The internal reporting channel duty in Malta

Principal Act 15 September 2013. The transposing amendments in Act LXVII of 2021 were assented on 18 December 2021; the Act provided that it would come into force on such date or dates as the Minister for Justice and Governance establishes by notice in the Gazette, and the official legislation.mt ELI record for Act LXVII of 2021 gives 24 December 2021 as the entry into force date.

Set by the Second Schedule, which defines "employer" for the purposes of the internal disclosure duty in Part III, Section 2: any organisation within the private sector with fifty (50) or more workers; plus any private sector organisation with fewer than fifty (50) workers where, following an appropriate risk assessment taking into account the nature of its activities and the ensuing level of risk, in particular for the environment and public health, it may be required to establish an internal disclosure channel and procedure; plus each ministry of the Government of Malta; plus any voluntary organisation which annually raises more than EUR 500,000 from public collections and other donations. The first proviso to Art. 12(4) disapplies the Second Schedule threshold to entities falling within the scope of Part I(B) and Part II of the Third Schedule (the Annex to Directive (EU) 2019/1937), which are therefore covered regardless of size.

No separate deadline. Malta did not use the 17 December 2023 option: the duty has applied to every covered organisation with 50 or more workers since the Act LXVII of 2021 amendments came into force in December 2021. Nothing in Cap 527, its Schedules or the amending Act defers the duty for organisations with 50 to 249 workers; the only concession for that band is the second proviso to Art. 12(4), which lets them share resources as regards the receipt of reports and any investigation, without prejudice to their own duties of confidentiality, feedback and addressing the reported breach.

Optional, and anonymous disclosures are not protected as such. Art. 11(1): "Anonymously made disclosures shall not be a protected disclosure in terms of this Act." Art. 11(2): the whistleblowing reporting officer or the whistleblowing reports unit "may receive and process anonymous disclosures and may take that disclosure into consideration in determining whether improper practice has occurred" - a discretion, not a duty. Art. 11(3) carves out one exception: where a public disclosure containing information on breaches was made anonymously and the whistleblower is subsequently identified and suffers retaliation, that disclosure is still a protected disclosure provided it satisfies Art. 9(1).

Incomplete in a way that matters: Part 1 of the First Schedule to Cap 527 also prescribes the Ombudsman and the Permanent Commission Against Corruption. The Ombudsman is the residual channel - its entry covers "(i) Conduct involving substantial risk to public health or safety or the environment that would if proved, constitute a criminal offence; and (ii) All matters which constitute improper practices and which are not designated to be reported to any other authority." The Permanent Commission Against Corruption covers "corrupt practices". Add both.

Cap 527 sets no penalty for an employer that fails to establish internal disclosure procedures. Part IV (Offences and Penalties) contains a single offence, Art. 19, and it is not about internal channels: a person who, for the purpose of compelling another to abstain from doing or to do any act that the other has a legal right to do or abstain from doing under the Act, wrongfully or without legal authority uses or threatens violence against that person or their spouse, child or household member or their property, persistently follows them, watches or besets their residence or its approaches, or deprives or hinders their use of their tools, clothing or other property, is liable on conviction to imprisonment not exceeding one year or a fine (multa) of not less than EUR 500 and not more than EUR 5,000, or both, without prejudice to any heavier punishment under another enactment; where the person achieved their aim, imprisonment is increased by one to two degrees and the fine becomes not less than EUR 1,500 and not more than EUR 10,000. So the maximum fine anywhere in the Act is EUR 10,000, and it attaches to coercion of a whistleblower, not to failing to set up a channel.

Not expressly provided for. Art. 2 defines the "whistleblowing reporting officer" as "such officer within an employer charged with carrying out the functions designated by article 12", wording that points to an appointment inside the organisation, and Art. 12(1)(b) requires the designation of that officer to follow up on reports. The Act does not contain the express permission to have the channel "provided externally by a third party" that appears in Cyprus (Art. 8(4)), Greece (Art. 9(7)) and Romania (Art. 3 pt. 16). It does allow private sector organisations with 50 to 249 workers to share resources for receiving reports and investigations (Art. 12(4)). Outsourcing the technical intake platform is not prohibited, but the designated reporting officer should be treated as an internal appointment.