Chapter 527

PROTECTION OF THE WHISTLEBLOWER [ CAP. 527. 1 PROTECTION OF THE WHISTLEBLOWER ACT ARRANGEMENT OF ACT Articles Part I Preliminary and General 1-2 Part II Prohibition of Detrimental Action 3-8 Part III Disclosures 9 - 18 Section 1 Protected Disclosures 9 - 11 Section 2 Internal Disclosures 12 - 14 Section 3 External Disclosures 15 - 18 Section 4 Public Disclosures 18A Offences and Penalties 19 Part IV Part V Regulations and Guidelines Part VI Miscellaneous 20 21 - 23 2 [ CAP. 527. PROTECTION OF THE WHISTLEBLOWER CHAPTER 527 PROTECTION OF THE WHISTLEBLOWER ACT To make provision for procedures in terms of which employees in both the private sector and the public administration may disclose information regarding improper practices by their employers or other employees in the employ of their employers and to protect employees who make said disclosures from detrimental action. 15th September, 2013 * ACT VIII of 2013 as amended by Acts LXVII of 2021 and XXXV of 2023. PART I PRELIMINARY AND GENERAL Short title. Definitions. Amended by: LXVII.2021.2. Cap. 9 1. The short title of this Act is the Protection of the Whistleblower Act. 2. (1) In this Act, unless the context otherwise requires: "authority" means the entities prescribed to receive external disclosures, as listed in the First Schedule; "bribery" means any conduct in violation of articles 112 or 115 or of article 121 insofar as it extends the application of articles 112 and 115 of the Criminal Code; "contract of service" means: (i) an agreement whether oral or in writing, in any form, whereby a person binds himself to render service to or to do work for an employer, in return for remuneration; and (ii) an agreement, even if implied, whereby a person agrees to render services for or at the request of a voluntary organisation without remuneration; Cap. 326. "corrupt practices" has the same meaning as is assigned to it by article 6 of the Permanent Commission against Corruption Act; "detrimental action" includes: (a) action causing injury, loss or damage; and, or (b) victimisation, intimidation or harassment; and, or (c) occupational detriment; and, or Cap. 9. (d) prosecution under article 101 of the Criminal Code relating to calumnious accusations and, or; (e) civil or criminal proceedings; proceedings or disciplinary "disciplined force" has the same meaning as assigned to it in Article 47(1) of the Constitution; "disclose" or "to disclose" means the oral or written *see article 1(2) as originally enacted, and Legal Notice 235 of 2013. PROTECTION OF THE WHISTLEBLOWER [ CAP. 527. communication of information on improper practice; "employee" means: (a) any person who has entered into or works under a contract of service with an employer and includes a contractor or subcontractor who performs work or supplies a service or undertakes to perform any work or to supply services; or (b) any person who has undertaken personally to execute any work or service for, and under the immediate direction and control of another person, including an outworker, but excluding work or service performed in a professional capacity to which an obligation of professional secrecy applies in terms of the Professional Secrecy Act when such work or service is not regulated by a specific contract of service and "outworker" means a person to whom articles, materials or services of any nature are given out by an employer for the performance of any type of work or service where such work or service is to be carried out either in the home of the outworker or in some other premises not being under the control and management of that other person; or Cap. 371 (c) any person in employment in the public administration, including as a member of a disciplined force; (d) any former employee; (e) any person who is or was seconded to an employer; or (f) any volunteer in terms of article 2(1) of the Voluntary Organisations Act even when such work or service is not regulated by a specific contract of service; (g) any candidate for employment only where information concerning improper practices has been acquired during the recruitment process or other pre-contractual negotiations; (h) shareholders and persons belonging to the administrative, management or supervisory body of an undertaking, including non-executive members, and paid or unpaid trainees; "employer" means any natural person, legal organisation or statutory body whether forming part of the public administration or the private sector who: (a) enters into a contract of service with an employee; or (b) who employs or engages or permits any other person in any manner to assist in the carrying on or conducting of his business; or (c) who seeks to employ other persons, and shall include a voluntary organisation in relation to volunteers who render services to such voluntary organisation on a voluntary basis or otherwise; Cap. 492. 3 4 [ CAP. 527. PROTECTION OF THE WHISTLEBLOWER "external disclosure" is a disclosure made in accordance with Section 3 of Part III; "External Whistleblowing Disclosure Unit" means with respect to the public administration, such section, body or unit as may be established to carry out the functions designated in article 17; "facilitator" means a person who assists a reporting person in the reporting process in a work-related context, and whose assistance should be confidential; "feedback" means the provision to the reporting person of information on the action envisaged or taken as follow-up and on the grounds for such follow-up; "follow-up" means any action taken by the recipient of a disclosure or any competent authority, to assess the accuracy of the allegations made in the report and, where relevant, to address the improper practice reported, including through actions such as an internal enquiry, an investigation, prosecution, an action for recovery of funds, or the closure of the procedure; "guidelines" means the set of rules issued by an authority, from time to time for the further implementation of the provisions of this Act, and any regulations made hereunder; "improper practice" means an action or a series of actions whereby: (a) a person has failed, is failing or is likely to fail to comply with any legal obligation to which he is subject; or (b) the health or safety of any individual has been, is being or is likely to be endangered; or (c) the environment has been, is being or is likely to be damaged; or (d) a corrupt practice has occurred or is likely to occur or to have occurred; or (e) a criminal offence has been committed, is being committed or is likely to be committed; or (f) a miscarriage of justice has occurred, is occurring or is likely to occur; or (g) bribery has occurred or is likely to occur or to have occurred; or (h) a person has failed, is failing or is likely to fail to comply with any legal obligation on public procurement to which he is subject; or (i) a person has failed, is failing or is likely to fail to comply with laws on financial services, products and markets, and prevention of money laundering and terrorist financing; or (j) a person has failed, is failing or is likely to fail to PROTECTION OF THE WHISTLEBLOWER [ CAP. 527. comply with product safety and compliance law; or (k) a person has failed, is failing or is likely to fail in ensuring transport safety; or (l) a person has failed, is failing or is likely to fail in ensuring radiation protection and nuclear safety; or (m) a person has failed, is failing or likely to fail in ensuring a food and feed safety, animal health and welfare; or (n) a person has failed, is failing or is likely to fail to comply with any legal obligation on consumer protection to which he is subject; or (o) a person has failed, is failing or is likely to fail to comply with any legal obligation on protection of privacy and personal data, and security of network and information systems to which he is subject; or (p) a breach affecting the financial interests of the European Union as referred to in Article 325 of the Treaty on the Functioning of the European Union (TFEU) and further specified in relevant European Union measures has occurred or is likely to occur or to have occurred; or (q) a breach relating to the internal market, as referred to in Article 26(2) of the Treaty on the Functioning of the European Union (TFEU), including breaches of European Union competition and State aid rules, as well as breaches relating to the internal market in relation to acts which breach the rules of corporate tax or to arrangements the purpose of which is to obtain a tax advantage that defeats the object or purpose of the applicable corporate tax law has occurred or is likely to occur or to have occurred; or (r) information tending to show any matter falling within any one (1) of the preceding paragraphs has been, is being or is likely to be deliberately concealed: Provided that, in the interpretation of this definition due account shall be given to the de minimis rule so that very minor or trivial matters shall not fall under the provisions of this Act; "information on improper practices" means information, including reasonable suspicions, about actual or potential improper practices, which occurred or are very likely to occur in the organisation in which the reporting person works or has worked or in another organisation with which the reporting person is or was in contact through his work, and about attempts to conceal such breaches; "internal disclosure" is a disclosure made in accordance with Section 2 of Part III; "member", in relation to a disciplined force, includes any person who under the law regulating the discipline of that force, is subject 5 6 [ CAP. 527. PROTECTION OF THE WHISTLEBLOWER to that discipline; "Minister" means the Minister responsible for justice; "occupational detriment", means any direct or indirect act or omission which occurs in a work related context, which is prompted by internal or external disclosures or by public disclosure, and which causes or may cause unjustified detriment to the whistleblower and may include: (a) suspension, lay-off, dismissal or equivalent measures; (b) demotion or withholding of promotion; (c) transfer of duties, change of location of place of work, reduction in wages, change in working hours; (d) withholding of training; (e) a negative performance assessment or employment reference; (f) imposition or administering of any disciplinary measure, reprimand or other penalty, including a financial penalty; (g) coercion, intimidation, harassment or ostracism; (h) discrimination, disadvantageous or unfair treatment; (i) failure to convert a temporary employment contract into a permanent one, where the worker had legitimate expectations that he would be offered permanent employment; (j) failure to renew, or early termination of, a temporary employment contract; (k) harm, including to the person's reputation, particularly in social media, or financial loss, including loss of business and loss of income; (l) blacklisting on the basis of a sector or industry-wide informal or formal agreement, which may entail that this person will not, in the future, find employment in the sector or industry; (m) early termination or cancellation of a contract for goods or services; (n) cancellation of a licence or permit; (o) psychiatric or medical referrals; (p) being subjected to any disciplinary action including for breach of ethics or confidentiality; (q) being subjected to a term or condition of employment or retirement which is altered or kept altered to his disadvantage: Provided that, this shall not apply where the action is taken where the direct or indirect act or omission is administratively or commercially justifiable for organizational reasons; "organisation" means any legal entity, whether having legal PROTECTION OF THE WHISTLEBLOWER [ CAP. 527. personality or not; "person" means a natural person; "person concerned" means a natural or legal person who is referred to in the report or public disclosure as a person to whom the improper practice is attributed or with whom that person is associated; "protected disclosure" means an internal disclosure or an external disclosure of information, made in writing or in any format which may be prescribed; "public administration" has the meaning as is assigned to it by article 2(1) of the Public Administration Act; Cap. 595. ""public disclosure" means a disclosure made in accordance with Section 4 of Part III; and "statutory body" means any corporation or other body corporate established by law; "voluntary organisation" has the same meaning as is assigned to it by article 2(1) of the Voluntary Organisations Act irrespective of whether such organisation is enrolled in terms of the said Act; "whistleblower" means any employee who makes a disclosure to a whistleblowing reporting officer or a whistleblowing reports unit, as the case may be, whether it qualifies as a protected disclosure or not under this Act; "whistleblowing reporting officer" means such officer within an employer charged with carrying out the functions designated by article 12; "whistleblowing reports unit" means such officer, office or section within an authority to carry out the functions designated by article 17 and, with respect to the public administration, the External Whistleblowing Disclosure Unit; "work-related context" means current or past work activities in the public or private sector through which, irrespective of the nature of those activities, persons acquire information on improper practices and within which those persons may suffer retaliation if they reported such information. (2) Where this Act refers to a matter which may be prescribed, unless this Act expressly designates the person authorised and the manner thereof, such matter may be prescribed by the Minister through regulations or by the authority through guidelines or by any one or all of them as may be determined, and in the case of any conflict, a regulation by the Minister shall prevail over a guideline. (3) This Act shall not apply to members of a disciplined force, to members of the Security Service or to persons employed in the foreign, consular or diplomatic service of the Government until the Minister makes regulations regulating the manner in which the provisions of this Act will apply in their regard, and in so doing, the Minister may make not applicable or modify the provisions of Cap. 492. 7 8 [ CAP. 527. PROTECTION OF THE WHISTLEBLOWER this Act as necessary for the purpose of the protection of national security, defence, intelligence, public order and the international relations of the State. (4) Where specific rules on the reporting of breaches are p rovi ded for i n th e sect or-specific laws l isted in the T hi rd Schedule, those laws shall apply. The provisions of this Act shall be applicable to the extent that a matter is not mandatorily regulated in those laws. (5) This Act shall not affect the exercise by workers of their rights to consult their representatives or trade unions, and on protection against any unjustified detrimental action prompted by such consultations as well as on the autonomy of the social partners and their right to enter into collective agreements. This is without prejudice to the level of protection granted by this Act. Extension of applicability to exclusive economic zone area or environment protection area. Added by: XXXV.2023.80. Cap. 362. Cap. 625. 2A. The provisions of this Act and of any subsidiary legislation made thereunder shall also apply, in accordance with the provisions of the 1982 United Nations Convention on the Law of the Sea as ratified by the Law of the Sea (Ratification) Act, to an exclusive economic zone area or an environment protection area as defined in the Exclusive Economic Zone Act. Any artificial island, installation, structure, equipment or device therein shall, solely for the purposes of this Act and any subsidiary legislation made thereunder, be treated as if they were situated in Malta itself. PART II PROHIBITION OF DETRIMENTAL ACTION Prohibition of detrimental action. 3. Subject to the exceptions stated in this Act, despite any prohibition of or restriction on the disclosure of information under a n y e n a c t m e n t , r u l e o f l a w, c o n t r a c t , o a t h o r p r a c t i c e a whistleblower may not be subjected to detrimental action on account of having made a protected disclosure. Protected disclosure. Amended by: LXVII.2021.3. Cap. 9. 4. (1) Notwithstanding the provisions of the Criminal Code or of any other law, a whistleblower who makes a protected disclosure is not liable to any civil or criminal proceedings or to a disciplinary proceeding for having made such a disclosure. (2) The protection afforded to a whistleblower shall not be prejudiced on the basis only that the whistleblower making the disclosure was, in good faith, mistaken about its import or that any perceived threat to the public interest on which the disclosure was based has not materialised or that the person making the disclosure has not fully respected the procedural requirements of this Act or of any regulations or guidelines made under this Act. (3) The protection afforded to a whistleblower shall, where relevant, be extended to: (a) facilitators; (b) third persons who are connected with the reporting persons and who could suffer retaliation in a work- PROTECTION OF THE WHISTLEBLOWER [ CAP. 527. 9 related context, such as colleagues or relatives of the reporting persons; (c) legal entities that the reporting persons own, work for or are otherwise connected with in a work-related context; and (d) legal aid in criminal and in cross-border civil proceedings in accordance with the relevant provisions of the Criminal Code and Directive 2008/52/EC of the European Parliament and of the Council of 21 May 2008 on certain aspects of mediation in civil and commercial matters and in accordance with national law, legal aid in further proceedings and legal counselling or other legal counselling. (4) Cap. 9. The whistleblower shall have access to: (a) comprehensive and independent information and advice, which is easily accessible to the public and free of charge, on procedures and remedies available, on protection against retaliation, and on the rights of the person concerned; (b) effective assistance from competent authorities before any relevant authority involved in their protection against retaliation, including, where provided for under national law, certification of the fact that they qualify for protection under this Act; and (c) legal aid in criminal and in cross-border civil proceedings in accordance with Directive (EU) 2016/ 1919 of the European Parliament and of the Council of 26 October 2016 on legal aid for suspects and accused persons in criminal proceedings and for requested persons in European arrest warrant proceedings and Directive 2008/52/EC of the European Parliament and of the Council of 21 May 2008 on certain aspects of mediation in civil and commercial matters and, in accordance with national law, legal aid in further proceedings and legal counselling or other legal assistance. 5. (1) Subject to the provisions of the proviso to sub-article (2), and to the provisions of sub-articles (3) and (4), nothing in this Part shall prevent the institution of criminal proceedings against the whistleblower where the said whistleblower was the perpetrator or an accomplice in an improper practice which constitutes a crime or contravention under any applicable law prior to its disclosure. (2) Subject to the provisions of sub-paragraph (ii) of subarticle (3), nothing in this Part shall be interpreted as providing immunity to any person making a disclosure about an improper practice from any disciplinary or civil proceedings or liability arising from his own conduct: Provided that: (i) any court or tribunal taking cognizance of proceedings No immunity to whistleblower if he was the perpetrator or an accomplice 10 [ CAP. 527. PROTECTION OF THE WHISTLEBLOWER instituted against any whistleblower based on the fact that the said person was the perpetrator or was an accomplice in the improper practice reported by the said person shall, in giving its judgement or decision take into due account the fact that the disclosure was made by such person in such manner as it deems appropriate and the punishment of such whistleblower may be mitigated or remitted and the court or tribunal shall expressly refer to the provisions of this article in its judgement; and (ii) in any civil proceedings instituted against a whistleblower based on the fact that the said person was the perpetrator or was an accomplice in the improper practice reported by the same person, the court shall, if it finds that the whistleblower is responsible for the payment of damages only hold him liable for such part of the damage as he may have caused and shall, notwithstanding the provisions of articles 1049, 1050 and 1051A of the Civil Code or of any other law, hold not him liable jointly and severally with others: Provided that the exemption from joint and several liability provided for in this sub-paragraph shall not apply in the case of damages resulting from wilful homicide or from grievous bodily harm; and (iii) where the whistleblower is an employee of the public administration and disciplinary proceedings are instituted against him based on the fact that he was the perpetrator or was an accomplice in the said improper practice reported by him, the public administration shall endeavour to mitigate the effects of any punishment, and shall, where possible, not seek dismissal as the punishment inflicted in the said disciplinary proceedings. (3) Notwithstanding the provisions of this article, where in criminal proceedings as provided for in sub-article (1) instituted against a whistleblower (i) the prosecution declares in the records of the proceedings that the accused has disclosed an improper practice which constitutes a criminal offence liable to a punishment of imprisonment of more than one year which has helped the police to apprehend the person or persons who committed the said criminal offence; or (ii) the whistleblower proves to the satisfaction of the court that his whistleblowing report has so helped the police, the punishment for such crime shall be diminished as regards imprisonment by one or two degrees and as regards any pecuniary penalty by one-third or one-half: Provided that the court may, if it considers that the PROTECTION OF THE WHISTLEBLOWER [ CAP. 527. 11 circumstances of the case so merit, after hearing all the evidence and after convicting the whistleblower either further reduce the p un i s h m e n t o r e x e m p t t h e wh i s t l e b l o w e r f r o m p un i s h m e n t completely: Provided further that when it applies the above proviso to exempt the whistleblower from punishment completely the court shall make a report to the President of the Republic stating the reasons for its action and shall expressly refer to the provisions of this article in its report. (4) The Attorney General, after having consulted the Commissioner of Police and a judge of the superior courts who at the time of the consultation is not a judge assigned to take cognizance of criminal trials, may, if in his individual judgement he is satisfied of the advisability to do so, whether unconditionally or under such conditions as he deems fit, issue a certificate in writing exempting any whistleblower to which sub-article (1) applies from any criminal proceedings as provided for in sub-article (1) and in such case the Attorney General shall make a report to the President of the Republic stating the reasons for his action and shall expressly refer to the provisions of this article in his report. 6. (1) Every whistleblowing reporting officer or whistleblowing reports unit to whom a protected disclosure is made or referred must not disclose information that identifies or may lead to the identification of the whistleblower unless the whistleblower expressly consents in writing to the disclosure of that information. Prohibition of disclosure of information to identify the whistleblower. Amended by: LXVII.2021.4. (2) The whistleblowing reports unit shall not communicate the contents of the disclosure to other departments within the authority of which it forms part until it has duly investigated the disclosure and it has established that it is necessary or appropriate in the public interest for further investigation to be carried out by such other departments or with the police in relation to an improper practice which constitutes a crime or contravention under any law. Notwithstanding any other law, the authority shall not be restricted in any manner in sharing information with the whistleblowing reports unit about its investigations from time to time for the whistleblowing reports unit to determine whether it has any relevant information on the subject matter under investigation. (3) Guidelines may be issued by each authority setting out – (a) the duties of communication between the whistleblowing reports unit and the whistleblower and the restrictions thereon; and (b) the rules for disclosure to other departments of the authority or to other authorities or entities of the State. (4) The protection provided for in this article shall not be subject to any exceptions and no court may order the disclosure of the identity of any whistleblower without his consent. (5) Every whistleblowing reporting officer or whistleblowing reports Unit that receive information on breaches that includes trade secrets as defined under article 2 of the Trade Secrets Act shall not Cap. 589. 12 [ CAP. 527. PROTECTION OF THE WHISTLEBLOWER use or disclose those trade secrets for purposes going beyond what is necessary for proper follow-up. Processing of personal data. Added by: LXVII.2021.5. Cap. 586. S.L. 586.08. 6A. Any processing of personal data carried out pursuant to this Act, including the exchange or transmission of personal data by the whistleblowing reporting officer or whistleblowing reports Unit, shall be carried out in accordance with Regulation (EU) 2016/679 of the European Parliament and of the Council of 27 April 2016 on the protection of natural persons with regard to the processing of personal data and on the free movement of such data, and repealing Directive 95/46/EC (General Data Protection Regulation), the Data Protection Act and the Data Protection (Processing of Personal Data by C om pet ent A uth orit ies fo r th e Purposes of the Preve ntion, Investigation, Detection or Prosecution of Criminal Offences or the Execution of Criminal Penalties) Regulations: Provided that, personal data which are manifestly not relevant for the handling of a specific report shall not be collected or, if accidentally collected, shall be deleted without undue delay. LXVII.2021.5. 6B. Where a person discloses information on breaches falling within the scope of this Act, and that information includes trade secrets, and where that person meets the conditions of this Act, such a disclosure shall be considered lawful under the conditions of article 5(2) of the Trade Secrets Act. Application to the Civil Court. Amended by: LXVII.2021.6. 7. (1) A person who believes that detrimental action has been taken or is to be taken against him in reprisal for a protected disclosure may file an application to the First Hall, Civil Court for - Disclosure of information on breaches under this Act. Added by: Cap. 589. (a) an order requiring the person who has taken the detrimental action to remedy that action; or (b) an injunction. (2) The court, pending the final determination of an application under this article may (a) make an interim order; or (b) grant an interim injunction. (3) If, in determining the application under sub-article (2) the court is satisfied that a person has taken or intends to take detrimental action against a person in reprisal for a protected disclosure, the court may: (a) order the person who took the detrimental action to remedy that action and determine the amount of damages, including, but not limited to, moral damages as the court may determine, due to the person who suffered the detrimental action; or (b) grant an injunction in any terms the Court considers appropriate. (4) In proceedings referred to in sub-article (1), where the whistleblower establishes that he made an internal, external or PROTECTION OF THE WHISTLEBLOWER [ CAP. 527. 13 public disclosure and suffered a detriment, it shall be presumed that the detriment was made in retaliation for the report or the public disclosure. In such cases, it shall be for the person who has taken the detrimental measure to prove that, that measure was based on duly justified grounds. (5) Notwithstanding the provisions of the Code of Organization and Civil Procedure, an injunction granted in terms of sub-article (3)(b) shall be for an indefinite period until an application for its revocation is made and need not be followed by an action on the merits. The provisions of articles 873 and 875 of the Code of Organization and Civil Procedure shall apply to warrants issued under sub-article (3)(b). Cap. 12. (6) The provisions of articles 829 to 838B of the Code of Organization and Civil Procedure shall not apply to injunctions granted in terms of sub-article (3)(b). Cap. 12. (7) Notwithstanding the provisions of Schedule A of the Code of Organization and Civil Procedure, no registry fees shall be charged on an application filed in the First Hall of the Civil Court by the person referred to in sub-article (1) but, if granted, an award on costs shall be made against the respondent. Cap. 12. 8. Any person who may have suffered detrimental action as a result of making a protected disclosure shall, without prejudice to any other right under any other law, have a right to compensation for any damage caused. Right to compensation after detrimental action. PART III DISCLOSURES SECTION 1 PROTECTED DISCLOSURES 9. (1) whistleblower: A disclosure is a protected disclosure if the (a) had reasonable grounds to believe that the information on breaches disclosed was true at the time of the disclosure and that such information fell within the scope of this Act; and (b) disclosed internally in accordance with article 12 or externally in accordance with article 16, or made a public disclosure in accordance with article 18A. (2) The protections conferred by this article do not apply to an employee who knowingly discloses information which he knows or ought to reasonably know is false and any person or organisation, other than the employer or officers or shareholders of the same when an organisation, which is prejudiced by the disclosure of such false information given in a disclosure made under this Act shall not by virtue of this Act be hindered in the exercise of any legal action or in the enforcement of any legal remedy available to that person or organisation under any other law in respect of the said prejudice: Protected disclosure. Amended by: LXVII.2021.7. 14 [ CAP. 527. PROTECTION OF THE WHISTLEBLOWER Provided that such remedy shall only be available if the identity of the whistleblower has been obtained or otherwise disclosed in accordance with the provisions of this Act. Cap. 9. Information protected by legal and medical professional privilege. Substituted by: LXVII.2021.8. Cap. 377. (3) It shall be an offence punishable in accordance with article 101 of the Criminal Code to knowingly provide false information in terms of this Act. 10. (1) Saving the provisions of article 6A(c) of the Professional Secrecy Act, nothing in this Act authorises a person to disclose information protected by legal and medical professional privilege and a disclosure of such information is not a protected disclosure for the purposes of this Act. (2) This Act shall not affect the application of laws relating to the protection of classified information, the secrecy of judicial deliberations and rules on criminal procedure. Anonymously made disclosures. Substituted by: LXVII.2021.9. 11. (1) Anonymously made disclosures shall not be a protected disclosure in terms of this Act. (2) The whistleblowing reporting officer or the whistleblowing reports Unit may receive and process anonymous disclosures and may take that disclosure into consideration in determining whether improper practice has occurred. (3) Despite the provisions of sub-article (1) when following a public disclosure with information on breaches that is made anonymously the whistleblower is subsequently identified and suffers retaliation, that disclosure shall still be a protected disclosure provided that the disclosure satisfies the conditions established in article 9(1). SECTION 2 INTERNAL DISCLOSURES Internal procedures for receiving and dealing with protected information. Substituted by: LXVII.2021.10. 12. (1) Without prejudice to article 16 and article 18A, every employer shall have in operation internal procedures for receiving and dealing with information about improper practice committed within or by that organisation; such internal procedures shall at least include the following: (a) channels for receiving the reports in writing or orally, or both. Oral reporting shall be made possible by telephone or through other voice messaging systems, and, upon request by the reporting person, by means of a physical meeting within a reasonable time frame. Such channels shall be designed, established and operated in a secure manner that ensures that the confidentiality of the identity of the whistleblower and any third party mentioned in the disclosure is protected, and prevents access thereto by nonauthorised staff members; (b) the designation of a whistleblowing reporting officer competent for following-up on the reports which may be the same person or department as the one that PROTECTION OF THE WHISTLEBLOWER [ CAP. 527. 15 receives the protected disclosure and which will maintain communication with the whistleblower and, where necessary, ask for further information from and provide feedback to that whistleblower; (c) diligent follow-up by the designated person or department referred to in paragraph (b). (2) Clear and easily accessible information about the existence of the internal procedures, and adequate information on how to use the procedures shall be published widely within the organisation and shall be republished at regular intervals. Every employer shall also provide clear and easily accessible information regarding the procedures for reporting externally to competent authorities pursuant to article 15 and, where relevant to institutions, bodies, offices or agencies of the European Union. (3) An internal disclosure is a protected disclosure made in accordance with the provisions of this Act if it is made by an employee to an employer substantially in the manner established by internal procedures established by the employer for receiving or dealing with such disclosures. (4) For purposes of Part III Section 2, "employer" means the same as the meaning assigned to it in the Second Schedule: Provided that, this shall not apply to entities falling within the scope of Part I(B) and II of the Third Schedule: Provided further that, organisation in the private sector with fifty (50) to two hundred and forty-nine (249) workers may share resources as regards the receipt of reports and any investigation that shall be carried out. This shall be without prejudice to the obligations imposed upon private sector organisations by this Act to maintain confidentiality, to give feedback, and to address the reported breach. 13. (1) The whistleblowing reporting officer shall acknowledge receipt of an internal disclosure within seven (7) days of receipt and provide feedback within a reasonable time, not exceeding three (3) months from the acknowledgment of receipt or, if no acknowledgment was sent to the reporting person, three (3) months from the expiry of the seven (7) day period after the report was made. (2) For the purposes of article 16, where it is apparent from external action that action has been taken to rectify the improper practice it will not be necessary for the whistleblowing reporting officer to notify the person who made the disclosure. (3) In the event that a disclosure under this Part leads to the detection of an improper practice which constitutes a crime or contravention under any applicable law, the whistleblowing reporting office may refer the report received to the police for investigation thereof: However, should the subject matter of the report have been Notice to whistleblower. Amended by: LXVII.2021.11. 16 [ CAP. 527. PROTECTION OF THE WHISTLEBLOWER rectified no provision of any law shall be interpreted as imposing an obligation on the whistleblowing reporting officer to report such matter. Internal disclosure may be made to the head or deputy head of the organisation. 14. An internal disclosure may be made to the head or deputy h e a d o f t h e o rg a n i s a t i o n , w h o i s h e r e b y d e e m e d t o b e t h e whistleblowing reporting officer and subject to the provisions of articles 6 and 13, if: (a) the organisation has no internal procedures established and published for receiving and dealing with information about an improper practice; or (b) the whistleblower believes on reasonable grounds that the whistleblowing reporting officer is or may be involved in the alleged improper practice; or (c) the whistleblower believes on reasonable grounds that the whistleblowing reporting officer is, by reason of any relationship or association with a person who is or may be involved in the improper practice alleged in the disclosure, not a person to whom it is appropriate to make the disclosure. SECTION 3 EXTERNAL DISCLOSURES Protection of external disclosure. 15. Except as provided in this Part, an external disclosure shall only be protected if an internal disclosure in accordance with Section 2 of this Part has already been made or attempted to be made. External disclosure made to the whistleblowing reports unit. Amended by: LXVII.2021.12. 16. (1) An external disclosure may be made to the whistleblowing reports unit of the authority as provided in the First Schedule directly if the whistleblower believes on reasonable grounds – (a) that the head of the organisation is or may be involved in the improper practice alleged in the disclosure; or (b) that immediate reference to the authority, is justified by the urgency of the matter to which the disclosure relates, or some other exceptional circumstances; or (c) at the time he makes the external disclosure, that he will be subjected to an occupational detriment by his employer if he makes an internal disclosure; or (d) that it is likely that evidence relating to the improper practice will be concealed or destroyed if he makes an internal disclosure; or (e) that although an internal disclosure has previously been made, the whistleblower has not been informed on the status of the matter disclosed or it is reasonably evident to the whistleblower that there has been no action or recommended action on the matter to which the disclosure relates within a reasonable time from the making of the disclosure. PROTECTION OF THE WHISTLEBLOWER [ CAP. 527. 17 (2) In determining for the purposes of sub-article (1) whether it is reasonable for the whistleblower to make the disclosure to the authority, regard shall be had, in particular, to: (a) the seriousness of the alleged improper practice; (b) whether the improper practice is continuing or is likely to occur in the future; (c) whether the disclosure is made in breach of a duty of confidentiality owed by the employer to any other person; (d) in a case falling within sub-article 1(e), any action which the employer has taken or might reasonably be expected to have taken as a result of the previous disclosure; and (e) whether in making the disclosure to the authority, the employee complied with any procedure whose use by him was authorised by the employer in accordance with article 12(1). (3) If a person makes a disclosure to an authority in accordance with this Part, the authority must within forty-five days after receiving the disclosure consider and reach a conclusion as to whether it is appropriate for the disclosure to be made externally. (4) If the authority concludes that a disclosure should not have been made externally, then it must within a reasonable time, not exceeding forty-five days, notify in writing the whistleblower that an internal disclosure in accordance with Section 2 of this Part must be made and that it will not be dealing further with the disclosure. (5) If the authority concludes that a disclosure has been properly made, then it must within a reasonable time notify in writing the person who made the disclosure of the status of the improper practice disclosed or such matters as may be prescribed. 17. (1) All authorities referred to in the First Schedule shall: (a) set up an independent and autonomous whistleblowing reports Unit, for receiving and handling information on breaches and which shall meet all the following criteria: (i) is designed, established and operated in a manner that ensures the completeness, integrity and confidentiality of the information and prevents access thereto by non-authorised staff members of the authority; (ii) enables the durable storage of information in accordance with article 21A to allow further investigations to be carried out; (b) promptly, and in any event within seven (7) days of receipt of the external disclosure, acknowledge that receipt unless the whistleblower explicitly requested otherwise or the whistleblowing reports Unit Setting up of whistleblowing reports unit. Amended by: LXVII.2021.13. 18 [ CAP. 527. PROTECTION OF THE WHISTLEBLOWER reasonably believes that acknowledging receipt of the disclosure shall jeopardise the protection of the reporting person’s identity; (c) diligently follow up on external disclosures; (d) provide feedback to the whistleblower within a reasonable time frame not exceeding three (3) months, or six (6) months in duly justified cases; (e) communicate to the whistleblower the final outcome of investigations triggered by the report, in accordance with procedures provided for under national law; (f) transmit in due time the information contained in the disclosures to competent institutions, bodies, offices or agencies of the European Union, as appropriate, for further investigation, where provided for under law. (2) The whistleblowing reports Unit shall enable external disclosures in writing and orally. Oral disclosures shall be possible by telephone or through other voice messaging systems and, upon request by the whistleblower, by means of a physical meeting within a reasonable time-frame. (3) The whistleblowing reports Unit shall ensure that, where an external disclosure is received through channels other than the reporting channels referred to in sub-articles (1) and (2) or by staff members other than those responsible for handling reports, the staff members who receive it are prohibited from disclosing any information that may identify the whistleblower or the person concerned, and that they promptly forward the report without modification to the staff members responsible for handling reports. (4) The whistleblowing reports Unit shall designate staff members responsible for handling reports, and in particular for: (a) providing any interested person with information on the procedures for reporting; (b) receiving and following up on external disclosures; (c) maintaining contact with the whistleblower for the purpose of providing feedback and requesting further information where necessary. (5) The staff members referred to in sub-article (4) shall receive specific training for the purposes of handling reports: (a) providing any interested person with information on the procedures for reporting; (b) receiving and following up on external disclosures; (c) maintaining contact with the whistleblower for the purpose of providing feedback and requesting further information where necessary. PROTECTION OF THE WHISTLEBLOWER [ CAP. 527. (6) The whistleblowing reports Unit shall publish on their websites in a separate, easily identifiable and accessible section at least the following information: (a) the conditions for qualifying for protection under this Act; (b) the contact details for the whistleblowing reports Unit as provided for under sub-article (1), in particular the electronic and postal addresses, and the phone numbers for such channels, indicating whether the phone conversations are recorded; (c) the procedures applicable to the reporting of breaches, including the manner in which the competent authority may request the whistleblower to clarify the information reported or to provide additional information, the time frame for providing feedback and the type and content of such feedback; (d) the confidentiality regime applicable to reports, and in particular the information in relation to the processing of personal data in accordance with article 6A, Articles 5 and 13 of Regulation (EU) 2016/679 of the European Parliament and of the Council of 27 April 2016 on the protection of natural persons with regard to the processing of personal data and on the free movement of such data, and repealing Directive 95/46/ EC (General Data Protection Regulation), regulation 13 of the Data Protection (Processing of Personal Data by Competent Authorities for the Purposes of the Prevention, Investigation, Detection or Prosecution of Criminal Offences or the Execution of Criminal Penalties) Regulations and Article 15 of Regulation (EU) 2018/1725 of the European Parliament and of the Council of 23 October 2018 on the protection of natural persons with regard to the processing of personal data by the Union institutions, bodies, offices and agencies and on the free movement of such data, and repealing Regulation (EC) No. 45/2001 and Decision No. 1247/2002/EC, as applicable; (e) the nature of the follow-up that shall be given to reports; (f) the remedies and procedures for protection against retaliation and the availability of confidential advice for persons contemplating reporting; (g) a statement clearly explaining the conditions under which persons disclosing to the competent authority are protected from incurring liability for a breach of confidentiality pursuant to article 4(1); and (h) contact details of the information centre or of the single independent administrative authority as provided for in article 4(4) where applicable. (7) The whistleblowing reports Units shall review their S.L. 586.08. 19 20 [ CAP. 527. PROTECTION OF THE WHISTLEBLOWER procedures for receiving disclosures, and their follow-up, regularly, and at least once every three (3) years. In reviewing such procedures, competent authorities shall take account of their experience as well as that of other whistleblowing reports Unit and adapt their procedures accordingly. (8) The whistleblowing reports Units may close procedures regarding repetitive reports which do not contain any meaningful new information on improper practice compared to a past report in respect of which the relevant procedures were concluded, unless new legal or factual circumstances justify a different follow-up. In such a case, the whistleblowing reports Units shall notify the reporting person of their decision and the reasons thereof. (9) In the event of high inflows of reports, whistleblowing reports Units may deal with reports of serious breaches or breaches of essential provisions falling within the scope of this Act as a matter of priority, without prejudice to the time frame as set out in paragraph (d) of sub-article (1). (10) The whistleblowing reports unit shall be charged with receiving and processing any external disclosures relating to the activities of persons operating within the sector regulated by the relevant authority as set out in the First Schedule so as to determine whether the disclosures should be referred for further investigation and the conditions under which such referral should take place. Reference of information to another authority. 18. (1) Where the authority to whom a protected disclosure is made considers that the information disclosed can be better investigated by another authority or in the case of an improper practice which constitutes a crime or contravention under any applicable law by the police, the authority to whom the disclosure i s m a d e m a y, w i t h i n n o t m o r e t h a n t h i r t y d a y s , r e f e r t h a t information to such other authority or the police, as the case may be, and immediately inform in writing the whistleblower accordingly: Provided that the identity of the whistleblower shall not be disclosed except with his prior consent in writing. (2) A protected disclosure does not, by reason of its referral to another authority or the police, cease to be a protected disclosure. Added by: LXVII.2021.14. SECTION 4 PUBLIC DISCLOSURES Public disclosures. Added by: LXVII.2021.14. 18A. (1) Except as provided in this Part, a public disclosure shall only be protected if an internal disclosure in accordance with Section 2 of this Part and an external disclosure in accordance with Section 3 of this Part has already been made, but no appropriate action was taken in response to the report within the time-frames referred to in article 13(1) and article 17(1)(b). PROTECTION OF THE WHISTLEBLOWER [ CAP. 527. 21 A public disclosure shall be as a protected disclosure under this Act if any one (1) of the following conditions are fulfilled: The whistleblower has reasonable grounds to believe that: (a) the breach may constitute an imminent or manifest danger to the public interest, such as when there is an emergency situation or a risk of irreversible damage; or (b) in the case of external reporting, there is a risk of retaliation or there is a low prospect of the breach being effectively addressed, due to the particular circumstances of the case, such as those where evidence may be concealed or destroyed or where an authority may be in collusion with the perpetrator of the breach or involved in the breach. (2) This article shall not apply to cases where a person directly discloses information to the press pursuant to specific national law establishing a system of protection relating to freedom of expression and information. PART IV OFFENCES AND PENALTIES 19. Any person who, for the purpose of compelling any other person to abstain from doing or to do any act which such other person has a legal right to do or to abstain from doing under the provisions of this Act, wrongfully or without legal authority (a) uses or threatens to use violence against such person, or the wife, husband or child of such person, or a member of his household, or causes or threatens to cause damage to his property; (b) persistently follows such other person from place to place; (c) watches or besets the house or other place where such other person resides or the approaches to such house or place; (d) deprives such person, or in any matter hinders him in the use of, any tools, clothing or other property owned or used by such other person, shall be guilty of any offence and be liable on conviction to imprisonment for a period not exceeding one year or to a fine (multa) of not less than five hundred euro (€500) and of not more than five thousand euro (€5,000) or to both such imprisonment and fine, without prejudice to any heavier punishment to which the offence may be liable under any other enactment: Provided that where as a result of his conduct the person convicted has achieved his aim the punishment of imprisonment shall be increased by one to two degrees and the fine (multa) shall not be less than one thousand five hundred euro ((€1,500) and not more than ten thousand euro (€10,000). Threatens to use violence. 22 [ CAP. 527. PROTECTION OF THE WHISTLEBLOWER PART V REGULATIONS AND GUIDELINES Regulations and guidelines. 20. (1) In addition to the matters on which the Minister is empowered to prescribe rules under the provisions of this Act, the Minister may from time to time make regulations, generally for the better implementation of this Act and to: (i) establish the internal procedures which employers must have in operation for receiving and dealing with information about improper practices committed within or by that organisation; (ii) establish the procedures which an authority in terms of the First Schedule needs to have in place to receive and process external disclosures; (iii) lay down the rules for disclosure between the whistleblowing reports unit and the other departments within the authority of which the whistleblowing reports unit forms part; (iv) set out the duties of communication between the whistleblowing reports unit and the whistleblower and the restrictions thereon; and (v) lay down rules for the better implementation of this Act. (2) An authority may, in furtherance of any of its functions under this Act, from time to time issue and publish guidelines on all matters in respect of which the Minister may issue regulations including guidelines setting out the procedures which are available in terms of law to those who wish to disclose an improper practice. (3) Guidelines issued by an authority shall be binding on all organisations whose activities are regulated by such authority. (4) Except for amendments to the guidelines which are purely administrative in nature, and are expressly declared to be so by the authority, which come into force immediately upon the posting thereof on the official website of the said authority, any new guidelines or amendments to guidelines shall come into force on the lapse of fifteen days after they are posted on the official website of the authority or on such later date as may be stated therein. PART VI MISCELLANEOUS Conflict between contract of service and the provisions of this Act. 21. Any provision in a contract of service or other agreement between an employer and an employee is void in so far as it(a) purports to exclude any provision of this Act, including an agreement to refrain from instituting or continuing any proceedings under this Act or any proceedings for breach of contract; or (b) purports to preclude the employee or has the effect of discouraging the employee from making a protected disclosure in terms of this Act. PROTECTION OF THE WHISTLEBLOWER [ CAP. 527. 21A. (1) Whistleblowing reports Unit and the whistleblowing reporting officers shall keep records of every report received, in compliance with the confidentiality requirements provided for in article 6: Provided that, reports shall be stored for no longer than it is necessary and proportionate in order to comply with the requirements imposed by this Act, or other requirements imposed by law. (2) Where a recorded telephone line or another recorded voice messaging system is used for disclosing, subject to the consent of the whistleblower, whistleblowing reports Unit and whistleblowing reporting officers shall have the right to document the oral reporting in one (1) of the following ways: (a) by making a recording of the conversation in a durable and retrievable form; or (b) through a complete and accurate transcript of the conversation prepared by the staff members responsible for handling the report. Whistleblowing reports Unit and whistleblowing reporting officers shall offer the whistleblower the opportunity to check, rectify and agree the transcript of the call by signing it. (3) Where an unrecorded telephone line or another unrecorded voice messaging system is used for disclosing, whistleblowing reports Units and whistleblowing reporting officers shall have the right to document the oral disclosure in the form of accurate minutes of the conversation written by the staff member responsible for handling the disclosure. The whistleblowing reports Unit and whistleblowing reporting officer shall offer the whistleblower the opportunity to check, rectify and agree the minutes of the conversation by signing them. (4) Where a person requests a meeting with the whistleblowing reports Unit and whistleblowing reporting officers for disclosing purposes pursuant to article 12(1)(a) and article 17(2), whistleblowing reports Unit and whistleblowing reporting office shall ensure, subject to the consent of the whistleblower, that complete and accurate records of the meeting are kept in a durable and retrievable form. The whistleblowing reports Unit and whistleblowing reporting officers shall have the right to document the meeting in one of the following ways: (a) by making a recording of the conversation in a durable and retrievable form; or (b) through accurate minutes of the meeting prepared by the staff members responsible for handling the report: Provided that, whistleblowing reports Units and whistleblowing reporting officers shall offer the whistleblower the opportunity to check, rectify and 23 Shall keep records of every report received. Added by: LXVII.2021.15. 24 [ CAP. 527. PROTECTION OF THE WHISTLEBLOWER agree the minutes of the meeting by signing them. Persons or class of persons exempt. 22. The Minister may, for the purpose of the protection of national security, defence, public order and the international relations of the State, by notice in the Gazette exempt any person or class of persons without retrospective effect from all or any of the provisions of this Act on any ground which to him may seem sufficient. Any such exemption may be made subject to such conditions or to the fulfilment of such other procedures, formalities or obligations, as the Minister may deem appropriate. Applicability of this Act. 23. This Act shall apply to disclosures of information made after the coming into force of this Act, irrespective of whether or not the improper practice being the subject of a disclosure has occurred before or after the coming into force of this Act. PROTECTION OF THE WHISTLEBLOWER [ CAP. 527. 25 FIRST SCHEDULE [Articles 16, 17 and 20] Authorities Prescribed To Receive External Disclosures Part 1 – Private Sector Authority Auditor General Description of Matters Failure to observe laws, rules and regulations relating to public finance and misuse of public resources. Commissioner for Revenue Income tax, corporation tax, capital gains tax, stamp duties, national insurance contributions, value added tax or "revenue acts" as defined in the Commissioner for Revenue Act. C o m m i s s i o n e r f o r Vo l u n t a r y Activities of a voluntary organisation Organisations Financial Intelligence Analysis Unit Money laundering or financing of terrorism in terms of the Prevention of Money Laundering Act. Malta Financial Services Authority T h e b u s i n e s s o f c r e d i t a n d f i n a n c i a l institutions, the business of insurance and the activities of insurance intermediaries, the provision of investment services and collective investment schemes, pensions and retirement funds, regulated markets, central securities depositories, the carrying out of trustee business either in a professional or a personal capacity and such other areas of activity or services as may be placed from time to time under the supervisory and regulatory competence of the Malta Financial Services Authority. Ombudsman (i) Conduct involving substantial risk to public health or safety or the environment that would if proved, constitute a criminal offence; and (ii) All matters which constitute improper practices and which are not designated to be reported to any other authority P e r m a n e n t C o m m i s s i o n A g a i n s t corrupt practices Corruption Part 2 – Public Administration External Disclosure Whistleblowing Unit within the Government of Malta 26 [ CAP. 527. Amended by: LXVII.2021.16. PROTECTION OF THE WHISTLEBLOWER SECOND …