I have been advising employers and senior executives on whistleblowing issues for over 20 years. In fact, the Public Interest Disclosure Act 1998 (‘PIDA’) came into force just as I qualified. In recent years, we’ve seen whistleblowing claims get significant global media coverage, and whistleblowers putting the spotlight on a wide range of illegal and public interest issues.
Just in the last 12 months, we have seen former employees of household brand names blow the whistle on an alleged culture of profitability over ethics and a dubious approach to misinformation. We’ve witnessed allegations of defrauding clients, and failures to investigate sexual harassment allegations, to highlight but a few examples.
The consistent trend we see is that many whistleblowers work directly for the named entities. Whether FTEs, contractors (for example, Edward Snowden) or suppliers, these individuals are privy to confidential information and have access to the documents that support their claims – in this digital age, everything is recorded in an electronic paper trail.
Whistleblowers have the ability to impact both the reputation and the share price of organisations. For example, allegations in the Wall Street Journal last year resulted in a share price dip of 13% for the named corporation. Whistleblowers can also derail careers: in a matter that we recently concluded for a client, a significant part of a divisions’ senior management team were exited.
So, the stakes are high and organisations may well be heading into a perfect storm when it comes to responding to whistleblowing disclosures.
An uneven playing field
Today, we have more laws around the world than ever before, but more uncertainty in respect of the laws. While there are comprehensive laws in Australia, Canada, Japan, the US and New Zealand, there is very little substantive law in, say, Israel or Mexico. Prior to Brexit, the UK was one of only 10 EU member states with comprehensive laws protecting whistleblowers, while 18 other EU member states did not have laws that meet this standard.
Currently we are seeing the piecemeal rollout of the Covid-impacted EU Whistleblowing Directive 2019/1937 (the ‘Directive’). As part of our research for the Paul Hastings’ annual survey of local counsel ‘Mapping the Trends: The Global Employer Update’ in early 2022, only 10 jurisdictions listed the implementation of the Directive as a top three issue for them. This is surprising as the deadline for transposition into national law was 17 December 2021.
The Directive itself leaves some key issues to be resolved in the national legislation of member states. For example, whether to go beyond a breach of the specified EU laws or not; whether to allow anonymous whistleblowing; whether there needs to be an internal reporting channel by legal entity; whether whistleblowers will be allowed to go external without exhausting internal channels; and whether there are civil or criminal sanctions.
It is fair to say that, in July 2022, the laws across the EU are in a state of flux and remain fragmented. As the EU threatens enforcement action, we will see more national legislation come into force across the EU. These developments may well impact existing compliance programmes and also require in-house legal teams to stay up to the minute on the latest legislative changes.
The right conditions for whistleblowing
With the current lack of consistency from one jurisdiction to the next, there is an increased likelihood of forum shopping (well who would not want 30% of any monies recovered by the SEC even if you are not a US citizen, or perhaps ‘gold-plated’ non-retaliation protection in the EU). While South Korea, Ghana, Slovakia and Canada also reward their whistleblowers, the US is the most well-known ‘bounty’ payer, where the SEC reports that it has awarded a staggering $1.1bn to over 200 whistleblowers since its first award in 2012.
More individuals than ever before now have legal protection against retaliation due to broad scope of the varied legislation. In New York, section 740 of the labour law now protects former employees and independent contractors. While coverage under the Directive may be incredibly challenging for companies. For example, Chapter VI of the Directive protects ‘facilitators’ and colleagues or relatives of the whistleblower who suffer retaliation in a work-related context. Traditionally, this is a group of individuals who did not have any workplace legal protection and it may not always be easy for an employer to identify these peripheral persons until they raise their hand to assert retaliation. Therefore, the investigations team will need to be even more astute in calling out this additional legal risk and gathering detailed background information.
The subject matter of any disclosures is now broader (including for sanction violations). We have greater employee and stakeholder activism at a time when there is increased scrutiny on ESG and the veracity of corporate disclosures and claims. We also have more of the C-suite speaking out on public interest issues, with CEOs taking corporate positions on issues that have not been vetted by legal and may not directly relate to their business.
Closer to home, while the UK is not implementing the Directive, there have been calls for reform for many years. A Private Members Bill had its first reading in the House of Lords last month, but the second reading is yet to be scheduled. The aim of the Bill is to establish an Office of the Whistleblower to protect whistleblowers and whistleblowing and to uphold the public interest in relation to whistleblowing; to create offences relating to the treatment of whistleblowers and the handling of whistleblowing cases; and to repeal PIDA. Some of this will align the UK with the Directive. However, this Bill is a long way off from becoming law and the focus of so many parliamentarians is certainly elsewhere at present.
In the meantime, for research Paul Hastings has underway into whistleblowing, the FCA confirmed that anonymous whistleblowing is on the rise. 22% of cases in the first three months of 2022 (21.65%) have been anonymous compared to 15% (15.33%) of cases in 2021. Of the 587 cases relating to employees/ex-employees reported to the FCA in 2021, 355 (60%) did not have an outcome as of March 2022. Therefore, there is no quick resolution for the UK financial services whistleblower and regulator interest and involvement seems protracted. (More to come from us on this research project).
All of these factors point to a potential tsunami of disclosures over at least the next 12 to 18 months and a considerable uptick in workload for in-house counsel. And if those disclosures are in the EU, companies have seven days to acknowledge the whistleblower’s allegations and three months to report back. Then, if the ‘speak up’ relates to a cross-border matter, or it is made to a group level reporting channel outside the EU, there is the small matter of GDPR compliance and any local language requirements.
Cultivating a speak-up culture
We know that if there is a genuine and healthy speak-up culture, there are obvious business benefits. It allows corporations to prevent further wrongdoing, to intervene with training, education and leadership development measures and hopefully resolve problems internally beyond the glare of shareholder scrutiny or the (social) media spotlight, mitigate fines and manage relationships with their regulators, including the FCA, the mighty SEC, DOJ, and EEOC, and other law enforcement agencies. Now is the right time to review existing programmes to ensure they really do nurture a speak-up culture while also complying with the requirements of the varied and complex laws.
But how to achieve it.
The successful whistleblower programmes that I have seen take time to implement and they are regularly monitored. For a global business, there needs to be dedicated resources from various teams across the business and relevant jurisdictions, including legal, ethics, HR and IT. There needs to be financial investment in the right tech, and of course, excellent legal advice from in house and external legal counsel.
The whistleblowing policy, associated process documents, and roles and responsibilities should be clear, user-friendly and realistic to facilitate prompt investigation. Key stakeholders need to be mindful of privilege and the varying practices around the world. There should also be consideration of how the whistleblowing policy interacts with other workplace policies, in relations to grievances, harassment, bullying and the code of conduct or ethics policy.
The programme needs to be widely launched and regularly promoted, ideally with the support of a board-level champion. There is no point embedding an email address in a Staff Handbook or Code of Conduct if you are serious about tackling these issues.
There also needs to be effective and engaging training, part of which needs to be tailored to local requirements. Disclosures under the Directive can be made in writing or orally and the whistleblower must have the option of reporting it at a local level. Therefore, the line manager on the ground needs to be alive to what s/he is being told and the local investigations team needs to know how to respond, and quickly.
A further crucial element to a successful programme is a process to collect and analyse the subject-matter and key details of speak-up reports to determine any patterns, trends or potential problem areas which will allow for targeted intervention. If there are regular issues in certain divisions or in certain jurisdictions, even if seemingly innocuous, this may be a red flag to more significant issues. Care needs to be taken to appropriately address issues of anonymity and confidentiality during this process.
There also needs to be a well-established practice of enforcement in response to established wrongdoing. Firstly, to achieve the obvious business benefits. Secondly, if the employee speaks up and nothing happens, the likelihood is that they will look for other avenues to vent their allegations. Equally, if the company is not receiving that many ‘speak-ups’ this may mean that the culture is not as healthy as the board might like or there is an issue with the programme. Either way this ‘silence’ requires some probing questions.
Then there is the issue of what to do with the whistleblower.
The longer-term relationship with the whistleblower
While retaliation is a definite ‘no-no’, the longer-term relationship with the employer and co-workers is a real challenge. The Directive contains rules designed to prevent direct or indirect reprisals but it is silent on what happens when the investigation is complete.
There are, of course, some employee whistleblowers who raise their hand when there is an on-going employment action or process, perhaps a transformation, performance issue or threat of dismissal, when it becomes clear that they don’t have the requisite two years’ service to bring an unfair dismissal claim or they want to take the ‘unfair dismissal compensation cap off’ as part of their leverage in the exit negotiation. These employees are often eager to tell the employer how they want their concerns resolved.
However, there are other whistleblowers who genuinely believe that they have an ethical obligation to call out wrongdoing to create a positive and healthy workplace. But, in a number of cases, the employment relationship is fractured by the end of the process despite everyone’s best intentions. In these cases, there is obvious scope for actual or perceived detriments if they remain with the business but are, say, unsuccessful in applying for that next role. It is a brave employer that raises the issue of a negotiated exit with these whistleblowers.
However, perhaps there is another way.
What if the whistleblowing policy contained a provision that if at the end of the process the employee wished to leave the business, they could opt for a specified severance package? The employer could take the position that the suggestion was not in response to their allegations but an integral part of their process. This would leave less scope for negotiation as to quantum, it could be overseen by someone independent, and the employee could exit stage right, if that is their preference. Radical but worth considering as a potential solution to a thorny issue that is not addressed in the reams of legislation.
In-house legal to the rescue
The in-house legal function continues to be at the epicentre of the corporate response to whistleblowing, advising the business on the complex and dynamic legal landscape particularly across the EU and aligning the corporate response to the culture, systems and processes already in place. As time runs down on the national implementing legislation coming into force across the EU, this is another opportunity for in-house counsel to demonstrate their ‘value-add’, as they help the business prepare for and weather the ‘perfect storm’ of the next 12 to 18 months. Of course, myself and the broader employment and investigations teams at Paul Hastings are at your disposal for both avoiding and cleaning-up any spillages.
The article forms part of an on-going series of whistleblower alerts and events by Paul Hastings.