The Law on Whistleblower Protection

In the realm of employment, whistleblowing refers to the act of an employee or worker disclosing information about certain wrongdoing, as “improper practice”, meaning misconduct, illegal activities, breaches of law, unethical practices, or dangers to public health and safety within an organisation that they form part of. The “whistleblower” would raise a concern either internally (for example, to management, human resources or compliance officers) or externally (to regulators, authorities, or in some cases, the public). 

Whistleblower protection is crucial because it safeguards individuals who come forward with such disclosures from retaliation by their employer or colleagues. Without protection, whistleblowers might face dismissal, demotion, harassment, reputational damage, or other forms of victimization. This risk often deters people from speaking up, allowing harmful practices at the workplace to continue unimpeded. 

The Protection of the Whistleblower Act (Cap. 527 of the Laws of Malta; the “Act”) was first enacted in 2013 and subsequently amended in 2021 and 2023 in order to align with Directive (EU) 2019/1937 on the protection of persons who report breaches of Union law. The Act applies across both the public administration and the private sector and its objective is to encourage individuals to come forward with information about wrongdoing, while ensuring that they are adequately protected from retaliation once such a disclosure is made in good faith. 

The Act broadly defines who may qualify as a whistleblower or “reporting person”. This includes not only current employees working under a n employment contract, but also former employees, secondees, contractors, subcontractors, trainees, volunteers, facilitators, shareholders, and even members of an organisation’s administrative or supervisory bodies. In this way, the protection is extended to a wide category of persons who may have access to information about improper practices. 

Prohibition of detrimental action 

For a disclosure to be protected, it must relate to what the law defines as an “improper practice”. This term covers several breaches of legal obligations, including corruption, bribery, misuse of funds, miscarriages of justice, threats to public health or safety, risks to the environment, or acts aimed at concealing wrongdoing.  

The protection attaches to the disclosure even if the whistleblower turns out to be mistaken, provided that there were reasonable grounds to believe that the information disclosed was true at the time of disclosure. Anonymously made disclosure are not a protected disclosure in terms of the Act. On the other hand, the law does not protect individuals who were themselves perpetrators or accomplices in the wrongdoing, nor does it protect those who knowingly make false disclosures. In such a case, the whistleblowing may risk criminal proceedings being taken against him/her. 

Internal and External Reporting, and Public disclosure 

The Act furthermore establishes two channels for reporting: internal and external reporting.  

Firstly, employers are required to put in place internal reporting channels that are accessible, secure, and ensure confidentiality. These channels must allow disclosures to be made both in writing and orally.  

Oral  reporting  shall  be  made  possible  by telephone or through other voice messaging systems, and, upon request by the reporting person, by means of a  physical  meeting  within  a  reasonable  time  frame. Such  channels  shall  be  designed,  established  and operated  in  a  secure  manner  that  ensures  that  the confidentiality of the identity of the whistleblower and any  third  party  mentioned  in  the  disclosure  is protected,  and  prevents  access  thereto  by  non-authorised staff member 

They must also designate a specific Whistleblowing Reporting Officer (WRO) responsible for receiving and handling reports. The WRO must acknowledge receipt of a report within seven (7) days and provide feedback to the reporting person within three (3) months, unless a justified extension is necessary. Internal procedures must also be made available to employees in an easily accessible format. 

Every   WRO or whistleblowing reports unit to whom a protected disclosure is made or referred must not disclose information that identifies or may lead to the identification of the whistleblower unless the whistleblower expressly consents in writing to the disclosure of that information. 

Secondly, where internal reporting is not possible, not effective, or inappropriate because of the involvement of the designated officer, whistleblowers may make external disclosures.  

Specifically, the law allows for an external disclosure to be made to the WRO or unit directly if the whistleblower believes on reasonable grounds, that any of the five (5) below instances has occurred: 

1. that the head of the organisation is or may be involved in the improper practice alleged in the disclosure; or 
2. that immediate reference to the authority, is justified by the urgency of the matter to which the disclosure relates, or some other exceptional circumstances; or 
3. at the time he makes the external disclosure, that he will be subjected to an occupational detriment by his employer if he makes an internal disclosure; or 
4. that it is likely that evidence relating to the improper practice will be concealed or destroyed if he makes an internal disclosure; or 
5. that  although  an  internal  disclosure  has  previously been made, the whistleblower has not been informed on the status of the matter disclosed or it is reasonably evident to the whistleblower that there has been no action or recommended action on the matter to which the disclosure relates within a reasonable time from the making of the disclosure. 

In Malta, external reporting can be made to the Whistleblowing Reports Unit or to other sector-specific authorities, such as the Financial Intelligence Analysis Unit (FIAU), the Malta Financial Services Authority (MFSA), the Ombudsman, or the Commissioner for Voluntary Organisations.  

Public disclosures, such as through the press, are only protected in very limited circumstances, usually after internal and external disclosures have been attempted and no action has been taken, or where there is an imminent threat to the public interest. 

The foundation of the Act is the prohibition of retaliation. Therefore, “the whistleblower may not be subjected to detrimental action on account of having made a protected disclosure.”  

Detrimental action is widely defined and includes any direct or indirect act or omission which occurs in a work related context, which is prompted by internal or external disclosures or by public disclosure, and which causes or may cause unjustified detriment to the whistleblower such as:  

• dismissal, suspension, law off or the equivalent; 

• demotion or withholding of promotion; 

• transfer of duties, change of work location, reduction in wages and change in working hours; 

• withholding of training; 

• harassment, intimidation, coercion or ostracism; 

• instituting financial penalties; 

• discrimination, disadvantageous or unfair treatment; 

• harming the employee’s reputation; 

• blacklisting; 

• cancellation of a licence or work permit  

• negative performance reviews, or  

• the institution of civil or criminal proceedings tied to the act of reporting. 

Importantly, a whistleblower who makes a protected disclosure is not liable to any civil or criminal proceedings or to a disciplinary proceeding for having made such a disclosure. Also, the Act shifts the burden of proof so that if an employee suffers negative treatment after making a disclosure, it is presumed to be retaliatory unless the employer can prove otherwise.  

Whistleblowers who are subject to detrimental action may apply to the First Hall, Civil Court for remedies, including injunctions and seeking compensation for damages. Moreover, anyone who intimidates or coerces another not to make a disclosure may face financial penalties.  

Under this provision of law, any person who unlawfully seeks to compel another to act or refrain from acting in a manner in which that person is legally entitled, through threats, violence, harassment, or deprivation of property, may be found guilty of an offence. 

Here, the offender may be sentenced to a term of imprisonment not exceeding one (1) year. In addition, the law imposes a financial penalty (multa) of not less than five hundred euro (€500) and not more than five thousand euro (€5,000). The Court also retains discretion to impose both imprisonment and a fine simultaneously, depending on the gravity of the case. 

Furthermore, where the offender’s conduct succeeds in compelling the other party to comply with the intended demand, so where the unlawful pressure achieves its aim, the penalties are aggravated. In such circumstances, the term of imprisonment shall be increased by one to two degrees in line with the provisions of the Criminal Code, and the fine shall not be less than one thousand five hundred euro (€1,500) and not more than ten thousand euro (€10,000). 

Obligations for employers 

For employers, several obligations and best practices arise from this legislation.  

Companies with fifty (50) or more employees are required to establish formal internal procedures and appoint a WRO. Even smaller organisations are encouraged to implement clear policies to ensure accessibility and transparency. Employers should take care to train managers and staff on the meaning of whistleblowing, how internal procedures function, and what protections exist for those who report. A strong culture of transparency and openness helps reduce risks of retaliation claims and encourages disclosures through proper channels rather than through damaging public leaks. 

When a disclosure is made, the employer must act promptly, acknowledging receipt, safeguarding confidentiality, and providing substantive feedback within the statutory timeframes. Employers should also ensure that the whistleblower’s identity is not disclosed without consent and that records of disclosures are securely kept. If the disclosure involves senior management or the WRO, the procedure should make available an alternative reporting route. Finally, because any adverse action against a whistleblower is presumed retaliatory, employers must carefully document decision-making processes and ensure that disciplinary or HR measures are justified by legitimate reasons unconnected to the disclosure. 

In practice, organisations should continuously monitor and review the effectiveness of their whistleblowing systems, conducting audits of procedures and outcomes. While the Act obliges employers to provide internal channels, it also makes clear that whistleblowers may escalate matters externally. Thus, employers are best placed to avoid reputational damage and legal liability by responding constructively and fairly to reports, demonstrating a commitment to accountability and integrity. 

How Can AE Help

AE provides strategic legal advice to both employers and individuals on all aspects of whistleblower protection under Maltese law. We assist organisations in designing and implementing compliant internal reporting procedures, including the appointment and training of Whistleblowing Reporting Officers (WROs), drafting policies, and ensuring alignment with the applicable legal framework.

Our team supports employers in handling disclosures effectively and confidentially, guiding internal investigations, managing risk, and ensuring adherence to statutory obligations and timeframes. We also advise on mitigating exposure to retaliation claims and safeguarding organisational reputation.

For individuals, AE offers confidential advice on making protected disclosures, assessing the appropriate reporting channel, and understanding the scope of legal protections available. Where disputes arise, we represent clients in proceedings before the Maltese courts, including claims relating to detrimental action, compensation, and injunctive relief.

With a practical and solutions-driven approach, AE helps clients navigate whistleblowing matters with confidence, ensuring compliance, protection, and accountability.