What protections do whistleblowers have under Irish and EU law?
Analysis: Ireland has one of the strongest whistleblower protection legislations in the world, and incentivises workers to make disclosures internally, but it also permits workers to go outside their organisation if they wish to do so.
By Dr Lauren Kierans Maynooth University, and Professor Kate Kenny NUI Galway
Last week’s RTÉ Investigates revelations shocked the nation. It emerged that the Department of Health was secretly compiling sensitive medical, social care, and educational information on children with autism who were involved in legal actions against the State.
The confidential information on the children and their families was obtained, without consent, from private doctor consultations, local care, community mental health, and support services.
It transpired that the department has held on to this information for years in a dedicated database that is accessible and searchable within a division of the department.
This breach of privacy, trust, confidentiality, and transparency in the processing of personal data would not have come to light if it had not been for the protected disclosure made by a senior civil servant whistleblower in the Department of Health, Mr Shane Corr.
Mr Corr initially raised his concerns internally with his superiors in 2020, but why did he then decide to go outside of his organisation to draw attention to this issue? And is he protected for doing so?
Protected Disclosures Act 2014
In July 2014, Ireland enacted one of the strongest whistleblower protection legislations in the world. Commended by experts internationally, the Protected Disclosures Act 2014 offers more robust protections for Irish whistleblowers than available in other countries.
The Act incentivises workers to make disclosures of relevant wrongdoings internally to their employer. But it also permits workers to go outside their organisation if that is what they wish to do, albeit this requires additional criteria to be met for the disclosure to be protected under the Act in legal proceedings.
For Mr Corr, it appears that the catalyst for taking his disclosure outside of the organisation was a requirement to sign a confidentiality agreement relating to his concerns. The department stated that, in order for him to view a senior counsel’s report examining the issues raised in his disclosure, he must sign an agreement that if he disclosed any details of the report, he would be guilty of misconduct.
The Protected Disclosures Act anticipates this type of conduct by employers to restrict or prohibit the making of a protected disclosure and provides that such agreements are void.
Nobody should be dissuaded from making their disclosure for fear that they will be breaching a confidentiality agreement, or with a threat of disciplinary action. The latter is also unlawful under the Act, as are other forms of retaliation for making a protected disclosure.
It has also been revealed that in seeking access to the report, Mr Corr was reminded of his duties as a civil servant not to disclose confidential information without authorisation.
Thankfully, again the Act addresses this issue. It protects public servants like Mr Corr from prosecution under the Official Secrets Act 1963 for communicating official information in breach of that Act — in cases of protected disclosures.
EU Whistleblowers Directive
The Protected Disclosures Act provides a framework for Mr Corr, and other whistleblowers, to make their protected disclosures in the knowledge that if they comply with the law, they will be protected if they are retaliated against.
However, Ireland’s law leaves some people vulnerable when they use it. A new EU directive, passed in 2019, offers the chance for Ireland to make significant improvements in how we protect people who speak out about wrongdoing, for the following reasons.
Burden of Proof
If you are retaliated against for speaking out, you have the right to a remedy under Ireland’s disclosures law, but it is not straightforward. In cases of reprisal that don’t involve dismissal, the "burden of proof" is on you, the whistleblower, to demonstrate that the only reason this happened is because you spoke out.
This is difficult to prove, because an organisation can often find other reasons for behaviour that seems to be retaliatory, at least enough to cast doubt.
This burden of proof represents a significant obstacle. Whistleblowers rarely have the financial resources to compete with corporate legal teams. It is the reason that many cases taken under the 2014 Act have not succeeded.
The EU Directive reverses this, and places the onus on the organisation to prove that retaliation was for a different reason. Adopting this change would be a valuable step forward for Ireland.
Reporting
The EU Directive is specific about the kinds of reporting systems organisations must have in place. These systems will make it easier to analyse what happened, when, and by whom during a whistleblowing process.
Everything to do with disclosures, including reprisals, will now have to be carefully documented and recorded. Right now in Ireland, only public sector organisations are required to have speak-up policies in place. The EU directive extends this to most private sector firms. And it extends protections to volunteers, shareholders, and even non-executive members of an organisation.
Outside disclosures
In Ireland, if you cannot disclose within your organisation, you have the option of going outside to a "prescribed person".
These include county councils, oversight authorities, and regulators. Prescribed persons should be providing the public with information on how to make a whistleblowing disclosure, but previous research found that four out of five do not.
Prescribed persons are supposed to report the number of protected disclosures they receive each year. But as of 2018, almost 80% were not reporting at all, or were providing incomplete information.
It seems that many prescribed persons either do not understand their obligations, or they ignore them. The EU Directive insists on adherence here: authorities must make full information available online, and provide regular reports.
Addressing wrongdoing
Under the EU directive, wrongdoing must be investigated. The current laws do not require Irish authorities to act on the information disclosed in whistleblowing cases. But the EU Directive demands that "diligent follow-up" of suspected wrongdoing is carried out.
The EU Directive is not perfect, but it offers better protection for whistleblowers. We have until 17th December 2021 to transpose the Directive. Ireland is currently deemed to have made "limited progress" towards transposition. It is vital that Ireland makes these changes to help ensure accountability: in our government, our businesses, and our public sector.
Applaud and protect
Mr Corr must be applauded and protected for the making of his protected disclosure.
Since his disclosure was aired by the RTÉ Investigates programme last week, the Taoiseach has announced the establishment of a multi-disciplinary team to consider the issues raised by the programme, the Data Protection Commission has initiated a statutory inquiry, and the Department of Health’s secretary general, Robert Watt, has committed to publish the independent senior counsel’s report.
Also, the Minister for Health, Stephen Donnelly, has said his department will carry out an "urgent and detailed review" of the cases, the Department of Education has said it will commence an examination into the practice, and the Oireachtas Health Committee has agreed to hold hearings into the issues.
This is only the beginning. The value of the disclosures by Mr Corr cannot be understated. Now, let’s make sure he is fully supported and protected.
This blog previously appeared on RTE.
Dr Lauren Kierans BL is a Lecturer in Law at Maynooth University and lectures on Whistleblowing Law at undergraduate level and as a Professional Certificate. Professor Kate Kenny is Full Professor of Business and Society at NUI Galway and researches whistleblowing.