When the Protected Disclosures Act 2014 (the "2014 Act") was introduced almost a decade ago, organisations and practitioners believed that this would instigate a great deal of whistleblowing complaints by individuals. This, however, did not materialise to the extent anticipated. Since the enactment of the Protected Disclosures (Amendment) Act 2022 (the "2022 Act") in January of this year, however, we are now seeing a very notable trend of employees blowing the whistle.
Here, we explore the key components of the 2022 Act and share our insights into how employers are managing these obligations in practice.
Let's recap: What is a "Protected Disclosure"?
Whistleblowing involves the making of a "Protected Disclosure". A Protected Disclosure is a disclosure of "relevant information" by a Worker (defined below) which, in their reasonable belief, tends to show one or more "relevant wrongdoings" which came to their attention in a work-related context.
The list of eight Relevant Wrongdoings under the 2014 Act has been extended by the 2022 Act to include certain breaches of EU law, including consumer protection, the prevention of money laundering and protection of personal data.
The most common Relevant Wrongdoings cited by employees, in our experience, are the following:
- that an offence has been, is being or is likely to be committed;
- that that a miscarriage of justice has occurred, is occurring or is likely to occur; and
- that the health and safety of an individual has been, is being or is likely to be endangered.
Who is a "Worker" under the 2022 Act?
The 2022 Act significantly extends the protection of the whistleblowing legal framework. In addition to those protected by the 2014 Act, shareholders, board members (executive and non-executive directors), volunteers, unpaid trainees, members of administrative, management or supervisory bodies and job applicants (where information on a Relevant Wrongdoings is acquired during the recruitment process or the pre-contractual negotiations) can now avail of the protections of the 2022 Act.
Key change: Internal reporting channels and procedures
One of the key changes introduced by the 2022 Act is the requirement on employers to establish, maintain and operate internal reporting channels and procedures for the making and managing of Protected Disclosures. These channels must be designed and operated in a secure manner, which prevents access by non-authorised persons and ensures the confidentiality of the identity of the reporting person. Reporting channels can be operated either internally within the organisation or outsourced externally to an authorised third party.
This requirement has been in place from 1 January 2023 for all public sector organisations, organisations with 250 employees or more and all organisations, irrespective of headcount, subject to certain EU legislation in various prescribed areas, including financial services. As of 17 December 2023, employers with between 50 and 249 employees are also required to comply with these obligations.
Non-compliance is a criminal offence so any in-scope employers who have not yet reviewed and updated their existing whistleblowing policies to ensure they are fully compliant with the 2022 Act should take action now.
What is the process for responding to and managing a Protected Disclosure? Think: acknowledgement, follow-up and feedback!
- Workers can submit their Protected Disclosure orally or in writing and the organisation must acknowledge the Protected Disclosure within seven days.
- The organisation must appoint a designated impartial person who is competent to follow-up on the Protected Disclosure (the "Designated Person"). The Designated Person must follow up, maintain communication with the reporting Worker and, where necessary, request further information. Reference to the Designated Person being "competent" means that they should receive training in how to manage the report in accordance with the 2022 Act and in line with the organisation's policies and procedures. We are currently providing this training to a number of clients.
- The Designated Person will conduct an initial assessment to determine if there is preliminary evidence that a Relevant Wrongdoing has occurred. If it is determined that there is no such preliminary evidence, the procedure can be closed or referred to another applicable policy (such as the grievance procedure, for example). The reporting Worker is to be notified in writing, as soon as practicable, of the decision and reasons for it.
- If the Designated Person decides that there is preliminary evidence that a Relevant Wrongdoing has occurred, appropriate action should be taken, having regard to the nature and seriousness of the matter. This is likely to include the appointment of an impartial investigator who will investigate the Relevant Wrongdoing alleged.
- The Designated Person must follow up and provide feedback to the reporting Worker within a reasonable period, not more than three months from the date the report was acknowledged or if no such acknowledgement was sent, not more than three months from the date of expiry of the period of seven days after the report was made.
- Where a reporting Worker requests further feedback in writing, the Designated Person must provide feedback in three monthly intervals until such time as the process relating to the report is closed.
Common client query: Can we retain our centralised reporting channel that operates at group level?
This is one of the most common queries arising for employers in Ireland that are part of a group structure which already has a centralised reporting channel operating at group or parent level. In such circumstances, there is usually a strong preference to retain the existing centralised reporting channel. However, our view is that a centralised group reporting channel alone is not sufficient to ensure compliance with the 2022 Act so, many organisations are retaining their centralised reporting channel while also introducing a local reporting channel.
Obligation to maintain confidentiality
In practice, one of the most challenging aspects of managing a whistleblowing complaint is protecting the identity of the reporting Worker. Other than in limited exceptions, where the reporting Worker's identity is being disclosed, prior consent will be required. If the organisation is seeking to rely on the limited exceptions, it must be able to credibly justify its decision to rely on the exceptions and that decision will need to be able to withstand scrutiny.
Criminal liability can arise for non-compliance with the 2022 Act's confidentiality obligations which could, in theory, result in fine of up to €250,000 and/or up to two years’ imprisonment.
How do we manage anonymous complaints?
Whistleblowers often seek to remain anonymous. Under the 2022 Act, an employer is not obliged to accept and follow-up anonymous reports. There may, however, be a moral weight behind an employer following up on an anonymous report to ensure that if there is a potential issue of wrongdoing, it is investigated and addressed. Organisations may also choose to follow up on anonymous reports due to reputational considerations or taking into account their ESG strategy. Where an employer chooses to accept anonymous disclosures, its whistleblowing policy should set out the conditions that apply to such acceptance.
What if the employee raises a personal grievance?
The 2022 Act seeks to exclude personal grievances from its protection by excluding “a matter concerning interpersonal grievances exclusively affecting a reporting person, namely, grievances about interpersonal conflicts between the reporting person and another worker, or a matter concerning a complaint by a reporting person to, or about, his or her employer which concerns the worker exclusively.”
According to the 2022 Act, a personal grievance must affect the Worker exclusively. The organisation must, therefore, consider whether the matter is a personal grievance which affects the Worker exclusively or not. For example, an allegation of bullying against one employee is likely to be a personal grievance (to be managed in line with the company's bullying and harassment policy). However, not all ‘grievances’ will affect the Worker exclusively, such as an allegation that there is a culture of bullying within a team or department which may, therefore, constitute a Protected Disclosure within the health and safety remit. The line between "interpersonal grievances" and Protected Disclosure can be blurred so careful consideration is required to ensure that the concern raised is not a Protected Disclosure.
Key change: Penalisation and redress
An employer is prohibited from penalising or threatening to penalise a Worker for having made a protected disclosure. The 2022 Act defines penalisation as: "Any direct or indirect act or omission which occurs in a work related context, is prompted by the making of a report and causes or may cause unjustified detriment to a worker". Detriment includes suspension, dismissal, demotion, negative performance assessments, etc.
Employers must tread carefully to ensure they don't unintentionally penalise an employee who has made a Protected Disclosure as the Workplace Relations Commission ("WRC") may make a maximum award of up to five years' remuneration in a successful penalisation claim.
In the recent case of A Worker v A Massage Therapy Business (ADJ – 00043225), the WRC made an award of five years' remuneration to an employee who claimed, among other things, that she has been dismissed for raising a Protected Disclosure. The facts of this case are extreme and stark and, although the maximum compensation level was awarded, it is likely that such a level will only be reserved for the most grievous of circumstances (as was the case here).
The maximum amount of compensation that the WRC may award to a Worker who is not in receipt of remuneration (for example, in the case of a volunteer or job applicant) is €15,000.
In addition, under the 2022 Act, a Worker can also apply for interim relief from the Circuit Court in respect of not just dismissals but for any act or omission that falls within the definition of penalisation. This significantly broadens the scope of the threat of immediate litigation.
Key change: Criminal liability
The 2022 Act introduces a number of new offences, many of which attract very significant criminal sanctions including fines of up to €250,000 and / or two years' imprisonment.
In addition, personal liability also arises. If an offence is proven to have been committed with the consent, connivance or is related to neglect on behalf of an officer of the company, that officer may be held personally liable. This is a notable departure for employment legislation which does not typically provide for personal liability (although it is certainly a robust feature of health and safety law) and illustrates the legislature's commitment to ensuring that employers take their obligations seriously so that Workers can raise Protected Disclosures in the knowledge that they will be protected and that their concerns will be sufficiently and appropriately addressed.