1/24/23, 12:57 PM Whistleblower Protection Act 2010: Sustainable a Decade on?

- Lexology

Register now for your free, tailored, daily legal newsfeed service.
Questions? Please contact [email protected]
Register

Whistleblower Protection Act 2010: Sustainable a Decade

on?
Malaysia March 16 2021
Environmental, Social & Governance (“ESG”) is increasingly gaining traction as the buzzword in 2021 and
more stakeholders are sitting up and taking notice when corporate governance matters are discussed.
Stakeholders understand that good corporate governance has a real impact on the sustainability and long-term
prospects of businesses, and are receptive to methods of improving corporate governance.
To illustrate the increasing importance placed on properly addressing ESG issues, the number of signatories to
the United Nations’ Principles for Responsible Investment, the world’s leading proponent of responsible
investment, increased from 63 (representing US$6.5 trillion of assets under management) in April 2006 to 3,038
signatories (representing US$103.4 trillion of assets under management) as of March 2020[1].
To this end, a good whistleblowing policy is no longer just “nice to have”, but is an integral part of a business’
long-term strategy. This article seeks to shed light on the efficacy of the Whistleblower Protection Act 2010
(“WPA”) in Malaysia in improving corporate governance.
Overview
The WPA was enacted to encourage and facilitate disclosure of improper conduct in both the public and private
sectors. To achieve this objective, the WPA grants protection to the persons making disclosures against
detrimental actions. We set out below the key protections offered under the WPA, as well as the reforms needed
to ensure an effective whistleblowing ecosystem can be achieved in Malaysia given the current shortcomings in
the WPA.
Key Protections under the WPA
There are three limbs of whistleblower protection under the WPA:
1. protection of confidential information;
2. immunity from civil and criminal action; and

3. protection from detrimental action.

Pursuant to Section 8 of the WPA, any person who makes or receives a disclosure of improper conduct, or
obtains confidential information in the course of investigation into such disclosure must not disclose such
confidential information. Section 8 prohibits not only the party receiving the disclosure, but also the
whistleblower making the disclosure, from disclosing confidential information.

https://www.lexology.com/library/detail.aspx?g=26a0b7ef-74e0-4859-868f-a82a0e7b50d2 1/5
1/24/23, 12:57 PM Whistleblower Protection Act 2010: Sustainable a Decade on? - Lexology

Under Section 9 of the WPA, a whistleblower will not be subject to any civil or criminal liability or any liability
arising by way of administrative process, including disciplinary action, and any action, claim, or demand taken or
made against the whistleblower, for making a disclosure of improper conduct. The inclusion of the provision,
“any liability arising by way of administrative process” suggests that this protection is not limited to liability
arising from legal suits but also internal actions taken by a corporation or organisation against an employee,
agent, or service provider that is a whistleblower.
Section 10 of the WPA protects a whistleblower and any person related to or associated with the whistleblower
from detrimental action in reprisal for a disclosure of improper conduct. This protection extends beyond the
whistleblower himself, and recognises that the safety of these related or associated people is an important
consideration for a whistleblower to blow the whistle.
Revocation of Protection
The protection granted under the WPA is, however, not absolute. An enforcement agency can revoke any
whistleblower protection pursuant to Section 11 of the WPA if:
1. the whistleblower himself participated in the improper conduct disclosed;

2. the whistleblower wilfully made a false material statement in his disclosure of improper conduct;

3. the disclosure of improper conduct is frivolous or vexatious;

4. the disclosure of improper conduct principally involves questioning the merits of government policy;

5. the disclosure of improper conduct is made solely or substantially with the motive of avoiding dismissal or
other disciplinary action; or

6. the whistleblower, in the course of making the disclosure or providing further information, commits an
offence under the WPA.

Deficiencies of the WPA

The limitation of the scope of disclosures that are accorded protection, and the ability of an enforcement agency
to revoke protection extended to whistleblowers under the WPA are examples of some shortcomings of the WPA.
A few of the key deficiencies are considered below.
1. Limited authorities that can accept whistleblowing reports

An individual is only a “whistleblower” under the WPA if he makes a disclosure of improper conduct to an
“enforcement agency”, which excludes regulatory bodies and public bodies with investigative and enforcement
powers. The Court of Appeal in the case of Rokiah Mhd Noor v KPDNHEP & Ors [2016] 8 CLJ 635 confirmed
this point, and also confirmed that an individual will breach Section 8(1) of the WPA if he discloses confidential
information to other parties after making a disclosure to an enforcement agency.
This is unduly restrictive on a potential whistleblower as disclosure of improper conduct other than to an
enforcement agency may be necessary to obtain, amongst other things, professional advice. In other instances,
whistleblowers may lack confidence in the enforcement agency to address the improper conduct, or consider the
matter to be of such importance that they ought to disclose it to the media or independent watchdog associations.
More importantly for body corporates, the WPA leaves no room for them to resolve any issues internally or to
advise the whistleblower of the best course of action, as corporations are not “enforcement agencies” for
purposes of the WPA. Where an employee discloses improper conduct to the management of the corporation in
the hopes that the management will resolve the issue, he effectively renounces any right to claim protection

https://www.lexology.com/library/detail.aspx?g=26a0b7ef-74e0-4859-868f-a82a0e7b50d2 2/5
1/24/23, 12:57 PM Whistleblower Protection Act 2010: Sustainable a Decade on? - Lexology

under the WPA. On the other hand, where an employee discloses improper conduct directly to an enforcement
agency, the corporation will then have no opportunity to rectify the issues internally, which it may genuinely be
unaware of, resulting in potential damage to reputation and, possibly, a less effective resolution of the complaint
if the most sensible solution should be internal reorganisation or implementation of new policies and procedures,
as opposed to criminal charges being brought against perpetrators who may subsequently leave the company.
As the intention of the WPA is to encourage potential whistleblowers to come forward with valuable information,
the WPA should not discriminate between disclosures to enforcement agencies, disclosures to third parties, and
disclosures to both enforcement agencies and to other parties. The European Union, for example, encourages
whistleblowing through internal reporting channels established by legal entities in the private and public sector
before whistleblowing through external reporting channels (i.e. enforcement agencies) if the matter can be
addressed effectively internally[2]. This is without prejudice to whistleblower protection, which applies to both
internal and external reporting channels.
It is also worth noting a double-layered whistleblowing mechanism serves to reduce the strain on enforcement
agencies who would otherwise have to dedicate time and resources to manage matters which could have been
resolved privately. Further, the whistleblower and the private entity stand to benefit from an expedient
investigation and resolution process, whilst guaranteeing adequate whistleblower protection. This cultivates a
healthy whistleblowing culture as this mechanism allows a certain level of internal regulation without the need
for involvement of enforcement agencies or the negative press associated with it, which may be unwarranted or
taken out of proportion.
In addition to internal and external reporting, the EU Whistleblower Protection Directive also recognises public
disclosure where:
1. the matter was reported internally and externally, but no appropriate action was taken;
2. there are reasonable grounds to believe that the breach may constitute imminent or manifest danger to
public interest; or
3. there are reasonable grounds to believe that there is a risk of retaliation, or low prospect of the breach
being effectively addressed, due to the particular circumstances of that case. 

The WPA should therefore be amended to confer protection on the whistleblower even where the disclosure was
made publicly, particularly in instances where there is a perceived lack of confidence in the authority in question
or where the whistle is blown against an enforcement agency. It goes against the grain of transparency if a
genuine whistleblower is unduly restricted in his means of disclosure and where whistleblower protection can be
unilaterally withheld by an enforcement agency.
B. Conflicting laws

It remains unclear whether disclosure of improper conduct by public officials would be protected under the
WPA. On one hand, Section 6(2)(c) of the WPA provides that disclosure of improper conduct may be made in
respect of information acquired as an officer of a public body. On the other hand, government documents, data,
and other information are generally classified as official secrets under the Official Secrets Act 1972 (“OSA”),
which can only be communicated with authorisation. As a result, disclosing such information without
authorisation — even where it relates to improper conduct — amounts to an offence under the OSA and
automatically disqualifies the whistleblower from protection under the WPA by virtue of Section 6(1) of the
WPA. Additionally, the whistleblower then faces the possibility of prosecution for an offence under the OSA
which, if convicted, carries a jail term of between 1 and 7 years.

https://www.lexology.com/library/detail.aspx?g=26a0b7ef-74e0-4859-868f-a82a0e7b50d2 3/5
1/24/23, 12:57 PM Whistleblower Protection Act 2010: Sustainable a Decade on? - Lexology

Further, Section 203A of the Penal Code makes it a criminal offence for a public servant to disclose any
information or matter obtained by him in the performance of his duties or the exercise of his functions. If
convicted, the public servant faces a fine of up to RM 1 million and a jail term of up to 1 year or either.
These conflicting legislations are a major deterrent for potential whistleblowers, especially public servants. In
addition, the possibility of hefty penalties and jail terms are often not worth the risk, and defeats the core purpose
the WPA seeks to achieve. It is therefore imperative for Parliament to amend the WPA to expressly exclude the
application of these conflicting legislations to genuine whistleblowers.
C. Timelines and transparency

To improve confidence and promote transparency in the whistleblowing process, clear timelines for the
management of whistleblowing reports in the WPA are necessary. While it may not be possible to commit to a
strict timeline, a whistleblower should be kept apprised of the status and outcome of his report.
As a general guide, enforcement agencies could consider taking the following steps upon receiving a report from
a whistleblower:
1. acknowledge receipt of the report;

2. assess the veracity of the report and, if credible, to act upon it;

3. provide regular updates to the whistleblower within reasonable timeframes; and

4. communicate the final outcome of the investigation to the whistleblower upon completion of the exercise.
Enforcement agencies should ensure their approach and processes on whistleblowing are publicly available, and
publish annual reports on the number of reports received, the number of cases still under investigation, and the
number of cases that have been resolved. Where possible, the final outcome should be made public, including
details of the action taken against the perpetrators.
D. Revocation of whistleblower protection

Protection for a whistleblower should not be automatically revoked in the circumstances set out under Section 11
of the WPA. While there are public policy concerns against doing so (e.g. extending protection to participants of
illegal activities, or where disclosure is made substantially with the motive of avoiding dismissal or other
disciplinary actions), it may be a greater injustice to refuse information from such persons. As such, as a starting
point, all whistleblowers should be presumed to be genuine and accorded the protection of the WPA, unless
subsequently proven otherwise, upon which the authorities can then take the appropriate criminal and civil action
against the whistleblower.
If the WPA provided the Courts or enforcement agencies with some flexibility and discretion to determine
whether or not whistleblower protection should be granted, for example by considering the degree of culpability
and the value of the information provided by the whistleblower in relation to investigation and/or enforcement
actions, whistleblowers would then be incentivised to provide full cooperation instead of withholding valuable
information, which in turn may result in the authorities uncovering improper behaviour with greater efficacy.
E. Strengthen the independence of the WPA

Currently, the WPA allows for the Minister in the Prime Minister’s Department (“Minister”) to oversee, issue
directions and make regulations pertaining to the WPA. Considering the Minister’s allegiance to the Government,
this can be perceived as a lack of transparency and independence. To remedy this, an independent body should be
established to replace the Minister’s functions under the WPA.

https://www.lexology.com/library/detail.aspx?g=26a0b7ef-74e0-4859-868f-a82a0e7b50d2 4/5
1/24/23, 12:57 PM Whistleblower Protection Act 2010: Sustainable a Decade on? - Lexology

Further, the evaluation process and the decision to grant or revoke whistleblower protection currently resides
solely with the enforcement agencies to which the disclosures are made. In order to avoid actual and perceived
conflicts of interest, this function should also be carried out by an independent body, while the role of
enforcement agencies should be confined to investigating disclosures, so as to uphold the concept of separation
of powers where an enforcement agency will not be both arbiter and enforcer of the WPA.
Conclusion
While the WPA has laid the foundations to inculcate a whistleblowing culture in Malaysia, it is telling that the
maiden charge under the WPA, where a deputy director of a company was charged for retaliating against a
whistleblower[3], only happened a decade after the WPA was legislated. Reforms to the WPA are needed to
ensure it works in practice, especially in today’s society which expects private and public entities alike to uphold
transparency and integrity, and also comply with sustainability goals.
Further evidence of the need to amend the WPA can be seen when comparing Transparency International’s report
that whistleblowing is the most effective way of detecting serious wrongdoings such as corruption and fraud —
with whistleblowing being responsible for 43% of fraud detection, dwarfing the detection rates of corporate
controls (34%) and law enforcement officers (3%)[4] — to the Malaysian Anti-Corruption Commission's 2019
Annual Report, which provides that only 50 out of 7,724 information reports received in that year were made by
whistleblowers (around 0.65%)[5]. Statistics from the Legal Affairs Division of the Prime Minister’s Department
also showed that, from 2011 to 2017, only 473 out of 62,852 complaints received were made by whistleblowers
(around 0.75%)[6].
Given the increasing need to provide a conducive environment for businesses to grow sustainably, especially
with the COVID-19 pandemic having decimated many businesses, Parliament must swiftly institute reforms in
order to rectify the shortcomings of the WPA and improve its efficacy. In the meantime, all stakeholders should
design and support the usage of a robust whistleblowing mechanism to ensure that the sustainability and long-
term prospects of their businesses from a governance perspective are being taken care of. The Whistleblowing
Management System Guidelines standard (ISO 37002) developed by the International Organisation for
Standardisation is a useful starting point.
Contribution Note: This Sustainability Update was written with contributions from Yip Li Qi (Associate) and
Tiew Kai Xiang (Associate).

Rajah & Tann Asia - Kuok Yew Chen, Tan Yi Li and Tracy Wong

https://www.lexology.com/library/detail.aspx?g=26a0b7ef-74e0-4859-868f-a82a0e7b50d2 5/5