Environmental, Social & Governance (“ESG”) is increasingly gaining traction as the buzzword in 2021 and more stakeholders are sitting up and taking notice when corporate governance matters are discussed. Stakeholders understand that good corporate governance has a real impact on the sustainability and long-term prospects of businesses, and are receptive to methods of improving corporate governance.

To illustrate the increasing importance placed on properly addressing ESG issues, the number of signatories to the United Nations’ Principles for Responsible Investment, the world’s leading proponent of responsible investment, increased from 63 (representing US$6.5 trillion of assets under management) in April 2006 to 3,038 signatories (representing US$103.4 trillion of assets under management) as of March 2020[1].

To this end, a good whistleblowing policy is no longer just “nice to have”, but is an integral part of a business’ long-term strategy. This article seeks to shed light on the efficacy of the Whistleblower Protection Act 2010 (“WPA”) in Malaysia in improving corporate governance.

Overview

The WPA was enacted to encourage and facilitate disclosure of improper conduct in both the public and private sectors. To achieve this objective, the WPA grants protection to the persons making disclosures against detrimental actions. We set out below the key protections offered under the WPA, as well as the reforms needed to ensure an effective whistleblowing ecosystem can be achieved in Malaysia given the current shortcomings in the WPA.

Key Protections under the WPA

There are three limbs of whistleblower protection under the WPA:

  1. protection of confidential information;
  2. immunity from civil and criminal action; and
  3. protection from detrimental action.

Pursuant to Section 8 of the WPA, any person who makes or receives a disclosure of improper conduct, or obtains confidential information in the course of investigation into such disclosure must not disclose such confidential information. Section 8 prohibits not only the party receiving the disclosure, but also the whistleblower making the disclosure, from disclosing confidential information.

Under Section 9 of the WPA, a whistleblower will not be subject to any civil or criminal liability or any liability arising by way of administrative process, including disciplinary action, and any action, claim, or demand taken or made against the whistleblower, for making a disclosure of improper conduct. The inclusion of the provision, “any liability arising by way of administrative process” suggests that this protection is not limited to liability arising from legal suits but also internal actions taken by a corporation or organisation against an employee, agent, or service provider that is a whistleblower.

Section 10 of the WPA protects a whistleblower and any person related to or associated with the whistleblower from detrimental action in reprisal for a disclosure of improper conduct. This protection extends beyond the whistleblower himself, and recognises that the safety of these related or associated people is an important consideration for a whistleblower to blow the whistle.

Revocation of Protection

The protection granted under the WPA is, however, not absolute. An enforcement agency can revoke any whistleblower protection pursuant to Section 11 of the WPA if:

  1. the whistleblower himself participated in the improper conduct disclosed;
  2. the whistleblower wilfully made a false material statement in his disclosure of improper conduct;
  3. the disclosure of improper conduct is frivolous or vexatious;
  4. the disclosure of improper conduct principally involves questioning the merits of government policy;
  5. the disclosure of improper conduct is made solely or substantially with the motive of avoiding dismissal or other disciplinary action; or
  6. the whistleblower, in the course of making the disclosure or providing further information, commits an offence under the WPA.

Deficiencies of the WPA

The limitation of the scope of disclosures that are accorded protection, and the ability of an enforcement agency to revoke protection extended to whistleblowers under the WPA are examples of some shortcomings of the WPA. A few of the key deficiencies are considered below.

  1. Limited authorities that can accept whistleblowing reports

An individual is only a “whistleblower” under the WPA if he makes a disclosure of improper conduct to an “enforcement agency”, which excludes regulatory bodies and public bodies with investigative and enforcement powers. The Court of Appeal in the case of Rokiah Mhd Noor v KPDNHEP & Ors [2016] 8 CLJ 635 confirmed this point, and also confirmed that an individual will breach Section 8(1) of the WPA if he discloses confidential information to other parties after making a disclosure to an enforcement agency.

This is unduly restrictive on a potential whistleblower as disclosure of improper conduct other than to an enforcement agency may be necessary to obtain, amongst other things, professional advice. In other instances, whistleblowers may lack confidence in the enforcement agency to address the improper conduct, or consider the matter to be of such importance that they ought to disclose it to the media or independent watchdog associations.

More importantly for body corporates, the WPA leaves no room for them to resolve any issues internally or to advise the whistleblower of the best course of action, as corporations are not “enforcement agencies” for purposes of the WPA. Where an employee discloses improper conduct to the management of the corporation in the hopes that the management will resolve the issue, he effectively renounces any right to claim protection under the WPA. On the other hand, where an employee discloses improper conduct directly to an enforcement agency, the corporation will then have no opportunity to rectify the issues internally, which it may genuinely be unaware of, resulting in potential damage to reputation and, possibly, a less effective resolution of the complaint if the most sensible solution should be internal reorganisation or implementation of new policies and procedures, as opposed to criminal charges being brought against perpetrators who may subsequently leave the company.

As the intention of the WPA is to encourage potential whistleblowers to come forward with valuable information, the WPA should not discriminate between disclosures to enforcement agencies, disclosures to third parties, and disclosures to both enforcement agencies and to other parties. The European Union, for example, encourages whistleblowing through internal reporting channels established by legal entities in the private and public sector before whistleblowing through external reporting channels (i.e. enforcement agencies) if the matter can be addressed effectively internally[2]. This is without prejudice to whistleblower protection, which applies to both internal and external reporting channels.

It is also worth noting a double-layered whistleblowing mechanism serves to reduce the strain on enforcement agencies who would otherwise have to dedicate time and resources to manage matters which could have been resolved privately. Further, the whistleblower and the private entity stand to benefit from an expedient investigation and resolution process, whilst guaranteeing adequate whistleblower protection. This cultivates a healthy whistleblowing culture as this mechanism allows a certain level of internal regulation without the need for involvement of enforcement agencies or the negative press associated with it, which may be unwarranted or taken out of proportion.

In addition to internal and external reporting, the EU Whistleblower Protection Directive also recognises public disclosure where:

  1. the matter was reported internally and externally, but no appropriate action was taken;
  2. there are reasonable grounds to believe that the breach may constitute imminent or manifest danger to public interest; or
  3. there are reasonable grounds to believe that there is a risk of retaliation, or low prospect of the breach being effectively addressed, due to the particular circumstances of that case. 

The WPA should therefore be amended to confer protection on the whistleblower even where the disclosure was made publicly, particularly in instances where there is a perceived lack of confidence in the authority in question or where the whistle is blown against an enforcement agency. It goes against the grain of transparency if a genuine whistleblower is unduly restricted in his means of disclosure and where whistleblower protection can be unilaterally withheld by an enforcement agency.

  1. Conflicting laws

It remains unclear whether disclosure of improper conduct by public officials would be protected under the WPA. On one hand, Section 6(2)(c) of the WPA provides that disclosure of improper conduct may be made in respect of information acquired as an officer of a public body. On the other hand, government documents, data, and other information are generally classified as official secrets under the Official Secrets Act 1972 (“OSA”), which can only be communicated with authorisation. As a result, disclosing such information without authorisation — even where it relates to improper conduct — amounts to an offence under the OSA and automatically disqualifies the whistleblower from protection under the WPA by virtue of Section 6(1) of the WPA. Additionally, the whistleblower then faces the possibility of prosecution for an offence under the OSA which, if convicted, carries a jail term of between 1 and 7 years.

Further, Section 203A of the Penal Code makes it a criminal offence for a public servant to disclose any information or matter obtained by him in the performance of his duties or the exercise of his functions. If convicted, the public servant faces a fine of up to RM 1 million and a jail term of up to 1 year or either.

These conflicting legislations are a major deterrent for potential whistleblowers, especially public servants. In addition, the possibility of hefty penalties and jail terms are often not worth the risk, and defeats the core purpose the WPA seeks to achieve. It is therefore imperative for Parliament to amend the WPA to expressly exclude the application of these conflicting legislations to genuine whistleblowers.

  1. Timelines and transparency

To improve confidence and promote transparency in the whistleblowing process, clear timelines for the management of whistleblowing reports in the WPA are necessary. While it may not be possible to commit to a strict timeline, a whistleblower should be kept apprised of the status and outcome of his report.

As a general guide, enforcement agencies could consider taking the following steps upon receiving a report from a whistleblower:

  1. acknowledge receipt of the report;
  2. assess the veracity of the report and, if credible, to act upon it;
  3. provide regular updates to the whistleblower within reasonable timeframes; and
  4. communicate the final outcome of the investigation to the whistleblower upon completion of the exercise.

Enforcement agencies should ensure their approach and processes on whistleblowing are publicly available, and publish annual reports on the number of reports received, the number of cases still under investigation, and the number of cases that have been resolved. Where possible, the final outcome should be made public, including details of the action taken against the perpetrators.

  1. Revocation of whistleblower protection

Protection for a whistleblower should not be automatically revoked in the circumstances set out under Section 11 of the WPA. While there are public policy concerns against doing so (e.g. extending protection to participants of illegal activities, or where disclosure is made substantially with the motive of avoiding dismissal or other disciplinary actions), it may be a greater injustice to refuse information from such persons. As such, as a starting point, all whistleblowers should be presumed to be genuine and accorded the protection of the WPA, unless subsequently proven otherwise, upon which the authorities can then take the appropriate criminal and civil action against the whistleblower.

If the WPA provided the Courts or enforcement agencies with some flexibility and discretion to determine whether or not whistleblower protection should be granted, for example by considering the degree of culpability and the value of the information provided by the whistleblower in relation to investigation and/or enforcement actions, whistleblowers would then be incentivised to provide full cooperation instead of withholding valuable information, which in turn may result in the authorities uncovering improper behaviour with greater efficacy.

  1. Strengthen the independence of the WPA

Currently, the WPA allows for the Minister in the Prime Minister’s Department (“Minister”) to oversee, issue directions and make regulations pertaining to the WPA. Considering the Minister’s allegiance to the Government, this can be perceived as a lack of transparency and independence. To remedy this, an independent body should be established to replace the Minister’s functions under the WPA.

Further, the evaluation process and the decision to grant or revoke whistleblower protection currently resides solely with the enforcement agencies to which the disclosures are made. In order to avoid actual and perceived conflicts of interest, this function should also be carried out by an independent body, while the role of enforcement agencies should be confined to investigating disclosures, so as to uphold the concept of separation of powers where an enforcement agency will not be both arbiter and enforcer of the WPA.

Conclusion

While the WPA has laid the foundations to inculcate a whistleblowing culture in Malaysia, it is telling that the maiden charge under the WPA, where a deputy director of a company was charged for retaliating against a whistleblower[3], only happened a decade after the WPA was legislated. Reforms to the WPA are needed to ensure it works in practice, especially in today’s society which expects private and public entities alike to uphold transparency and integrity, and also comply with sustainability goals.

Further evidence of the need to amend the WPA can be seen when comparing Transparency International’s report that whistleblowing is the most effective way of detecting serious wrongdoings such as corruption and fraud — with whistleblowing being responsible for 43% of fraud detection, dwarfing the detection rates of corporate controls (34%) and law enforcement officers (3%)[4] — to the Malaysian Anti-Corruption Commission's 2019 Annual Report, which provides that only 50 out of 7,724 information reports received in that year were made by whistleblowers (around 0.65%)[5]. Statistics from the Legal Affairs Division of the Prime Minister’s Department also showed that, from 2011 to 2017, only 473 out of 62,852 complaints received were made by whistleblowers (around 0.75%)[6].

Given the increasing need to provide a conducive environment for businesses to grow sustainably, especially with the COVID-19 pandemic having decimated many businesses, Parliament must swiftly institute reforms in order to rectify the shortcomings of the WPA and improve its efficacy. In the meantime, all stakeholders should design and support the usage of a robust whistleblowing mechanism to ensure that the sustainability and long-term prospects of their businesses from a governance perspective are being taken care of. The Whistleblowing Management System Guidelines standard (ISO 37002) developed by the International Organisation for Standardisation is a useful starting point.

Contribution Note: This Sustainability Update was written with contributions from Yip Li Qi (Associate) and Tiew Kai Xiang (Associate).