Businesses in the Life Science sector have already seen that there can be major consequences where an employee blows the whistle on wrongdoing at work. Previous well-publicised instances of regulatory action were taken after reports of alleged kickbacks and off-label marketing as well as significant sums awarded by the courts in false claims suits. 

So far, many of these proceedings have taken place in the USA.  But the implementation of the EU Whistleblower Protection Directive means there could soon be an increase in whistleblowing activity on this side of the Atlantic.  

This update provides an overview of key features of the Directive and looks at some related issues that could affect businesses in the Life Sciences sector.

KEY PROVISIONS OF THE WHISTLEBLOWING DIRECTIVE 

The Directive provides protection from retaliation for people who obtain information about a breach of certain EU laws in a work-related context and then report the breach internally, externally or publicly.  Laws setting quality and safety standards for medicinal products and medical devices are covered along with other laws concerning, for example, public health, consumer protection and product safety and compliance.  The Directive also requires employers of 50 or more workers to set up internal channels to receive and manage reports of breaches.    

The deadline for transposition of the Directive was 17 December 2021, but few Member States met this.  At the start of 2023, only 13 of the 27 EU countries had finalised relevant laws, but as of July 2023 laws have been implemented in all but two Member States.   As local implementation varies, businesses need to understand the position in each country in which they operate.   However, the minimum requirements set by the Directive are as follows:

• Business scope: the protection against retaliation applies to all workers regardless of the size of their employer and, as such, the Directive applies to all business operating in the EU.      In terms of more specific obligations, the requirement to establish channels for internal reporting applies to legal entities with 50 or more workers, so those with fewer than 50 may be excluded.
  
  
• Personal scope:   an internal reporting channel must be made available to all workers of a business.  This is defined widely and includes not only employees but workers in non-standard employment relationships such as fixed-term workers, agency workers and workers in other a-typical relationships.
  
  
• Scope of reports:  the Directive provides protection against retaliation for individuals who report breaches of EU laws in specific listed areas.  Country implementing laws may extend the protection to apply to reports of breaches of national laws in the areas listed and to encompass national laws in areas beyond those listed in the Directive.
  
  
• Internal reporting procedure:    there are prescriptive requirements in relation to internal reporting procedures. Provision must be made for oral or written reports (or both) and Member States can decide whether anonymous reports must be accepted. Receipt of a report must be acknowledged within seven days and feedback provided within a reasonable timeframe, not exceeding three months. There are detailed record keeping requirements and processing of personal data must comply with General Data Protection Regulation.   Unless they consent to disclosure, the identity of a person who makes a report and of any third party mentioned in a report must be kept confidential.  Information on internal reporting procedures and on procedures for reporting externally to competent authorities must be provided to all workers by the employer.
  
  
• Retaliation:  what amounts to retaliation against a whistleblower is defined broadly in the Directive and includes failure to promote, not renewing or converting a temporary contract into a permanent one, change in duties or hours, negative performance assessment, disciplinary action, dismissal, and psychiatric or medical referrals. 
  
  
• Defence to legal proceedings: recognising that the risk of legal proceedings can be a deterrent to whistleblowing, the Directive provides an individual making a report with a defence in certain circumstances. In proceedings for disclosure of trade secrets, a whistleblower will not incur liability for revealing information if they had reasonable grounds to believe that disclosure was necessary to show a breach under the Directive. 
  
  
• Sanctions:   sanctions for retaliation must be real, effective, and dissuasive, but the Directive leaves it to each country to determine the specifics.   This gives scope for significant variation and businesses need to be aware that the risks are higher in some countries than in others.     

CONSIDERATIONS FOR THE LIFE SCIENCE SECTOR 

Protection of trade secrets

The Life Science sector includes some of the most research-intensive companies in the world. Data generated from research is a coveted asset as are the abstract ideas, patient information and experimental data which are created at research stage.    This information, however, cannot be patented, falling instead to be protected as trade secrets.   As explained above, the Directive may limit a business’s ability to protect its trade secrets using legal proceedings where a disclosure occurs in the context of a whistleblowing report.   This is likely to be a matter of real concern for Life Science businesses given that information disclosed could, for example, undermine public confidence in its future products or provide its market rivals with a competitive advantage.  

To minimise this risk, our recommendation is that businesses should adopt an approach to workplace whistleblowing that strongly encourages internal, rather than external, reporting.  Doing so will allow the organisation to contain, manage and remedy potential adverse consequences of any reported legal breach and to avoid the external disclosure of its confidential information and trade secrets.     Internal reporting can be encouraged by clear communication, trusted speak-up policies and procedures, and workforce training.

Use of group reporting channels

An issue which many global businesses are grappling with is the impact which the Directive has on their use of centralised group reporting channels.   

The Directive specifically permits entities with 50 to 249 workers to share resources for receipt of reports and investigations. The European Commission has clarified that in such cases the reporting person must be told that a designated person/department at headquarters level could be authorized to access the report for the purpose of investigating and that they must have the right to object and to request investigation at the level of the subsidiary.

For companies with 250 or more workers, sharing of resources is not permitted by the Directive and the European Commission’s view is that their use of central group reporting channels does not comply.  Although it accepts that these channels do not have to be removed if they exist, the Commission has said that the Directive requires all entities to establish a local reporting channel, even if they are part of a group.  

The solution which many businesses are choosing in relation to this issue is to retain a global reporting system and to encourage individuals to report centrally, while ensuring that the worker also has the option to report locally.     However, whether a Life Science business is prepared to allow whistleblowing reports to be managed at local level, rather than by an experienced central function, will require careful consideration given the high stakes where a legal breach is alleged, which might include regulatory enforcement or other legal action as well as reputational damage and loss of competitive advantage.   

Retaliation

Individuals who report a relevant legal breach are protected against retaliation. The Directive includes an extensive list of actions that might be classed as retaliation, giving wide scope for a would-be litigant to allege retribution for making a whistleblowing report.   Certain types of retaliation identified by the Directive could be particularly problematic for Life Science employers.

A common feature of Life Science manufacturing companies is the tendency to have large contingent workforces with a sizeable percentage of the overall headcount made up of agency workers and fixed term contractors.  This inevitably means that there is a high incidence of failure to secure a permanent contract or non-renewal of temporary contracts, both of which the Directive identifies as possibly retaliatory action.  Given this, we foresee an increased risk that employers in the sector will face allegations that decisions made about temporary contracts relate to an individual making a whistleblowing report.

Also common in the sector is the use of on-site occupational health services and medical referrals.  That retaliation can include “psychiatric or medical referrals” increases the level of risk for an employer managing a whistleblower with health issues. In view of this, we recommend employers to exercise caution when making a referral to occupational health or seeking a medical report, even when doing so in accordance with normal practices for managing workplace ill-health.   

Overall, to protect against the increased risk of allegations of retaliation, as well ensuring that all whistleblowing reports are fully investigated and responded to, once a case is finalized an employer should continue to monitor its relationship with a whistleblower and to keep records of management decisions. This will help to ensure that there is no retaliation and that any later adverse action is justifiable on legitimate grounds.