The Securities and Exchange Commission (the SEC or Commission) made clear in 2023 that it intends to aggressively enforce its whistleblower protection laws, namely Rule 21F-17, which prohibits employers from taking any action that impedes an individual from communicating potential securities violations to the Commission.

Read More >> Eyes on 2024: Will the SEC Continue Its Aggressive Enforcement of Whistleblower Laws in 2024?

On Oct. 28, 2021, Gov. Hochul signed legislation that significantly expands the scope of New York Labor Law Section 740 (NYLL 740), the state’s “whistleblower” protection law covering all private sector employees. Most notably, beginning in January 2022, employees and independent contractors will be protected for reporting employer activity that they reasonably believe violates any law, regardless of whether the law relates to public safety or whether the activity was an actual violation. 

Read More >> New York Significantly Expands Employee Whistleblower Protections

On December 28, 2015, Governor Cuomo signed a bill repealing Civil Service Law § 75-b(2)(b).  This has a significant effect on the anti-retaliation provisions of New York’s “whistle blower” protection statute for public employees who report to a governmental body either (a) violations of a law, rule or regulation, or (b) something which an employee reasonably believes to be “improper governmental action." Civil Service Law § 75-b protects public employees who are whistle blowers against retaliation by public employers (which includes the State of New York, counties, cities, towns, villages, and school districts).  As originally enacted, § 75-b(2)(b) (now repealed) required that a public employee, in order to invoke the anti-retaliation protection, first “shall have made a good faith effort to provide the appointing authority or his or her designee the information to be disclosed and shall provide the appointing authority or designee a reasonable time to take appropriate action unless there is imminent and serious danger to public health or safety.” With the repeal, there now appears to be no requirement that the employee report the issue internally before taking it to another governmental body.  While no doubt well-intentioned, the repeal may very well empower disgruntled employees to pepper regulatory and criminal authorities with complaints of alleged misconduct. In addition to the fact that public employers should generally be aware of this change, public employers should also examine and review their existing whistle blower policies to determine if any revisions should be made.

Conducting workplace investigations is one of the most challenging and most important duties that Human Resource professionals must take on.  With the slew of existing laws, how Human Resource professionals respond to complaints about harassment or other misconduct can have huge legal and practical implications for the employer.  Unfortunately, Einstein’s definition of insanity -- doing things the same way and expecting a different result -- all too often is at play when it comes to conducting effective investigations.  Unfortunately, employers make the same mistakes time and again, exposing themselves to potential legal liability.  These common mistakes often result in lawsuits being filed by the complaining employee or by the employee who is fired or disciplined.  Here is a list of 10 common mistakes Human Resource professionals should avoid to minimize unnecessary legal exposure. 1.  Failing to Investigate or Ignoring Complaints Failing to take action when a complaint is made is one of the biggest mistakes employers can make.  Choosing not to conduct an investigation after acquiring knowledge of the alleged inappropriate conduct will result most likely in the company being legally responsible for harm caused to any employee, client, and others due to the inappropriate conduct.  Regardless of how frivolous or unfounded the complaint appears, or who made the complaint, an investigation should be conducted.  Even allegations made by employees who have a history of making complaints or are regarded as “troublemakers” at work should not be ignored.  Equally important, the mere fact that the complaint may be anonymous does not excuse the failure to investigate.  Obviously, the task is more difficult but the investigation nonetheless should be conducted. 2.  Not Creating an Investigation Plan Failing to create a preliminary plan for the investigation creates serious issues because it often results in the purpose of the investigation being misunderstood or forgotten.  Before diving into the investigation, make sure you’ve thought about the five W’s:  (1) Why are you investigating?; (2) Who will conduct the investigation?; (3) Who are the witnesses that need to be interviewed?; (4) What evidence needs to be collected?; and (5) What is your investigation timeline? 3.  Taking Too Long to Investigate Delaying the initiation of the investigatory process after being notified of an issue may lead to employer liability.  Particularly in harassment and discrimination cases, an employer’s decision to delay an investigation may be viewed as subjecting the employee to additional unlawful behavior.  Nonetheless, making sure an investigative plan is properly prepared remains important.  Therefore, Human Resource professionals must strike a balance between adequately preparing for the investigation and avoiding unreasonably long delays. 4.  Not Having Trained and Ready Investigators or Selecting the Wrong Investigator A failure to have trained investigators prepared to promptly respond to complaints can result in an ineffective and drawn out investigation.  Employers should have a few employees trained to conduct an impartial, professional, and credible investigation.  Another option is to hire a trusted Human Resources colleague or use in-house or outside counsel to conduct the investigation.  No matter who you choose as the investigator, making sure that the investigator is trained and able to begin the investigation promptly is key. Depending on the nature of the allegations, you also need to be sure you have selected the right person for the job.  For example, having a former senior law enforcement official interview relatively young employees regarding highly sensitive allegations of a sexual nature may not be the most effective way to get the truth! 5.  Not Doing a Thorough Investigation Conducting a sloppy investigation by failing to interview necessary witnesses, failing to review relevant documents, and ignoring potential issues that come up during the investigation can create just as much legal exposure as not doing an investigation at all.  You should make sure that every investigation is thorough, not only to ensure that the alleged misconduct is properly dealt with, but also to counteract any accusations by an employee that the investigation was ineffective. 6.  Conducting Unlawful Searches Searching an employee’s personal belongings or monitoring certain communications without consent can result in the employer breaking several federal and state laws.  To avoid liability, it is good practice for employers to make employees aware of its surveillance policies and obtain consent from employees to monitor and access communications and information contained on any electronic devices employees are given access to at work. 7.  Using Aggressive or Unwelcoming Interview Styles An employer may become the target of a lawsuit if its investigators are overly aggressive when interviewing employees about alleged misconduct.  Aggressive tactics may result in legal claims such as false imprisonment and coerced confessions, just to name a few.  More practically, the employer risks not getting the whole story, dissuading employees from cooperating in the investigation, and not reaching the correct conclusion in the matter.  To avoid aggressive interviewing, you should consider appropriate locations to conduct the interviews, outline questions in advance, and use open-ended questions when able, to get the entire story.  As noted above, the “right” investigator can and often does make a big difference in making witnesses feel comfortable so that they will be cooperative instead of obstructing the investigation. 8.  Making Confidentiality Promises Although it is reasonable for an employer to encourage everyone involved in the investigation to keep the matter private, an employer should never promise an employee that his or her complaint will remain confidential.  There will always be certain information that must be disclosed in order for a thorough investigation to be completed.  Moreover, depending again on the nature of the allegations, employers run the risk of a possible violation of federal labor law (considering the NLRB's Banner Health decision) if they demand absolute confidentiality by the witnesses. 9.  Failing to Create a Report Don’t underestimate the value of documenting investigations and credibility determinations to help support the company’s action or inaction regarding the allegations.  Not appropriately documenting necessary evidence, information provided during interviews, and any other relevant findings is just as bad as failing to conduct an investigation.  “The dog ate my homework” does not work very well in the legal arena.  When there is no record of the information obtained to support your determination, there is no way to show that a proper investigation was done and that an appropriate determination was reached.  An investigatory report should be prepared for every single investigation and should include a summary of the matter, the identity of the complainant, the accused, and all witnesses, a description of the relevant documents, findings, credibility determinations, and the recommended action. 10.  Failing to Make a Determination Failing to reach a conclusion and take the necessary steps to stop misconduct and prevent it from occurring in the future will ultimately result in the employer once again exposing itself to legal liability.  Once the report has been completed, a determination should be made regarding whether the misconduct occurred and what appropriate actions should be taken.  Make sure, especially in cases of harassment, that the complainant does not suffer any adverse employment actions resulting from the determination unless you can prove that the allegations were made in bad faith.  When a determination is made, you should consider not only if the chosen action appropriately corrects the problem, but whether it also sends a message to coworkers of what the consequences are for harassing behavior or misconduct. Following these basic common sense steps should go a long way in helping you ensure your employer avoids unnecessary liability.

In August of 2011, a former employee of DISH Network filed a complaint with OSHA that DISH had “blacklisted” him.  Specifically, the complainant alleged that DISH had given him a negative job reference, and had refused to do business with the complainant’s subsequent employers.  What was the alleged reason for the “blacklisting”?  The employee, who worked in the marketing department in New York, had reported possible financial fraud to his superior in 2008, and the employee contended the actions against him by DISH -- a publicly traded company -- amounted to retaliation for his reporting the fraud, in violation of the Sarbanes-Oxley Act.  Earlier this month, OSHA completed its investigation, finding merit to the employee’s complaint, and ordering hefty fines of over $250,000 against DISH:  $157,024 in back wages, $100,000 in compensatory damages, and attorneys’ fees.  DISH has 30 days to file an appeal before an Administrative Law Judge. We highlight this recent decision because it is not widely known that OSHA is the agency tasked with investigating whistleblower provisions in twenty-two different laws, ranging from the Occupational Safety and Health Act itself, to the Surface Transportation Assistance Act and even the Affordable Care Act.  Thus, for example, an employer can be subject to a whistleblower investigation and an order from OSHA if it retaliates against an employee for participating in activities protected by these laws, such as complaining about workplace safety, reporting driving a commercial motor vehicle longer than allowed by law, or receiving a subsidy under the Affordable Care Act.  When OSHA completes a whistleblower investigation in which it finds merit or after which it files suit in federal court, it has historically issued a corresponding press release as it did regarding the DISH decision.  For an example of a press release announcing a lawsuit, see this link. A complete list of laws with whistleblower provisions subject to enforcement by OSHA is available here.  Employers are well advised to review the list and their policies, and to provide training to their managers and supervisors who make employment decisions, in order to ensure compliance with any applicable whistleblower provisions.

On March 4, 2014, the U.S. Supreme Court significantly expanded the Sarbanes-Oxley anti-retaliation law to cover employees of private contractors who perform services for publicly-traded companies.  Passed in 2002 in the wake of the Enron scandal, the Sarbanes-Oxley Act (“SOX”) establishes strict standards for financial behavior by publicly-traded companies and protects “employees” from retaliation for blowing the whistle on a number of specific types of violations.  In Lawson v. FMR LLC, the Court concluded in a 6-3 decision that not only are employees of the publicly-traded company protected from retaliation, but employees of contractors and subcontractors of the company are also similarly protected. Although it is not clear how wide the net will be expanded, millions of workers who provide almost any type of service to a publicly-traded company (e.g., cleaning, daycare, lawn service, as well as tax and audit and many others) will likely have the right to file a complaint with the Department of Labor and proceed to court if they suffer an adverse employment action after they have filed a complaint involving the publicly-traded company. What does the Lawson decision mean for most employers?  First, employers need to take inventory of whether they provide services to publicly-traded companies in order to determine if SOX’s whistleblower provision applies to their employees.  Second, employers must be sure to establish properly worded anti-retaliation policies that are broad enough in scope to cover reports of alleged fraudulent activity, including reports of alleged Securities and Exchange Act violations.  Third, even well-written policies will not be sufficient if managers and supervisors are not properly trained to deal with employee complaints covered by the policy.  Managers must be aware that adverse actions against whistleblowers (not only terminations, but also lesser actions such as job reassignments, shift changes, and below-average merit increases) can create serious liability for their employer. A well-publicized internal complaint procedure is crucial; otherwise, employees will likely turn to a private attorney or a government agency to raise their complaints.  All complaints must be taken seriously, followed by reassurance to the complaining employee that he/she will not be retaliated against in any manner.  If an internal complaint of retaliation is made, the employer must conduct a thorough and comprehensive investigation, and take corrective action if necessary.  The investigation and corrective action must be properly documented.  Solid documentation will help the company assess whether the complaint falls under SOX and will lock in the scope of the employee’s complaint.  A well-documented investigation, followed by an appropriate response to the facts uncovered, will also show a court that the company took the complaint seriously, and may help to avoid unnecessary litigation.

The Securities and Exchange Commission’s final rules (the “Rules”) clarifying Dodd-Frank whistleblower rewards and protections take effect on August 12, 2011. The Rules govern the payment of rewards to eligible individuals who report violations of the federal securities laws which lead to a successful enforcement action by the SEC in which monetary sanctions of over $1 million are collected. The SEC promulgated the Rules pursuant to the Dodd-Frank Wall Street Reform and Consumer Protection Act (“Dodd-Frank”), which requires the SEC, in certain cases, to award to qualifying whistleblowers no less than 10%, and no greater than 30%, of the total monetary sanctions collected because of the whistleblower’s information. The Rules detail, among other things, how the SEC will evaluate an individual’s right to a reward and, if qualified, the amount to be awarded. Significant aspects of the Rules are summarized in brief below.

Notably, a whistleblower can submit information to the SEC anonymously through counsel, and a whistleblower’s identity is kept confidential. Moreover, a whistleblower need not have “clean hands” to receive an award. While the culpability or involvement of a whistleblower is a factor in determining the amount of an award, a culpable whistleblower, in the absence of a criminal conviction, is not per se precluded from receiving an award.

The Rules also clarify the anti-retaliation protections afforded whistleblowers under Dodd-Frank. Whistleblowers who do not qualify for a reward are still protected by the anti-retaliation provisions as long as the individual has a “reasonable belief that the information he is providing relates to a possible securities law violation … that has occurred, is ongoing, or is about to occur.” 

Whistleblowers are not required to report their concerns internally to their employers before making a report to the SEC. The Rules do, however, include incentives intended to encourage whistleblowers to use their companies’ internal compliance and reporting systems. For example, one of the factors the SEC will consider in determining whether to increase the amount of the award, is whether the whistleblower participated in his or her company’s internal reporting system. Similarly, a factor in determining whether to decrease the amount of the whistleblower award is whether the whistleblower undermined the integrity of the company’s internal compliance and reporting system. In addition, a whistleblower remains eligible to receive an award for his or her original information, even if he or she first reports the possible violation to the company, and the company subsequently reports the information to the SEC or provides the SEC with the results of an internal investigation which was prompted by the whistleblower’s information. 

The SEC states in the Rules that it is not seeking to undermine effective company processes for receiving reports on possible violations. In appropriate cases, it will contact the company after receiving a complaint, describe the nature of the allegations, and give the company an opportunity to investigate the matter and report back. Among other factors the SEC will consider in determining whether to give a company this opportunity are the company’s existing culture related to corporate governance, and the company’s internal compliance programs, including what role, if any, internal compliance had in bringing the information to management’s or the SEC’s attention.

In light of these factors alone, companies should evaluate their current internal reporting processes and policies to ensure that they effectively encourage employees to report their concerns about potential violations and misconduct through internal processes, to minimize the risk of being blindsided by an enforcement action. An effective internal reporting system will: be uncomplicated and non-threatening; include a process for reporting and receiving concerns about possible violations, including anonymous submissions; and ensure that all allegations of misconduct are taken seriously and addressed in a timely manner. Companies should routinely train their employees on how to report potential violations using the company’s internal reporting system, promote the use of their internal compliance programs, and train supervisors how to respond to reports of potential violations.