Protected Disclosures: 2022 Act Employer Obligations

What Is a Protected Disclosure?

A protected disclosure is a report made by a worker who has reasonable grounds to believe that information they are disclosing reveals wrongdoing in a work-related context.

The wrongdoing does not need to be proven, the worker only needs to have reasonable grounds for believing it is occurring. This is an important distinction. An employee who reports a concern in good faith is protected even if the investigation concludes that no wrongdoing took place.

Under the 2022 Act, relevant wrongdoing includes:

• A criminal offence
• Failure to comply with a legal obligation
• A miscarriage of justice
• Endangerment of health or safety
• Damage to the environment
• Breach of EU law across specific areas including financial services, food safety, product safety, transport, data protection, and anti-money laundering
• Deliberate concealment of any of the above

A disclosure must relate to information obtained in a work-related context, the worker must have come across the information through their work, and the concern must relate to the organisation they work for or one connected to it.

It is important to be aware that not every workplace complaint is a protected disclosure. A grievance about a personal employment matter, pay, working conditions, a disagreement with a manager, is generally not a protected disclosure unless it also involves a broader wrongdoing. The distinction matters because the level of protection, and the obligations on employers, differs significantly between a grievance and a protected disclosure.

Who Qualifies for Protection?

This is where the 2022 Act made the most significant expansion compared to the original 2014 legislation. Protection is no longer limited to employees. It now extends to a much broader category of workers, including:

• Current and former employees
• Agency workers and temporary workers
• Independent contractors and self-employed individuals
• Job applicants who receive information about wrongdoing during a recruitment process
• Shareholders and members of governing bodies
• Volunteers and trainees
• Workers whose employment has already ended at the time of the disclosure

The practical consequence for founders is that protection can be triggered by someone who never formally joined your company, a candidate who went through your hiring process and became aware of a concern, or a contractor who completed a project six months ago, may both be entitled to protection if they make a disclosure relating to your organisation.

What Are Your Obligations as an Employer?

Companies With Five or More Employees

If your company has five or more employees, you are required to establish and maintain a formal internal reporting channel under the 2022 Act.

That reporting channel must:

• Allow workers to report concerns in writing, orally, or both
• Acknowledge receipt of the report within seven days
• Provide feedback to the reporting worker on the action taken or planned within three months of acknowledgement
• Maintain the confidentiality of the reporting worker's identity, their name cannot be disclosed without their consent, subject to limited exceptions
• Be managed by a designated person or department with the independence and competence to follow up on reports

The designated person responsible for handling protected disclosures must be clearly identified within the company and accessible to all workers. In a small company, this will often be a founder or senior director, the key requirement is that the person is genuinely independent from the subject of any potential report and takes the role seriously.

In our experience a policy document alone is not sufficient, the channel must be real, accessible, and actively maintained.

Companies With Fewer Than Five Employees

Companies with fewer than five employees are not required to have a formal internal reporting channel, but the individual protections for whistleblowers apply regardless of company size.

This means that if an employee at a two-person startup makes a disclosure about wrongdoing and is penalised as a result, the company faces exactly the same legal exposure as a large organisation that had a formal process in place and ignored it.

The practical recommendation is to have a basic written policy in place from the first hire, not because the law requires a formal channel at that stage, but because it sets expectations, demonstrates good faith, and significantly reduces the risk of mishandling a disclosure if one is made.

What Must the Policy Actually Say?

A compliant protected disclosures policy should cover the following:

The purpose of the policy: a statement that the company takes wrongdoing seriously and is committed to providing a safe channel for workers to raise concerns without fear of retaliation.

What qualifies as a protected disclosure: a clear explanation of what types of wrongdoing can be reported and what a worker needs to believe in order to be protected.

How to make a report: the specific channel available, whether in writing or orally, and the name and contact details of the designated person.

What happens after a report is made: the acknowledgement and feedback timescales, a description of how reports are investigated, and what the outcome of an investigation might look like.

Confidentiality: a clear commitment to protecting the identity of the reporting worker and explaining the limited circumstances in which confidentiality may not be maintained.

Protection from penalisation: an explanation of what penalisation means and a statement that it will not be tolerated, with a description of what the worker can do if they believe they have been penalised.

External reporting channels: workers have the right to report directly to a relevant external authority rather than using the internal channel, and the policy should acknowledge this. The Workplace Relations Commission and sector-specific regulatory bodies are the most relevant external channels for most companies.

What Is Penalisation and Why Does It Matter?

Penalisation is the single most important concept in protected disclosures law, because it is where the greatest legal exposure lies for employers.

Penalisation means any act or omission that causes detriment to a worker because they made a protected disclosure. It is defined broadly and includes:

• Dismissal or threatened dismissal
• Demotion or loss of promotion opportunities
• Transfer or change of location against the worker's wishes
• Reduction in pay or hours
• Imposition of a disciplinary measure or sanction
• Harassment, intimidation, or coercion
• Damage to reputation, including in professional or industry references
• Blacklisting within an industry
• Early termination of a contract or withdrawal of work from a contractor

It is important to be aware that the penalisation must be connected to the protected disclosure. In practice, if a worker is dismissed or demoted shortly after making a protected disclosure, the burden shifts to the employer to demonstrate that the action was taken for a wholly unrelated reason. That is a difficult burden to discharge when the timing is obvious.

What Are the Penalties for Getting It Wrong?

The consequences of penalising a whistleblower are among the most severe in Irish employment law. These consequences are set out below.

Compensation awards at the WRC can reach up to five years' remuneration, significantly higher than the two-year cap that applies to standard unfair dismissal claims. Where the penalisation takes the form of dismissal, the WRC can also order reinstatement.

There is no minimum service requirement for protected disclosure claims. A worker who is penalised on their first day of employment has the same right to bring a claim as someone who has been with the company for a decade.

Interim relief is available in some cases, a worker who has been dismissed for making a protected disclosure can apply to the WRC for an order requiring the employer to continue payment pending the outcome of the full hearing. The bar for obtaining interim relief is high, but the possibility alone creates significant pressure on employers.

Beyond individual claims, the 2022 Act introduced the possibility of criminal liability for individuals who penalise or threaten to penalise a reporting worker. This is a significant escalation from the pre-2022 position and reflects the seriousness with which the legislature is treating whistleblower protection.