in their reliability and effectiveness, they will inevitably go outside their company to report any wrongdoings.

Employers, which have in place a strong compliance policy that includes internal reporting protocols, the prompt investigation of reported concerns and anti-retaliation safeguards, are actively assuring everyone within the organisation that their whistleblowing programmes are effective. In this way, they are able to cultivate a culture of openness, which can incentivise potential whistleblowers to first report internally with confidence without fearing retaliation. In some cases, more time may be required but a strategic and consistent approach led from the top is required. Accountability consists of setting clear expectations and making sure everyone—from executives to entry-level staff—takes ownership of their responsibilities, with recognition for achievements and constructive responses to setbacks. Having a system of internal disclosures is a good starting point towards encouraging open communication; making this system work will further embed openness, transparency and accountability into everyday operations, making these values an integral part of an organisation’s identity.¹³⁰

When discussing external reporting and the US, there is always reference made to the SEC’s whistleblower programme, created as part of the Dodd-Frank Act, under which an individual, who provides the SEC with original information leading to an enforcement action that results in over $1 million in monetary sanctions, is eligible to receive an award of 10% to 30% of the amount collected. What is not often mentioned is that this same whistleblower programme also provides for the payment of awards in instances in which an individual’s internal report results in a successful SEC action resulting in monetary sanctions exceeding $1 million. Also, when determining the amount of a whistleblower award, the SEC will give value to the fact that the whistleblower used the company’s internal procedures at first.¹³¹ Finally, it is worth noting that the Dodd-Frank regime is particularly focused on the financial markets and does not cover all sectors of the US economy. Therefore, albeit its popularity and extensive use in practice, it does not represent the only whistleblowing regime available in the US. The US corporate governance system actively promotes transparency, robust compliance programmes and internal investigations.

The Court in Somers made this point very clearly, referring to the reasoning of the court in Berman, and highlighted that the intent of the Congress cannot be other than ‘provide protection for those who make internal disclosures as well as to those who make disclosures to the SEC’.¹³² Whistleblower protection is a coin with two sides and any rewards programme or legislative framework should complement the need for strong internal policies and reporting mechanisms. By channelling disclosures internally, the cost and length of investigations by regulatory authorities is reduced, corporate embarrassment can be avoided, and companies will have the breathing space to remedy any improper conduct before an external investigation begins or before the stories reaches the newspapers and the internet sites.

This article argues that internal and external reporting are part of the same preventive and protective strategy. Each country can choose the model of enforcement that fits its needs and the one that can support in terms of resources. Internal compliance programmes and policies indicate a culture of openness and provide an incentive to their employees to report internally first. It is all about the culture and culture can only change from within.¹³³

8. CONCLUSION

All the recent developments around the world highlight the importance of whistleblowing in corporate governance, accountability and enforcement. Whistleblowing has been at the top of the policy agenda of the EU, the UK as well as in the US, which can only be a positive development after years of silence and retaliatory practices against whistleblowers. It has become apparent that whistleblowers protect companies, shareholders and the society as a whole by preventing corporate wrongdoing and sharing key information with the management teams, the authorities or the public, if necessary. At the same time, companies need to be responsive to all the new developments and keep up with the shifting regulatory framework. Most importantly, they should be mindful that their whistleblowing procedures must be robust and efficient, because otherwise there will be no change of culture, no trust in the internal compliance processes and inevitably no speak-ups. Whether whistleblowers will report first internally, or they will prefer to go directly to the authorities is a strategic decision and it depends a lot on the regulatory choices that the government of their countries has made when introducing whistleblowing rules. The examples of the UK, France and the US illustrate this reality and confirm that the internal vs external whistleblowing is not a dilemma that can easily be resolved in favour of the one approach or the other. What matters more is that whistleblowers have options in terms of reporting channels and disclosure recipients: because in this way they won’t be obliged to stay silent and put up with a situation that is often unbearable and affects their mental health as well as their personal and professional life.

Footnotes

Author notes