The protection of the Whistleblower Act and the Ombudsman's role under the Act

The Act

The Protection of the Whistleblower Act, adopted in 2013, was amended in November 2021 to transpose the 2019 EU Directive on Whistleblowing (EU Directive 2019/1937) on the protection for persons reporting on breaches of Union Law, into national law.  The Directive serves to create common minimum standards within the EU for the protection of those reporting breaches of EU law with their employers by setting out a framework for procedures in terms of which those who obtain information on violations related to their work-related activities may report or publicly disclose said information. 

The Scope of the Act – the protection from retaliation

The Act aims to preclude the possibility of unfavourable action being taken against an employee who makes a genuine disclosure about an improper practice committed by his employer on account of his having made said protected disclosure.   It further seeks to afford protection from liability to criminal, civil or disciplinary proceedings consequent to said disclosure[1]. 

Article 3 provides that notwithstanding any prohibition of, or restriction on the disclosure of information under any law, contract, oath or practice, whistleblowers cannot be subjected to detrimental action because they make a protected disclosure.  Moreover, those assisting the reporting person (whistleblower)[2], as well as third persons connected therewith ‘who could suffer retaliation in a work-related context, such as colleagues or relatives’, are also afforded protection after providing a responsible disclosure.   The said protection subsists even if:

i)                 it results that the whistleblower, although in good faith, was mistaken about the import of the information; or

ii)                if any perceived threat to the public interest on which the disclosure was based did not occur; or

iii)              there is lack of full compliance with the procedural requirements of the Act, regulations or guidelines made thereunder.  

However, disclosure of information protected by legal and medical professional privilege is not protected under the Act, subject to the provisions of Article 6A(c) of the Professional Secrecy Act[3]. 

In terms of Article 7(4) reporting persons shall have access to comprehensive and independent information and advice on the procedures and remedies available in regard to protection against retaliation and the rights available to those reporting, which is easily accessible and free of charge.  Moreover, reporting persons shall be given effective assistance from competent authorities before the relevant authority involved in their protection against retaliation. 

Protection from retaliation to a reporting person who believes that detrimental action ‘has been taken or is likely to be taken against him in reprisal for a protected disclosure’[4] is granted through access to the courts, which access is free of charge.  The court can grant interim relief following a preliminary determination, aimed at ensuring that litigation is not protracted unnecessarily by employers who might harass their employee at the workplace while the case is pending or deprive him of income as a result of dismissal or suspension.  Once the reporting person establishes that he made a protected disclosure and suffered a detriment, there is a presumption of retaliation, and it is up to the employer to prove that any action taken is based on justified grounds[5].  Should the Court conclude that the person has taken, or intends to take detrimental action against the reporting person in reprisal for a protected disclosure, the court may grant an injunction or any measure it deems appropriate to provide redress, including the liquidation of an amount to cover direct, indirect and future consequences of the reprisal, including moral damages.     

Who is protected under the Act?

The law does not afford protection to the public in general and defines the term ‘Whistleblower’ as ‘any employee who makes a disclosure to a whistleblowing reporting officer or a whistleblowing reports unit, as the case may be, whether it qualifies as a protected disclosure or not under this Act.”   

Protection is granted to natural persons working in the private or public sector, who make a disclosure of information obtained on breaches in a work-related context, through an internal or external reporting channel, including:

• any worker who has entered into a contract of service or works under a contract of service with an employer and in return receives remuneration;
• any person who has agreed to work under the supervision or control of another person, including an outworker, excluding work or service performed in a professional capacity in regard to which there is an obligation of professional secrecy when such work/service is not regulated by a specific contract of service;
•  any former employee, provided the report concerns information on breaches obtained in the employee’s work-related activities through their relationship with the entity which has ended;
• any person who is or was seconded to an employer;
• any person employed with the public administration, including members of disciplined forces;
• any contractor or subcontractor who performs work or provides a service or undertakes to perform or provide such work or service;
• any volunteer, even when the work/service is not regulated by a specific contract of service;
• job applicants, where the information concerning the improper practices has been acquired during the recruitment or other pre-contractual negotiations; and
• shareholders or persons pertaining to the administrative, management or supervisory body of an entity/company, including non-executive members, and paid or unpaid trainees. 

What are protected disclosures?

All disclosures that fall within the scope of the Act, which are made in good faith and not for personal gain, and where the whistleblower reasonably believes the information to be true, qualify to be treated as protected disclosures in terms of Article 9 of the Act. 

Anonymously made disclosures shall not be protected disclosures, although the Whistleblowing Reports Unit may still receive and process anonymous disclosures and may consider the disclosure made in determining whether an improper practice has taken place.    

The type of breaches that can be reported under the Act

A disclosure falls within the scope of Chapter 527 if it relates to an ‘improper practice’.  In terms of Article 2, an improper practice is defined as an action or a sequence of actions whereby:

• a person has failed/is failing/is likely to fail to comply with any legal obligations to which he is subject; or
• the health and safety of a person has been, is being or is likely to be put in danger; or
• the environment has been/is being/is likely to be damaged; or
• a corrupt practice has happened/is likely to happen/to have happened; or
• a criminal offence has been committed/is being committed/is likely to be committed; or
• an injustice (miscarriage of justice) has occurred/is occurring/is likely to occur; or
• bribery has occurred/is likely to occur or to have occurred; or
• someone has failed/is failing/is likely to fail to:

i) abide with any legal obligation imposed upon him on public procurement; or

ii)comply with legislation on financial services, products and markets, and prevention of money laundering and terrorist financing; or

iii)comply with product safety and compliance law; or

iv) ensure transport safety; or

v) ensure radiation protection and nuclear safety; or

vi) ensure food and feed safety, animal health and welfare; or

vii) comply with any legal obligation on consumer protection to which he is subject; or

viii) comply with any legal obligation on protection or privacy and data protection, and security or network and information systems, to which he is subject; or

ix) a breach affecting the financial interests of the Union[6]; as well as breaches relating to the internal market in relation to acts which violate the rules of corporate tax or to arrangements the purpose of which is to obtain a tax advantage, that defeats the object or purpose of the applicable corporate tax;  has occurred/is likely to occur or to have occurred; or

x) information tending to show that any of the aforementioned issues has been/is being/is likely to be deliberately concealed.   

It is noted that ‘very minor or trivial matters’ fall outside the provisions of Chapter 527. 

Internal and External Reporting Channels  

Internal Reporting

In terms of Article 12 and the Second Schedule of the Act, each Ministry, including entities operating in the public sector, and legal entities with 50 or more employees operating in the private sector must establish channels and procedures so as to enable ‘employees’ to report breaches.  The said procedures must ensure the confidentiality of the identity of the reporting person and of any third parties mentioned therein. 

Entities in the private sector employing less than 50 employees may also be required to create internal reporting channels, following an appropriate risk assessment.  The said risk assessment takes into account the nature of the operations of the entity and ensuing level of risk that said operations have, particularly on the environment and public health.   

Employers are required to appoint a Whistleblowing Reporting Officer tasked with following up on the reports that may be made, who may be the same person/department that receives a protected disclosure made internally within the entity.  The said officer/department will maintain contact with the person submitting the report, require further information from the whistleblower and provide this latter with feedback.  Once a report is submitted the Whistleblowing Reporting Officer shall acknowledge the report within 7 days of receipt and provide feedback not later than three months from the acknowledgement, or where the acknowledgement is not sent, within three months after the expiry of the seven days from the submission of the report.    

Furthermore, an internal disclosure may be made to the head or deputy head of the particular organisation if:

• the organisation has not established and published any internal procedures for receiving and tackling information about an improper practice; or
• the reporting person reasonably believes that the Whistleblowing Reporting Officer is or may be involved in the alleged improper practice; or
• the reporting person reasonably believes that the Whistleblowing Reporting Officer is not a person to whom it is appropriate to make such a disclosure because of a relationship or association he has with a person who is, or maybe involved, in the improper practice alleged in the disclosure.

External Reporting 

The Act promotes the making of internal disclosures before escalation to external disclosures by requiring an ‘employee’ to first make a disclosure internally so as to minimise the impact of the improper practice being committed.  Article 15 clearly stipulates that external disclosures are only protected if an internal disclosure has already been made or attempted to be made. 

However, in terms of Article 16 one may also report an alleged improper practice by making an external disclosure through the Whistleblowing Reporting Unit of the authorities indicated in First Schedule of the Act, after having resorted to the internal reporting channels, or directly without resorting to internal reporting were said person reasonably believes that:

·        the head of the organisation is or may be involved in the improper practice he is reporting; or

·        immediate reporting to an external authority is justified due to the urgency of the matter to which the disclosure refers, or some other exceptional circumstances; or

·        he/she will be subjected to an occupational detriment by his/her employer if he/she makes an internal disclosure; or

·        it is likely that evidence relating to the improper practice will be concealed or destroyed if an internal disclosure is made; or

·        although having made an internal disclosure, the reporting person has not been updated about the status of the issue disclosed, or it is reasonably evident to him/her that no action/recommended action has been taken within a reasonable time regarding the issue  referred to in his disclosure. 

It is further noted that:

1. where no appropriate action is taken within the specified time-frames, after the filing of the initial report (both internally and externally); or
2. if the reporting person reasonably believes that there is an imminent or apparent danger to public health; or
3. in the case of the submission of an external report, there is a risk of retaliation or a low prospect of the breach being effectively addressed due to the particular circumstances of the case;
4. the reporting person will still be protected if he/she chooses to disclose information on breaches available in the public domain[7].             

The role of the Maltese Parliamentary Ombudsman and applicable procedure

In terms of the First Schedule of the Act, the Ombudsman is designated as one of the authorities mandated to receive external disclosures from the Private Sector.

In line with the Act, the Ombudsman established an independent Whistleblowing Reports Unit charged with receiving and processing any information on breaches relating to –

i) conduct involving substantial risk to public health or safety or the environment that would if proved, constitute a criminal offence; and

ii) all matters which constitute improper practices and which are not designated to be reported to any of the other authorities which are listed in the First Schedule of the Act.

The Whistleblowing Reporting Unit will determine whether, and under what conditions, the disclosure made should be referred for further investigation.  The Unit acts as a filter and determines whether disclosures should be further investigated by another unit/officer within the Office, referred to another authority for better processing (including the Police) or not processed any further.  The Unit may also request the reporting person to provide further written information or attend meetings to discuss/clarify the information initially provided with the submission of the complaint.     

In terms of the Act, whoever receives a confidential disclosure and/or documentation from a whistleblower, becomes immediately responsible for protecting the existence and identity of the reporting person – the Whistleblowing Reports Unit must protect the identity of the whistleblower and cannot ‘disclose information that identifies or may lead to the identification of the whistleblower unless the whistleblower consents in writing to the disclosure of that information”.[8]  Moreover, a  court cannot order the disclosure of the identity of any whistleblower without his/her consent[9].   Consequently, the contents of the disclosure are not communicated by the Whistleblowing Reports Unit to other units within the Office of the Ombudsman, until the former has duly investigated the disclosure, and determined that the public interest requires that further investigation be carried out by such other units or by the Police (in the case of an improper practice which constitutes a contravention or crime under any law). 

Upon receipt of the disclosure the Whistleblowing Reports Unit shall acknowledge receipt within 7 days, unless the whistleblower requests otherwise, or the Unit reasonably believes that an acknowledgement shall endanger the protection of the reporting person’s identity. 

The Unit will initially establish whether the Ombudsman can receive the information and any related documentation – that is, whether the disclosure/report being referred to this Office falls within the remit of the Office of the Ombudsman as established by the Protection of the Whistleblower Act.  This is in line with the First Schedule that limits the mandate of the Ombudsman to specific conduct and matters arising within the private sector as mentioned above.  Thus, where for instance an issue being referred to this Office refers to the Public Administration or a public authority or entity, the Whistleblowing Report Unit will guide the person who filed the report to seek assistance from the External Disclosure Whistleblowing Unit at the Office of the Prime Minister, as stipulated by Part 2 of the First Schedule of the Act. 

If it is established that the disclosure falls within the remit of the Office, the Unit will proceed to  examine whether it is appropriate for an external disclosure to be made in line with Sub-articles (1), (2) and (3) of Article 16.   Where it is ascertained that a disclosure should not have been made externally, the whistleblower is notified in writing within forty-five days, that an internal disclosure must be made and that the Ombudsman will not be dealing further with the disclosure.   Where the Unit concludes that the disclosure has been properly made, an investigation is launched and the reporting person is informed about the status of the improper practice disclosed (i.e. whether the issues/actions mentioned in the disclosure made to this Office, fall within the definition of ‘improper practice’ as defined by the Act) and about other related issues within three months, which can be extended to six months in justified cases[10] .    

Should the Whistleblowing Reporting Unit consider that the protected disclosure made, can be better  investigated by another authority, or in the case of an improper practice which constitutes a crime or a contravention, by the Police; the Unit can refer the information to such other authority or the police within 30 days[11] and inform update the reporting person in writing.  In these cases, the whistleblower’s identity cannot be disclosed without his prior written consent[12].  Such a referral does not affect the status of a protected disclosure[13]

The Whistleblowing Reports Unit within the Office of the Ombudsman shall communicate the final outcome of the investigation triggered as a consequence of the report made, in writing.  It will further transmit the information contained in the disclosure to the competent institutions, offices or agencies of the EU for further investigation, where this is required under the law[14].

How to contact the Whistleblowing Reporting Unit at this Office

In line with Article 17(2) of the Act, disclosures can be made in writing and orally. 

A disclosure of the alleged improper practice can be made online, through this website on the Whistleblowing External Disclosure Form available, which Form may also be sent by registered mail, or delivered by hand in an envelope marked ‘CONFIDENTIAL’ addressed to WBR, 11 St Paul Street Valletta.  In urgent cases an email may be sent on office@ombudsman.org.mt followed by registered mail.

Should the person filing the disclosure desire a face-to-face meeting, he may contact the Office on 2248 3210. and an appointment will be scheduled with the Whistleblowing Reporting Unit/Officer.  

Reporting Persons can also contact the Office by telephone on 2248 3216.  Telephone conversations made to this Office are not recorded.      

Download the DOCUMENT