Whistleblowing provides an effective early warning system to ensure that fraud does not go undetected. Cynthia Chung, Partner, Deacons, argues that Hong Kong companies need to have corporate whistleblower policies and programmes in place, backed up by a comprehensive statutory regime to give potential whistleblowers the confidence to come forward.

The recent explosive uncovering of a railway construction scandal in Hong Kong by whistleblowers not only flagged concerns about its potential impact on public safety, but also alerted employers to the importance of having a whistleblowing framework in place for the protection of their employees who report malpractice. Usually, front-line employees of an organisation will be the first to know of a wrongdoing since they have access to firsthand information in their workplaces. Whistleblowing happens when such employees report misconduct or malpractice that has occurred within their organisation. It is therefore crucial to have a whistleblowing policy in place to ensure compliance with the law and prevent corporate wrongdoing from turning into a crisis or disaster, as otherwise it could easily attract adverse publicity or ridicule.

Should whistleblowing be encouraged at your company?

The railway construction scandal and other well-publicised high-profile cases around the world in recent years all show that whistleblowing is a vital tool to help organisations detect and correct unlawful conduct or irregularities that occur in the workplace more efficiently. The International Bar Association’s Whistleblower Protections: A Guide, published in April 2018 (see ‘Further reading’ for details of the publications mentioned in this article), points out that: ‘Organisations, be they government or private, rely on individuals, particularly employees, to bring to their attention information on actual or potential misconduct that may be occurring in the workplace.’ According to the OECD Foreign Bribery Report, published by the Organisation for Economic Co-operation and Development (OECD) in 2014, 33% of the bribery cases analysed by the OECD between 1999 and 2014 were detected through whistleblowing. Furthermore, the statistics published in the OECD’s 2016 report Committing to Effective Whistleblower Protection reveal that, of the private sector employees who have reported to the US Securities and Exchange Commission (SEC) Office of the Whistleblower, over 80% first raised their concerns internally before reporting to the SEC. Only 18% of the private sector employees in the US chose to report externally. Often, when employees become aware of wrongdoing in a company, whether or not they will report the matter depends on whether there exists a mechanism to protect them against the risk of retaliation. The hard truth is – the less protection there is for whistleblowing, the more likely an employee will be at risk, whether in terms of losing his or her job or other interests that hang in the balance. Surveys conducted in the past 10 years, for example Gaps in the System: Whistleblower Laws in the EU, published by Blueprint for Free Speech in 2018, reveal the different forms that a fear of retaliation can take, such as apprehension about being disciplined, fired, sued or prosecuted, or even threats to personal safety. These are among the top reasons why employees would not blow the whistle. Analyses of whistleblower protection over the years show that effective whistleblower protection requires both robust internal corporate whistleblowing policies, and a comprehensive legislative/regulatory regime.

Legal protection for whistleblowers

Regrettably, Hong Kong lags behind on whistleblower protection in comparison with other member countries of the OECD. It is therefore not surprising that Hong Kong employees are less willing to come forward. The common law does not provide much protection for whistleblowers except in certain circumstances. For instance, an employee may have a defence to a claim for breach of confidentiality if the disclosure of such information is in the public interest. In terms of legislation, there is currently no single comprehensive whistleblowing law to protect whistleblowers in Hong Kong. There are, however, piecemeal provisions in various ordinances that provide protection to specific whistleblowers for the reporting of specific offences (see ‘Current legal protections for whistleblowers in Hong Kong’). In summary, the existing legislative measures in Hong Kong are fragmented and only afford a limited scope of protection to certain whistleblowers.

The UK model

The OECD’s Whistleblower Protection: Encouraging Reporting (July 2012) advocates the enactment of a comprehensive law as the most effective means of providing whistleblower protection. This gives the requirements visibility, thereby making implementation easier for employers. The Gaps in the System report mentioned above found that a piecemeal approach to protecting whistleblowers is largely ineffective. Among the nine European countries that have a standalone whistleblower protection law covering public and private sector employees, the UK attracts a top protection rating. The UK Public Interest Disclosure Act (PIDA) of 1998 is considered to be one of the most developed and comprehensive whistleblower protection laws in the world, and has been used by several countries as a model in developing their whistleblower protection regimes. The PIDA, which came into force in 1999, is part and parcel of the Employment Rights Act 1966. It applies to every employee in the private, public and not-for-profit sectors, and operates in the manner set out below.

• Under the PIDA, it is unlawful for an employer to dismiss an employee or subject a worker to a detriment on the grounds that he or she has made a ‘protected disclosure’. ‘Worker’ includes limited liability partnership members, National Health Service (NHS) job applicants, homeworkers, non-employees undergoing training, self-employed medical professionals, agency workers and police officers.
• To be protected, a disclosure must, in the reasonable belief of the whistleblower, be in the public interest, and such disclosure must be made via one of the prescribed disclosure channels. These include: the worker’s employer, the person responsible for the relevant failure, legal advisers, government ministers, a person prescribed by an order made by the Secretary of State and a person who is not covered by the list above provided certain conditions are met. Employees may, subject to certain conditions, choose any of the prescribed disclosure channels.
• As far as relief is concerned, employees who are unfairly dismissed, or workers who are subjected to any detriment, by reason that they have made a protected disclosure, can bring a claim against their employers. Further, employers may be vicariously liable for detriment caused by employees and workers unless they have taken all reasonable steps to prevent this from happening. Workers or agents with employer’s authority who victimise whistleblower colleagues will be personally liable.

Hong Kong needs a comprehensive whistleblower protection law

While Hong Kong continues to boast its status as an international financial centre, the laws in place to tackle the practical consequences associated with whistleblowing are merely piecemeal in nature. Compared to the broad scope of the PIDA, it can be readily seen that the current legal protections for whistleblowers in Hong Kong fall far short of international standards in many aspects. There is uncertainty on the extent of coverage of persons, the reporting channel is unclear and there is no definition of the scope of disclosure that would be protected or what constitutes retaliatory actions. Even if employees are willing to come forward, there are as yet no clear procedures for reporting retaliation, or remedies open to those who suffer retaliation as a result of making a report. To promote and encourage whistleblowing, a comprehensive legal regime should be introduced, the sooner the better! The OECD’s Committing to Effective Whistleblower Protection survey mentioned earlier found that 27 countries had already adopted dedicated whistleblower protection laws back in 2014. It is therefore high time for the Hong Kong government to consider enacting a comprehensive whistleblower protection regime in line with international standards and practices without delay.

Internal protection for whistleblowers

The Australian Banking Association, in its Review of Whistleblowing Protections by Australian Banks (August 2016), emphasised that having a whistleblower programme should be a standard part of corporate governance and risk management practice. ‘Effective whistleblower programmes, capable of receiving and responding to disclosures from whistleblowers in an efficient and effective way, and of protecting them from inappropriate retaliation, are a critical element of modern corporate governance and risk management frameworks.’ Although the current laws of Hong Kong do not require employers to have a whistleblowing policy in place, it is good practice for employers to implement appropriate measures, not only to stave off wrongdoing that could develop into a corporate disaster, but also to demonstrate their commitment to solving problems by listening to their employees’ concerns.

Whistleblowing policy

Every company is different. Employers should therefore be proactive in developing their own whistleblowing policies to meet their own ethical and moral concerns. In any case, a good whistleblowing policy should be clear and easy to understand and include guidelines for the effective management of whistleblowing. Companies should consider the issues highlighted below – based on the guide issued by the UK Department for Business Innovation & Skill (Whistleblowing: Guidance for Employers and Code of Practice, March 2015).

• A list of the type of concerns that should be reported.
• The procedures for raising concerns.
• An assurance to train employees at all levels of the organisation on whistleblowing policy and any applicable laws.
• An assurance to treat all disclosures appropriately, consistently and fairly.
• An assurance to take all reasonable steps to maintain the confidentiality of the whistleblower where this is requested.
• Ways in which the organisation will respond to the whistleblower.
• An assurance that victimisation of a whistleblower is not acceptable.
• Clear channels for making disclosures. Alternative reporting procedures should also be made available in the event that employees do not feel comfortable approaching their line managers. For example, organisations may establish whistleblower hotlines with their legal advisers for the reporting of misconduct.

Awareness-raising, communication and training

To ensure cooperation, participation and support by employees, the purpose and goals of whistleblower protection should be promoted through effective awareness-raising, communication and training, such as providing a clear explanation to employees of their rights and obligations when disclosing wrongdoing. The following approaches, based on the OECD’s Good Practice Guidance on Internal Controls, Ethics and Compliance (2010), represent some of the best practices an employer could adopt for raising awareness of the whistleblowing policy or procedures:

• Making the policy accessible on the staff intranet, briefing at team meetings, including the policy in staff handbooks and new staff induction packs.
• Introducing training to all employees on how disclosures should be made.
• Introducing training to managers on how to handle disclosures, protect personal information, receive reports, and recognise and prevent occurrence of discriminatory and disciplinary actions taken against whistleblowers.
• Conducting regular training for managers and employees to help refresh their minds on the whistleblowing policy and procedures.

Conclusion

The OECD’s The Role of Whistleblowers and Whistleblower Protection (2017), found that whistleblowers who are provided with internal reporting protection can help companies detect wrongdoing earlier and therefore avail themselves of the earliest opportunity to deal with it before it turns into a crisis. Whistleblowing is a powerful internal system of checks and balances for a company to maintain business integrity, thereby promoting a healthy working culture. Compared to the more developed UK model, the existing legislative framework in Hong Kong is clearly inadequate, which calls for urgent reform by the government to provide better protection for whistleblowers. In the meantime, for companies that do not have whistleblower policies, it is in their best interests to develop and adopt whistleblower protection programmes as part of their corporate governance/integrity management, and to introduce such programmes to their employees through awareness-raising initiatives. Companies that already have policies in place should review them periodically to ensure compliance with the legislative framework in force, and update them as and when reform is introduced. Cynthia Chung, Partner Deacons  

SIDEBAR: Further reading

• Whistleblower Protections: A Guide (The International Bar Association, April 2018) – www.ibanet.org.
• Foreign Bribery Report (2014); Committing to Effective Whistleblower Protection (2016); Whistleblower Protection: Encouraging Reporting (2012); Good Practice Guidance on Internal Controls, Ethics and Compliance (2010); and The Role of Whistleblowers and Whistleblower Protection (2017) (the Organisation for Economic Co-operation and Development) – www.oecd.org.
• Gaps in the System: Whistleblower Laws in the EU (Blueprint for Free Speech, 2018) – www.fibgar.org. Review of Whistleblowing Protections by Australian Banks (The Australian Banking Association, 2016) – www.ausbanking.org.au.