This article was first published by the International Law Office, a premium online legal update service for major companies and law firms worldwide. Register for a free subscription.


In 2013 Malta promulgated the Protection of the Whistleblower Act.(1) However, as few EU member states have similar whistleblower protection legislation, on 16 December 2019 the EU Whistleblowing Directive (2019/1937/EU) entered into force. This long-awaited piece of legislation is crucial given recent large-scale scandals, such as the Panama Papers and Cambridge Analytica.

The directive aims to:

  • strengthen the enforcement of EU law; and
  • protect freedom of expression and freedom of the media.

But what does this mean for Malta?


The Second Schedule to Malta's Protection of the Whistleblower Act specifies which employers are subject to the act and required to have internal whistleblowing procedures in place. These include:

  • government ministries;
  • organisations in the private sector which, according to their last annual or consolidated accounts, meet at least two of the following criteria:
    • an average number of more than 250 employees during the financial year;
    • a total balance sheet which exceeds €43 million; and
    • an annual turnover which exceeds €50 million; and
  • voluntary organisations which annually raise more than €500,000 from public collections and other donations.

The above criteria were seen as restrictive, especially considering Malta's size and the average size of companies operating in the private sector. Fortunately, the EU directive requires the act's scope to be significantly widened. It not only obliges all private companies and public entities with 50 or more employees to set up effective internal reporting channels (ensuring confidentiality), but also requires national authorities designated to investigate reports to similarly set up channels enabling confidential reporting. These changes have broadened the spectrum of the Maltese law exponentially.

Material scope

Notwithstanding the fact that the Protection of the Whistleblower Act grants protection to employees making protected disclosures regarding improper practices(2) in relation to, among others, the environment, bribery, non-compliance with the law and corrupt practices, the EU directive requires the legislative branch of the government to expand the act in order to cater for the directive's provisions.

The EU directive applies to reports regarding breaches or abuses of EU law concerning:

  • transport safety;
  • public health;
  • consumer protection;
  • environmental protection;
  • financial services; and
  • the prevention of money laundering and terrorist financing.

It also applies to reports concerning breaches which harm the European Union's financial interests and, in view of their negative impact on the proper functioning of the internal market, breaches relating to EU competition and corporate tax rules or arrangements whose purpose is to obtain a tax advantage that defeats the object or purpose of the applicable corporate tax law.

Notably, EU member states may extend the scope of the directive to other areas and sectors as they deem fit. It remains to be seen whether the Maltese legislature will add other areas or sectors to the non-exhaustive lists provided by the directive.

Personal scope

In a similar manner to the EU directive, the Maltese act already provides the following broad definition of an 'employee':

"employee" means:

(a) any person who has entered into or works under a contract of service with an employer and includes a contractor or subcontractor who performs work or supplies a service or undertakes to perform any work or to supply services; or

(b) any person who has undertaken personally to execute any work or service for, and under the immediate direction and control of another person, including an outworker, but excluding work or service performed in a professional capacity to which an obligation of professional secrecy applies in terms of the Professional Secrecy Act when such work or service is not regulated by a specific contract of service and "outworker" means a person to whom articles, materials or services of any nature are given out by an employer for the performance of any type of work or service where such work or service is to be carried out either in the home of the outworker or in some other premises not being under the control and management of that other person; or

(c) any person in employment in the public administration, including as a member of a disciplined force;

(d) any former employee;

(e) any person who is or was seconded to an employer; or

(f) any volunteer in terms of article 2(1) of the Voluntary Organisations Act even when such work or service is not regulated by a specific contract of service;

(g) any candidate for employment only where information concerning a serious threat to the public interest constituting an improper practice has been acquired during the recruitment process or at another pre-contractual negotiating stage.(3)

Under the EU directive, reporting individuals, whether in the private or public sector, who acquired information on breaches in a work-related context include:

  • workers (including in non-standard employment relationships);
  • self-employed service providers (including freelancers, contractors, subcontractors and suppliers);
  • shareholders and members of the management body of a company;
  • volunteers and unpaid trainees;
  • persons working under the supervision and direction of contractors;
  • job applicants; and
  • persons whose employment relationship has ended or has yet to begin.

Who is protected?

Under the Maltese act, a disclosure will be afforded protection only if:

  • the whistleblower makes such disclosure in good faith;
  • the whistleblower believes such information to be substantially true;
  • such information tends to show an improper practice being committed by the employer; and
  • such disclosure is not made for personal gain.

At present, Malta's act affords protection only to whistleblowers themselves – the protections afforded under the act therefore do not extend to the general public but are afforded only to those who fall within the definition of 'employee'.

Under the EU directive, protection is afforded to whistleblowers who have reasonable grounds to believe that the information reported is true at the time of reporting and falls within the directive's scope.

Indeed, member states must provide for effective and proportionate penalties to dissuade malicious or abusive reports. Under the Maltese act, not only is no immunity afforded to whistleblowers who are perpetrators or accomplices of such improper practices, but any person who knowingly provides false information is liable for a criminal offence.(4)

A crucial step in the right direction is that unlike those of the Maltese act, the protective measures provided for by the EU directive apply not only to whistleblowers but also to:

  • any person who facilitates a whistleblower;
  • any third parties connected to a whistleblower who may suffer retaliation in a work-related context, such as colleagues or relatives; and
  • legal entities that the reporting persons own, work for or are otherwise connected with in a network-related context.

The EU directive encourages whistleblowers to use internal channels first; however, persons may choose to immediately report externally to the competent authorities.

Notably, whistleblowers can report to the media only if no appropriate action is taken following such reporting or if they reasonably believe that there is an imminent or manifest danger to the public interest and there is a risk of retaliation or a low prospect of the breach being effectively addressed, due to particular circumstances of the case (eg, collusion of the authorities).

The EU directive establishes protective measures for concerned persons. Persons implicated by the reports enjoy the presumption of innocence, the right to an effective remedy and fair trial and the right to a defence.

Minimum standards of protection

The Maltese act prohibits detrimental action(5) and occupational detriment(6) against the employee and clearly establishes that whistleblowers who make a protected disclosure will not be subject to any civil or criminal proceedings or to a disciplinary proceeding for having made such a disclosure.

Similarly, the EU directive sets out several minimum standards of protection for whistleblowers. It requires clear and easily accessible information which is free of charge in relation to procedures for reporting, protective measures, available remedies and access to advice.

Those receiving the reports must diligently follow up and give feedback to the whistleblower within a reasonable timeframe.

A vital form of protection enshrined in the EU directive is the prohibition of, and punishment for, retaliation in any form, including, among others:

  • dismissal;
  • a negative performance assessment;
  • intimidation;
  • harassment; and
  • discrimination.

The EU directive also affords several remedies in cases where such retaliation, notwithstanding the prohibition, still occurs. Indeed, the EU directive provides for, among other things:

  • the reversal of the burden of proof;
  • interim relief; and
  • protection from liability in judicial proceedings in such cases.

Similarly, under the Maltese act, a person who believes that detrimental action has been taken or will be taken imminently due to a protected disclosure having been made, may apply to the Civil Court for an order to remedy the action or an injunction. The court, pending the final determination, may make an interim order or grant an interim injunction. Compensation (including moral damages) may also be granted by the court on final determination.

In the same way that Malta may extend the scope of the EU directive, it can also introduce or retain more favourable protective mechanisms.

Respect for social partners' autonomy and workers' rights

The EU directive will not affect the Maltese rules on:

  • workers' right to consult their representatives;
  • security against any unjustified detrimental measures prompted by such consultations; and
  • social partners' autonomy and their right to enter into collective agreements.


EU member states have until 17 December 2021 to transpose the EU directive. The transposition of this directive will require Malta's legislative branch to expand the Protection of the Whistleblower Act and introduce the novel provisions.


(1) Chapter 527 of the Laws of Malta.

(2) As defined in Chapter 527 of the Laws of Malta.

(3) As defined in Chapter 527 of the Laws of Malta.

(4) Article 101, Chapter 9 of the Laws of Malta.

(5) 'Detrimental action' includes:

  • action causing injury, loss or damage;
  • victimisation, intimidation or harassment;
  • occupational detriment;
  • prosecution under Article 101 of the Criminal Code relating to calumnious accusations; and
  • civil or criminal proceedings or disciplinary proceedings.

(6) 'Occupational detriment' in relation to an employee's working environment includes:

  • being subjected to any disciplinary action, including for breach of ethics or confidentiality;
  • being dismissed, suspended or demoted, except where administratively or commercially justifiable for organisational reasons;
  • being transferred against their will or being refused transfer or promotion except where administratively or commercially justifiable for organisational reasons;
  • being subjected to a term or condition of employment or retirement which is altered or kept altered to their disadvantage;
  • being refused a reference or being provided with an adverse reference from their employer, except where justifiable on the basis of performance;
  • being denied appointment to any employment, profession or office; and
  • being otherwise adversely affected in respect of their employment, profession or office, including employment opportunities and work security.