The Legal Framework for Whistleblowing in Malta: A Guide for Employers and Employees

1 – Who is a whistleblower?

The term ‘whistleblower’ refers to any employee who submits a disclosure to the designated Whistleblowing Reporting Officer, regardless of whether such disclosure qualifies as a protected disclosure. The status and protection of whistleblowers are regulated by the Protection of the Whistleblower Act (Chapter 527).

2 – Who qualifies as a whistleblower under the Act?

The term ‘employee’ refers to any person who has entered into, or is engaged under, a contract of service with an employer. This definition also encompasses:

• Contractors
• Sub-contractors who perform work, provide services, or agree to carry out such work or services.
• Any person working under another person’s direct supervision, including outworkers, except professionals bound by professional secrecy obligations.
• Former workers;
• Seconded workers;
• Candidates for employment;
• Volunteers;
• Shareholders;
• Persons forming part of the administrative, management, or supervisory body of a company, and;
• Trainees.

3 – Who has the obligation to establish whistleblowing procedures?

In accordance with the Protection of the Whistleblower Act (Cap. 527), the duty to implement whistleblowing procedures is imposed on employers,  including both public sector bodies and private sector entities.

As a general rule, in the private sector, this obligation applies to organisations that employ fifty (50) or more workers.  However, this obligation also applies to private sector organisations with fewer than fifty (50) employees, where a risk assessment which takes into account the nature of the organisation’s activities and the degree of risk involved (particularly with respect to public health and the environment) justifies such inclusion.

In addition, certain sectors, such as financial services products and markets, and those particularly exposed to money laundering and terrorist financing risks, are already governed by Union legislation that requires the creation of an internal reporting system. These requirements apply to all entities within these sectors, irrespective of their size. Voluntary organisations raising over five hundred thousand euro (€500,000) annually through public donations must also implement whistleblowing procedures.

Employers falling within the above mentioned categories are required to establish secure internal channels for receiving and handling reports. They must appoint a whistleblowing reporting officer responsible for following up on disclosures, maintaining the confidentiality of the whistleblower’s identity, and providing employees information about such procedures.

Private sector organisations employing between fifty (50) and two hundred and forty-nine (249) workers are permitted to share resources for the purpose of receiving and investigating reports. Nonetheless, they remain bound to comply fully with the statutory obligations concerning confidentiality, the provision of feedback, and the effective handling of reported breaches.

4 – What matters can be reported?

In terms of the Protection of the Whistleblower Act (Cap. 527), matters that may be reported are classified as improper practices. This designation refers to any act or series of acts that fall within any of the following categories:

• Failure to comply with a legal obligation;
• Danger or risk to the health or safety of an individual;
• Harm or risk thereof to the environment;
• Corrupt practices and bribery, whether already committed, ongoing or anticipated;
• Criminal offences committed, being committed, or likely to be committed;
• Miscarriage of justice;
• Failures relating to regulatory obligations, including those concerning:
  • Public procurement law;
  • Financial services, markets and products;
  • Prevention of money laundering and terrorist financing;
• Breaches of sector-specific legal requirements;
  • Product safety and compliance;
  • Transport safety;
  • Radiation and nuclear safety;
  • Food and feed safety;
  • Animal health and welfare
• Violation of fundamental rights and protections, such as;
  • Consumer protection laws;
  • Data protection and privacy rules;
  • Security of network and information systems;
• Breaches affecting the financial interest of the European Union;
• Breaches connected to the internal market under Article 26(2)TFEU;
• Deliberate concealment of information relating to any of the categories above.

5- How can reports be submitted?

According to the Protection of the Whistleblower Act (Cap. 527), reports may be made in three distinct ways.

(i) Internal disclosures: Reporting persons can report wrongdoings to an internal officer who will refer the report for further follow-up while retaining the identity of the reporting person in strict confidentiality. The reporting person will remain anonymous and therefore protected from retaliation at the workplace.

Every employer is required to establish secure internal reporting channels through which employees may send reports. These channels must allow reports to be made either in writing or orally, such as by telephone, voice messaging systems, or, upon request, during a physical meeting. Reports are normally addressed to a whistleblowing reporting officer, although in certain cases they may be made directly to the head or deputy head of the organisation.

(ii) External Disclosures: If no such internal channel is in place, or the report is not investigated effectively, the reporting person may report externally to one of the competent authorities mentioned in the law. In such cases, a report is made directly to an external whistleblowing reports unit established within a competent authority listed in the First Schedule of the Act: The Commissioner of Revenue (CfR), Financial Intelligence Analysis Unit (FIAU), Malta Financial Services Authority (MFSA), Commissioner for Voluntary Organisation (CVO), Permanent Commission Against Corruption and the Ombudsman.

(iii) Public Disclosures: This is considered a last resort and may only be used under specific circumstances. A whistleblower may disclose information directly to the public, such as through the media, if both internal and external reporting channels have already been used and no action was taken within the legally required timeframes. Public disclosure is also permitted when there is an imminent or manifest danger to the public interest, such as in cases of emergencies or irreversible harm. In addition, it may be justified if there is a risk of retaliation against the whistleblower or if there is a low prospect of the breach being effectively addressed. This may occur if there is a risk of evidence being destroyed or if the authority is implicated in the misconduct.

6- Who is responsible for investigating reports?

The investigation of these reports shall be the responsibility of the Whistleblowing Reporting Officer (WRO). The employer is required to designate an impartial WRO who shall be accountable for managing all reports received, including evaluating the accuracy of the allegations and, where applicable, addressing any improper practices identified.

In the execution of their duties, the WRO must ensure full compliance with the General Data Protection Regulation (GDPR) and all applicable local data protection laws.

The functions of the WRO include maintaining ongoing communication with the whistleblower, requesting additional information when necessary, providing timely feedback, and keeping a comprehensive record of each report received.

7 – What are the timeframes for acknowledging and investigating reports?

With respect to internal disclosures, the Whistleblowing Reporting Officer (WRO) shall acknowledge receipt of an internal disclosure within seven (7) days from the date of submission. Feedback regarding the disclosure shall be provided within a reasonable timeframe, not exceeding three (3) months from the date of acknowledgment.

In cases where the disclosure leads to the identification of an improper practice that constitutes a criminal offence or legal contravention, the WRO may refer the matter to the police for investigation. However, if the subject matter of the disclosure has been remedied, no provision of law shall be construed as imposing an obligation on the WRO to report the matter further.

Whistleblowers can make external disclosures to authorities listed in Schedule 1. These authorities must assess the disclosure within forty-five (45) days and determine whether it is appropriate to handle the matter externally. Where it is apparent that corrective measures have been taken to address the improper practice, the WRO is not required to notify the person who made the disclosure.

Should the authorities conclude that the disclosure was improperly made, it shall provide written notification to the whistleblower regarding the outcome within a further period not exceeding forty-five (45) days. If the disclosure is deemed valid, these authorities shall provide the whistleblower with written updates regarding the status of the reported improper practice within a reasonable timeframe.

8 – What protections are afforded to whistleblowers?

A whistleblower is entitled to protection under the Act when making a disclosure, whether internal, external, or public, provided it is made in accordance with the law. Protection applies to individuals who act in good faith and have reasonable grounds to believe that the reported information is accurate and falls within the scope of the Act.

Whistleblowers are protected against all forms of detrimental action, including dismissal, demotion, harassment, intimidation, discrimination, loss, damage, or the initiation of civil, criminal, or disciplinary proceedings. This protection does not extend to situations where the whistleblower is directly involved in the wrongdoing, although courts may reduce or waive liability at their discretion.

Protection also covers facilitators, colleagues, relatives, and legal entities that are connected to the whistleblower. The identity of the whistleblower is strictly confidential and cannot be disclosed without explicit consent.

Where retaliation occurs or is likely, whistleblowers are entitled to seek judicial relief, which may include compensation, reinstatement, or interim measures. Any agreement that seeks to restrict or prevent protected disclosures shall be deemed null and void.

9 – How are anonymous reports treated?

Under the Protection of the Whistleblower Act (Cap. 527), anonymous reports are treated differently from other types of disclosures.

The law makes it clear that an anonymous disclosure is not considered a protected disclosure. This means that if a person makes a report without revealing their identity, they will not automatically receive the protections that the Act gives to whistleblowers, such as protection from retaliation or detrimental action.

However, the Act still allows whistleblowing reporting officers or external whistleblowing reports units to receive and process anonymous disclosures. Even though they are not protected disclosures, such reports must still be examined and taken into account when determining whether an improper practice has occurred. In this way, anonymous reports are not ignored, but the legal safeguards for the whistleblower do not apply unless their identity is known.

Nevertheless, there is an important exception. If an anonymous report later becomes linked to an identified whistleblower, and that person suffers retaliation, the disclosure will then qualify as a protected disclosure, provided it meets the conditions laid down in the Act.

10 – What constitutes a protected disclosure?

A protected disclosure is a disclosure made by a whistleblower who has reasonable grounds to believe that the information they are reporting is true at the time of disclosure and that the information falls within the scope of the Act. The disclosure must be made either internally, externally, or it must be a public disclosure.

Protections under this Act do not apply if an employee knowingly discloses information that is false or that they ought reasonably to know is false.

11 – What legal avenues are available to whistleblowers when facing retaliation from their employer, and how is jurisdiction divided between the Civil Courts and the Industrial Tribunal?

In Malta, a whistleblower who suffers detrimental action, such as dismissal, victimisation, intimidation, harassment, or any other harm as a result of making a protected disclosure may seek legal remedies before the First Hall Civil Court under Chapter 527. This court is empowered to address claims involving detrimental action in reprisal for whistleblowing, including through the issuance of injunctions, interim orders, and awarding compensation, even for moral damages.

On the other hand, the Industrial Tribunal has exclusive jurisdiction under Chapter 452 for specific employment disputes, such as unfair dismissal.

Recently, the First Hall Civil Court, in cases numbered 170/2022DC and 133/2021MH, issued two preliminary rulings clarifying that not every dispute related to employment or dismissal, falls under the exclusive authority of the Industrial Tribunal, particularly in matters involving whistleblowing.

Additionally, the Court concluded that, a complaint before the Industrial Tribunal for unfair dismissal does not exclude the right of the whistleblower to institute a parallel action before the Civil Courts in terms of Chapter 527, and that both actions, can be pursued simultaneously.