Public Concern

• Home
• About Us
• FAQ
• Individuals
• Organisations
• Policy
  • Policy Overview
  • Policy Papers
  • Whistleblower
  • Annual Reports
• Schools
• Law
• News

Whistleblowing and Data Protection

Below is the paper we were aksed to present to the EU data protection authorities(Article 29 Working Party) in 2006. The Opinion of the Article 29 Working Party on whistleblowing and data protection can be viewed here. The PCaW approach meets the requirements of SOX and UK law and the EU working party has confirmed that it also meets their concerns - as highlighted in our newsletter.

Paper presented to Article 29 Working Party Brussels, 31 January 2006

Whistleblowing - [a] Bringing an activity to a sharp conclusion as if by the blast of a whistle ( Oxford English Dictionary ); [b] Raising a concern about wrongdoing within an organisation or through an independent structure associated with it ( UK Committee on Standards in Public Life ); [c] Giving information (usually to the authorities) about illegal or underhand practices (Chambers Dictionary); [d] Exposing to the press a wrongdoing or cover-up in a business or government office ( US, Brewers Dictionary ); [e] ( origins ) Police officer summoning public help to apprehend a criminal; referee stopping play after a foul in football.

Contents

1. WHISTLEBLOWING

1.1 Why whistleblowing matters
1.2 Silence and Society
1.3 Whistleblowing & the employer
1.4 Whistleblowing outside
1.5 Anonymous informing
1.6 Summary

2. DATA PROTECTION ISSUES

2.1 The CNIL approach
2.2 The American problem

3. TOWARDS WELCOME GUIDANCE

3.1 Seven issues to consider

4. GUIDED BY REAL CASES

5. OUR APPROACH TO WHISTLEBLOWING

1 WHISTLEBLOWING

1.1 Why whistleblowing matters
1.1.1 Whistleblowing matters to all organisations and people. This is because every business and every public body faces the risk of things going wrong. The risk may be that some food you are about to buy is contaminated, that the train your family will travel on is unsafe, that the surgeon who will operate on your child is incompetent, that a hazardous substance is being dumped in your neighbourhood, that a public official demands a bribe to do his job or that your savings are being stolen. Where such wrongdoing is taking place, usually the first people to realise what is going on will be those who work in or with the organisation. Yet while employees are the people best placed to sound the alarm or blow the whistle and so enable the risk to be removed or reduced, they are also the people who have the most to lose if their organisation does not welcome their efforts.

1.1.2 Unless organisations foster a culture that indicates that it is safe and accepted to raise a genuine concern about wrongdoing, employees will assume that they face victimisation, losing their job or damaging their career. The consequence is that they will stay silent where there is a threat – even a grave one - to the interests of others, be they consumers, passengers, patients, communities, taxpayers or shareholders. This silence means that those in charge are denied the opportunity to remove or reduce any such risk, and can only find out about it when serious damage has been caused. Equally, the knowledge that there is a culture of silence in the workplace both encourages and shields the corrupt and dishonest.

1.1.3 Whistleblowing matters because it addresses how we can counter this breakdown in communication in the workplace. That such a breakdown undermines the public interest is clear when one considers that the most successful way the police deter, detect and clear up crimes is through information communicated to them by the public. Yet in workplaces across the world, law and practice gives a strong message that employees should not communicate information about suspected wrongdoing either internally or externally.

1.1.4 The consequence of this culture is that it discourages normal, decent law abiding people from raising concerns about workplace wrongdoing that threatens the interests of others. It encourages employees to be guided exclusively by their own short-term interests and undermines any sense of mutual interest between the organisation and its workforce. While its effect is most damaging and direct in relation to workplace wrongdoing, it also influences the way employees behave when - whether travelling home or shopping at the weekend - they come across crime in their community. Conditioned to turn a blind eye in the workplace, this culture encourages them to walk away from the interests of others in their community.

1.1.5 These are the ‘big picture’ reasons why whistleblowing matters. But to understand whether or how an organisation or group can do anything to address this issue, we must first consider the position of the individual employee who realises that there is some crime or threat to the public interest.

In practical terms, if an employee is concerned about corruption or serious wrongdoing in his workplace, he has four options. These are

• To stay silent;
• To blow the whistle internally;
• To blow the whistle outside; or
• To inform anonymously.

1.2 Silence and society
1.2.1 Silence is the option of least risk for the individual employee who comes across serious wrongdoing in the workplace which threatens others, be it colleagues, consumers or the community. It is the default option for many reasons. The employee will realise that his suspicions could be mistaken or that there may be an innocent explanation for the conduct. Where colleagues are also aware of the suspect conduct but are staying silent, he will wonder why he alone should speak out. Where the wrongdoing seems clear to the employee, he will assume that those in more senior positions have also seen it and are implicated in some way and so will see little reason to pursue the matter internally. In societies where unions are scarce or their independence has been compromised, the employee will be left without any independent guidance as to who to approach and how, and so will more likely stay silent. In organisations where labour relations are adversarial and whistleblowing is unwelcome, the employee will be expected to prove that the wrongdoing is occurring, even though it clearly would be far better if those in charge assessed and, where appropriate, investigated the matter. Finally, unless the employee believes there is a good chance that something will be done to address the wrongdoing, there will be no reason why he should consider risking his own position.

1.2.2 Even if the employee is not deterred by any or all of these considerations, he will rightly need to consider his private interests and those of his family before raising the matter. Without any reassurance to the contrary, he will fear workplace reprisal – be it harassment, isolation or dismissal.

1.2.3 Without any guidance on what to do, it is inevitable that most employees stay silent. The reasons that people are now re-evaluating whistleblowing are because the costs of this silence have become too high. They mean that

• Consumers, shareholders and communities are left at risk with neither the information nor opportunity to protect their own interests;
• Unscrupulous competitors, managers or employees are given a reason to believe that ‘anything goes’;
• Those in charge are denied the chance to look into concerns about wrongdoing and to avert real problems; and
• Laws and policy focus too much on ways to improve the system, rather than on the conduct of the people who have to make it work.

1.3 Whistleblowing and the employer
1.3.1 Recognising the damaging effects of this culture, the UK Committee on Standards in Public Life recommended steps for organisations to take to reassure and enable staff to raise concerns constructively. While its recommendations were directed at public bodies, the same message applies to organisations in all sectors. One of the reasons the Committee was set up was because of the damage that was being done to public confidence by (a) incidents of wrongdoing which had not come to light in time to avert real damage (caused or facilitated by silence), and also by (b) rumours of misconduct or sleaze that were difficult to effectively refute or substantiate (often caused by anonymous leaks to the media).

“Placing staff in a position where they feel driven to approach the media to ventilate concerns is unsatisfactory both for the staff member and the organisation. We observed in our First Report that it was far better for systems to be put in place which encouraged staff to raise worries within the organisation, yet allowed recourse to the parent department where necessary. An effective internal system for the raising of concerns should include:

• A clear statement that wrongdoing is taken seriously in the organisation and an indication of the sorts of matters regarded as wrongdoing;
• Respect for the confidentiality of staff raising concerns if they wish, and an opportunity to raise concerns outside the line management structure;
• Access to independent advice;
• Penalties for making false and malicious allegations;
• An indication of the proper way in which concerns may be raised outside the organisation if necessary.” (1)

1.3.2 At the heart of this approach is the recognition that without safe and constructive means for concerns to be raised and addressed, the only options employees have are silence or the feeding of a rumour-mill that will undermine public confidence. While these options appear as alternatives, they are in fact linked because, though the organisation is kept in the dark, the silence is rarely absolute. This is because in many cases the employee will mention the concern about the wrongdoing to immediate family or close friends (who are unable to do anything but sympathise with the employee’s plight) and through them the unchecked allegation can gain its own demoralising momentum.

1.3.3 In formulating its recommendations, the Committee took account of good practice in the private sector where, in genuinely competitive markets, there has been a growing recognition that the early reporting of suspected wrongdoing was in the organisation’s self-interest and a key aspect of effective self-regulation. The reason for this is that, as every shopkeeper and small business knows, if it suffers wrongdoing or damages its consumers they will likely take their custom elsewhere.

1.3.4 In terms of shifting cultures, an analogy can be drawn with the approach taken by large corporations to feedback from consumers. Businesses in sectors that became more competitive over the past twenty years realised the need to try and build lasting relationships with their customers. Aware of survey findings that one dissatisfied customer would tell ten or more people of their unhappy experience, market leaders started to solicit feedback from customers rather than wait for complaints. They found that even if they did not satisfy the particular complaint, the mere fact they had considered it would substantially improve the customer’s attitude to the company. This was in contrast to the approach adopted by monopolistic organisations which treated consumers - once they had been parted from their money - as troublesome, if not untrustworthy, complainants.

1.3.5 The approach taken to information from the workforce has traditionally also been negative. The assumption is that employees will only raise personal grievances because they neither recognise nor identify with the well-being of the organisation. This assumption has informed a raft of laws and practices on workplace relationships and so, in turn, inevitably influenced the way employees are conditioned to behave in the workplace. This is not just misguided but self-defeating as information from the workforce is not only readily accessible and free to collect, but it enables the organisation to put a potential problem right before it causes any real damage to the organisation, its reputation or its stakeholders.

1.3.6 The self-interest of organisations in promoting whistleblowing is now being recognised and increasingly employers have begun to provide whistleblowing routes for staff. While many of these are in response to recent legislation, the most effective ones are where the organisations’ leaders realise the importance of providing an alternative to (but not a substitute for) line management. This is because without it their managers are given a monopolistic control over the information which goes to those in charge. As with any monopoly, one weak link – be it a corrupt, lazy, sick or incompetent manager – will break the communication chain and stop those in charge receiving information which could be critical to the success or failure of the organisation.

1.4 Whistleblowing outside the organisation
1.4.1 Where, however, it is not safe and accepted for people to blow the whistle internally, we need to turn to the options that exist for those employees who decide to speak up if they come across serious wrongdoing. Without a safe internal route, one key option is to disclose the matter openly outside the organisation - be it to the authorities or more widely.

1.4.2 Such outside disclosures can raise ethical and legal issues of confidentiality and secrecy. They also influence the balance of relationships between business, the state and the media. An outside disclosure will more often than not involve some regulatory intervention and, at worst, unjustified adverse publicity. At the very least this will cause inconvenience and disruption to an organisation that could have dealt with the matter properly had it been told of the concern directly. In cases where the employer would have addressed the matter responsibly the value of an external disclosure is questionable as regulators and the media, when they receive such information, will mostly put the facts straight back to those in charge of the organisation. So a workplace where – in the absence of safe alternatives – outside disclosures are seen and used as the legitimate first port of call is an illustration of poor management and weak leadership.

1.4.3 Obviously not all employers are responsible and in such cases outside disclosures are the only effective way of averting a problem before real damage is done. But understood and used properly, the right approach to whistleblowing allows regulators to distinguish those organisations that can rightly be given the chance to address such problems themselves from those that cannot.

1.4.4 Until recently, in most legal systems there has been no protection for an employee who makes an outside disclosure – even if it is in good faith, justified and reasonable. Accordingly, such disclosures have often been made anonymously, raising the difficult issues we address below. Where the ability of the authorities or the media to do their job depends so much on the information that they receive, there is every reason why law and culture should explain and provide for circumstances where such open disclosures are permitted and protected.

1.4.5 Where a whistleblowing culture exists, protecting outside disclosures is something that should cause little or no fear to any well run organisation as it will see how such a provision works to its advantage. First, without there being an external body to which staff may safely and openly go, some of its employees will lack the confidence to believe that any internal scheme is a genuine attempt to hear and address such concerns. Secondly, recognition that there is an outside body (be it a regulator, parliament, shareholders or the wider public) makes real the principle of accountability – in the sense that people can be expected to give an explanation of their conduct. This has a key benefit throughout the organisation as it engenders a sense of self-discipline across the workforce that deters wrongdoing without giving managers an excuse to duck difficult decisions. Finally the clear acceptance that there is such an external route is a powerful reason for the organisation’s management to promote and deliver its own internal scheme and to ensure that it addresses any concerns properly.

1.5 Anonymous informing
1.5.1 Without safe routes for whistleblowing concerns to be raised openly and addressed properly, anonymous disclosures are the likely alternative to silence. Here it is important to distinguish anonymous from confidential disclosures. An anonymous disclosure is one sent in a brown envelope or a message left on an answer machine, with little or no possibility of identifying the person and so contacting him or verifying the information. By contrast, a confidential disclosure is where the recipient knows the identity of the person but agrees not to disclose it when he uses the information.

1.5.2 As to the message, anonymity raises real problems as it makes the concern more difficult to investigate and the facts more difficult to corroborate, and it excludes the possibility of clarifying any ambiguous information or asking for more.

1.5.3 As to the messenger, an anonymous disclosure focuses more attention on and speculation about his identity than open whistleblowing. The result is that anonymity is no guarantee that the source of the information will not be deduced. Where the allegations are serious, those implicated will try all the harder to identify the source and, in the context of disclosures from the workplace, they succeed far more often than not. When they do, the fact that the employee acted anonymously is often claimed as a sign of bad faith or dishonesty, and used to undermine suggestions he was acting in the public interest.

1.5.4 As anonymity makes it harder to address the message and can also harm the messenger, it can have little to commend it from either point of view. Looked at in a wider sense, anonymity also has little virtue. For example, whether anonymous disclosures are made internally or externally, they are tainted by the fact that anonymity will always be the cloak preferred by a malicious person. Also, where the anonymous information is solicited and received by a fascist or tyrannical state, it gives the state an excessive amount of unaccountable and unlimited power over what to do with it. As it is anonymous, it is entirely in the discretion of the agents of the state whether to use, ignore or conceal the information. This is because its decision is not open to question by the anonymous informant and nobody else knows it exists. For these reasons anonymity fuels mistrust and makes the powerful unaccountable and this explains why it is a common feature among dictatorships.

1.6 Summary
1.6.1 As this shows, the word is now used to describe the options available to an employee to raise concerns about workplace wrongdoing. It refers to the disclosure of wrongdoing that threatens others, rather than a complaint about one’s own treatment. Whistleblowing covers the spectrum of that communication, from raising the concern with managers, with those in charge of the organisation, with regulators or with the public (be it through the media or otherwise). And the purpose of whistleblowing is not the pursuit of some private vendetta but that the risk can be assessed and, where appropriate, reduced or removed.

1.6.2 As whistleblowers should be encouraged to stand up and to be counted, they should raise concerns openly. As such, they are quite different from the anonymous informer that dictatorships nurture and they are different from the sources that journalists can also depend on to inform their stories.

2 DATA PROTECTION ISSUES

2.1 The CNIL approach
2.1.1 In this section we comment on some of the data protection issues that may arise in connection with whistleblowing. These focus, understandably, on the position of someone who may be implicated by the information the whistleblower discloses. In looking at these issues, we focus on the recent CNIL guidance. First, we wish to make it clear that Public Concern at Work does support the CNIL’s general approach that

• It is not desirable that employees should be mandated by their employer to blow the whistle;
• Whistleblowing arrangements should focus on concern about illegality or wrongdoing that threatens an innocent third party or the wider public interest;
• Anonymous reports - and so schemes or hotlines that actively encourage such reports – raise particular data protection problems which justify separate rules from those that apply to whistleblowing alerts which are made openly or confidentially; and
• Whistleblowing should be viewed as subsidiary to, and not a replacement for, internal management.

2.1.2 However, we remain unclear about when and how the guidelines will apply and about several points of detail. This may be the result of the translation we have seen, the speed with which the CNIL felt obliged to issue its guidelines or some uncertainty inherent in the policy.

2.1.3 As the previous section explains, our starting point is that all good employers will want their employees to tell them of actual or potential dangers in the workplace that threaten stakeholders and the public. Recognising that some employees will be reluctant to raise such a concern with their manager, or that the management line may lose or block the concern, reasonable employers provide a fail-safe option to discourage employees from doing nothing. Rather than undermine management accountability, such a fail-safe option strengthens it.

2.1.4 The fail-safe communication line that is whistleblowing will exist in most well-run organisations but often go under some other name or, where it is seen as an inherent part of the organisational culture, under no name.

2.1.5 By contrast, as the cases in section 4 show, any criminal, dangerous or reckless employer will exploit an underlying culture of silence to damage consumers and competitors and to undermine the ability of the state to protect its citizens and safeguard the public interest. For this reason it is important for people to understand that whistleblowing also addresses the relationships between the employer, the state and the wider public interest.

2.1.6 The main benefit of whistleblowing arrangements is that they deter those tempted by the opportunity to engage in serious wrongdoing. Where whistleblowing arrangements or laws protect those who raise concerns about wrongdoing in good faith, they operate so that open reporting is the default with confidential reporting (2) as the fall-back position.

2.1.6 Such whistleblowing arrangements provide an effective alternative to anonymous reports and provide a proportionate and effective protection for someone falsely and maliciously accused. For these reasons, developed countries where the rule of law operates should treat whistleblowing arrangements differently and separately from schemes that encourage or require anonymous reporting (3).

2.1.7 For these reasons we think it is important that any guidance in this area does not confuse whistleblowing with anonymous reporting. Equally it is important it does not see whistleblowing merely as a potential battleground between employee and employee, or between employee and employer. Rather, any guidance should be clear that whistleblowing demonstrates and reflects the relationships between citizens, employers, the community, the state and the public interest.

2.2 The American problem
2.2.1 We believe that the relationship between whistleblowing and data protection can be confused if the distinction between anonymous reporting and whistleblowing is not clearly understood. This risk has been exacerbated by the problem with the US SOX legislation.

2.2.2 Without a legitimate and safe procedure for staff to raise concerns of wrongdoing or risks to the public, the only options that an organisation leaves its staff, where line management is not a viable route, are (a) silence or (b) an anonymous report. Understood and implemented correctly a whistleblowing policy will - and in our experience over the last decade does - actually discourage anonymous reporting. This is because such a whistleblowing procedure offers an alternative to anonymous reports in practice by providing reassurance and protection to the concerned employee - things which can only be invoked by an identified person. We do not see how such a procedure can be objected to on data protection grounds

2.2.3 This point was picked up by the Committee on Standards in Public Life in its last report (see www.pcaw.co.uk/policy/balanceright.htm) when it emphasised that organisations and people must understand the difference between open, confidential and anonymous reporting. The relevance of this to the data protection point is that if the concern is raised openly or confidentially (where the recipient knows the person’s name and identity but agrees not to disclose it without their consent or court order), the whistleblower can be held to account for his actions. In this way such a scheme is not an invitation to or an opportunity for a malicious employee to falsely denounce a colleague or someone else.

2.2.4 This confusion is, however, complicated by the inherent problem in the US legislative provision in SOX. Section 301(4) says that the Audit Committee shall establish procedures for “the confidential, anonymous submission by employees of the issuer of concerns regarding questionable accounting or auditing matters”. It is not possible for an employee to make “a confidential, anonymous submission” as – if they are not synonyms - they are mutually exclusive. There are other practical problems. First, even if the identity of the source of the information is unknown to all (i.e. he is truly an anonymous informant), his identity can still be deduced from other facts. For this reason a guarantee can only be offered where the identity of the person is known and the guarantee can be no more than that the identity will not be revealed without the source’s consent. This was the position of Watergate’s Deep Throat and he was a confidential rather than an anonymous source as the journalists knew who he was. (Also it is now clear that he source’s identity had been deduced by at least one Department of Justice lawyer more than a decade before it was publicly revealed that he was the deputy head of the FBI). Secondly, it should be recalled that Enron had a ‘best-in-class’ anonymous reporting system and it clearly did nobody any good as it was only when Sherron Watkins identified herself that the principles of accountability came into play. Thirdly, under the US Constitution it would not be lawful to take criminal action against someone based on anonymous evidence and this will override SOX.

2.2.5 This particular provision in SOX was passed at the last minute and without any debate. We suspect the legislative language may have been intended to reflect the popular, journalistic use of the words anonymous and confidential as synonymous. However in the wake of SOX, there has been a growing and unwelcome emphasis on the anonymous aspect of the provision in recent years. We believe this has been driven by the fact that there are a number of technological solutions and systems aimed at large organisations which, for reasons of convenience and commercial advantage to the provider of those solutions, have emphasised anonymous reporting. It was two of these systems that caused the CNIL concern in its decisions of May 2005.

2.2.6 We believe the CNIL correctly recognised that systems which

• mandate employee reports,
• are promoted as an alternative to, rather than a fail-safe for, the management line,
• emphasise and encourage anonymity, and
• invite reports on all matters and not only concerns about illegality and danger,

are likely to result in an increase in false reports made maliciously.

2.2.7 Due to the emphasis on anonymity in such schemes, the rights and interests of such a person who has been implicated (whether rightly or wrongly) may be left exposed and unprotected. By contrast, where a concern is raised openly or confidentially, the whistleblower can be held to account for his actions.

3. TOWARD SOME WELCOME GUIDANCE

3.1.1 We think it would be clearer and simpler if any initiative the Working Party takes focuses on the problem of anonymous reporting and the data protection issues it raises. Otherwise, there is a risk that any guidance or rules will have a much wider scope and impact on the normal management and running of all organisations than the Working Party might intend. This is for the simple reason that many of the data protection issues that arise will be the same whether the whistleblowing alert is sounded to the management line, through ‘open reporting methods’, senior officers, regulators, the media or through some other system. If this risk is not addressed, we fear any guidance may risk undermining public support for data protection.

3.1.2 From our point of view, the data rights of an individual should be the same whether a whistleblowing system has been formally introduced or not. As we have explained we think the only real data protection problems arise in the context of anonymous reports (4), and this is the case whether the report is received by the line manager in an unsigned letter, or through other reporting methods or to senior officers, or outside to regulators or the media. We recognise that there is an additional risk where an employer contracts with an external body to solicit from its workforce anonymous concerns.

3.2 Seven issues to consider
3.2.1 If the Working Party is to consider guidance on the data protection obligations that arise on both whistleblowing and anonymous reporting schemes, we believe that consideration should be given to the following issues.

1) Should the guidance apply only where the employer uses an external system to collect and process data for and on its behalf?

2) If not, how far should the same rules apply where the whistle is blown
a) openly to or through the normal chain of command;
b) openly to senior officers or the Board, outside the normal chain of command but under an internal scheme expressly introduced or authorised by the employer;
c) openly to senior officers or the Board, outside the normal chain of command but not under an internal scheme expressly introduced or authorised by the employer;
d) in confidence to or through the normal chain of command;
e) in confidence to senior officers or the Board, outside the normal chain of command but under a scheme expressly introduced or authorised by the employer, or
f) in confidence to senior officers or the Board, outside the normal chain of command but not under a scheme expressly introduced or authorised by the employer?

3) Should the guidance apply, and if so how, where
a) the alert is raised with or through a union,
b) advice is sought from a union
c) the alert is raised with or through a professional association or lawyer,
d) advice is sought from a professional association or lawyer,
e) the alert is raised with a statutory agency, the police, or
f) the alert is raised with the media?

4) Should such general guidance apply to whistleblowing arrangements
a) in all areas,
b) only in areas where such arrangements are required or authorised by law, or
c) only in areas where such arrangements are not required or authorised by law?

5) As an example, how would the guidelines apply where the whistleblowing alert is about a discrepancy or problem in the accounts but the alert does not identify or implicate any individual? Should they require the employer to contact every person who may possibly be implicated in an investigation, in case the discrepancy or problem proves valid and it may turn out that they may have been at fault? From the point of view of the data rights of any individual who may be implicated, should their rights be given the same protection if the problem with the accounts was discovered by the company’s auditors?

6) Where a whistleblowing alert is raised with an employer, should its initial obligation be
(a) to assess whether, if accurate, the facts justify an investigation, or
(b) to verify the facts by (as in CNIL paragraph 10) safeguarding the evidence and the without delay notifying any incriminated person?

7) The CNIL guidelines emphasise (paragraph 11) that the whistleblower’s identity should be processed confidentially and should not be disclosed to any incriminated person. We suspect this goes too far and such a rule should not apply where
a) The whistleblower has reported the alert openly,
b) The employer is satisfied the report was made both falsely and maliciously, or
c) A court has ordered that his identity be disclosed.

4 GUIDED BY REAL CASES

In this section we set out some whistleblowing cases from our files. We believe that any guidance will be of greater practical use if the Working Party considers whether and how it would apply in these sort of cases and so we hope this is of assistance.

4.1 Case study 1
Mark worked for a large construction company. He had become more and more suspicious over the behaviour of his line manager, Eric. Due to structural changes, an increasing amount of work was being contracted out, particularly to XYZ. Mark noticed that the quality of work carried out by XYZ was markedly substandard and mentioned this to Eric. Eric’s response was surprising: he owned XYZ and most of its employees were family members. Although the need to subcontract work had been approved in general by the construction company, it knew nothing of this arrangement.

Mark then discovered that technical equipment was being sold by Eric to XYZ at a significant undervalue, and that Eric had begun altering computer records for the equipment. Small technical items were also going missing with increased frequency and Eric would order these to be replaced immediately. The relationship between Mark and Eric became strained. Mark felt trapped. Eric was a popular and respected senior manager who had worked in the industry for many years.

We advised Mark to prepare a detailed statement of his concerns in chronological order. At his request, we wrote to the Managing Director of Mark’s company and to the Group Personnel Director of the parent company, enclosing a copy of Mark’s statement. We asked that the company keep in mind Mark’s personal position in coming forward with the information and to treat his identity as confidential.

Mark was asked to stay at home for a week while his concern was investigated. One week later, we received a letter from the parent company thanking us for our assistance. The result of their investigations was that Eric resigned from the company and Mark was able to continue in his position. Four months later, Mark wrote to us: “I have been treated very well by the company. The matter has been handled very firmly but very discreetly. I would like to thank you for your help and support through this matter. I cannot imagine having blown the whistle without your support”.

4.2 Case study 2
Adrian worked at a local site of a major waste disposal firm. He was concerned that his colleagues were involved in a big scam defrauding a local paper mill. Adrian suspected that some employees of the mill were being paid to steal top grade paper, which was then concealed amongst waste paper in skips that were collected daily by a waste paper company. When the company delivered the waste to Adrian’s firm, the paper was also sold on for cash, at a fraction of the market cost.

Adrian was reluctant to identify himself initially and was concerned that the perpetrators were influential in his firm and had good contacts with the local police. He described the atmosphere at the site as intimidatory, and the managers as bullying and abusive. He feared that if he spoke out, not only would he lose his job, but his life would be made intolerable. From the information that Adrian gave us, we were satisfied that the matter should be looked into by someone. With Adrian’s agreement we contacted the victim of the fraud, the local paper mill. Although the company initially suspected we were a security company seeking new business, they soon realised that their procedures left them open to such a fraud.

Within a couple of weeks the company caught two of its staff engaged in the scam red-handed. However, they were unable to identify the size of fraud or how long it had gone on. Having obtained assurances on his behalf, we put the company’s investigators in touch with Adrian. He was able to show them how the fraud had been concealed in the paperwork.

With this information the company realised that the fraud had cost it some £3 million. The police were called in and arrests were made. The boss of the waste paper company was convicted and sentenced to three years, and others involved were jailed for several months. Adrian’s foreman was sacked, the charge hand resigned and the manager of the site took early retirement. The local paper mill recovered almost £1 million from its insurers toward the loss and so averted plans to close down with the loss of over one hundred jobs. The atmosphere at Adrian’s firm has improved no end.

4.3 Case study 3
Ian worked as a safety inspector at an amusement park. He was responsible for maintaining one of the park’s most popular rides. Every morning he would carry out a safety inspection on the ride and, if it passed, he would sign off the ride as safe in the log. During one inspection, he noticed that pins on the axles which kept the carriages stable had become loose. Ian thought this presented a serious risk and notified his managers. After what Ian felt was a cursory examination, the operation’s manager cleared the ride as safe. Ian was unhappy with this and the next day, as no corrective action had been taken, he again failed the ride. Again the operations manager overruled Ian and he was assigned to other rides.

Ian contacted us the same day. He was anxious that the weekend was coming up and that the park would be extremely busy. He was also worried that if he pursued the issue any further he would be dismissed. We advised Ian that we could contact the Health & Safety Executive (HSE) on his behalf and relay the information that he had given us without giving his name. However, it was more than likely that they would want to speak to him, if they felt that the situation was potentially serious. We said we would explain Ian’s anxieties about his position and ask the HSE to bear this in mind. While he was unsure whether he would speak to the HSE, he asked us to make the initial contact.

The HSE agreed that the situation sounded potentially serious. However, they told us that they would need to speak to Ian. We explained Ian’s fears that if the HSE suddenly turned up to inspect this particular ride, his employers would easily put two and two together and he would be out of a job. The HSE assured us that if they were to carry out an inspection, it could be done in such a way as not to make Ian’s role apparent. We went back to Ian and, after talking things through, he agreed that he would speak to the HSE.

Shortly afterwards the HSE made a ‘routine’ visit to the park during which they inspected the ride, along with several other rides. As a result of the inspection, the ride was suspended and the repairs were carried out.

4.4 Case study 4
Judith Jones is the deputy matron at Denison House, a small private nursing home in Selby, Yorkshire which looks after elderly and disabled people. One day a care assistant told Judith that Mr Tiplady, who ran the home with his wife, was behaving oddly in one of the rooms. When Judith went to investigate, Mr Tiplady was not there but Judith found what looked like semen on a lady’s cardigan and in her hair. She immediately tended to the resident, washing her and her cardigan.

A few weeks later, Judith heard about Public Concern at Work and contacted us. As Mr Tiplady ran the home with his wife, she didn’t feel confident that she could safely raise the matter internally. Equally, if she went to the Health Authority inspectors or to the police, there was a risk: because she had removed the evidence, it would simply be a matter of her word against Mr Tiplady’s. As he had a long career in the caring sector - for which he had received a Gold Award from the Archbishop of York - Judith’s word alone might not have been enough.

We advised her to keep a vigilant eye on Mr Tiplady and to try to ensure that he was not left alone with the female residents. If another incident occurred, we advised her to contact us immediately and take care to keep any supporting evidence. We checked with the Social Services Inspectorate who confirmed our advice was sensible.

Several months later Judith rang. The previous night she had entered a room where there were two blind ladies and one with senile dementia; Mr Tiplady seemed to have his groin in the face of the lady with dementia. Judith thought he might be forcing oral sex on her. She left the room and got a colleague. Once Mr Tiplady had gone, they returned and, with a clean swab, took a specimen from the lady’s mouth.

Once she was home, she contacted us. Neither the Social Services Inspectorate nor the police could offer practical help, even though all we wanted was a forensic test of the swab. The police could not arrange one unless there was a formal complaint; if there were, then even if the specimen proved negative, they would have to question Mr Tiplady. We pointed out that this put Judith Jones in a catch-22. We decided to pay the costs of the test. The Forensic Laboratory collected the swab from Judith’s home and within 24 hours the sample had been found to contain semen.

We immediately forwarded the evidence to Selby CID who interviewed Judith Jones and arrested Mr Tiplady the next day. He initially denied the allegation but, when confronted with the forensic evidence, changed his stance. Tiplady pleaded guilty to three charges of indecent assault over a nine year period and was jailed for four years in February 1997.

The home now has new owners, Judith’s job is secure and the residents are well cared for. As one of the residents’ relatives said “If it hadn’t been for her, it could still be going on and no-one would ever have known. Judy Jones deserves a medal.”

4.5 Case study 5
Kate was recruited by a major training company to secure new contracts for courses funded by Training and Enterprise Councils (TECs). The courses, paid for by public funds, led to vocational qualifications to help the unemployed get back into the job market.

On a routine site visit, Kate discovered that certificates had been issued at one centre for fictitious trainees and for students who had not completed the courses. She alerted her management who commenced an investigation, which revealed large numbers of falsely claimed certificates. The company dismissed the manager of that centre. Despite this action, Kate was surprised that she herself was then moved to other duties. Some weeks later, she was telephoned at home by the local TEC and asked whether anything was wrong at that centre. Kate said that there were problems but that they were being sorted out. The following day she received a letter by courier summarily dismissing her for breaching confidentiality in mentioning to the TEC that there had been problems.

Kate contacted us to discuss the options. Fearing a cover-up she decided to give a journalist copies of company documents confirming the scale and nature of the fraud and the reason for her dismissal. However, when the story appeared the proven fraud was referred to simply as Kate’s allegations. Worse, the story falsely said that Kate had been dismissed because the TEC had lost trust in her. After we threatened the paper with legal action, the story was corrected - but days later. Media interest continued as more trainees came forward to corroborate the scam and as politicians demanded an investigation. The company then issued a press release, implying that Kate had been involved in the fraud.

The TEC sued the company to recover the public money paid on the false certificates. A Fraud Squad investigation led to a number of arrests before the investigation was taken over by the Serious Fraud Office. We arranged for expert libel solicitors to help and Kate brought proceedings against her former employer for the damage done to her reputation. Kate has now received a fulsome apology from her former employers, an undertaking they will not repeat the slur, damages of £25,000 and legal costs.

5 OUR APPROACH TO WHISTLEBLOWING

Below we summarise the approach of this independent charity to whistleblowing, as it is set out in the UK’s 1998 Public Interest Disclosure Act (PIDA). This legislative approach, which has since been adopted in both Japan and South Africa , was developed from legal decisions on the public interest. There has also been keen interest in this approach from business, unions, regulators and citizen groups across Europe .

Unlike the US legislation which variously emphasise anonymous disclosures and reporting direct to the authorities, the UK favoured open whistleblowing and a tiered disclosure regime. This is illustrated in the chart below which shows when various disclosures are protected.

		X	Particular disclosure reasonable
		X	Valid cause to go wider
	X	X	Substance to concern
X	X	X	Reasonable suspicion & in good faith
Internal whistleblowing	Regulatory disclosure	Public disclosure

AN OVERVIEW OF THE UK LEGISLATION

Wrongdoing
The Act applies to people at work raising genuine concerns about crimes, civil offences (including negligence, breach of contract, breach of administrative law), miscarriages of justice, dangers to health and safety or the environment and the cover up of any of these. It applies whether or not the information is confidential and whether the malpractice is occurring in the UK or overseas.

Individuals covered
In addition to employees, it covers workers, contractors, trainees, agency staff, police officers, home workers, and every professional in the NHS. The usual employment law restrictions on minimum qualifying period and age do not apply to this Act. It does not cover the genuinely self-employed (other than in the NHS), volunteers, the intelligence services or the army.

Internal disclosures
A disclosure made in good faith – essentially honestly - to the employer (be it a manager or director) will be protected if the whistleblower has a reasonable suspicion that the wrongdoing has occurred, is occurring or is likely to occur. Where a third party or person is responsible for the wrongdoing, this same test applies to disclosures made to him. The same test also applies where someone in a public body subject to ministerial appointment (e.g. the NHS and many ‘quangos’) blows the whistle direct to the sponsoring Department.

Regulatory disclosures
The Act makes special provision for disclosures to prescribed persons. These are regulators such as the Health and Safety Executive, the Inland Revenue, the Data Protection Authority and the Financial Services Authority. Such disclosures are protected where the whistleblower meets the tests for internal disclosures and, additionally, reasonably believes that the information and any allegation in it are substantially true.

Public disclosures
Wider disclosures (e.g. to the police, the media, MPs, consumers and non-prescribed regulators) are protected if, in addition to the tests for regulatory disclosures, they are reasonable in all the circumstances and they are not made for personal gain.

A wider disclosure must, however, meet one of four preconditions to trigger protection. These are that either (a) the whistleblower reasonably believed he would be victimised if he raised the matter internally or with a prescribed regulator; or (b) there was no prescribed regulator and he reasonably believed the evidence was likely to be concealed or destroyed; or (c) the concern had already been raised with the employer or a prescribed regulator; or (d) the concern was of an exceptionally serious nature.

If these provisions are met and the tribunal is satisfied that the disclosure was reasonable, the whistleblower will be protected. In deciding the reasonableness of the disclosure, the tribunal will consider all the circumstances, including the identity of the person to whom it was made, the seriousness of the concern, whether the risk or danger remains, and whether the disclosure breached a duty of confidence which the employer owed a third party. Where the concern had been raised with the employer or a prescribed regulator, the tribunal will also consider the reasonableness of their response. Finally, if the concern had been raised with the employer, the tribunal will consider whether any whistleblowing procedure in the organisation was or should have been used.

Full protection
Where a whistleblower is victimised or dismissed in breach of the Act he can bring a claim to an employment tribunal for compensation. Awards are uncapped and based on the losses suffered. An element of aggravated damages can also be awarded. Where the whistleblower is an employee and he is dismissed, he may within seven days seek interim relief so that his employment continues or is deemed to continue until the full hearing.

Confidentiality clauses
Gagging clauses in employment contracts and severance agreements are void insofar as they conflict with the Act’s protection.

Secrecy offences
Where the disclosure of the information is found to be in breach of the Official Secrets Act or another secrecy offence, the whistleblower will lose the protection of the Public Interest Disclosure Act if (a) he has been convicted of the offence or (b) an employment tribunal is satisfied, effectively beyond reasonable doubt, that he committed the offence.

Whistleblowing policies
Though the Act does not require organisations to set up or promote any particular whistleblowing procedures, they are strongly recommended. The key elements of such procedures, as endorsed by the Committee on Standards in Public Life (supra), are

• a clear statement that wrongdoing is taken seriously in the organisation;
• an indication of the sorts of matters regarded as wrongdoing;
• respect for the confidentiality of staff raising concerns, if they wish it;
• the opportunity to raise concerns outside the line management structure;
• access to confidential advice from an independent charity;
• an indication of the proper way in which concerns may be raised outside the organisation if necessary;
• giving staff of contracting firms access to the organisation’s whistleblowing policy;
• penalties for making false allegations maliciously; and
• effective promotion.

Footnotes
1) UK Committee on Standards in Public Life, Second Report, May 1996, page 22 and Third Report, July 1997, p.49.

2) As summarised earlier, a confidential report is where the identity of the whistleblower is known to the recipient on the recipient’s promise not to reveal the whistleblower’s identity without his consent or an order of the court. This contrasts with an anonymous report where the person does not disclose his identity to anyone.

3) We recognise that in some parts of the world, where legal protection is unavailable or the rule of law offers little or no protection, anonymous reporting may be the only alternative to silence.

4) That said, we do agree with the CNIL that it is important that employers should explain any whistleblowing arrangements to employees and should provide guidance and training on how any promise of confidentiality made to the whistleblowing employee should operate.