The much-anticipated Protected Disclosures (Amendment) Bill 2022 ("Bill") has finally been published.
The purpose of the Bill is to implement Directive (EU) 2019/1937 of the European Parliament and of the Council on the protection of persons who report breaches of Union law ("Whistleblowing Directive") and to amend existing legislation on protected disclosures in Ireland, including the Protected Disclosures Act 2014 ("2014 Act").
The Whistleblowing Directive necessitates substantial changes to the 2014 Act. These changes are contained within the Bill, including the enhancement of obligations to reporting persons and increased protection from penalisation.
Which Employers Will be in Scope and When?
The deadline for Ireland to implement the Whistleblowing Directive by 17 December 2021 has long passed. The Bill provides for commencement of the legislation on a day or days as shall be appointed by the Minister, so parts of the Bill may be introduced in phases. The Minister for Public Expenditure and Reform ("Minister") previously indicated that the Bill will not be enacted until the end of Q1 2022.
The following employers will be required to establish reporting channels within their organisation for workers who wish to report breaches of EU law from the date of commencement of the relevant sections of the Bill:
- public bodies;
- employers who are subject to EU law in various prescribed areas, including financial services, products and markets, prevention of money laundering and terrorist financing, public procurement, product safety and compliance, transport safety and protection of the environment, food safety, animal safety and welfare, and public health; and
- private employers who employ 250 or more employees.
As outlined above, employers subject to EU law in prescribed areas will be required to establish internal reporting procedures from the date of commencement of the Bill, regardless of their headcount. The full list of applicable legislation under which employers may be subject to this requirement is contained in Schedule II of the Bill, which can be accessed here. Employers in the areas outlined above should review Schedule II to check whether they will be required to establish internal reporting channels from the commencement date.
Other private employers who employ between 50 and 249 employees will not be required to establish internal reporting channels until 17 December 2023.
The Bill also provides that the Minister may, by order, reduce the threshold of 50 employees for specified classes of employers, subject to a risk assessment and public consultation. The Minister can also make an order setting out how organisations should calculate the threshold of 50 employees.
Statutory guidance for handling protected disclosures will also be comprehensively overhauled. This guidance, which will be published when the Bill is enacted, will assist private sector employers on establishing and operating internal reporting channels.
Sector-specific protected disclosures obligations continue to apply and it has been previously indicated that guidance will be published on how sector-specific legislation will interact with the Bill.
Establishing Internal Reporting Channels
Internal reporting channels and procedures may be operated internally by a person or department designated for that purpose by an employer, or provided externally by a third party authorised by an employer.
Internal reporting channels must be designed, established and operated in a secure manner that ensures the confidentiality of the reporting person's identity and any third party mentioned in their report. Employees must be able to make their report in writing or orally or both.
The Bill provides that employers who employ less than 250 employees may share resources for receiving and investigating reports. The Bill also provides that employers who are part of a larger group structure, must provide internal reporting channels which are accessible by workers of the employer and its group companies. This is quite helpful as it will allow group companies to avoid having to put in place multiple internal reporting channels.
Acknowledgement, Feedback and Follow Up
Strict deadlines for acknowledging receipt, following up and providing feedback are imposed by the Whistleblowing Directive. In summary:
- Unless the disclosure can reasonably be considered minor enough not to warrant a formal process, receipt of a protected disclosure must be acknowledged in writing within seven days.
- The disclosure itself must be "diligently followed up" within three months. "Follow up" is defined in the Whistleblowing Directive as any action taken to assess the accuracy of the allegations made and, where relevant, address the breach reported, including, by way of internal enquiry, investigation, prosecution, action for recovery of funds, or the closure of the procedure.
- Feedback must be provided within three months, or six months in duly justified cases. "Feedback" is defined in the Whistleblowing Directive as informing the worker who made the protected disclosure of the action envisaged or taken as follow-up and the grounds for such follow-up.
The current text of the Bill provides further details on what will be required of employers going forward. The Bill places more substantive obligations on employers to provide "feedback" and to "follow up" than required under the Whistleblowing Directive. The Bill envisages that communication will be maintained with the reporting person by the person designated to follow up on their report. Follow up shall include, at a minimum:
- the carrying out of an initial assessment to decide whether there is a prima facie evidence that a relevant wrongdoing has occurred; and
- if the initial assessment demonstrates that there is no prima facie evidence that a relevant wrongdoing has occurred, the closure of the procedure or referral of the matter to the grievance procedure and notification in writing to the reporting person of the decision and the reasons for it; or
- if the initial assessment demonstrates that there is prima facie evidence that a relevant wrongdoing has occurred, the taking of appropriate action to address the relevant wrongdoing, having regard to the nature and seriousness of the matter concerned.
The Bill provides that employers will not be required to follow up on reports made anonymously. However, persons who make reports anonymously remain entitled to all of the protections of the legislation if their identity is subsequently revealed and they suffer penalisation for having made a protected disclosure.
The 2014 Act already provided for a broad definition of "worker" to include employees, contractors and agency workers. The Whistleblowing Directive and the Bill expand the definition of "workers" further, to include shareholders, members of the board of directors including non-executive members, volunteers, unpaid interns, trainees, individuals who acquire information on a relevant wrongdoing during a recruitment process and individuals who acquire information on a relevant wrongdoing during pre-contractual negotiations
The Bill proposes to exclude interpersonal grievances exclusively affecting a reporting person, which is further clarified to mean grievances about interpersonal conflicts between the reporting person and another worker, or a matter concerning a complaint by a reporting person to, or about, their employer which concerns the worker exclusively.
This is a narrower exclusion than discussed as being necessary in the recent Supreme Court decision in Baranya v Rosderra Irish Meats Group Limited  (see our previous advisory discussing the Baranya decision here).
The definition of penalisation is significantly expanded by the Whistleblowing Directive to include withholding of training; a negative performance assessment or employment reference; harm, including to the person's reputation; blacklisting; and psychiatric or medical referrals. Such a broad definition of penalisation will present challenges to employers in managing and assessing the performance of employees who have made protected disclosures.
The Bill proposes to reverse the burden of proof for proceedings concerning allegations of penalisation for having made a protected disclosure. It also enables workers to seek interim relief from the Circuit Court for penalisation other than dismissal.
The Bill provides for a maximum award of compensation in the sum of €15,000 from the Workplace Relations Commission ("WRC") for individuals who are not in receipt of remuneration from the "employer" with whom they are in a work-based relationship.
The Bill also provides that any award of compensation made by the WRC may be reduced by 25% where investigation of the wrongdoing is not the main motivation for the making of the protected disclosure.
Record Keeping Obligations
Employers will be required to make and retain records of any protected disclosures. Detailed requirements outline the required form of such records, which depend on whether the report was made anonymously, whether it was made orally or in writing, whether it was made on a recorded or unrecorded telephone line or in a meeting. The Bill also requires employer to offer the reporting person the opportunity to check, rectify and agree the record of their report where their report was made via a telephone line or voice messaging system. In the case of reports made via a meeting with staff designated for receiving protected disclosures, the Bill also requires the employer to offer the reporting person the opportunity to check, verify and agree the record of their report.
The Bill also provides for very substantial fines (ranging between €75,000 and €250,000 for convictions on indictment) and the possibility of a term of imprisonment not exceeding two years for employers who are found to have committed a criminal offence under the Bill. Criminal offences provided for in the Bill include hindering or attempting to hinder a reporting person from making a protected disclosure, penalising or threatening to penalise a reporting person or a person connected with a reporting person, breaching the duty of confidentiality regarding the identity of a reporting person, and failing to comply with the requirement to establish, maintain or operate internal reporting procedures.
Key Takeaways for Employers:
- employers subject to EU law listed in Schedule II of the Bill, private employers who employ more than 250 employees, and public employers should take steps now to establish internal reporting channels, including designating staff to receive protected disclosures in a secure and confidential manner or engaging an external third party to provide the reporting channel;
- if designating one or more staff members as responsible for receiving protected disclosures, specific training on handling protected disclosures will be required. Careful consideration will be required before selecting these individuals to reduce the risk of any inference of penalisation. For instance, individuals in management positions or certain reporting lines could be conflicted;
- a balancing exercise will be required for employers to comply with their obligations to provide feedback of their follow up on a report with their duty of care, confidentiality obligations and procedural obligations to an employee against whom a report is made;
- whistleblowing policies should be reviewed now and updated once the awaited statutory guidance is published; and
- the limited exclusion of interpersonal grievances will likely cause difficulties for employers seeking to refer complaints to grievance procedures. Many situations, which might previously have been considered grievances, may soon attract enhanced protection for the reporting person
The content of this article is intended to provide a general guide to the subject matter. Specialist advice should be sought about your specific circumstances.