Wide-ranging changes to Irish whistleblowing legislation

In 2014, the Protected Disclosures Act 2014 (the 2014 Act) was introduced to protect workers from dismissal or penalisation for making a protected disclosure in the workplace. In 2019, Directive (EU) 2019/1937 of 23 October 2019 was published, on the protection of persons who report breaches of EU law.

Member states had until 17 December 2021 to transpose this Directive into law. Although the protections afforded by the Directive were already largely incorporated into Irish law, some further changes were required in order for the 2014 Act to fully align with the Directive. The Protected Disclosures (Amendment) Act (the 2022 Act), which was recently signed into law, provides for these changes. It should be noted that the order commencing the 2022 Act hasn’t yet been introduced, but it is expected once the Dáil resumes on 14 September 2022.

This article addresses some key questions in relation to the changes made by the 2022 Act.

What categories of workers are protected by the legislation?

The 2014 Act provided protection to employees, consultants, contractors, agency workers and individuals on work experience. The 2022 Act extends this protection to shareholders, volunteers, members of the administrative, management or supervisory body of an undertaking (eg., non-executive directors) and applicants for employment.

What is a protected disclosure?

A protected disclosure is a disclosure of information, which, in the reasonable belief of the worker making the disclosure, tends to show a relevant wrongdoing, and which came to the attention of the worker in a work-related context.

The 2014 Act listed the following matters as relevant wrongdoings:

• an offence has been, is being or is likely to be committed;

• a person has failed, is failing or is likely to fail to comply with any legal obligation, other than one arising under the worker's contract of employment or contract for services;

• a miscarriage of justice has occurred, is occurring or is likely to occur;

• the health or safety of any individual has been, is being or is likely to be endangered;

• the environment has been, is being or is likely to be damaged;

• an unlawful or otherwise improper use of funds or resources of a public body, or of other public money, has occurred, is occurring or is likely to occur;

• an act or omission by or on behalf of a public body is oppressive, discriminatory or grossly negligent or constitutes gross mismanagement; or

• information tending to show any matter falling within any of the preceding paragraphs has been, is being or is likely to be concealed or destroyed.

The 2022 Act adds a breach of EU law that has occurred, is occurring or is likely to occur to the above list. Such a breach includes an act or omission that is unlawful and falls within the scope of the EU laws set out in the Directive and which concern areas including (but not limited to) public procurement, financial services, prevention of money laundering and terrorist financing, product safety and compliance, consumer protection and protection of privacy and personal data. It also includes acts or omissions affecting the financial interests of the EU laws the internal market.

In addition, the 2022 Act adds to the definition of relevant wrongdoing the situation where an attempt has been, is being or is likely to be made to conceal or destroy information tending to show any matter falling within any of the above categories.

Could a grievance brought by an employee in relation to their own individual circumstances amount to a protected disclosure?

Yes, there is no requirement that there be a public interest element to the disclosure, and the recent Supreme Court decision in Baranya v Rosaderra Irish Meats Group Limited widened the door for employee grievances to be considered protected disclosures in certain circumstances (the case held that complaints about the employee’s own health or safety could fall within the remit of a protected disclosure).

However, the 2022 Act excludes interpersonal grievances (grievances about interpersonal conflicts and complaints to, or about, an employee’s employer which concern the worker exclusively) from the scope of the Act. As such, employers can take comfort that individual complaints of bullying or harassment between two workers would likely not amount to a protected disclosure. However, we would advise that legal advice be sought on this before making a firm decision because, due to the fact that there is no public interest requirement, there may be other individual grievances that would not come within this exclusion (eg., complaints about an individual worker’s health and safety, or in relation to an individual worker working excessive hours in breach of working time legislation).

Can a worker make a protected disclosure anonymously?

Yes, a worker can report wrongdoing anonymously. Helpfully, the 2022 Act provides that generally an employer will not be obliged to accept and follow-up on anonymous reports (in certain sectors, however, there may be legislation which requires employers to act on anonymous reports). Where a worker’s identity subsequently becomes known the protection against penalisation will extend to them.

Subject to some limited exceptions, a worker’s identity must not be disclosed without their consent except to those persons who the person that has received the protected disclosure reasonably considers necessary for the purposes of receiving, or following up on, the protected disclosure. If that is necessary, they must be informed in writing that their identity will be disclosed (together with the reasons for the disclosure) except in certain limited circumstances, such as where this notification would jeopardise the effective investigation of the relevant wrongdoing.

Are employers required to have a whistleblowing procedure in place?

Yes, the 2022 Act requires private sector employers with more than 50 employees to establish, maintain and operate internal reporting channels and procedures for the making of protected disclosures and in order to follow-up on such complaints. These can be operated internally by a designated person or department or can be provided externally by a third party on behalf of the employer. Employers with between 50-249 employees have an exemption until 17 December 2023 to put such measures in place.

Therefore, once the 2022 Act commences, employers with over 250 employees are required to have a whistleblowing procedure in place. Certain employers such as public bodies are already required to have whistleblowing procedures in place regardless of the number of employees.

Are global or group-wide reporting channels sufficient?

The 2022 Act provides that the internal reporting channels and procedures must be accessible to workers of the entity concerned and any of its subsidiaries and affiliates (Group). Furthermore, these channels and procedures must be accessible to any of the Group’s agents and suppliers and to any persons who acquire information on a relevant wrongdoing through their work-related activities with the entity and the Group. Employers with less than 250 employees may share resources as regards the receipt of reports and any investigation to be carried out as part of the follow-up process, so long as they maintain confidentiality, diligently follow-up and provide feedback in accordance with the legislation.

This language would suggest that a global or group-wide reporting channel would be allowable, but only as long as they run alongside local internal channels. In fact, on 14 June 2021 the Committee of Experts set up by the EU Commission said that, although companies can still have global or group-wide policies, there must be a local reporting channel and procedure at the subsidiary level, of which workers can avail. As such, a global or group-wide mechanism will not of itself be sufficient to comply with the obligation to provide an internal reporting channel.

What should a whistleblowing procedure look like?

The 2022 Act sets out further detail regarding what the internal channels and procedures should include, and certain timelines for dealing with a protected disclosure, as set out below. These should be reflected in the employer’s whistleblowing procedure.

• The employer should have channels for receiving protected disclosures that are designed, established and operated in a secure manner that ensures the confidentiality of the identity of the person making the protected disclosure and any persons referred to in the protected disclosure and prevents unauthorised access.

• The internal channels and procedures should enable reports to be made in writing or orally, or both.

• The protected disclosure should be acknowledged in writing by the employer not more than 7 days after receipt.

• An impartial competent person (or persons) (the designated person) should be designated to follow-up on the protected disclosure and this person should maintain contact with the person making the disclosure, request further information where necessary and provide feedback to that individual.

• Helpfully, there is scope for an employer to carry out an initial assessment of the complaint, which does not currently exist under the 2014 Act. If, having done this, the designated person decides that there is no evidence that a relevant wrongdoing has occurred, they should close the procedure, or refer the matter to another procedure such as the grievance procedure. As soon as practicable, they should notify the person who made the disclosure in writing of this decision and the reasons for it. If the designated person decides there is evidence that a relevant wrongdoing may have occurred, they must take appropriate action to address the relevant wrongdoing, having regard to the nature and seriousness of the matter concerned.

• Feedback should be provided to the person who made the disclosure within a reasonable period, but no more than three months from the date of the acknowledgement of receipt of the protected disclosure.

• Where the person who makes the protected disclosure requests feedback, further feedback should be provided to that individual at intervals of three months until the procedure relating to the protected disclosure is closed.

What kind of conduct could be deemed to be penalisation of a whistleblower?

Workers who report a relevant wrongdoing are protected from penalisation. Penalisation is defined in the 2014 Act as any act or omission that affects a worker to their detriment, and includes:

• suspension, lay-off or dismissal;

• demotion or loss of opportunity for promotion;

• transfer of duties, change of location of place of work, reduction in wages or change in working hours;

• the imposition or administering of any discipline, reprimand or other penalty (including a financial penalty):

• unfair treatment;

• coercion, intimidation or harassment;

• discrimination disadvantage or unfair treatment;

• injury, damage or loss; and

• threat of reprisal.

The 2022 Act significantly broadens this list, to include any direct or indirect act or omission that occurs in a work-related context, is prompted by the making of a protected disclosure and causes or may cause unjustified detriment to a worker. This includes the following, in addition to the above:

• ostracism;

• withholding of promotion;

• withholding of training;

• a negative performance assessment or employment reference;

• failure to convert a temporary employment contract into a permanent one;

• failure to renew or early termination of a temporary employment contract;

• harm, including to the worker’s reputation, particularly in social media, or financial loss, including loss of business and loss of income;

• blacklisting on the basis of a sector or industry-wide informal or formal agreement, which may entail that the person will not, in the future, find employment in the sector or industry;

• early termination or cancellation of a contract for goods or services;

• cancellation of a licence or permit; and

• psychiatric or medical referrals.

By way of a reminder, where an employer is found to have penalised a worker for having raised a protected disclosure, the Workplace Relations Commission (the WRC) can award compensation of up to five years’ remuneration. However, in practice, awards do not tend to be near this level, and the largest award that we have seen is two years’ gross remuneration in a whistleblower dismissal claim. Where the investigation of the relevant wrongdoing was not the sole or main motivation for making the protected disclosure concerned, the WRC can reduce any award of compensation by up to 25%.

The 2022 Act provides for compensation of a maximum of €15,000 in the case of a worker who is not in receipt of remuneration from the employer (for example in the case of a volunteer or an applicant for employment).

Employers must be mindful that, where previously (under the 2014 Act), an employee who claimed that they were dismissed due to having made a protected disclosure could apply to the Circuit Court for an injunction to restrain the dismissal, under the 2022 Act this right now extends to any act of penalisation (including, for instance, a negative performance review). The injunction will continue until the underlying penalisation claim has been dealt with by the WRC.

Is there anything else employers should be aware of?

The burden of proof has changed. The 2022 Act provides that in any proceedings brought by an employee to the WRC where the employee is claiming penalisation for raising a protected disclosure, there is a presumption that the penalisation was as a result of the worker having made a protected disclosure. Therefore, the employer has to prove that the act or omission concerned was for some other justifiable reason (and not as a result of the protected disclosure).

In addition, the 2022 Act provides for a number of new offences on the part of employers, including where:

• it hinders a worker from making a report;

• it penalises or threatens to penalise a person who made a protected disclosure;

• it breaches the duty of confidentiality; or

• it fails to put internal reporting channels and procedures in place.

It is also an offence for a person to make a protected disclosure containing any information that the person knows to be false. Depending on the offence, the fines range from €5,000 and/or imprisonment for up to 12 months on summary conviction, up to €250,000 and/or imprisonment for a term not exceeding two years for conviction on indictment.

Key takeaways for employers

Employers should review and update their whistleblowing procedures so that they comply with the provisions of the 2022 Act. They should also ensure that any managers are live to the provisions of whistleblowing law in Ireland.

Employers with more than 250 employees, who do not have a local whistleblowing procedure in place, should take steps to put one in place, and employers who have between 50-250 employees should prepare to do likewise by December 2023. While it might not be legally required, it is recommended that employers with less than 50 employees also have a local whistleblowing procedure in place in order to ensure any whistleblowing complaints are dealt with appropriately. In addition, it will be easier to defend any claim brought by an employee to the WRC in circumstances where the employer has such a procedure in place and is able to show that it followed its procedure in investigating the worker's complaint.

Employers and managers should also be mindful that certain employee grievances could amount to a protected disclosure and that protected disclosures do not need to be made in writing and can be made verbally. Care should be taken to investigate such complaints in accordance with the appropriate procedure and to ensure that employees do not face any detriment or retaliation as a result of raising such a complaint.

The Protected Disclosures (Amendment) Act 2022 is available here.