Transposition of the EU Whistleblower Directive into the Protection of the Whistleblower Act, Chapter 527 of the Laws of Malta

This article was written by​ Dr Petra Attard and Dr Martina Bonnici

The legislation currently regulating whistleblower protection in Malta is the Protection of the Whistleblower Act, Chapter 527 of the Laws of Malta (the ”Act‘‘) which came into force on the 15^th September 2013. While the Whistleblowing Directive EU 2019/1937 (the “Directive”) has not yet been transposed into Maltese law, Bill 249 of 2021, titled An Act to Amend the Protection of the Whistleblower Act (the “Amending Act”), published on the 15^th November 2021 seeks to amend the Act in order to align it with the Directive. It is yet to be confirmed whether the Directive will be transposed by the set deadline of 17^th December 2021, as the Act will come into force on the date or dates that the Minister for Justice and Governance will establish, by notice in the Government Gazette.

By virtue of the Amending Act, the definition of employee will be extended to include shareholders and persons belonging to the administrative, management, or supervisory body of an undertaking, including non-executive members, and paid or unpaid trainees.

The definition of improper practice, which is subject to be disclosed or reported, will also be broadened by the coming into force of the Amending Act. There is an array of actions or series of actions which would constitute an improper practice, in areas such as public procurement, financial services, products and markets, and prevention of money laundering and terrorist financing, consumer protection, protection of privacy and personal data among others.

The list of examples of occupational detriments, which an employee is to be protected from, is set to be expanded beyond the four examples given in the Act, and will now also include withholding of training; discrimination, disadvantageous or unfair treatment; harm to the person’s reputation, particularly on social media; blacklisting on the basis of a sector or industry-wide informal or formal agreement; and psychiatric or medical referrals among others.

The protection afforded to a whistleblower, where warranted, shall be extended, inter alia, to third persons who are connected with the reporting persons and who could suffer retaliation in a work-related context such as colleagues or relatives of the reporting persons, and legal entities that the reporting persons own, work for or are otherwise connected with. While not defined in the Act, ‘reporting person’ in terms of the Directive means a natural person who reports or publicly discloses information on breaches acquired in the context of his or her work-related activities.

A whistleblower shall be provided with effective assistance from competent authorities before any relevant authority involved in their protection against retaliation and legal aid in criminal and cross border civil proceedings.

While, generally, anonymously made disclosures do not constitute a protected disclosure, they may be received and processed by whistleblowing reporting officers or the whistleblowing reports unit, and they may be taken into consideration in determining whether an improper practice has occurred. If following an anonymous disclosure the whistleblower is identified and suffers retaliation, the disclosure shall be deemed to be a protected one if the whistleblower had reasonable grounds to believe that the information on breaches disclosed was true at the time of the disclosure and that such information fell within the scope of the Act; and if it was disclosed in accordance with procedures laid down in the Act.

Employers are to have in operation, internal procedures for receiving and dealing with information about improper practices committed within or by that organisation which shall at least include channels for receiving reports in writing or orally or both; the designation of a whistleblowing reporting officer or department and diligent follow-up by the designated person or department. Employers shall also have clear and easily accessible information about the existence of the internal procedures, and adequate information on how to use the procedures shall be published and republished at regular intervals. There should also be information regarding the procedure for external reporting to competent authorities and institutions of the European Union, where relevant.

Organisations in the private sector with 50 to 249 workers may share resources as regards the receipt of reports and any investigations that shall be carried out.

For the purposes of internal procedures, the definition of employer is set out in the Second Schedule and is set to be amended by virtue of the new Act.

Currently, an organisation within the private sector needs to meet two criteria out of the following according to its last annual or consolidated accounts;

• an average number of employees, during the financial year, of more than 250;
• a total balance sheet exceeding forty-three million euro (€43,000,000);
• an annual turnover exceeding fifty million euro (€50,000,000)

When the amendments come into force, any organisation within the private sector with fifty or more workers will be obliged to have in operation the mentioned internal procedures. Furthermore, where following an appropriate risk assessment taking into account the nature of the activities of the organisation and the ensuing level of risk for, in particular the environment and public health, an organisation in the private sector with fewer than fifty (50) workers may be required to establish an internal disclosure channel and procedure as above.

Importantly, the new Act lays down timeframes for dealing with internal disclosures. Within 7 days of receipt of an internal disclosure, the whistleblowing reporting officer shall acknowledge receipt and thereafter provide feedback within a reasonable time which shall not exceed 3 months. Where there is no acknowledgement of receipt, the 3 months shall start to run from the seventh day from when the report was made.