Substantial changes to Irish whistleblowing law will be introduced by the Protected Disclosures (Amendment) Act, 2022 (the "Amendment Act") on 1 January 2023.
Protection for whistleblowers is not a new concept in Ireland. There is already strong protection for whistleblowers under the Protected Disclosures Act, 2014 (the "2014 Act"). However, the Amendment Act introduces a number of new and substantial obligations, including by implementing Directive (EU) 2019/1937 of the European Parliament and of the Council on the protection of persons who report breaches of Union law ("Whistleblowing Directive")
From 1 January 2023, certain categories of employers will be required to establish, maintain and operate secure and confidential reporting channels and procedures for a widely defined category of workers who wish to make a protected disclosure:
- employers who are subject to EU law which is listed in Schedule II of the Amendment Act which can be accessed here, regardless of their headcount. These prescribed areas include a long list of directives and regulations in the areas of financial services, products and markets, prevention of money laundering and terrorist financing;
- employers who employ at least 250 employees;
- public sector employers.
Employers of at least 50 but less than 250 employees will be subject to these requirements from 17 December 2023.
What guidance is available for employers who are in scope?
In November 2022, the Minister for Public Expenditure and Reform, Michael McGrath published Interim Guidance for public sector employees and prescribed personnel on the handling of reports made to them under the Amendment Act, which is available here.
While this guidance is aimed at public sector bodies, the Minister has stated that "those private sector employers that will be required to establish internal reporting channels for their staff under the new legislation may also find some of the material in the guidance helpful." This interim guidance is due to be reviewed in 2023 "with a view to issuing full formal statutory guidance in the first quarter of 2023".
For the time being, in-scope private sector employers may consult the high-level summary available in the Department's "Information for Employers", which is available here.
Expansion of Protection for Whistleblowers
Whistleblowing law already applies to employees, independent contractors, agency workers and individuals undergoing work experience or a training course or programme.
The definition of "workers" will be extended under the Amendment Act to include shareholders, members of the administrative, management or supervisory body of an undertaking (eg the board of directors) including non-executive members, volunteers, unpaid interns, trainees and individuals who acquire information on a relevant wrongdoing during a recruitment process or pre-contractual negotiations.
The definition of "penalisation" has also been broadened under the Amendment Act to mean:
- any direct or indirect act or omission;
- which occurs in a work related context;
- is prompted by the making of a report of a relevant wrongdoing; and
- causes or may cause unjustified detriment to a worker including: suspension, lay-off or dismissal; demotion, loss of opportunity for promotion or withholding of promotion; transfer of duties, change of location of place of work, reduction in wages or change in working hours; the imposition or administering of any discipline, reprimand or other penalty (including a financial penalty); coercion, intimidation, harassment or ostracism; discrimination, disadvantage or unfair treatment; injury, damage or loss; threat of reprisal; withholding of training; a negative performance assessment or employment reference; failure to convert a temporary employment contract into a permanent one, where the worker had a legitimate expectation that they would be offered permanent employment; failure to renew or early termination of a temporary employment contract; harm, including to the worker's reputation, particularly in social media, or financial loss, including loss of business and loss of income; blacklisting on the basis of a sector or industry-wide informal or formal agreement; early termination or cancellation of a contract for goods or services; cancellation of a licence or permit; and psychiatric or medical referrals.
The definition of "detriment" has similarly been broadened to encompass all the same circumstances as penalisation.
The 2014 Act provides that the following information disclosed by a worker constitutes "relevant wrongdoings":
- an offence has been, is being or is likely to occur;
- that a person has failed, is failing or is likely to fail to comply with any legal obligation, other than one arising under the worker's contract of employment or other contract whereby the worker undertakes to do or perform personally any work or services;
- that a miscarriage of justice has occurred, is occurring or is likely to occur;
- that the health or safety of any individual has been, is being or is likely to be endangered;
- that the environment has been, is being or is likely to be damaged;
- that an unlawful or otherwise improper use of funds or resources of a public body, or of other public money, has occurred, is occurring or is likely to occur;
- that an act or omission by or on behalf of a public body is
oppressive, discriminatory or grossly negligent or constitutes
- that information tending to show any of the above has been, is being or is likely to be concealed or destroyed.
The definition of "Relevant wrongdoing" is broadened under the Amendment Act to include an act or omission that breaches EU law in the following areas: public procurement; financial services, products and markets, and prevention of money laundering and terrorist financing; product safety and compliance; transport safety; protection of the environment; radiation protection and nuclear safety; food and feed safety and animal health and welfare; public health; consumer protection; and protection of privacy and personal data, and security of network and information systems.
Certain Grievances Excluded
Although the Amendment Act represents a notable expansion of protection for whistleblowers, it also includes a limited exclusion for certain disclosures.
A matter concerning interpersonal grievances exclusively affecting a reporting person, namely, grievances about interpersonal conflicts between the reporting person and another worker, or a matter concerning a complaint by a reporting person to, or about, their employer which concerns the worker exclusively, shall not be a relevant wrongdoing for the purposes of the Amendment Act.
Although the 2014 Act contained no such exception, the Workplace Relations Commission published the Code of Practice on Protected Disclosures Act 2014 (Declaration) Order 2015 which purported to exclude grievances specific to a worker regarding their duties, terms and conditions of employment, working procedures or working conditions. However, this distinction was declared invalid in the Supreme Court decision of Baranya v Rosderra Irish Meats Group Ltd as it was not constitutionally permissible for a Code of Practice to amend primary legislation. The Supreme Court also noted that it appeared from the long title of the 2014 Act that it was intended that protected disclosures would relate to matters of public interest. Despite this, there is no requirement in the Amendment Act for a protected disclosure to relate to a matter of public interest in order for the worker to avail of the protections available.
Requirement to Establish Reporting Channels
The most significant change introduced by the Amendment Act is the requirement to establish, maintain and operate reporting channels and procedures enabling workers to make protected disclosures as follows:
- reporting channels may be operated internally by a person or department designated for that purpose or provided externally by a third party authorised for that purpose by the employer;
- the worker must be able to make their report in writing or orally; and
- in the case of reports made orally, a telephone or other voice messaging system must be available; and
- the worker will be entitled to request a physical meeting to make their report
Whether an employer operates internal reporting procedures through a designated person or department or authorises a third party to do so, the reporting channel must be secure and protect the confidentiality of the reporting person, subject to certain exceptions to confidentiality outlined below. Careful consideration should be given before selecting the individuals/department to reduce the risk of any inference of penalisation. Individuals designated to receive protected disclosures must be impartial and ideally separate from the reporting lines within the business.
The Internal Reporting Procedure
The Amendment Act outlines a number of obligations for employers in operating an internal reporting procedure.
Unless the disclosure is minor enough not to warrant a formal process, receipt of a protected disclosure must be acknowledged within seven days. The disclosure itself must be "diligently followed up" within three months. Follow up must include carrying out of an initial assessment to decide whether there is a prima facie evidence that a relevant wrongdoing has occurred.
If the initial assessment demonstrates that there is no prima facie evidence that a relevant wrongdoing has occurred, there should be proper closure of the procedure or referral of the matter to the grievance procedure and notification in writing to the reporting person of the decision and the reasons for it.
If, however, the initial assessment demonstrates that there is prima facie evidence that a relevant wrongdoing has occurred, appropriate action must be taken to address the relevant wrongdoing, having regard to the nature and seriousness of the matter concerned.
Feedback must also be provided within three months and, if the worker requests further feedback in writing, the employer is required to provide further feedback at intervals of three months until the procedure concludes. Communication must be maintained between the reporting person and the person designated to follow up on their report.
Employers are required to provide clear and accessible information to workers on the procedures for making reports via the internal reporting channels. This requirement should be fulfilled by having a whistleblowing policy in place. As not all "workers" will have access to the employer's intranet or employee handbook, the whistleblowing policy could also be available online on the employer's website or provided to non-staff "workers" through a secure link during their engagement or recruitment process.
The Amendment Act permits employers of less than 250 employees to share resources for receipt and follow up of protected disclosures. However, the obligations to maintain confidentiality, diligently follow up and provide feedback continue to apply to the individual employer.
Initially, there was some confusion over whether resources could be shared across jurisdictions. The European Commission's Expert Group has clarified that there is no exemption for individual legal entities belonging to the same corporate group. Centralised group level reporting channels may be used addition to, but not in substitution for, a local reporting channel at the subsidiary level. The rationale for this is that reporting channels must be accessible and the designated person must be appointed by the employer entity that has a working relationship with the worker who is making the report.
Employers must not disclose the identity of a worker who has made a protected disclosure, without the consent of the worker. This includes any information from which the identity of the worker could be directly or indirectly deduced. However, there are exceptions to this.
Workers should be informed that their identity may be disclosed in the following circumstances:
- where the disclosure is a necessary and proportionate obligation imposed by law in the context of investigations or judicial proceedings, including with a view to safeguarding the rights of defence of the person concerned;
- where the designated person/department took all reasonable steps to avoid disclosing their identity or reasonably believes that disclosing their identity is necessary for the prevention of serious risk to the security of the State, public health, public safety or the environment; or
- as required by law.
If the employer is disclosing the worker's identity under one of these exceptions, the worker must be notified in advance in writing, unless such notification would jeopardise: the effective investigation of the relevant wrongdoing concerned; the prevention of serious risk to the security of the State, public health, public safety or the environment; or the prevention of crime or prosecution of a criminal offence.
Employers are not required to follow up on reports made anonymously, though they may do so if they wish. Workers who make an anonymous disclosure but whose identities are later revealed are entitled to all the protections contained in the Amendment Act.
Although there is no legal obligation to follow up on anonymous disclosures, employers who do not do so risk reputational damage if this subsequently becomes public knowledge. Employers can protect their interests by documenting why an anonymous disclosure was not followed up on. For instance, it may not be possible to adequately investigate the relevant wrongdoing without further information or to initiate the disciplinary process where the employer cannot rely on the evidence of the person who reported their concerns.
Existing Whistleblowing Requirements
The Amendment Act amends section 25 of the 2014 Act by including the following:
- "(1) This Act is without prejudice to any specific rules on the reporting of breaches as provided for in the sector-specific Union acts listed in Part II of the Annex.
- (2) Specific rules on the reporting of breaches referred to in subsection (1) shall continue to apply without prejudice to, and are in addition to, the provisions of this Act in so far as those provisions relate to the reporting of breaches of the sector-specific Union Acts referred to in subsection (1)."
Therefore, existing whistleblowing requirements will continue to exist side-by-side with the new internal reporting channels. For instance, whistleblowing requirements contained in the Criminal Justice (Money Laundering and Terrorist Financing) Act 2010 (as amended) and the European Communities (Undertakings for Collective Investment in Transferable Securities) Regulations 2011 (as amended) will continue to apply
External Disclosures and the Office of the Protected Disclosures Commissioner
Workers may also make and/or be required to make disclosures externally to a "prescribed person". When making an external disclosure, the worker must do so to the appropriate prescribed person and must believe the information related to the disclosure is substantially true. The appropriate prescribed person is defined in the legislation.
The Amendment Act will also establish the Office of the Protected Disclosures Commissioner. It will operate as an alternative route for workers to make an external disclosure. The Commissioner will have power to require the furnishing of documents, examine such documents and make copies in order to investigate disclosures made to the Office of the Protected Disclosures Commissioner.
External reporting procedures are similar to internal reporting procedures. However, the three month deadline for providing feedback to the worker may be extended to six months for external disclosures in duly justified cases due to the particular nature and complexity of the report. There is also an exception to the requirement to communicate the final outcome of any investigation where such communication would be contrary to other legal obligations relating to confidentiality, legal professional privilege, privacy and data protection. The Amendment Act is silent on whether such legal obligations would exempt an employer from having to provide certain information as feedback to workers under internal reporting channels. However, there is also no corresponding explicit obligation on employers to communicate the final outcome to the worker, beyond the obligation to provide feedback
Potential Claims Expanded
Under the 2014 Act, employees who have suffered penalisation in foot of making a protected disclosure may refer a claim to the Workplace Relations Commission ("WRC"). The WRC is empowered to award such an employee up to five year's remuneration as compensation. The Amendment Act expands the ability to take a penalisation claim to workers other than employees and provides that the WRC is empowered to award up to €15,000 to workers who are not in receipt of remuneration.
Under the 2014 Act, employees who allege that they have been dismissed due to having made a protected disclosure may also seek a Circuit Court order for interim injunctive relief, i.e. that the worker be re-instated until a case for protected disclosure related unfair dismissal is determined. The Amendment Act extends the ability to obtain an interim injunction to employees who allege that they have suffered any form of penalisation.
A crucial change introduced by the Amendment Act is the reversal of the burden of proof in penalisation claims. Previously, in order to be successful in a penalisation claim, workers had to demonstrate that 'but for' them having made the protected disclosure, the penalisation would not have occurred. However, the Amendment Act has reversed this burden and now employers must be able to prove that the act of alleged penalisation was separate to the worker having made the protected disclosure. Considering the very broad definition of penalisation, this will present challenges for employers in managing and assessing the performance of employees who have made protected disclosures.
The best way to defend against any penalisation claim will be to ensure that the reporting channels are kept confidential and secure with no potential for the individuals to whom the worker reports or who could "penalise" them becoming aware that they have made a potential disclosure and being able to objectively justify any alleged penalisation. For example, demonstrating with the use of objective and documented evidence that a negative performance assessment was merited and unconnected to the worker's protected disclosure as the assessor could not have known the worker had made a report. As outlined above, there is also a right of action under tort law for those who suffer detriment as a result of making a protected disclosure. A person may make a penalisation claim or a claim for detriment, but not both. The Amendment Act provides that where the investigation of wrongdoing was not the sole or main motivation for making the protected disclosure, the damages awarded to a person for a detriment claim may be reduced by up to 25%.
Certain criminal offences have been introduced under the Amendment Act, including:
- hindering a person making a report;
- penalising a reporting person, facilitator or entity a reporting person works for;
- bringing vexatious proceedings against a reporting person; and
- failing to establish and operate internal reporting channels.
- The maximum penalties for the above offences are a fine of €250,000 and two years' imprisonment.
There is also the possibility of personal liability being imposed on directors, managers, secretaries or other officers, or a person who was purporting to act in any such capacity.
It will also be a criminal offence to breach the duty of confidentiality, the maximum penalties for which will be a fine of €75,000 and two years' imprisonment.
Potential criminal liability is not limited to employers. It is also a criminal offence for a person to knowingly make a false report. Such a person could face a maximum fine of €100,000 and two years term of imprisonment.
The Amendment Act has limited retrospective effect depending on the circumstances. However, in most cases retrospective effect is limited to workers who have made a protected disclosure prior to commencement of the Amendment Act but suffered penalisation after it was enacted on 21 July 2022.
Next Steps for Employers
- employers who are required to establish internal reporting channels on or before 1 January 2023 should immediately take steps to consider their options and comply with their obligations under the Amendment Act;
- existing whistleblowing policies and procedures should be reviewed and updated in accordance with the Amendment Act, including the procedures for making a report to the Office of the Protected Disclosures Commissioner, where relevant;
- employers with less than 250 employees may share resources regarding the receipt of reports and any investigation to be carried out as part of the follow-up process, but each entity will need to have separate confidential reporting channels;
- if operating reporting channels internally rather than through a third party, training on handling protected disclosures should be provided to the staff member(s) designated as responsible for receiving protected disclosures. Careful consideration should be given before selecting these individuals to reduce the risk of any inference of penalisation;
- public bodies should review the interim guidance for public sector employees and prescribed persons on the handling of reports and private sector employers that will be required to establish internal reporting channels under the Amendment Act may also find certain aspects of this guidance helpful; and
- the interim guidance is due to be reviewed in January 2023 with a view to issuing full formal statutory guidance in the first quarter of 2023.
The content of this article is intended to provide a general guide to the subject matter. Specialist advice should be sought about your specific circumstances.