Download the PDF here:

5G-is-an-indictable-crime-updated

 

Protection for whistleblowers in the UK is provided under the Public Interest Disclosure Act 1998 (PIDA), which amends the Employment Rights Act 1996. The PIDA protects employees and workers who blow the whistle about wrongdoing. Employees who make “protected disclosures” under the PIDA can claim unfair dismissal if their contracts are terminated due to the disclosures. Additionally, they are protected from other detriment that may result, such as a refusal to offer promotion, facilities or training opportunities. Workers who are not employees (for example, independent contractors and workers supplied through an agency) cannot make an unfair dismissal claim, but can claim that they have experienced detrimental treatment.

Only certain kinds of disclosure qualify for protection under the PIDA. These are known as “qualifying disclosures” and must relate to one of the following “relevant failures”:

• A criminal offence.
• A breach of a legal obligation.
• A miscarriage of justice.
• A danger to any individual’s health or safety.
• Damage to the environment.
• Deliberate covering up of information relating to any of the above.

The relevant failure can involve conduct that took place outside the UK. In addition, it does not matter if non-UK law applies to the relevant failure.

Whistleblowers must have a reasonable belief that the information disclosed points to one or more of the relevant failures (see above), which can relate to past, present or likely future occurrences. The belief need not be correct provided that it is honestly held in the circumstances prevailing at the time of the disclosure.

Certain types of disclosure are excluded from protection. These include disclosures prohibited under the Official Secrets Act 1989 and those subject to legal professional privilege.

Disclosures are only protected if they are made to an appropriate party. The PIDA protects whistleblowers who make disclosures in good faith to:

• Their employer, either directly or through an internal company procedure.
• Another person whom they reasonably believe to be solely or mainly responsible for the relevant failure.

Those persons who make disclosures to a “prescribed person” (that is, a party outside the company prescribed by the Secretary of State, such as a regulatory body) must satisfy more conditions to obtain protection. In turn, whistleblowers who make disclosures to external persons or bodies not specified in the PIDA must fulfil a larger number of conditions before qualifying for protection.

Individuals who have been dismissed or believe that they have suffered detriment can bring a claim before any employment tribunal. There is usually a three-month limitation period for unfair dismissal claims, but this can be extended if the claims are made after following the statutory grievance procedures under the Employment Act 2002, or if the tribunal exercises its discretion to extend the time limit. The employment tribunal assesses whether it was reasonable to make a disclosure by considering:

• The identity of the party to whom the disclosure was made.
• The seriousness of the relevant failure.
• Whether the relevant failure is continuing or is likely to occur again.
• Whether the disclosure breaches a duty of confidentiality that the employer owes to any other party.
• If the disclosure was first made to the employer or to any other appropriate person, what action the employer took or might reasonably have taken.
• If the disclosure was first made to the employer, whether the individual complied with the employer’s internal procedures for disclosure.

An employment tribunal can order re-instatement, re-employment or compensation for a justified complaint of unfair dismissal, or compensation for a well-founded claim of detriment. In the case of unfair dismissal for a disclosure protected under the PIDA, the damages awarded are not subject to the statutory cap that applies in standard unfair dismissal claims. For example, in July 2005, a prison officer was awarded record damages of GB£477,600 (about US$872,203) for unfair constructive dismissal as a result of making a disclosure about abuse and bullying in the prison (Lingard v HM Prison Service 1802862104, 30 June 2005).

Data protection issues

The PIDA does not specify any mechanism for an employer to handle complaints. However, data protection regulations impose duties on employers who may receive complaints containing personal data. While the UK Information Commissioner has not produced formal guidelines for processing personal data in connection with whistleblowing complaints, any such data processing must comply with certain key principles. As a result, the information gathered must be:

• Proportionate to the purpose for which it is obtained.
• Retained no longer than is objectively necessary or required by legislation.

Individuals who are the subject of a complaint have the right to access data collected about them, and a corresponding right to collect or delete inaccurate information. In addition, data transfer to a non-EEA jurisdiction that is considered to provide inadequate data protection is largely prohibited (Directive 95/46/EC on data protection (Data Protection Directive)). To be acceptable, data must be transmitted in accordance with certain limited EU procedures for cross-border transfers of information.

The Article 29 Working Party (the European data protection advisory body) has issued an Opinion that sets out detailed guidelines on whistleblowing procedures (Opinion 1/2006). While not yet directly applicable in each member state, the Opinion stipulates that for a whistleblowing system to be compatible with data protection provisions, it must be:

• Set up for a legitimate purpose, such as to comply with a legal obligation or to protect an important interest.
• Consistent with the principles of proportionality and ensuring the collection of accurate data.
• Disclosed to potential subjects and users.
• Protective of incriminated persons’ rights.
• Processed securely.
• Managed consistently with the data protection principles.
• Compliant with the requirements under the Data Protection Directive relating to cross-border transfers of information.
• Compliant with any notification duties to the data protection authority.

The Information Commissioner has not yet formally responded to the Opinion or, in particular, to its recommendation that companies should not advertise that anonymous reports can be made through a whistleblowing procedure.

See also PLC Cross-border IP&IT Handbook 2006/07 Volume 2: Data Protection UK (England and Wales) at www.practicallaw.com/dataprotectionhandbook.

Whistleblowing policies

The PIDA does not require an employer to set up a special procedure for handling whistleblowing complaints. Individuals can use any existing procedures that the employer has in place. While a company may have a grievance procedure (such as one complying with the statutory requirement for a three-stage process), individuals do not have to make their disclosure using this method. However, it is advisable for an employer to notify employees about how it will process personal data received in connection with whistleblowing complaints to comply with data protection legislation. This approach is also consistent with the Article 29 Working Party’s Opinion, which recommends that a data controller should provide clear and complete information regarding the whistleblowing procedure, including the:

• Existence, purpose and functioning of the procedure.
• Recipients of reports.
• Accused party’s right to access data, and rectify or erase any that is inaccurate.
• Fact that the whistleblower’s identity will be kept confidential.
• Fact that abuse of the system may result in disciplinary action against the abuser.
• Protection against adverse action for those who use the system in good faith.

Implementation process

The PIDA protects employers, regardless of whether the protected disclosures are made under the employer’s standard grievance procedure. An employer should establish a clear method for making whistleblowing complaints outside the grievance procedure. It will then be easier for the employer to show that employees who did not first raise claims using this method were acting unreasonably. However, there is no specified method for implementing a whistleblowing policy under the PIDA (see above, Whistleblowing policies). If employers have an employee representative body (whether created before or after the Information and Consultation of Employees Regulations 2004 came into force), they must determine whether consultation with that body regarding the whistleblowing procedure is required.