Read our article on The EU's new whistleblowing regime – why it matters to UK businesses.
As the United Kingdom is not a Member State of the EU, the answers to the following questions are given in accordance with national legislation.
1) Local Laws
a) Has the country implemented any laws / regulations on whistleblowing (Local Law)?
When devising the EU Directive on whistleblowers protection, the UK was one of the 10 Member States identified by the EU as already having a comprehensive whistleblowing law in place.
This is in the form of the Public Interest Disclosure Act 1998 (PIDA) which came into force on July 2, 1999, inserting sections 43A to 43L, 47B, 103A and 105(6A) into the Employment Rights Act 1996 (ERA). This provides protection for workers reporting misconduct by their employers or third parties against detrimental treatment or dismissal. PIDA creates two levels of protection for whistleblowers:
- Section 47B of ERA protects workers from being subjected to any detriment on the grounds that they have made a “protected disclosure”, such as a refusal to offer promotion, denial of training or blocking access to resources.
- Under section 103A of ERA, the dismissal of an employee will be automatically unfair if the reason or principal reason for their dismissal is that they have made a protected disclosure.
The Whistleblowing Commission (Commission) established in 2013 developed a Whistleblowing Code of Practice (Code) which outlines best practice for whistleblowing policies; this is best practice only and not legislation. The Code provides practical guidance to employers, workers and their representatives for effective whistleblowing arrangements and sets out recommendations for raising, handling, training and reviewing of whistleblowing in the workplace.
In 2015, the Department for Business, Energy and Industrial Strategy (BEIS) published Whistleblowing: Guidance for Employers and Code of Practice (BEIS Guidance). This explains employer’s responsibilities with regard to whistleblowing and offers suggestions for best practice, including the recommendation that an employer should implement a whistleblowing policy for the company. Please note, this is best practice only and not legislation.
As a departing Member State, the UK abstained from the European Council’s vote in 2019 on the implementation of the EU Directive. In a letter dated October 4, 2019, to the European Scrutiny Committee, the UK government declared that due to the UK’s exit from the EU, it was not required to transpose the Directive into national law. Concerns about the “overall proportionality” of the EU Directive were cited and it was also noted that, prior to the legislation, the UK “already exceeds EU minimums in a number of areas of worker rights.”
However, the UK government also specified that it would review the impact it had on Member States when considering reforms to UK whistleblower legislation in future. Post-Brexit, it seems unlikely that the EU Directive will be implemented in the UK, although it is unclear whether UK legislation will be amended to incorporate the same rights in order to align UK worker rights with the rest of the EU. Even if the Directive is not implemented, it is nevertheless likely to be relevant for the UK in a number of ways:
- It exceeds the current UK requirements relating to whistleblowing in certain areas (as outlined below) and therefore it may be regarded as best practice or even provide momentum for change to the current UK laws.
- It will be relevant for all companies with operations in EU Member States.
- It will need to be taken into account by companies which maintain a single global whistleblowing framework.
2) Scope of application
a) What types of wrongdoings are covered by the Local Law? Does it cover breaches of EU law?
Section 43B(1) of ERA sets out the six specified types of “relevant failure” which, in the reasonable belief of the worker, must either be taking place or likely to take place:
- Criminal offences.
- Breach of any legal obligation.
- Miscarriages of justice.
- Danger to the health and safety of any individual.
- Damage to the environment.
- The deliberate concealing of information about any of the above.
PIDA gives protection to those making disclosures relating to breaches of UK law or the law of any other country or territory (section 43B(2) of ERA).
b) Personal scope
- Does the Local Law apply to reporting persons working in both the private and public sectors?
Yes. PIDA provides protection against detriment or dismissal to those working in both the public and private sector. It protects not only employees but also other workers, including employee shareholders. A wider definition of worker applies in relation to whistleblowing than it does in relation to other employment rights under ERA.
Among the individuals covered by the extended definition of worker under section 43K of ERA are:
Does the Local Law apply only to breaches that the reporting person became aware of in a work-related context?
- Homeworkers, whether or not the work is to be done by them personally.
- Non-employees undergoing training or work experience as part of a training course, otherwise than at an educational establishment.
- Self-employed doctors, dentists, ophthalmologists and pharmacists in the NHS.
- Agency workers.
- Police officers.
- Student nurses and student midwives.
Yes. The authorities have highlighted the fact that a disclosure can be protected whether it was made:
Does the Local Law also protect: facilitators; people connected to the whistleblower and who could suffer retaliation in a work-related context; and legal entities the whistleblower owns, works for, or is otherwise connected with?
- During employment with an employer.
- During employment with a previous employer.
- After employment with an employer has terminated.
- Before PIDA came into force.
No, local law does not extend to such facilitators.
c) Does the Local Law require specific conditions to protect reporting persons?
Yes. A whistleblower qualifies for protection where both of the following are satisfied: they have made a qualifying disclosure; and it is also a protected disclosure.
Section 43B of ERA outlines the requirements for a qualifying disclosure:
- The worker must make a disclosure of information.
- The information must relate to one of six types of relevant failure outlined in Section 2) a) above.
- The worker must have a reasonable belief that the disclosure is in the public interest.
- The worker must have a reasonable belief that the information tends to show one of the relevant failures.
For a qualifying disclosure to be protected, it must be made to one of the categories listed in sections 43C to 43H of ERA:
- The worker’s employer.
- The person responsible for the relevant failure.
- Legal advisors.
- Government ministers.
- A person prescribed by an order made by the Secretary of State.
- A person who is not covered by the list above provided certain conditions are met, with the conditions being varied in exceptionally serious cases.
3) Reporting channels
a) Does the Local Law allow anonymous reports? How are companies/agencies meant to handle them?
Yes. PIDA does not preclude anonymous reporting. This would normally be covered in a company’s whistleblowing policy and it is considered best practice in the Code and the BEIS Guidance to offer a facility for anonymous reporting.
b) Is there a duty of confidentiality and any derogation from this duty?
No. PIDA does not stipulate a duty of confidentiality towards the reporting worker, although it is generally considered best practice to offer confidentiality and this would normally be covered in a company’s whistleblowing policy. Both the Code and the BEIS Guidance recommend that confidentiality of identity should be afforded to the whistleblower unless it is required by law to breach that confidentiality.
c) Public disclosures: does the Local Law provide for this possibility?
Yes. PIDA acknowledges, in sections 43G and 43H of ERA, that there may be situations in which it is in the public’s interest for a worker to make a disclosure beyond their employer, responsible person, legal advisor, government minister or prescribed person.
However, a wider qualifying disclosure can only be classified as a protected disclosure in narrow circumstances. Among the requirements are that:
- The worker must reasonably believe that the information disclosed, and any allegation contained in it, are substantially true.
- The worker must not make the disclosure for the purposes of personal gain, but rewards offered, for example by HMRC, are ignored.
- In all the circumstances of the case, it must be reasonable for the worker to make the disclosure.
- The worker must:
- reasonably believe, at the time of the disclosure, that they will be subjected to a detriment by their employer if they make a disclosure to their employer or a prescribed person;
- reasonably believe (where there is no prescribed person) that it is likely that material evidence relating to the relevant failure will be concealed or destroyed if disclosure is made to their employer; or
- have previously disclosed substantially the same information to their employer or to a prescribed person.
4) Reporting channels: internal
a) Is there an obligation for private and/or public legal entities to establish channels and procedures for internal reporting and follow-ups?
No. PIDA does not impose a positive obligation on UK employers to implement a whistleblowing policy, it merely requires them to refrain from subjecting whistleblowers to any detriment or dismissal if a protected disclosure is made.
However, it is best practice for an employer to implement a company whistleblowing policy. Both the Code and BEIS Guidance offer suggestions as to what should be included. Channels and procedures for internal reporting would usually be covered in a company’s whistleblowing policy.
b) Do internal reporting channels need to allow reporting in writing, orally or both?
PIDA does not set forth any specific requirements. This would normally be covered in a company’s whistleblowing policy.
c) Procedures for internal reporting and follow-up: does the Local Law require legal entities to adopt internal reporting systems with the following elements?
- Channels able to ensure the confidentiality of the identity of the reporting person and the protection of third parties mentioned in the report:
No. PIDA does not impose a positive obligation on UK employers to ensure the confidentiality of the identity of the reporting person. It is generally considered best practice to offer confidentiality, so far as is reasonably possible, to the reporting person, and this would normally be covered in a company’s whistleblowing policy.
Both the Code and BEIS Guidance recommend that confidentiality of identity should be afforded to the whistleblower unless it is required by law to breach that confidentiality.
- Acknowledgement of receipt of the report to the whistleblower within seven days of receipt:
No. PIDA does not require any acknowledgement of receipt and both the Code and BEIS Guidance are silent on this point.
- The designation of an impartial function/team to manage follow-ups on reports and maintain communication with the whistleblower:
No. PIDA does not require an impartial function or team to manage follow-ups of the report and maintain communication with the whistleblower. Both the Code and BEIS Guidance suggest information should be provided to the worker, by whom and how the disclosure will be handled, as well as recommending that the communication should be maintained with the reporting person.
- Any other follow-up requirements including those for anonymous complaints:
No. There are no other follow-up requirements stipulated in PIDA. BEIS Guidance suggests a whistleblowing policy should include: an idea about what feedback a whistleblower might receive; and an explanation that anonymous whistleblowers will not ordinarily be able to receive feedback and that any action taken to look into a disclosure could be limited – anonymous whistleblowers may seek feedback through a telephone appointment or by using an anonymised email address.
- A reasonable timeframe to provide feedback, not exceeding three months from acknowledgment of receipt or if no acknowledgement was sent, three months from the expiry of the seven-day period after a report is made:
No. There is no time frame stipulated in PIDA, and the Code and BEIS Guidance are also silent on this point. However, both the Code and Guidance suggest that a whistleblowing policy should include an idea of the timeframe for handling any disclosures.
- Providing clear and easily accessible information on internal reporting procedures and external reporting procedures to competent authorities and/or EU institutions/bodies:
No. PIDA does not create any requirements as to how information on internal and external reporting procedures should be presented. The Code and BEIS Guidance both suggest that the whistleblowing policy should be clear, simple, readily available, well-publicised and easily understandable.
- Should legal entities take any additional measures in order to comply with the above requirements?
No additional measures need to be taken to be compliant with PIDA. However, it is best practice to establish a whistleblowing policy as this will also help to prevent the two whistleblower protections which are enshrined in PIDA, namely dismissal or any other detriment relating to a protected disclosure. Guidance for an effective whistleblowing policy can be found in the Code and BEIS Guidance.
5) Reporting channels: external
a) Has the country designated a competent authority to receive and investigate whistleblower disclosure and retaliation complaints?
No. There is no single designated competent authority established to receive and investigate whistleblower disclosure and retaliation complaints in the UK. However, if a worker does not wish to make a disclosure to its employer, there are alternative means for a qualifying disclosure to still be classified as a protected disclosure. The worker can make a disclosure to a legal advisor, government minister or person prescribed by an order made by the Secretary of State. A list of prescribed persons and the matters for which each are prescribed can be found on the UK government publications web pages.
b) Is an independent and autonomous external reporting channel already established in the country?
No PIDA has not established an independent and autonomous external reporting channel in the UK. A worker can use one of the methods outlined in Section 5) a) above if they wish to pursue an external reporting channel.
6) Processing of personal data
a) Is personal data concerning the reports processed in compliance with local and EU legislation such as EU Regulation 2018/1725 and local privacy laws?
Although PIDA does not give any guidance on this issue, companies are required to treat data in compliance with applicable data protection laws.
7) Record keeping of reports
a) Is there any obligation regarding record keeping of reports as provided for by the EU Directive?
No. PIDA does not stipulate any record keeping requirements. The Code and BEIS Guidance both suggest that is best practice to a keep record of the number of whistleblower reports and their nature, as well as any feedback provided to the reporting persons.
a) Is there any difference between whistleblower protections in the private and public sectors?
No, there is no difference between protection in the private and public sectors.
b) Are whistleblowers protected against all forms of retaliation including threats and attempts of retaliation? Which forms of retaliation are expressly indicated?
Yes. PIDA creates two levels of protection for whistleblowers:
- Section 47B of ERA protects workers from being subjected to any detriment on the grounds that they have made a protected disclosure.
- Under section 103A of ERA, the dismissal of an employee will be automatically unfair if the reason, or principal reason, for their dismissal is that they have made a protected disclosure.
The Code sets out what “any detriment” could include:
- Failure to promote.
- Denial of training.
- Closer monitoring.
- Blocking access to resources.
- Unrequested re-assignment or re-location.
- Disciplinary sanction.
- Bullying or harassment.
- Failure to provide an appropriate reference.
- Failing to investigate a subsequent concern.
c) Does the Local Law provide for any other measures of support such as those indicated in the EU Directive?
No. PIDA does not establish any other measures of support other than the two protections outlined in Section 8) b) above. Useful information is provided for workers at www.gov.uk/whistleblowing.
d) Does the Local Law provide for the necessary measures to prohibit any form of retaliation against whistleblowers?
No. The legislation does not provide any mechanism to injunct retaliation, but remedies are available where an individual who has made a protected disclosure is subject to detriment or dismissal (see below).
e) Does the Local Law provide for any remedial measures, including interim relief measures?
Yes. Individuals who make a protected disclosure have the right not to be subject to a detriment or, in the case of employees, to be dismissed for making a protected disclosure and, where they are subject to detriment or dismissal, may claim compensation in the Employment Tribunal.
In dismissal cases, it is also possible to seek interim relief (an order for continued employment pending the final outcome of the case), as well as a final remedy of reinstatement or reengagement. None of these remedies are commonly sought by claimants.
The prohibition against detriment is contained in section 47B of ERA, under which a worker has the right not to be subjected to any detriment by any act, or any deliberate failure to act, by their employer done on the grounds that the worker has made a protected disclosure. This also extends to any act, or deliberate failure to act, done by another worker in the course of their employment or an agent of the employer with the employer’s authority.
If an employee is dismissed and the reason or principal reason for their dismissal is that they have made a protected disclosure, they can bring an unfair dismissal claim under the automatic unfair dismissal provisions in section 103A of ERA.
There is no minimum length of service requirement for bringing a detriment claim or unfair dismissal based on a protected disclosure. This is one of its advantages over ordinary unfair dismissal cases where a length of service requirement applies under section 108 of ERA. There is also no upper limit on the amount of compensation that can be awarded and interim relief is available (see below).
f) Does the Local Law provide for exemptions from liability for whistleblowers?
Yes. Under section 43J of ERA, any provision in an agreement between an employer and an employee is void in so far as it purports to preclude the worker from making a protected disclosure. Therefore, any disclosure as part of a protected disclosure to anyone other than the employer will not constitute a contractual breach of confidentiality.
g) Does the Local Law provide for sanctions against natural and legal persons that violate whistleblowers’ protection or the duty of maintaining the confidentiality of their identity?
No. PIDA does not stipulate any sanctions for violations against whistleblowers’ protection or the duty of maintaining the confidentiality of their identity. It allows for the employer to bring a detriment claim or have their dismissal ruled as unfair as outlined in Section 8) e) above. The Code suggests it is best practice to establish such sanctions.
h) Does the Local Law provide for sanctions in case of false reports?
No. PIDA does not set out any sanctions for false reports. This is something which can be covered in a company’s whistleblowing policy, although the Code and BEIS Guidance are silent on this point.
9) Other issues
a) Under the Local Law, is adopting a whistleblowing system relevant to assess the adequacy of a compliance program? Does this have any value to mitigate or eliminate criminal liability for legal entities?
There are no strict legal requirements under UK law relating to the composition, and hence the adequacy, of a company’s compliance program. However, in order to protect itself from criminal liability under section 7 of the UK Bribery Act 2010, a company must show that it has “adequate procedures” in place to prevent persons associated with it from committing bribery on its behalf. The implementation of a robust whistleblowing policy which is routinely reviewed and updated, communicated to the employees and upon which regular training is provided, can go some way to demonstrate that the company had adequate procedures in place to prevent bribery.
b) Does the Local Law or another law in your country provide for whistleblower reward programs?
There is no legislation in the UK to financially reward whistleblowers in the workplace environment. However, since 2017, the UK Competition and Markets Authority has been offering rewards of up to GBP100,000 for information on cartel activity, but this is a discretionary reward and given only in exceptional circumstances. HMRC also offers undisclosed financial awards to informants in relation to tax evasion.
c) Can companies benefit from any incentives in the case of voluntary self-disclosure of violations they became aware of following an internal report?
There are no incentives for voluntary self-disclosure in PIDA.
However, since 2014 there has been the incentive, in the form of a discount for financial penalties, to self-report a number of different crimes. This came about when the UK introduced deferred prosecution agreements (DPAs) in section 45 and schedule 17 to the Crime and Courts Act 2013 (CCA). A DPA is a discretionary tool which can be used by a prosecutor as an alternative means of dealing with alleged criminal conduct. It is an agreement made between the prosecutor and a corporate entity which effectively defers the formal prosecution for a period of time within which the company has to follow a course of action dictated to it by the prosecutor which has been approved by the courts. If at the end of the DPA the company in question has complied with all the necessary obligations, then the case is dismissed without prosecution. There is also a DPA Code of Practice published by the Serious Fraud Office (SFO) and the Crown Prosecution Service which governs the conduct of DPAs.
Five key elements to a DPA:
- The prosecutor must be a designated prosecutor; currently this is only the Director of Public Prosecutions and the Director of the SFO.
- The defendant must be a corporate entity; individual defendants are not able to enter into DPAs.
- DPAs are only available for certain offences relating to fraud and dishonesty; part 2 of schedule 17 to the CCA lists all the relevant offences.
- DPAs are subject to judicial agreement.
- A successful DPA only protects the corporate entity from criminal prosecution in the UK. It does not prevent any civil, regulatory or disciplinary action from being taken, or any criminal investigation or prosecution from being initiated anywhere else in the world.
To date, there have been seven instances where DPAs have been successfully obtained following investigation and prosecution by the SFO. Self-reporting has led to significant reductions in the financial penalties paid by the offending companies.
The first DPA in the UK was agreed in 2015 between the SFO and ICBC Standard Bank plc, where the judge gave a discount of a third to the financial penalty due to Standard Bank’s original self-report and co-operation with the SFO throughout. This is the same discount as a guilty plea at first instance in criminal proceedings. However, the incentive for self-reporting was enhanced by comments made by the judge during the second DPA entered into, between the SFO and XYZ Ltd (a small to medium-sized UK enterprise) in 2016. Even though the financial penalty had already been fixed at a lower amount due to the company’s lack of funds, the judged stated that had a discount been applied, a 50% reduction could have been appropriate in order to encourage other companies to conduct themselves as XYZ Ltd had done by self-reporting.
Although self-reporting is important for a company to secure a DPA and subsequently a reduction in the financial penalty it receives, it is not integral. The SFO entered into two DPAs in 2017 with Rolls-Royce and Tesco Stores Ltd respectively, even though neither company self-reported. Rolls-Royce received a 50% discount, which followed the judge’s comments in the earlier XYZ Ltd DPA, as Rolls-Royce had shown “extraordinary co-operation” with the SFO. Tesco Stores Ltd was also granted a 50% discount, following the precedent set in the Rolls-Royce DPA, because of what the SFO described as “the exemplary standard of co-operation.”
d) Will implementing the EU Directive create any issues with obligations provided for under other laws / regulations?
As explained previously, it is uncertain at this stage whether the UK will implement the EU Directive. The most likely outcome would appear that the UK will, in due course, seek to update its own existing legislation in areas where it is deficient, to ensure it meets the standards included in the Directive. This will be addressed following a period of review and analysis of the impact of the Directive on EU Member States.
For a pdf of the full guide please click on the button below.