This article was first published by the International Law Office, a premium online legal update service for major companies and law firms worldwide. Register for a free subscription.
There is no definition of 'whistleblowing' under UAE law and, until recently, there were no laws specifically providing for whistleblower protection.
Historically, the Penal Code has placed a positive obligation on all persons to report crime. However, this reporting requirement is difficult to enforce and does not address the sort of unethical practices or behaviour which are caught by whistleblowing laws in other jurisdictions. However, recent changes to UAE law have gone some way to encourage employees to escalate and report corporate wrongdoing.
The Financial Crime Law (4/2016) introduced a degree of whistleblower protection where the disclosure is:
- true;
- related to an activity that may affect Dubai's economic security; and
- made to the Dubai Centre for Economic Security.
Where a disclosure satisfies the above criteria, the individual making it will be protected against prosecution and disciplinary action, unless proven to be providing false information. The Financial Crime Law expressly states that the reporter will be protected at their workplace and must not be subject to mistreatment or discrimination. In addition, an employee who makes a report to the centre will not be deemed to be in breach of any non-disclosure or confidentiality agreement signed and entered into with their employer.
The centre was set up to combat financial crimes, including:
- corruption;
- fraud;
- bribery;
- embezzlement;
- destruction of public property;
- forgery;
- counterfeiting;
- money laundering; and
- the financing of terrorism and illegal organisations.
This – coupled with the wide possible interpretation of 'an activity that may affect Dubai's economic security' – means that employees could use the Financial Crime Law to escalate an activity undertaken by their employer to the centre.
The Financial Crime Law provides that the centre can coordinate with international institutions in order to access and monitor information and data relating to matters which it is investigating for national security purposes. Therefore, it could potentially monitor and discipline Dubai companies and organisations which contravene provisions of the Financial Crime Law when operating outside Dubai. Thus, companies which have operations and assets in different locations worldwide should be particularly aware of the possible extra-territorial reach of the Financial Crime Law.
The Dubai International Financial Centre (DIFC) free zone operates a common law jurisdiction and its own court system that sits separately to that of onshore Dubai. Significantly, the DIFC Operating Law (7/2018) expressly includes a positive obligation to disclose wrongdoing as well as whistleblower protections.
The law protects an employee who, in good faith, discloses to the DIFC Registry of Companies information relating to a reasonable suspicion that a person contravened the DIFC Operating Law by:
- being subject to contractual or civil liability; and
- being dismissed from their employment or otherwise suffering any detriment.
While the DIFC Operating Law does not extend outside the DIFC's jurisdiction, it does put the concept of 'whistleblowing' on the map and most DIFC-based employers now have a whistleblowing policy and practice in place. In addition, employers are increasingly seeking to include provisions in employment contracts that place a contractual obligation on their employees to report any wrongdoing of which they may become aware during their employment. However, these obligations are useful only if the employer has the necessary resources in place to support a whistleblowing policy.
Interaction with criminal and privacy laws
The United Arab Emirates has far-reaching privacy laws which may conflict with the whistleblower protections. While an employer might be able to assure its employees that they will not be disciplined or dismissed from their employment for whistleblowing, the same cannot be said in relation to any potential liabilities that may attach to employees under UAE criminal law.
If, in disclosing an unethical practice, an employee simultaneously shares confidential company information, this could amount to a crime under the Penal Code or, where a disclosure is made online, the Cybercrimes Law. In addition, a reporting employee who brings an individual or a company into disrepute may be accused of crimes of defamation. Penalties for a breach of UAE privacy laws can include fines and imprisonment.
The Financial Crime Law simply states that an employee who files a report to the centre will not be deemed to be in violation of the legislation. However, no reference is made to UAE criminal laws. The DIFC Operating Law protects employees against only contractual or civil liability, not criminal liability.
Therefore, while employers can and should encourage their employees to speak out and report illegal or unethical practices and behaviour, they cannot protect their employees from any liability that might attach under UAE criminal laws. Protection against unlawful dismissal is different to a defamation claim. Employers must ensure that this balance is carefully considered in the wording of their whistleblowing policies.
For employees, reporting suspicions of wrongdoing by their employer is usually a difficult choice to make. However, employers can encourage their employees to report their concerns by:
- publishing a well-defined and accessible whistleblower policy;
- presenting clear and regular communications from senior management on the topic;
- offering regular training and awareness of whistleblowing;
- providing evidence of support of protection by senior management;
- providing secure and easily accessible reporting facilities; and
- guaranteeing anonymity.
