Conditions for Protection Against Retaliation
While the Directive does not refer to the term good faith anywhere in its text, it mentions malicious reports in its recital 32, where it explains the reasoning behind the condition for the protection of reporting persons as defined in Article 6 (1) (a) of the Directive. According to the mentioned recital, the condition is supposed to provide protection against malicious reports. Namely, it requires that the reporting person must have reasonable grounds to believe that the information on the breach reported was true at the time of reporting and that such information fell within the scope of the Directive. This condition should act as the key safeguard against malicious, and frivolous or abusive reports, ensuring that reporting persons who deliberately and knowingly report wrong or misleading information are not entitled to protection against retaliation.
The approach taken by the Directive does not seem to be the best one. At least not for the reporting persons.
The Directive requires a certain degree of probability regarding the veracity of the information and of the Directive's material scope at the time of reporting from the reporting person. There is no rebuttable presumption provided by the Directive that this condition is met until proven otherwise. This places the burden of proof on the reporting person as the weaker party in the proceedings, which significantly increases his or her legal risk.
The Directive does not define the legal standard “reasonable grounds” and leaves this to national laws. Moreover, this is not the only legal standard which applies to the condition. Namely, the information on the breach, to which the discussed condition refers to, is defined in Article 5 as information, including reasonable suspicion, about actual or potential breach, which occurred or is very likely to occur. It is not clear why this definition uses the term “reasonable suspicion”, while in Article 6 it requires “reasonable grounds” from the applicant. These legal standards may have very different meaning in some national legislations, which will surely add to confusion.
Certainly, however, not all reports with a lower degree of probability than the required “reasonable grounds” (nor “reasonable suspicion”) should necessarily be equated with intentionally wrong and misleading reports. If one understands good faith reporting persons as all those who are not intentionally submitting wrong and misleading reports, the Directive apparently divides the good faith reporting persons into two further groups. The one with more and the one with less good faith. The distinction is far from insignificant, as the protection against retaliation depends on it. In addition to intentionally wrongfully reporting persons, also the reporting persons with "less" good faith who fail to prove the sufficient degree of probability of the truthfulness of the information at the time of reporting will not be able to rely on the protective measures against retaliation. Moreover, even the fact that the reported breaches turn out to be substantiated will not allow the reporting persons with "less" good faith the access to the protective measures. The opposite situation in which the reporting person with “more” good faith reports information which later turns out to be untrue and still enjoys protection, seems much less relevant.
Instead of the positive condition set out in Article 6 of the Directive, it might be more appropriate for maliciousness to be defined as a negative condition for providing the protection against retaliation. Similar to the provision of Article 23 (2), where penalties need to be provided in respect of reporting persons where it is established that they knowingly reported false information, the denial of protection could be defined under the same condition. Such a solution would be simpler, pose less legal risk for reporting persons, while the purpose set out in recital 32 would still be achieved. Member States may still introduce such a solution in their national laws, as it is a more favourable provision to the rights of the reporting persons.