Whistleblowing

In the UK, the legal framework for whistleblowers is set out in the Employment Rights Act 1996 (as amended by the Public Interest Disclosure Act 1998 and the Employment and Regulatory Reform Act 2013).

The UK framework does not fully comply with European standards set out in the EU Directive 2019/1937/EU (the Directive).  Especially now that the UK has left the EU, it is not known whether UK whistleblowing legislation will be amended to reflect the workers’ rights and best practices introduced by the Directive.

There is no legal requirement in the UK for companies to implement a whistleblowing procedure or policy or any requirements as to the content or form of any procedure or policy if one is adopted. However:

• The Department for Business Innovation and Skills has published guidance entitled Whistleblowing: Guidance for Employers and Code of Practice which identifies that it is best practice for an employer to have a whistleblowing policy or appropriate written procedure. The guidance can be found here.
• The UK Corporate Governance Code set by the Financial Reporting Council recommends public-listed companies implement a whistleblowing procedure.
• Financial services firms regulated by the Financial Conduct Authority or the Prudential Regulation Authority will be subject to regulatory requirements that require the operation of applicable whistleblowing procedures.

Yes. Employers can implement a whistleblowing procedure at a Group level.

No, because there is no underlying legal requirement under the Employment Rights Act 1996 for companies to implement a whistleblowing procedure or policy.

There is no specific legal requirement in the Employment Rights Act 1996 for employee representative bodies to be involved in (or otherwise agree to) the implementation of a whistleblowing procedure or policy. However, the rules in place with existing employee representative bodies may require consultation on any new policy or procedure and, in any event, it is best practice to involve employee representatives in the implementation of a whistleblowing system.

According to the Whistleblowing: Guidance for Employers and Code of Practice published by the Department for Business Innovation and Skills (BEIS), it is best practice for the whistleblowing policy or procedures to be in writing and easily accessible to all workers. BEIS also recommends that awareness of the policy or procedures is raised through all available means such as staff engagement, intranet sites and other marketing communications.

The reporting channel can be outsourced. Where an employer’s whistleblowing policy or procedure authorises disclosure to a third party (eg, an external hotline), UK law will treat a disclosure to the third party the same as a disclosure to the employer.

The Department for Business Innovation and Skills guidance on whistleblowing identifies that larger UK organisations may have a designated team who can be approached to make a disclosure. The guidance recommends that smaller organisations should have at least one senior member of staff as a point of contact for whistleblowers. However, the guidance also acknowledges that there are commercial providers who can manage a whistleblowing process on behalf of the employer.

When implementing and operating whistleblowing procedures, employers must comply with the relevant UK data protection requirements, which implement those set out in the EU’s General Data Protection Regulation (the GDPR). When an individual makes a disclosure, in most cases this will include the personal data of related individuals. Employers must ensure that they have the requisite technical and organisational measures in place to secure any personal data disclosed or obtained as part of the whistleblowing disclosure or subsequent investigation.

The Department for Business Innovation and Skills guidance on whistleblowing recommends, as best practice, several practical considerations when setting up a whistleblowing procedure, including, but not limited to:

• employers should provide training to all workers on how disclosures should be raised and to managers on how to deal with disclosures;
• organisations should ensure that there are a range of alternative persons who a whistleblower can approach if a worker feels unable to approach their manager; and
• any clauses in any settlement agreements or non-disclosures agreements (including confidentiality clauses in the employment contract) must not prevent workers from making disclosures in the public interest.

In the UK, only certain “protected disclosures” will be protected under the Employment Rights Act 1996. There are several conditions, one of which is that the disclosure of the information must “tend to show” that one or more types of failures or wrongdoing has occurred or is likely to occur (each a “relevant failure”):  

• a criminal offence has been committed, is being committed or is likely to be committed;
• a person has failed, is failing or is likely to fail to comply with any legal obligation to which he or she is subject;
• a miscarriage of justice has occurred, is occurring or is likely to occur;
• the health or safety of any individual has been, is being or is likely to be endangered;
• the environment has been, is being or is likely to be damaged; or
• information tending to show any matter falling under the categories above is being or is likely to be deliberately concealed.

There is no requirement that the qualifying disclosure must relate to a relevant failure or failures of the employer. The disclosure can relate to a relevant failure of the employer, an individual employed or engaged by the employer or a third party.

There is also no requirement that the relevant failure occurs or would occur in the UK. It could occur, or be occurring, outside of the UK.

The other conditions are set out in question 14.

The UK Corporate Governance Code recommends public-listed companies implement whistleblowing procedures.

Financial services firms regulated by the Financial Conduct Authority or the Prudential Regulation Authority will be subject to regulatory rules and requirements that govern the terms and operation of their whistleblowing procedures.

There is no specific legal definition of “a whistleblower” under UK law.

Whistleblowing legislation in the UK protects a wide range of individuals. The following individuals can be a whistleblower:

• employees;
• employee shareholders; and
• an extended definition of workers, including:
  • agency workers;
  • self-employed medical practitioners in the NHS and student nurses/midwives;
  • police officers;
  • homeworkers and freelancers; and
  • trainees.

The level of legal protection will depend on the status of the individual (please see question 23).

Yes. In the UK, only certain “protected disclosures” will be protected under the Employment Rights Act 1996. A protected disclosure must satisfy three main conditions. It must:

• be a disclosure of information;
• be a “qualifying disclosure”, meaning that in the reasonable belief of the worker making the disclosure it is made in the public interest and tends to show that one or more types of failures or wrongdoing has occurred or is likely to occur (for details of relevant failures or wrongdoing please see question 10); and
• be made under the specific methods of disclosure depending on the recipient of the disclosure.

Regarding the “methods” of disclosure (ie, to whom disclosure is made), the disclosure requirements range from limited requirements for an internal disclosure to an employer up to more stringent requirements for external disclosures to a third party outside of the employer’s organisation.

Minimum Requirements

A qualifying disclosure is made where the worker makes the disclosure to:

• the employer;
• a third party authorised by the employer to receive qualifying disclosures;
• their legal adviser in the course of obtaining legal advice; or
• to a Government minister if the worker’s employer is a statutory appointed individual or body (for example, an executive non-departmental public body or an NHS body).

In such cases, there are no additional requirements over and above the general conditions 1 and 2 set out above.  

Moderate Requirements

A qualifying disclosure is made where the worker makes the disclosure to:

• a responsible person. In this instance, the worker must reasonably believe the relevant failure relates solely or mainly to:
  • the conduct of a person other than the employer; or
  • any other matter for which a person other than the employer has responsibility; or
• any “prescribed persons” named in a relevant order. This includes, but is not limited to, HM Revenue and Customs, The Office of Communications (Ofcom), the Financial Conduct Authority and the Health and Safety Executive. However, in this instance, a worker must reasonably believe that:
  • the relevant failure is within the remit of the prescribed person; and
  • the information disclosed and any allegation contained in it is substantially true.

Stricter Restrictions

Under UK law, a worker may make an external disclosure to a third-party organisation (eg, the press, and union officials); however, for such disclosures to be protected four additional conditions must be met.

The worker must:

• reasonably believe that the information they have disclosed and any allegation contained in it is substantially true;
• not have made the disclosure for personal gain;
• either:
  • reasonably believe (when they made the disclosure) that they will be subjected to a detriment by their employer if they make a disclosure to the employer or prescribed person;
  • (where there is no prescribed person) reasonably believe that if they were to make the disclosure to the employer, it is likely that evidence surrounding the relevant failure will be concealed or destroyed; or
  • have already made a disclosure of substantially the same information to their employer or a prescribed person.
• The fourth and final test is that, in all the circumstances of the case, it must be reasonable for the worker to make the external disclosure.

However, where an external disclosure relates to an “exceptionally serious” failure the conditions are slightly less stringent. The conditions are:

• the worker must reasonably believe that the information disclosed, and any allegation contained in it, is substantially true;
• the worker must not make the disclosure for personal gain;
• the relevant failure must be of an exceptionally serious nature (eg, rare cases of extreme public concern); and
• in all the circumstances, it is reasonable for the worker to make the external disclosure. 

Yes. The Department for Business Innovation and Skills  guidance on whistleblowing recognises that it is good practice to have a facility for anonymous reporting. However, it recommends that workers should be made aware that if a disclosure is made anonymously it may be more difficult for the individual to qualify for protection as a whistleblower. There will be no documentary evidence linking the worker to the disclosure for an employment tribunal to consider.

No. The worker must have a “reasonable belief” that the information disclosed tends to show one of the relevant types of wrongdoing.

Under the Employment Rights Act 1996, there is no requirement to have a whistleblowing procedure and, therefore, there are no prescribed terms and conditions.

Yes. In the UK, in addition to the general conditions that amount to a “protected disclosure”, there is essentially a tiered system of disclosure depending on to whom the disclosure is made. The disclosure requirements range from limited requirements for an internal disclosure to an employer up to more stringent requirements for external disclosures to a third party outside of the employer’s organisation. Please see question 11 for further details.

A protected disclosure may trigger a requirement to inform an external authority. This will ultimately depend on the nature of the company, the protected disclosure and the relevant failure disclosed. For example, if the disclosure relates to a regulatory breach, a regulated employer may need to inform the Financial Conduct Authority, or a disclosure that indicates money laundering would need to be disclosed to the National Crime Agency.

No. There are no sanctions for false reporting under the Employment Rights Act 1996.  

While the worker must have a “reasonable belief” that the information disclosed tends to show one of the relevant types of wrongdoing, there is no requirement for the worker to prove that the allegations or facts are, in fact, true. Certain disclosures carry a higher test and require the worker to show that they believed the facts were “substantially true”.  Please see the stricter restrictions outlined in question 11.

To qualify as a protected disclosure the worker must reasonably believe that the disclosure is made in the public interest. There is no longer a legal requirement that the disclosure is made in “good faith”. However, tribunals do have a statutory power to reduce compensation for unfair dismissal by up to 25 per cent where the tribunal believes that the disclosure was not made in good faith. If a disclosure is deliberately falsely made, the whistleblower may be subject to disciplinary proceedings.

The Employment Rights Act 1996 does not provide for specific sanctions for obstructing a whistleblower. However, in the UK, workers are protected against suffering a detriment on the grounds of making a protected disclosure and the dismissal of an employee will be automatically unfair if the reason or principal reason for the dismissal is that they have made a protected disclosure. For further details of the scope of protection please see question 23.

To gain statutory protection, a whistleblower must follow the correct procedure for disclosing the qualifying disclosure as outlined in question 14.

There are two main types of protection for whistleblowers under the Employment Rights Act 1996: protection against being subjected to a detriment and against unfair dismissal. The type of protection an individual whistleblower has depends on their legal status. Employees have more protection than workers.

Detriment: All workers have a right not to be subjected to any detriment on the ground they have made a protected disclosure. The definition of worker is wide (as outlined in question 13).

A worker must have:

• made a protected disclosure;
• suffered an identifiable detriment; and
• been subjected to the detriment by an act or deliberate omission of the employer, another worker or agent and this must have been done on the ground that the worker had made a protected disclosure.

There is no definition of “detriment” under the Employment Rights Act 1996. Detriment is interpreted widely. Examples include, but are not limited to:

• suspending a worker;
• disciplinary action;
• changes to the worker’s role or workplace;
• exposing the worker as a whistleblower; and
• giving a bad reference.

Workers have three months from the date of the act or omission to bring a claim. Liability for detriment claims is uncapped.  In successful claims, a worker will be awarded a compensatory award to cover financial losses together with an injury to feelings award.

Automatic unfair dismissal: An employee will be automatically unfairly dismissed if the reason or principal reason for the dismissal is the fact that the employee made a protected disclosure. Workers do not have unfair dismissal protection under UK law.

An employee will be deemed to have been dismissed where:

• the contract of employment was terminated by the employer (whether with or without notice);
• the employee was employed under a fixed-term contract and the contract expired without being renewed on the same terms; or
• the employee has been constructively dismissed.

The selection of an employee for redundancy is automatically unfair if the reason or principal reason for the section is that the worker made a protected disclosure.

Employees have three months from the date of termination to bring a claim. Employees do not need a minimum length of service to have protection. Compensation for automatic unfair dismissal is uncapped.

There are no specific “support measures” outside of the legal protection under UK whistleblowing laws (outlined in question 23).  However, the UK whistleblowing charity Protect operates a free, confidential whistleblowing advice line.

The Employment Rights Act 1996 does not provide for specific sanctions for abusive reporting. Please see question 20 for further details.  

The main consequence of non-compliance with the statutory whistleblowing procedure will be that the worker will not be deemed to have made a protected disclosure. As a result, they will not be in a position to bring a claim under the relevant whistleblowing protections.