Maltese whistleblower protection law "Protection of the Whistleblower Act"

Malta did not wait for Brussels. It passed the Protection of the Whistleblower Act in 2013, six years before the EU set a common rule. The Act now runs on broad immunity and court-proof secrecy. Yet it still refuses to protect an anonymous report, and it makes a worker try inside first.

What does the Protection of the Whistleblower Act cover?

The Act protects a worker who reports an "improper practice" they find through their job. That term is wide. It covers any breach of a legal duty, a risk to health or safety, harm to the environment, corruption, a crime, a miscarriage of justice, and bribery. On top of that sits the full EU-law list, from money laundering to product safety and data protection.

This is broader than the EU directive asked for. The directive only required cover for breaches of EU law. Malta kept its older, home-grown scope and bolted the EU layer on top. A report about a local bribe counts the same as a report about an EU rule. A de minimis line keeps very minor or trivial matters out.

The law also reaches a long way out to sea. A 2023 amendment stretched it to Malta's exclusive economic zone and to environment protection areas. So an oil rig or a fish farm offshore counts as Maltese ground for this Act.

"The provisions of this Act and of any subsidiary legislation made thereunder shall also apply ... to an exclusive economic zone area or an environment protection area ... Any artificial island, installation, structure, equipment or device therein shall, solely for the purposes of this Act ... be treated as if they were situated in Malta itself."
Article 2A, Protection of the Whistleblower Act

Cover follows the work, not the contract. The Act protects employees and public servants. It covers contractors and subcontractors, volunteers, and trainees, paid or not. It also reaches former staff and people on secondment. Job candidates who learn something during hiring are in, and so are shareholders and board members.

Who must set up an internal reporting channel?

Every ministry of the Government of Malta must run an internal channel. So must any private organisation with 50 or more workers. A voluntary organisation joins the list once it raises more than 500,000 euros a year from public collections and donations. The duty can also reach a smaller firm after a risk assessment.

Smaller firms get one break. A private organisation with 50 to 249 workers may share the resources it uses to receive and look into reports. That sharing does not water down the core duties. The firm must still keep reports confidential, give feedback, and deal with the breach.

How do you set up the internal reporting channel?

The channel has clear rules under Article 12. It must take reports in writing and out loud. Oral reports go by phone or voice message, and by a face-to-face meeting if the worker asks. It must be secure and keep the reporter's name from anyone not handling the case. The employer names a whistleblowing reporting officer to follow up.

Two clocks then start. The officer must confirm a report within seven days. They must give feedback within a reasonable time, and no later than three months. The officer also has to keep a record of every report. When an oral report is taken down, the worker can check the transcript, fix it, and sign it.

Run the channel on WeMoral, locked-down whistleblowing software that does what the Protection of the Whistleblower Act demands. The whistleblowing reporting officer you appoint gets a single sealed inbox, and no one else, not even a court, can draw a reporter's name from it. Reports arrive in writing, by voice, or in a booked meeting, and each one lands in a durable, signed record. WeMoral stamps every step with a time, so the file is ready whenever an authority asks to see it. Nothing installs, and a Maltese firm can have the channel live the same afternoon.

Internal first, then external, then public

Malta sets a strict order. An outside report is only protected if the worker already made, or tried to make, an internal one. This is stricter than the EU directive, which lets a worker pick the internal or the external route freely. Malta points people inside first and treats the outside path as a step up, not a free choice.

"Except as provided in this Part, an external disclosure shall only be protected if an internal disclosure in accordance with Section 2 of this Part has already been made or attempted to be made."
Article 15, Protection of the Whistleblower Act

There are escape hatches. A worker can go straight outside if the boss is the problem, if the matter is urgent, if they fear payback, if evidence might vanish, or if an earlier internal report went nowhere. Malta did not build one central whistleblowing office for these reports. It spreads the job across set authorities, with the Ombudsman as the catch-all.

Each authority has its patch. The Auditor General takes public-finance matters. The Financial Intelligence Analysis Unit takes money laundering. The Malta Financial Services Authority takes financial business. The Permanent Commission Against Corruption takes graft. Going fully public is a last resort. It only holds up after the inside and outside routes have failed, or when there is a clear danger to the public.

Are anonymous reports protected?

No. An anonymous disclosure is not a protected disclosure under the Act. Malta took the option the EU directive left open to each state and chose not to shield reports made with no name. This sets Malta apart from neighbours like Spain, which do protect anonymous reports.

"Anonymously made disclosures shall not be a protected disclosure in terms of this Act."
Article 11(1), Protection of the Whistleblower Act

The door is not shut all the way. The reporting officer or the reports unit may still receive an anonymous report and act on it. It just does not carry the law's shield on its own. And there is one more twist. If a worker reports in public with no name, is later identified, and then faces payback, that disclosure becomes protected after all.

What protection does a whistleblower get?

The protection is strong and personal. A whistleblower who makes a protected disclosure cannot be punished for it. They face no civil, criminal, or disciplinary case for having spoken up. The same shield covers facilitators, plus colleagues and relatives who could face payback over the link.

Secrecy is close to absolute. The officer must not reveal anything that could name the whistleblower without their written consent. The Act goes one step further than most. It bars any court from ordering that the name be given up.

"The protection provided for in this article shall not be subject to any exceptions and no court may order the disclosure of the identity of any whistleblower without his consent."
Article 6(4), Protection of the Whistleblower Act

The remedies have teeth. A worker can ask the First Hall, Civil Court to undo the harm or grant an injunction. Once the worker shows a detriment after a report, the law presumes it was payback, and the employer must prove otherwise. The court can award moral damages, and it charges no registry fees to bring the case.

What are the penalties?

Malta's Act spends its criminal teeth in a narrow spot. The one offence in the law targets coercion. It punishes anyone who uses force, threats, or harassment to stop a person using their rights. That carries up to a year in prison, or a fine of 500 to 5,000 euros, or both. If the bully gets their way, the prison term rises and the fine climbs to 10,000 euros.

One penalty is missing here. Many EU states fine a company that fails to run a channel or that takes revenge, often heavily. Cyprus reaches 30,000 euros, and Luxembourg 250,000 euros. Malta does not. It leaves plain retaliation to the civil court and its damages. It saves the criminal fine for those who try to bully a whistleblower into silence. A knowingly false report is a separate crime, to keep the shield honest.

Malta's law holds a real tension. It was early, it grants wide immunity, and it lets no court unmask the person who speaks up. Yet it withholds its shield from the anonymous tip and orders workers through the inside door before any other. The bet is that a named worker, sure of secrecy and immunity, is worth more than a flood of anonymous notes. To see how Malta sits beside the rest of Europe, read our guide to whistleblower laws by country.