Having a clearly defined whistleblowing policy would safeguard any sensitive company information and make employees aware of the consequences of publicising any such data. Laura Mitchell outlines some key advice for keeping your data safe.

A worker at Marks & Spencer who ‘blew the whistle’ on plans by the retailer to cut redundancy payments has been dismissed for gross misconduct. The employee, who is thought to have worked for M&S for more than 25 years, leaked an email outlining the retailer’s plans to slash redundancy pay-outs to the media.

Given the current economic climate, many UK businesses are cautious about their prospects and could be looking to cut back in case they too get into difficulties. M&S have said that they had no option but to dismiss the employee because they could not be confident that he would not disclose information in this way again. Maria Ludkin, GMB Legal Officer who represented the employee at the disciplinary hearing called the decision a “gross act of corporate bullying” and intends to appeal.

“The right of an employee to disclose company wrongdoing lies within the boundaries of the Public Interest Disclosure Act 1998 (PIDA).”

The story highlights the difficulties facing businesses when seeking to protect their company information and raises questions of when employers are legally able to discipline workers who make information known to the public.

When are employees protected under whistleblowing?

The right of an employee to disclose company wrongdoing lies within the boundaries of the Public Interest Disclosure Act 1998 (PIDA), which came into force on 2 July 1999. PIDA was introduced following official reports into the sinking of the Zeebrugge ferry and scandals at BCCI, Maxwell, Barlow Clowes and Barings all revealed that staff had been aware of the risk of serious physical or financial harm but that they were either too scared to raise their concerns or they did so in the wrong way or with the wrong person.

If the disclosure qualifies under PIDA, an employee is entitled to ‘blow the whistle’ on suspected malpractice by their employer and receive protection from detriment or dismissal on the grounds that they have done so.

M&S is reported to have said that it does not regard this as a case of whistleblowing because it does not believe that the business was doing anything wrong. However, that will not necessarily be sufficient. To be protected under the Act, it is enough if the employee is able to show that their disclosure relates to one of a list of specific wrongdoings which the employee ‘reasonably believes’ has taken place, is taking place or is likely to take place. These are:

In addition, the employee must make the disclosure to one of the specific people set out in PIDA and in a specified way. Disclosure to the media will only be protected in very limited circumstances.

What action can employers take?

It is important that employers seek specific legal advice where they suspect an employee has ‘blown the whistle’ on their company information. If an employer dismisses an employee or subjects them to any other detriment, that employer could face an Employment Tribunal claim against them. Employers should be particularly wary because if an employee is successful, the compensation which they can be awarded in such a claim is unlimited.

Disclosure of confidential company information by an employee (which does not qualify under PIDA) may constitute gross misconduct and/or breach of the employment contract, entitling the employer to dismiss the employee without notice.

Employers are therefore faced with a catch-22 situation; while businesses will want to minimise the risks of a tribunal claim being brought against them, equally an employer will be keen to protect their confidential information from being disclosed and may feel that disciplinary action is necessary to set an example to other employees.

Best practice for employers

Seek legal advice: If an employer is in any doubt as to whether a disclosure could qualify as whistleblowing under PIDA, they should seek specific legal advice before taking any action against the employee.

Implement a whistleblowing policy and procedure: In order to minimise the risks which arise when a worker makes a protected disclosure, employers should implement a whistleblowing policy and procedure for workers to follow if they consider that there are matters which should be reported. By having a whistleblowing policy, this ensures that employers are made aware of any malpractice in the workplace as soon as possible so that any problems can be addressed through the proper channels (and before the public or media are alerted).

Circulate key information to only a limited number of employees: If there is legitimate company information which the business considers confidential and wishes to protect, it should consider limiting access only to those who need to have access to it.

Make confidential information clearly identifiable: Circulate confidential information in files, envelopes and emails that are clearly identifiable as ‘confidential’ and/or using different coloured paper for documents with different degrees of confidentiality.

If it is practical, operate security measures for some databases: If the information is stored electronically, ensure it is password protected. If it is stored manually, keep it in a locked cupboard or filing cabinet.

Consider monitoring the use of email, photocopiers and similar devices: Employers should consider implementing a proper monitoring procedure that both protects company information, but also ensures that employees’ rights in relation to their personal data are respected.

Check contracts of employment: During the employment relationship, there is an implied duty on employees to respect the confidentiality of the employer’s commercial and business information. However, employers would be advised to reinforce this by ensuring that each written contract of employment includes an express confidentiality clause.

Laura Mitchell is an associate at Clarion Solicitors LLP