CHAPTER § 8.02 Whistleblower Protection Under the Sarbanes-Oxley Act of 2002

• Jurisdiction: United States

§ 8.02 Whistleblower Protection Under the Sarbanes-Oxley Act of 2002

[1] Introduction

The 2001 collapse of Enron was followed by corporate-corruption scandals culminating in the bankruptcy of WorldCom in mid-2002. The Sarbanes-Oxley Act of 2002 reflects intense political pressure for reform. The Senate passed SOX by a vote of 99-0, and, on July 30, 2002, President Bush signed the Act into law.⁹ SOX led to many changes in corporate accountability and expanded criminal jurisdiction and penalties. Section 806 of the Act also provides a civil cause of action for whistleblowers who are retaliated against for having blown the whistle.¹⁰ The whistleblower provision applies primarily to publicly traded companies subject to the registration and reporting requirements of the Securities Exchange Act of 1934, and certain entities and individuals related to those public companies. On July 21, 2010, President Obama signed into law the Dodd-Frank Act, which amended SOX's whistleblower provisions in several key ways.¹¹ As discussed below, the statute of limitations was broadened from 90 to 180 days, certain non-publicly traded subsidiaries of publicly traded companies are now explicitly covered, SOX plaintiffs are entitled to a jury trial, pre-dispute arbitration agreements are unenforceable, and it is clear that the rights and remedies under SOX cannot be waived by agreement.

The Department of Labor has delegated its authority to investigate and adjudicate Section 806 whistleblower claims to OSHA, and OSHA published the companion regulations.¹²

[2] Definitions

[a] Covered Employees

[i] Definition of Employee

An "employee" means an individual presently or formerly working for a covered employer, an individual applying to work for a covered employer, or an individual whose employment could be affected by a covered employer.¹³

[ii] Protected Conduct

To be protected under the whistleblower retaliation provision, an "employee" must:

[P]rovide information, cause information to be provided, or otherwise assist in an investigation regarding any conduct which the employee reasonably believes constitutes a violation of section 1341 [mail fraud], 1343 [wire fraud], 1344 [bank fraud], or 1348 [securities or commodities fraud], any rule or regulation of the Securities and Exchange Commission, or any provision of Federal law relating to fraud against shareholders, when the information or assistance is provided to or the investigation is conducted by [a Federal regulatory or law enforcement agency], [any Member of Congress or any committee of Congress], or [a person with supervisory authority over the employee, or such other person working for the employer who has the authority to investigate, discover, or terminate misconduct]¹⁴[; or]
file, cause to be filed, testify, participate in, or otherwise assist in a proceeding filed or about to be filed (with any knowledge of the employer) relating to an alleged violation of section 1341 [mail fraud], 1343 [wire fraud], 1344 [bank fraud], or 1348 [securities or commodities fraud], any rule or regulation of the Securities and Exchange Commission, or any provision of Federal law relating to fraud against shareholders.¹⁵

[iii] Extraterritorial Application

SOX is silent as to whether whistleblower protection applies extraterritorially. Court and Administrative Review Board ("ARB") decisions have held that whistleblower protection does not extend to employees employed entirely outside the United States.¹⁶ However, a 2017 ARB decision stated, in dictum, that SOX's whistleblower protections can be applied extraterritorially.¹⁷ The ARB cautioned that its opinion should not be read to extend to all foreign conduct of publicly traded foreign companies: "The misconduct of the foreign issuer/employer under the statute must still 'affect in some significant way' the United States."¹⁸ It remains to be seen whether the ARB's position will be adopted more broadly.

[b] Covered Employers

[i] Public Companies

SOX applies to all publicly traded companies with a class of securities registered under section 12 of the Securities Exchange Act of 1934 or that are required to file reports under section 15(d) of the Act.¹⁹

[ii] Subsidiaries or Affiliates

Prior to the enactment of the Dodd-Frank Act, courts and other adjudicators struggled to determine whether a non-public subsidiary of a publicly traded company and the subsidiaries' employees were covered by SOX.²⁰ Several decisions took a narrow view, limiting coverage to public companies and their immediate employees.²¹ Other decisions held that SOX covers private subsidiaries and their employees if the subsidiary and the parent company maintained shared management and control, unity of operations, and a high degree of interconnectivity.²² A number of cases imposed SOX liability if a subsidiary acted as a company representative or agent on behalf of the publicly traded company,²³ although some decisions required the agency to relate to employment.²⁴

Section 929A of the Dodd-Frank Act amended SOX to explicitly state that SOX's whistleblower provisions cover "any subsidiary or affiliate whose financial information is included in the consolidated financial statements of [a publicly traded] company."²⁵ The Department of Labor appears to take the view that the amendment clarifies rather than changes existing law.²⁶

[iii] Individuals

SOX covers the actions of "officer[s], employee[s] . . . or agent[s]" of a covered employer.²⁷ Cases have held that SOX whistleblower liability extends to individuals.²⁸

[iv] Private Contractors and Subcontractors

On March 4, 2014, the U.S. Supreme Court held that SOX's whistleblower provision protects employees of private contractors and subcontractors that provide services to public companies.²⁹ However, courts have found that SOX's "contractor" provision does not cover situations where the plaintiff employee does not allege fraud related to or engaged in by a public company. "In other words, the contractor provision does not apply where a public company has no involvement in the conduct Congress sought to curtail by passing SOX."³⁰

[3] Administrative Procedures

[a] Timing

Prior to the enactment of the Dodd-Frank Act, a SOX whistleblower had 90 days to file an administrative complaint with OSHA. The Dodd-Frank Act doubled the limitations period to 180 days. Specifically, a SOX action must be commenced "not later than 180 days after the date on which the violation occurs, or after the date on which the employee became aware of the violation."³¹

[b] Complaint

An employee should file a complaint alleging discrimination with the OSHA Area Director but may also file it with any OSHA officer or employee.³² "No particular form of complaint is required. A complaint may be filed orally or in writing. Oral complaints will be reduced in writing by OSHA."³³ Courts disagree as to whether a plaintiff must name each individual defendant as a respondent in her OSHA complaint or whether merely identifying each individual defendant as an actor within the body of the complaint is sufficient to exhaust administrative remedies against individual defendants.³⁴

[c] Investigation

When it receives a complaint, OSHA will notify the respondent of the allegations, evidence, and the respondent's rights.³⁵

[i] Prima Facie Case

An employee who seeks to pursue a SOX claim must establish the four elements of a prima facie case, or OSHA will dismiss the complaint without investigating. The employee must demonstrate: the employee engaged in a protected activity; the employer was aware (or should have been aware) of the protected activity; the employee suffered an unfavorable personnel action; and the circumstances were sufficient to raise the inference that the protected activity was a contributing factor in the unfavorable action.³⁶

[ii] Response

If a prima facie case is established, OSHA will decide on behalf of the respondent without further investigation if the respondent demonstrates by clear and convincing evidence that it would have taken the same adverse action in the absence of the complainant's protected activity.³⁷ Within 20 days of receiving notice of the complaint, the respondent may submit a written statement, affidavits, and/or documents supporting its position and request a meeting with OSHA to present its position.³⁸ If the respondent fails to make a timely response or to show it would have taken the same adverse action in the absence of the protected activity, the investigation will begin.³⁹

[d] Preliminary Order

If the investigation supports a finding of reasonable cause, OSHA will notify the respondent as to the substance of the relevant evidence. Within 10 business days of the notification, the respondent can submit a written response, meet with investigators to present statements from witnesses, and present legal and factual arguments.⁴⁰ Within 60 days after the filing of the complaint, the Assistant Secretary must issue written findings as to whether there is reasonable cause to believe the respondent retaliated against the complainant.⁴¹

[e] Relief

If reasonable cause is found, the Assistant Secretary will preliminarily order "make-whole" relief. SOX expressly provides the following remedies: (1) reinstatement with the same seniority status that the employee would have had, but for the discrimination; (2) back pay, with interest; and (3) compensation for any special damages sustained as a result of the discrimination, including litigation costs, expert witness fees, and reasonable attorney fees.⁴² In some cases, front pay may be awarded in lieu of reinstatement.⁴³ SOX does not provide for punitive damages.⁴⁴ Some jurisdictions have held that non-economic compensatory damages, i.e., emotional distress and reputational harm, are recoverable under SOX.⁴⁵

[f] Objections

A party must file written objections and/or a written request for a hearing within 30 days of receiving the findings and preliminary order.⁴⁶ If a timely objection is filed, the preliminary...