The protection of sources and whistleblowers

On matters of public concern, how does information that is unjustifiably hidden become known? In some situations, formal oversight mechanisms and access to information laws compel disclosure. Even where they do exist, however, they are not always effective. Other approaches may be needed, for as a general rule, secrets do not out themselves. Rather, disclosure typically requires three basic elements: a person with knowledge who is willing and able to shed light on what is hidden; a communicator or a communication platform to disseminate that information; and a legal system and political culture that effectively protect both. Without that combination — source, dissemination and protection — what is secret all too often remains hidden, and the more that remains hidden, the less authorities are held accountable and individuals are able to make informed decisions about matters that may most affect them and their communities.

Those are the principal rationales for legal and political frameworks that promote and guarantee access to information and protect the individuals and organizations that often make such access possible. Notwithstanding formal progress, Governments, international organizations and private entities often target persons disclosing secret information, in particular when they bring to light uncomfortable truths or allegations. Those who wish to call attention to malfeasance may find internal channels blocked, oversight bodies ineffective and legal protection unavailable. The absence of recourse often forces whistle-blowers to become sources for public disclosure, which may make them vulnerable to attack. International, regional and national trends toward greater formal protection do not necessarily translate into effective protection for sources and whistle-blowers. Ineffective protection results from gaps in law; a preference for secrecy over public participation; technology that makes it easy for institutions to breach privacy and anonymity; overly broad application of otherwise legitimate restrictions; and suspicion or hostility towards sources, whistle-blowers and the reporters who make such information known.

The disclosure of secret information runs across a broad spectrum, with some instances, such as Edward Snowden’s revelations of surveillance practices, making a deep and lasting impact on law, policy and politics, while others struggle for attention and response. While the present report may be read in the light of all such cases, the Special Rapporteur does not analyse herein specific situations, but aims instead to highlight the main elements that should be part of any framework protecting sources and whistle-blowers consistent with the right to freedom of expression. He begins by reviewing everyone’s right to receive information of all kinds, especially information held by public bodies. He then highlights the principal elements of the international legal frameworks for source and whistle-blower protection, while also drawing on the practice of States, international and regional mechanisms and non-governmental initiatives. The report concludes with a set of recommendations.

As part of the preparations for the present report, a questionnaire was sent to States seeking input on national laws and practices, to which 28 States responded.¹ Civil society organizations and individuals also contributed with critically important submissions. State responses and submissions, along with recommendations for further research into best practices, which could not be cited in the report, are available on the web page of the Special Rapporteur.² On 11 June 2015, a meeting convened in Vienna drew upon civil society and academic expertise in source and whistle-blower protection.³ The Special Rapporteur thanks all who made contributions to the preparation of the present report.

1. By August 2015, the following States had responded: Angola, Argentina, Bosnia and Herzegovina, Bulgaria, Burkina Faso, Colombia, Cuba, Estonia, Finland, Georgia, Germany, Ghana, Guatemala, Ireland, Kazakhstan, Morocco, Mauritania, Netherlands, Norway, Oman, Republic of Korea, Saudi Arabia, Slovakia, Switzerland, Suriname, Trinidad and Tobago, Turkey and United States of America. ↩
2. See www.ohchr.org/EN/Issues/FreedomOpinion/Pages/ProtectionOfSources.aspx. ↩
3. The meeting was jointly organized by the International Press Institute and the Government of Austria, with the generous support of the latter. ↩

Source and whistle-blower protections rest upon a core right to freedom of expression. Article 19 of the Universal Declaration of Human Rights guarantees the right to seek, receive and impart information and ideas through any media and regardless of frontiers. The International Covenant on Civil and Political Rights enshrines the same rights in its article 19, which emphasizes that the freedom applies to information and ideas of all kinds. Sources and whistle-blowers enjoy the right to impart information, but their legal protection when publicly disclosing information rests especially on the public’s right to receive it. That right has been emphasized by previous special rapporteurs and experts in the European, African and inter-American systems.⁴ As indicated in general comment No. 34 of the Human Rights Committee on article 19: Freedoms of opinion and expression, it extends to information held by all public bodies, whether legislative, executive or judicial, and it applies to other entities when they are carrying out public functions (paras. 7 and 18.) The right to receive information advances several principles that underlie and animate human rights.⁵ It advances the individual’s ability to seek out information of all kinds, allowing the development of opinions protected against interference under article 19 (1) of the Covenant.⁶ It encourages participation in public affairs, which is independently protected by article 25 of the Covenant. It encourages accountability, increasing the costs for those who might engage in wrongdoing.

4. See, for example, the joint declaration by the Special Rapporteur on freedom of opinion and expression, the Organization for Security and Cooperation in Europe Representative on Freedom of the Media and the Organization of American States Special Rapporteur on Freedom of Expression (1999) (E/CN.4/2000/63, annex I). ↩
5. See Article 19, The Public’s Right to Know: Principles on Freedom of Information Legislation (London, 1999). ↩
6. See general comment No. 25 of the Human Rights Committee on the right to participate in public affairs, voting rights and the right of equal access to public service; Inter-American Court of Human Rights, Claude-Reyes et al. v. Chile (2006); and A/HRC/14/23, para. 31. ↩

Regional and international human rights instruments also advance the public’s right to receive information.⁷ The Convention on the Rights of the Child obliges States parties to ensure that children have access to information in order to support individual development and a capacity to participate in public life (art. 17). The Convention on the Rights of Persons with Disabilities requires States parties to promote appropriate forms of assistance and support to persons with disabilities to ensure their access to information (art. 9 (2) (f)). The Special Rapporteur on the right of everyone to the enjoyment of the highest attainable standard of physical and mental health and the Special Rapporteur on extreme poverty and human rights have highlighted the importance of the right of access to information to the realization of social and economic rights (see A/HRC/20/15 and A/HRC/23/36). The right is further reflected in international standards on the environment, efforts to combat corruption and development.⁸

7. See the African Charter on Human and Peoples’ Rights, art. 9; the American Convention on Human Rights, art. 13; and the Convention for the Protection of Human Rights and Fundamental Freedoms, art. 10. ↩
8. See the Rio Declaration on Environment and Development, principle 10; the United Nations Convention against Corruption, art. 13; and “Transforming our world: the 2030 Agenda for Sustainable Development” (General Assembly resolution 69/315, annex). ↩

International bodies, recognizing the role played by the media in providing access to information, emphasize the importance of protecting “a free, uncensored and unhindered press or other media” (see general comment No. 34 of the Human Rights Committee, para. 13). The right to information is grounded in the public’s right to know “information of public interest” (see A/68/362, para. 19). The Security Council has affirmed that the work of a free, independent and impartial media constitutes one of the essential foundations of a democratic society (see Council resolutions 2222 (2015) and 1738 (2006)). The General Assembly in 2014 and 2015 called upon States to maintain a safe environment for journalists to work independently and without undue interference (see Assembly resolutions 68/163 and 69/185). The Human Rights Council in 2012, in its first resolution on the protection of journalists, highlighted the need to ensure greater protection for all media professionals and for journalistic sources (see Council resolution 21/12).

In adopting the International Covenant on Civil and Political Rights and other measures, Governments did not preclude themselves from keeping certain kinds of information hidden from public view, but because article 19 promotes so clearly a right to information of all kinds, States bear the burden of justifying any withholding of information as an exception to that right. Article 19 (3) provides that any restriction on freedom of expression must be provided by law and be necessary to achieve one or more of the enumerated legitimate objectives, which relate to respect of the rights or reputations of others or to the protection of national security or of public order or of public health or public morals (see A/HRC/29/32, paras. 30-35). Limitations must be applied strictly so that they do “not put in jeopardy the right itself” (see Human Rights Committee, general comment No. 34, para. 21), a point that the Human Rights Council emphasized when it urged States not to restrict the free flow of information and ideas (see Council resolution 12/16).

Three considerations deserve emphasis. First, to be necessary, a restriction must protect a specific legitimate interest from actual or threatened harm that would otherwise result. As a result, general or vague assertions that a restriction is necessary are inconsistent with article 19. However legitimate a particular interest may be in principle, the categories themselves are widely relied upon to shield information that the public has a right to know. It is not legitimate to limit disclosure in order to protect against embarrassment or exposure of wrongdoing, or to conceal the functioning of an institution.⁹

9. See Article 19, International Centre against Censorship, The Johannesburg Principles on National Security, Freedom of Expression and Access to Information, principle 2 (b), in E/CN.4/1996/39, annex. See also A/HRC/20/17, A/HRC/13/37 and A/HRC/29/32. ↩

Second, under the well-accepted proportionality element of the necessity test, disclosure must be shown to impose a specific risk of harm to a legitimate State interest that outweighs the public’s interest in the information to be disclosed. If a disclosure does not harm a legitimate State interest, there is no basis for its suppression or withholding (see general comment No. 34 of the Human Rights Committee, para. 30). Some matters should be considered presumptively in the public interest, such as criminal offences and human rights or international humanitarian law violations, corruption, public safety and environmental harm and abuse of public office.¹⁰ The importance of the public’s interest has been emphasized repeatedly in other regional mechanisms.¹¹ National laws relating to the right to information also commonly provide for a public interest analysis.¹²

10. See the Global Principles on National Security and the Right to Information, principle 37; and Maeve McDonagh, “The public interest test in FOI legislation”, available from www.right2info.org/resources/publications/eu-mcdonagh-maeve-the-public-interest-test-in-foi-legislation/view. ↩
11. See Council of Europe, recommendation CM/Rec(2014)7, p. 5; African Commission on Human and Peoples’ Rights, Declaration of Principles on Freedom of Expression in Africa, principles IV (2) and XII (2); and Inter-American Commission on Human Rights, Inter-American Declaration of Principles on Freedom of Expression, principle 10. ↩
12. See, for example, Supreme Court of Slovenia, Ranc v. Ministry of Internal Affairs, 10 October 2007. ↩

Third, restrictions on access to information must not be left to the sole discretion of authorities. Restrictions must be drafted clearly and narrowly, designed to give guidance to authorities, and subjected to independent judicial oversight (see A/HRC/29/32, paras. 29-33). Layers of internal governmental oversight should ensure that restrictions on access to information meet the standards of article 19 and related national laws.

Effective access to information begins with how Governments categorize, or classify, information as secret or otherwise not subject to disclosure. Over-classification occurs when officials deem material secret without appropriately assessing the public’s interest in access to it or determining whether disclosure would pose any risk to a legitimate interest. Secrecy should be imposed only on information that would, if disclosed, harm a specified interest under article 19 (3); even in the event of a risk of harm, a process should be in place to determine whether the public interest in disclosure outweighs that risk. Processes that allow for evaluation of classification decisions, within institutions and by the public, including penalties for over-classification, should be considered and adopted in order to ensure the greatest possible access to information in the public interest. The Swedish Constitution and its Freedom of the Press Act provide perhaps a welcomed translation of the principle of maximum disclosure when it comes to access to information held by public bodies, protecting the right of all public officials to communicate information and, except for specified situations, prohibiting public officials from sanctioning others for communicating information outside their institutions.

While the Special Rapporteur evaluates herein legal frameworks, law alone is a necessary but insufficient basis for protection of any right under the umbrella of freedom of expression. A strong formal framework on the right to information will not overcome an official culture of secrecy and disrespect for the rule of law. Protection requires a political and bureaucratic culture that values transparency and public participation. An independent judiciary and legal profession, broad and non-discriminatory access to justice, and basic law enforcement capacity and willingness to confront violence and intimidation form the basic infrastructure of protection.

Everyone depends upon well-sourced stories in order to develop informed opinions about matters of public interest. Professional reporting organizations emphasize that named sources are preferable to anonymous ones.¹³ Nonetheless, reporters often rely upon, and thus promise confidentiality to, sources who risk retaliation or other harm if exposed.¹⁴ Without protection, many voices would remain silent and the public uninformed.

13. See The Canadian Association of Journalists Ethics Advisory Committee, “Ethics guidelines” (2011). See also Reuters, “The Essentials of Reuters sourcing”; and One Caribbean Media Limited, “Statement of Editorial Principles and Operational Guidelines”. ↩
14. See, for example, David Banisar, “Silencing sources: an international survey of protections and threats to journalists’ sources” (Privacy International Global Survey Series, 2007); and Julie Posetti, “Protecting journalism sources in the digital age”, United Nations Educational, Scientific and Cultural Organization (UNESCO) Series on Internet Freedom (UNESCO Publishing, 2015). ↩

International human rights law has developed well-established principles protecting source confidentiality. At the international level, such rules derive from the guarantee of the right to seek, receive and impart information enshrined in article 19 of the International Covenant on Civil and Political Rights.¹⁵ The European Court of Human Rights celebrates the “vital public watchdog role of the press” as underlying source protection and has established a high level of protection for journalists who are reporting on matters of public interest.¹⁶ In May 2015, the East African Court of Justice ruled that journalists could not be compelled to reveal sources merely because the information they provided related to national security or defence.¹⁷ The Inter-American Commission on Human Rights has emphasized that “every social communicator has the right to keep his/her source of information, notes, personal and professional archives confidential”.¹⁸ The African Commission on Human and People’s Rights has stated that “media practitioners shall not be required to reveal confidential sources of information or to disclose other material held for journalistic purposes”, except where meeting certain specified exceptions.¹⁹ The Committee of Ministers of the Council of Europe recommends that States provide “explicit and clear protection of the right of journalists not to disclose information identifying a source”.²⁰ International criminal tribunals also protect sources.²¹

15. See the United Nations Convention against Corruption, art. 33; and general comment No. 34 of the Human Rights Committee, para. 45. See also United Nations Special Rapporteur on freedom of opinion and expression, the Organization for Security and Cooperation in Europe Representative on Freedom of the Media, the Organization of American States Special Rapporteur on Freedom of Expression and the African Commission on Human and Peoples’ Rights Special Rapporteur on Freedom of Expression and Access to Information, “Joint declaration on defamation of religions, and anti-terrorism and anti-extremism legislation” (2008). ↩
16. See European Court of Human Rights, Goodwin v. United Kingdom, application No. 17488/90, judgement of 27 March 1996, para. 39; Sunday Times v. United Kingdom, application No. 6538/74, judgement of 26 April 1979; and Tillack v. Belgium, application No. 20477/05, judgement of 27 February 2007. ↩
17. See Burundi Journalists Union v. Attorney General of the Republic of Burundi, East African Court of Justice, case No. 7 of 2013, judgement of 15 May 2015, paras. 107-111. ↩
18. See Inter-American Commission on Human Rights, Declaration of Principles on Freedom of Expression, principle 8. The Special Rapporteur for Freedom of Expression of the Inter-American Commission has stated that “sources and materials related to the disclosure of confidential information must be protected by law”, see Annual Report of the Inter-American Commission on Human Rights 2013: Annual Report of the Office of the Special Rapporteur for Freedom of Expression, vol. II (Washington, D.C., 2013), chap. IV, para. 171. ↩
19. See African Commission on Human and Peoples’ Rights, Declaration of Principles on Freedom of Expression in Africa, principle XV. ↩
20. See Council of Europe, Committee of Ministers recommendation No. R (2000) 7, appendix, principle 1. ↩
21. See, for example, Prosecutor v. Radoslav Brdjanin and Momir Talic, case No. IT-99-36-AR73.9, judgement of 11 December 2002. ↩

National legal systems have also widely adopted the norm of protection of confidentiality. In a strong statement of legal protection, the 2010 Media Services Act of Estonia establishes that persons who are “processing information for journalistic purposes shall have the right not to disclose the information that would enable identification of the source of information” (sect. 15 (1)). The 1987 German Code of Criminal Procedure establishes a right to refuse to testify on professional grounds (sects. 53 (1(5)) and (2)). In Sweden, the Fundamental Law on Freedom of Expression of 1991 prohibits journalists from disclosing their sources and has criminalized the non-consensual disclosure of source identity (chap. 2, arts. 3-5). The Constitution of Cabo Verde guarantees that “no journalist shall be forced to reveal his sources of information” (art. 48 (8)). The laws of Argentina, Bosnia and Herzegovina, Bulgaria, Chile, Colombia, India, Mozambique and the Philippines are among the many other States in which the principle of source protection is recognized.²²

22. See Constitution of Argentina (1994), sect. 43; Law on protection against defamation of Bosnia and Herzegovina, art. 9; Bulgaria, Law for the Radio and Television (1998), art. 10 (1 (3)); Chile, Law 19.733 of 2001, art. 7; Constitution of Colombia (1991), arts. 73-74; India, Whistle Blowers Protection (Amendment) Bill (2015), sect. 6; Constitution of Mozambique (2005), art. 48 (3); Philippines Republic Act No. 53, as amended by Republic Act No. 1447. ↩

Confidential sources rely on others to invoke the right to confidentiality on their behalf. Historically, States have enabled a professional class of journalists to invoke the right, but the revolution in the media and in information over the past 20 years demands reconsideration of such limitations. Article 19, which protects freedom of expression through any media, requires that States take into account a contemporary environment that has expanded well beyond traditional print and broadcast media. The protection available to sources should be based on the function of collection and dissemination and not merely the specific profession of “journalist”. The practice of journalism is carried out by “professional full-time reporters and analysts, as well as bloggers and others who engage in forms of self-publication in print, on the Internet or elsewhere” (Human Rights Committee, general comment No. 34, para. 44).

Today, journalists and other “social communicators” may claim the right of confidentiality for the source.²³ Persons other than journalists inform the public and carry out a “vital public watchdog role”. International bodies increasingly use terms more general than “journalist”, such as “media professionals” or “media workers”.²⁴ The African Commission on Human and Peoples’ Rights refers to “media practitioners”²⁵ and the Organization for Security and Cooperation in Europe Representative on Freedom of the Media refers to “new participants in journalism”.²⁶ All those terms demonstrate an understanding that those performing the same journalistic functions should enjoy the right to protect sources. The Council of Europe has defined the term “journalist” functionally as “any natural or legal person who is regularly or professionally engaged in the collection and dissemination of information to the public via any means of mass communication”.²⁷ For the purposes of source protection — when, as the Norwegian Supreme Court has noted, the broadest protection should be available²⁸ — any person or entity involved in collecting or gathering information with the intent to publish or otherwise disseminate it publicly should be permitted to claim the right to protect a source’s confidentiality. Regular, professional engagement may indicate protection, but its absence should not be a presumptive bar to those who collect information for public dissemination.²⁹

23. See Inter-American Commission on Human Rights, Declaration of Principles on Freedom of Expression, principles 8 and 13. ↩
24. See, for example, Human Rights Council resolutions 27/5 and 21/12; General Assembly resolution 68/163; and Security Council resolution 1738 (2006). ↩
25. See the Declaration of Principles on Freedom of Expression in Africa, principle XV. ↩
26. See 2nd Communiqué on Open Journalism. Available at www.osce.org/fom/128046?download=true. ↩
27. Council of Europe, Committee of Ministers recommendation No. R (2000) 7, appendix, definition (a). ↩
28. See Supreme Court of Norway, case No. 2013/1196, reference No. HR-2013-2170-A (2013). ↩
29. Posetti, “Protecting journalism sources in the digital age”. ↩

Two categories, for example, expand beyond officially recognized journalists. First, there are those who most closely reflect the professional engagement in collection and dissemination: members of civil society organizations who conduct research and issue findings, and researchers — academics, independent authors, freelance writers and others — who regularly participate in gathering and sharing information publicly. It is common for such people to adopt and publish methodologies that underscore the degree of professionalism upon which their work depends. Many non-governmental organizations are themselves publishers of well-sourced content that, in form and substance, is virtually identical to the work of the press, often the result of thorough research, in-the-field reporting and analysis.³⁰ It is common for human rights researchers to rely upon sources who require confidentiality for safety.³¹ Recognizing a broad scope of protection, the European Court of Human Rights indicated that “non-governmental organisations, like the press, may be characterised as social ‘watchdogs.’ In that connection their activities warrant similar Convention protection to that afforded to the press”.³² The Information Commissioner’s Office in the United Kingdom of Great Britain and Northern Ireland granted a non-governmental organization, Global Witness, an exemption from the national Data Protection Act because its work, and those of other non-media organizations, “constitutes a journalistic purpose even if they are not professional journalists and the publication forms part of a wider campaign to promote a particular cause”.³³ In Canada, a judge of the Superior Court of Quebec upheld a researcher’s right to protect confidential information.³⁴

30. See, for example, www.hrw.org/about-our-research. ↩
31. See Youth Initiative for Human Rights v. Serbia, European Court of Human Rights, application No. 48135/06, judgement of 25 June 2013. ↩
32. See European Court of Human Rights, Österreichische Vereinigung zur Erhaltung, Stärkung und Schaffung eines wirtschaftlich gesunden land- und forst-wirtschaftlichen Grundbesitzes v. Austria, application No. 39534/07, judgement of 28 November 2013. ↩
33. See letter from Information Commissioner’s Office to Global Witness, 15 December 2014. Available from www.globalwitness.org/sites/default/files/141215%20letter%20from%20ICO%20to%20GW%20(2)%20(1).pdf. ↩
34. See Parent and Bruckert v. Her Majesty the Queen, Province of Quebec District of Montreal, case No. 500-36-006329-125, judgement of 21 January 2014. See also Dotcom v. Her Majesty’s Attorney-General, Supreme Court of New Zealand, case No. [2014] NZSC 199, judgement of 23 December 2014. ↩

Second, “citizen journalists” and bloggers and other media “non-professionals” engage in independent reporting and disseminate their findings through a wide variety of media, from print and broadcast to social media and other online platforms.³⁵ They frequently work in ways similar or identical to, or even more rigorous than, the work of traditional journalists. Some States have adopted rules that provide important protection for them. For example, the Irish High Court, in Cornec v. Morrice and Ors, found that bloggers might claim source protection because they could constitute an “organ of public opinion” and because the right to influence public opinion would be jeopardized if they were forced to disclose their sources.³⁶

35. See A/65/284; see also Council of Europe, Committee of Ministers recommendation CM/Rec(2011)7. ↩
36. Irish High Court, Cornec v. Morrice and Ors, 2012, para. 66. See also California Court of Appeals, O’Grady v. Superior Court (Apple), 2006. ↩

Some authorities refer to a journalistic “privilege” not to disclose a source’s identity, but both reporter and source enjoy rights that may be limited only according to article 19 (3).³⁷ Revealing or coercing the revelation of the identity of a source creates disincentives for disclosure, dries up further sources to report a story accurately and damages an important tool of accountability. In the light of the importance attached to source confidentiality, any restrictions must be genuinely exceptional and subject to the highest standards, implemented by judicial authorities only.³⁸ Such situations should be limited to investigations of the most serious crimes or the protection of the life of other individuals.³⁹

37. See Tillack v. Belgium, European Court of Human Rights, application No. 20477/05, judgement of 27 February 2008. ↩
38. See Council of Europe, Committee of Ministers recommendation No. R (2000) 7, appendix, principles 3 and 5. ↩
39. See A/HRC/20/17, para. 109. See also A/HRC/7/14. ↩

National laws should ensure that protections apply strictly, with extremely limited exceptions. Under Belgian law, journalists and editorial staff may be compelled by a judge to disclose information sources only if they are of a nature to prevent crimes that pose a serious threat to the physical integrity of one or more persons, and upon a finding of the following two cumulative conditions: (a) the information is of crucial importance for preventing such crimes; and (b) the information cannot be obtained by any other means. The same conditions apply to investigative measures, such as searches, seizures and telephone tapping, with respect to journalistic sources.⁴⁰

40. See Banisar, “Silencing sources”. ↩

Protection must also counter a variety of contemporary threats. A leading one is surveillance. The ubiquitous use of digital electronics, alongside government capacity to access the data and footprints that all such devices leave behind, has presented serious challenges to confidentiality and anonymity of sources and whistle-blowers.⁴¹ The problem of unintended self-disclosure has been a recurrent feature in the leading cases involving journalistic sources in recent years, in which the Government of the United States of America discovered probable source identities through telephone and e-mail records.⁴² Writers themselves report concern that their ability to protect sources is much diminished in the face of surveillance.⁴³ National and regional courts in Europe have appropriately criticized extralegal approaches to compromising confidentiality. The Italian Supreme Court of Cassation, for example, protected the telephone records of a journalist because they were openly instrumental to the identification of those who had provided confidential information.⁴⁴ The European Court of Human Rights emphasized the importance of providing “the individual adequate protection against arbitrary interference” caused by surveillance.⁴⁵ The Committee of Ministers of the Council of Europe recommends that interception, surveillance and other digital searches “should not be applied if their purpose is to circumvent” source protection.⁴⁶

41. See Posetti, “Protecting journalism sources in the digital age”. ↩
42. See, for example, United States of America v. Sterling, 724 F.3d 482 (2013). ↩
43. See PEN America, “Chilling effects: NSA surveillance drives U.S. writers to self-censor” (New York, 2013); and Human Rights Watch and American Civil Liberties Union, “With liberty to monitor all: how large-scale U.S. surveillance is harming journalism, law and American democracy” (New York, 2014). ↩
44. See decision of the Supreme Court of Cassation, Sixth Criminal Chamber, 21 January 2004, No. 85, concerning the appeal filed by Paolo Moretti against a ruling by the Court of Como. ↩
45. See Telegraaf Media Nederland Landelijke Media B.V. and Others v. the Netherlands, European Court of Human Rights, application No. 39315/06, judgement of 22 November 2012, para. 90. ↩
46. See Council of Europe, Committee of Ministers recommendation No. R (2000) 7, appendix, principle 6 (a). ↩

Journalists are often subjected to searches of their persons, homes or offices, including their papers, hard drives and other digital devices. In addition to the normal rules that apply to such searches, a higher burden should be imposed in the context of journalists and others gathering and disseminating information.⁴⁷ The United States Privacy Protection Act of 1980, for example, protects journalists and others from searches and seizures of their work product, while the Police and Criminal Evidence Act of 1984 of the United Kingdom excludes journalistic material from the scope of seizure authorities.⁴⁸ The Code of Criminal Procedure of France enables searches of the offices of media only where “such investigations do not violate the freedom of exercise of the profession of journalist and do not unjustifiably obstruct or delay the distribution of information”.⁴⁹

47. See Canadian Broadcasting Corp. v. Lessard, Supreme Court of Canada, case No. 21629, report No. [1991] 3 S.C.R. 421; and the Federal Constitutional Court of Germany, 1 BvR 538/06, judgement of 27 February 2007. ↩
48. See United States, Title 42 U.S. Code sect. 2000aa; United Kingdom of Great Britain and Northern Ireland, Police and Criminal Evidence Act (1984). ↩
49. Code of Criminal Procedure of France, art. 56-2. ↩

Source protection extends beyond the immediate reporting person to include editors, publishers and others engaged in the work. In Norway, the Dispute Act of 2005 provides that editors and media staff may refuse to provide access to evidence about who is the author of an article or report in the publication or the source of any information contained therein. The Criminal Code in Switzerland provides similar protection to refuse to identify sources; the Press Law of 2004 in Turkey provides that periodical owners and editors cannot be forced to either disclose their news sources or to legally testify on that issue; and the Press Law of 2006 in Angola extends protection against compelled disclosure to editors.⁵⁰

50. See Banisar, “Silencing sources”. ↩

States have responded to the problem of hidden wrongdoing with laws to protect those who take steps to report it. However, individuals who report alleged wrongdoing are still subjected to harassment, intimidation, investigation, prosecution and other forms of retaliation. All too often, States and organizations implement the protections only in part or fail to hold accountable those who retaliate against whistle-blowers. Moreover, beyond law, the right to information also requires a bedrock of social and organizational norms that promote the reporting of wrongdoing or other information in the public interest. The strengthening of such norms requires training at all levels of organizations, supportive policies and statements from political and corporate leaders, international civil servants, the courts and others, and accountability in cases of reprisals.

At least 60 States have adopted some form of whistle-blower protection as a part of their national laws.50 The United Nations Convention against Corruption protects persons who report corruption offences; the Council of Europe has recommended broad whistle-blower protections; and the Organization of American States has adopted a model law on the protection of whistle-blowers.⁵¹ International organizations have adopted protections that, to some extent, mirror national practice. The following principles draw on international law, State practice and a range of civil society projects; they are not exhaustive of the legal, policy and drafting issues in framing whistle-blower protections.

51. See United Nations Convention against Corruption, art. 33; Council of Europe, recommendation CM/Rec(2014)7, appendix; Organization of American States, Model Law to Facilitate and Encourage the Reporting of Acts of Corruption and to Protect Whistle-blowers and Witnesses (2013). ↩

International authorities and national jurisdictions adopt a variety of definitions of whistle-blowing. In the present report, the Special Rapporteur adopts a broad definition in order to account for relevant purposes of whistle-blowing, in particular the right to know, accountability and democratic governance. For the purposes of the present report, a whistle-blower is a person who exposes information that he or she reasonably believes, at the time of disclosure, to be true and to constitute a threat or harm to a specified public interest, such as a violation of national or international law, abuse of authority, waste, fraud, or harm to the environment, public health or public safety.

Protection laws often limit whistle-blowers to those who blow the whistle “in the context of their work-based relationship”.⁵² However, a person may come into contact with public interest information even when outside such a relationship. The United Nations Convention against Corruption contains no employment limitation. Broad definitions are also found in, for example, Ghanaian law, which protects employees and “any person” making a disclosure, and Indian law, which covers “any public servant or any other person including any non-governmental organisation”.⁵³ Non-work-related whistle-blowers may include patients who blow the whistle on wrongdoing in a hospital, parents who blow the whistle on wrongdoing in a child’s school and students themselves. Typically, a whistle-blower will enjoy a work status, but because of the range of others who may report wrongdoing allegations, such as consultants, interns, job applicants, students, patients and others who do not enjoy a legally protected relationship with an organization, such a limitation is not recommended.⁵⁴

52. See Council of Europe, recommendation CM/Rec(2014)7, appendix, definition (a). See also United Kingdom Public Interest Disclosure Act 1998. ↩
53. See Ghana, Whistleblower Act 720, sect. 12 (2006); India, The Whistle Blowers Protection Act, 2011, chap. II, sect. 4 (1). ↩
54. See, for example, Serbia, draft law on protection of whistle-blowers (2013), art. 7. ↩

Protection mechanisms should promote disclosure and not require potential whistle-blowers to undertake precise analyses of whether perceived wrongdoing merits penalty under existing law or policy. Otherwise, the protection itself would be hollow, encouraging disclosure and signalling potential retaliation at the same time. In general, a reasonable belief requirement may encourage whistle-blowing based on thoughtful consideration of the facts known to a person at the time of disclosure. Whistle-blowers who, based on a reasonable belief, report information that turns out not to be correct should nonetheless be protected against retaliation.

The whistle-blower’s motivations at the time of the disclosure should also be immaterial to an assessment of his or her protected status.⁵⁵ Variation centres around the inclusion of “good faith” as an element of reporting, from the exclusion of a good faith requirement, to a good faith requirement only in the context of compensation as a remedy for retaliation, to inclusion of both “good faith” and reasonable belief.⁵⁶ “Good faith,” however, could be misinterpreted to focus on the motivation of the whistle-blower rather than the veracity and relevance of the information reported. It should not matter why the whistle-blower brought the information to attention if he or she believed it to be true. Irish law serves as a model, given that it provides that “the motivation for making a disclosure is irrelevant to whether or not it is a protected disclosure”.⁵⁷ Application of protection should focus on the public interest information underlying the whistle-blowing. Bosnia and Herzegovina, addressing that problem, seeks to protect against the risk of focusing on motivation by defining good faith as meaning the stance of the whistle-blower “based on facts and circumstances of which the whistle-blower has his or her own knowledge and which he or she deems to be true”.⁵⁸ In Zambia, the Public Interest Disclosure Act (2010) protects disclosures made by an employee in reasonable belief and limits the relevance of motivation to when a person discloses “for purposes of personal gain, excluding any reward payable in terms of any law”.⁵⁹

55. See the Global Principles on National Security and the Right to Information, principle 38. According to the Norwegian Working Environment Act, bad faith does not rule out lawful reporting. ↩
56. See United Nations Office on Drugs and Crime, United Nations Convention against Corruption: Resource Guide on Good Practices in the Protection of Reporting Persons (New York, 2015). ↩
57. See Ireland, Protected Disclosures Act 2014, part 2, sect. 5 (7). ↩
58. See Bosnia and Herzegovina, Law on Whistleblower Protection in the institutions of Bosnia-Herzegovina, art. 2 (h). ↩
59. See Zambia, Public Interest Disclosure (Protection of Whistleblowers) Act (2010), part III, sect. 22 (a) (ii). ↩

Whistle-blowing does not always involve specific individual wrongdoing, but it may uncover hidden information that the public has a legitimate interest in knowing. International authorities and States often provide a general protection for the disclosure of information in the public interest, or disclosure of specific categories of information, or both. The Council of Europe Committee of Ministers recommends that States adopt protections for those who report threats or harms to the public interest, which it says “should, at least, include violations of law and human rights, as well as risks to public health and safety and to the environment”.⁶⁰ Zambian law provides an extensive definition that covers a range of maladministration, abuse of public trust, criminal and disciplinary offences and waste or fraud.59 The legislation of the United States specifies violations of a law, rule or regulation; gross mismanagement; a gross waste of funds; an abuse of authority; and a substantial and specific danger to public health and safety.⁶¹ While the term “public interest” may appear capacious as a basis for whistle-blower protection, a State might define “public interest” as involving information that contributes to public debate, promotes public participation, exposes serious wrongdoing, improves accountability or benefits public safety.⁶²

60. See Council of Europe, recommendation CM/Rec(2014)7, appendix, sect. I (2), and explanatory memorandum CM(2014)34 addfinal, para. 43. ↩
61. See Whistleblower Protection Enhancement Act of 2012 and Whistleblower Protection Act of 1989. ↩
62. See Parliamentary Assembly of Council of Europe, Committee on Legal Affairs and Human Rights, Memorandum of Arcadio Díaz Tejera, document No. 13293, 3 September 2013, para. 46. The Irish Protected Disclosures Act 2014 provides a list of matters which qualify as relevant wrongdoings. ↩

Regardless of the approach taken, the scope of protected disclosures should be easily understandable by potential whistle-blowers. Legalistic definitions may lead potential whistle-blowers not to report because of a lack of clarity about what is covered by a protection framework.56

When working properly, internal mechanisms provide a way for someone who perceives wrongdoing to seek a competent authority’s investigation. They allow for timely attention by those who may be in the best position to address problems, while also providing a basis for balancing legitimate interests in secrecy and the redress of wrongdoing. However, internal mechanisms present potential whistle-blowers with serious risks. They often lack strong measures of confidentiality and independence from the organization in which they are embedded, putting whistle-blowers at risk of retaliation. Many mechanisms are widely perceived as ineffective, so that the risk of retaliation may appear too great in the face of low odds of success. For those reasons, among others, studies suggest that employees have relatively low confidence in whistle-blowing mechanisms.⁶³ If States aim to have working whistle-blowing procedures that reduce public disclosure, they must ensure the effectiveness and trust in the full independence of whistle-blowing processes.

63. See Public Concern at Work and the University of Greenwich, Whistleblowing: The Inside Story (London, 2013); Stephen Bolsin, Rita Pal, Peter Wilmshurst and Milton Pena, “Whistleblowing and patient safety: the patient’s or the profession’s interests at stake?”, Journal of the Royal Society of Medicine, vol. 104, No. 7 (July 2011). ↩

When whistle-blowers reasonably perceive that an internal process lacks effective redress and protection, they should have access to two other permissible avenues of disclosure. One would be external but not public, such as a government-wide ombudsman or oversight institution or a legislative oversight body. Belgium, Ireland, New Zealand, the Republic of Korea and the United Kingdom, among others, provide explicitly for various forms of external but non-public whistle-blowing.56 The legislation of Ghana provides for protected disclosures to nearly 20 categories of competent recipients apart from the whistle-blower’s employer.⁶⁴ At the same time, it is critical that, once a whistle-blower makes a disclosure outside his or her institution, the law does not hold the person to any pre-existing duties of confidentiality owed to the employer.

64. See Ghana, Whistleblower Act 720, sect. 3 (1) (2006). ↩

Whistle-blowers may reasonably perceive that neither internal nor oversight mechanisms provide effective protection or a likelihood of addressing wrongdoing. They may leave whistle-blowers exposed to retaliation and the absence of redress even if the formal legal framework and the mechanisms appear sufficiently protective. Whistle-blowers often reasonably doubt that such protections will work for them; the more a State can demonstrate that whistle-blowing results in changed institutional behaviour, individual accountability and protection, the more likely it is that whistle-blowers will not go public. When a Government seeks to prosecute or otherwise penalize a publicly disclosing whistle-blower, the burden should be on the State to show that the whistle-blower’s perceptions of non-protection or non-redress were unreasonable.

Where other mechanisms to disclose information about wrongdoing are unavailable or ineffective, the whistle-blower may disclose information of alleged wrongdoing to external entities, either the media or others in civil society, or by self-publishing. The public-disclosure whistle-blower in such circumstances should be protected. The European Court of Human Rights weighs six factors in assessing the legitimacy of restrictions imposed on those who make public disclosure. Those factors are whether the whistle-blower had available any “competent authority” to which he or she could make disclosure, or “any other effective means of remedying the wrongdoing”; the public interest in the information, which “can sometimes be so strong as to override even a legally imposed duty of confidence”; the information’s authenticity, requiring a person to “carefully verify, to the extent permitted by the circumstances, that it is accurate and reliable”; the damage that the public institution may suffer by public disclosure, including whether it outweighs the public’s interest in knowing the information; the motive and good faith of the whistle-blower, which could implicate the “level of protection” available; and an evaluation of the proportionality of the penalty imposed upon the whistle-blower.⁶⁵

65. See European Court of Human Rights, application No. 14277/04, judgement of 12 February 2008, paras. 73-78. See also Heinisch v. Germany, application No. 28274/08, judgement of 21 July 2011 and Bucur and Toma v. Romania, application No. 40238/02, judgement of 1 August 2013. ↩

Notwithstanding such balancing, the public may have an exceptionally strong right to know about some kinds of information or allegations, such that they override even potentially effective internal or oversight processes. For example, public disclosure of serious violations of international human rights law, international humanitarian law or other fundamental rights in a State’s constitutional or statutory framework should be encouraged regardless of the effectiveness of internal mechanisms. The same may hold true where the value of the public’s knowledge of the information depends upon its timely or urgent disclosure. The public has an overriding interest in knowing of allegations of serious violations of fundamental legal norms (see A/68/362).

Maintaining the confidentiality of whistle-blowers may be especially difficult, depending on the nature, size and scope of the institution. Even so, whistle-blower laws should protect strongly against the risk that persons who disclose facts that indicate wrongdoing may be subject to personal attack and other forms of retaliation. Guarantees and mechanisms of confidentiality provide important protection against retaliation. States should not breach the confidentiality of the source by putting pressure on the media or any other organization or person to whom the whistle-blower disclosed the information. Whistle-blowing mechanisms should provide for secure submissions and take other steps to ensure the confidentiality of disclosures, including by defining intentional or negligent breaches of confidentiality as a form of retaliation subject to penalty.⁶⁶

66. Austria, Bosnia and Herzegovina and Mexico have initiatives promoting anonymous reporting. ↩

Some institutions permit anonymous disclosures in order to enable people to report without identifying themselves to any competent authority. Unlike confidentiality guarantees, in which a whistle-blower is known to the internal mechanism, anonymous disclosure should allow individuals to provide information without identifying themselves to anyone in the internal mechanism. Anonymity has some drawbacks; it may diminish the ability of authorities to conduct follow-up, or encourage frivolous or malicious reporting. In situations in which few persons enjoy access to disclosed information, reporting persons may be easily exposed. However, anonymous reporting provides a safeguard for those situations where the potential whistle-blower lacks confidence in the ability of existing legal mechanisms to provide protections against retaliation and yet wishes not to make a public disclosure. It enables a focus on the elements of the disclosure rather than on the person. Moreover, those who make anonymous disclosures who are later exposed should still receive whistle-blower protections.⁶⁷

67. See Slovakia, Act No. 307/2014 Coll. on Certain Measures Related to the Reporting of Antisocial Activities and on Amendments to Certain Acts (2015). ↩

Without protection against retaliation and the possibility of redress, few would disclose wrongdoing. Protection should be detailed explicitly in law, providing whistle-blowers and others with clarity about the nature of the protection that they may seek. In particular, whistle-blowers must be protected against coercion or harassment of themselves or their families, discrimination, physical harm to a person or property, threats of retaliation, job loss, suspension or demotion, transfer or other hardship, disciplinary penalty, blacklisting or prosecution on grounds of breach of secrecy laws, libel or defamation.56 In the event of investigation or prosecution, whistle-blowers should be permitted to raise all of the principles identified above in their defence, especially that the disclosure was to protect a specified public interest that outweighed harm to a governmental interest. Whistle-blower laws should provide a mechanism to redress wrongdoing and prohibit those forms of retaliation, among others.

Impunity for reprisals sends a message to all potential whistle-blowers that the institution lacks commitment to their protection, while serious and effective penalties are necessary to overcome the structural and cultural protection of secrecy. Whistle-blower laws should therefore include specific rules that make clear the penalties that those who commit reprisals will face, including civil or criminal repercussions for officials in leadership positions. Zambian law, for example, provides for substantial penalties (fines and imprisonment) against “a person who takes any detrimental action that is in reprisal for a person who makes a protected disclosure”.⁶⁸

68. Zambia, Public Interest Disclosure Act (see footnote 59 above). See also Norway, Dispute Act, sect. 2-5 (2005). ↩

States have long sought to keep secret information that, if disclosed, could undermine efforts to protect the public from grave harms such as terrorism or armed conflict. The protection of confidential information is a necessary by-product of some government activity, and article 19 (3) recognizes the legitimacy of limitations to protect specific interests such as national security. Institutions that operate in national security, such as institutions of defence, diplomacy, internal security and law enforcement, and intelligence, may have a greater claim not to disclose information than other public bodies, but they have no greater claim to hide instances of wrongdoing or other information where the value of disclosure outweighs the harm to the institution. Yet whistle-blower protections are often weak, or simply unavailable, in the area of national security and intelligence. Those who disclose wrongdoing in national security institutions are often subject to retaliation, such as job loss or transfer, denial or revocation of security clearance, and investigation, prosecution and harsh sentencing, and they lack redress because of legal doctrines that support an infrastructure of secrecy. Whistle-blowing’s main function thus loses all force, and while the lack of protection ultimately denies members of the public access to critical information about their Government, national security institutions also lose a tool of accountability.

In 2013, dozens of organizations, academic institutions and experts from 70 countries — including the special rapporteurs on freedom of expression in the United Nations and the African, European and Inter-American systems — concluded a two-year study of national security and the right to information. The resulting Global Principles on National Security and the Right to Information, known as the Tshwane Principles, provide guidance for States seeking to balance their interests in protecting information and ensuring the public’s right to know. The principles and their detailed explanatory discussions deserve widespread study and implementation. Already, the Council of Europe has recognized that a special whistle-blower framework applicable in the context of national security may be valuable.⁶⁹

69. See Council of Europe, recommendation CM/Rec(2014)7, appendix, sect. II (5). See also Parliamentary Assembly of the Council of Europe, “Improving the protection of whistle-blowers”, document No. 13791 (19 May 2015). ↩

All of the principles identified above should apply in the context of national security, modified as appropriate according to the principles below. Full coverage means that no institution should be accorded such a wide measure of discretion as to eliminate the protections themselves. National security institutions enjoy secrecy as a norm of behaviour. Moreover, non-disclosure is often buttressed by a network of secrecy and espionage laws — often with harsh criminal penalties — that all but eliminate genuine whistle-blower protection, in particular by removing the whistle-blower’s ability to advocate on the basis of the public’s interest in the disclosed information. In those situations, States should rationalize their laws so that whistle-blower protections, and the public interest basis for them, apply regardless of the institution involved.

Where internal or external oversight mechanisms have not operated or do not operate so as to provide protection and effective redress in the face of a disclosure, the following principles apply generally in the context of external, public disclosure.

States may find it appropriate to apply specific rules to public national security disclosures. To be consistent with article 19 (3), they should nonetheless strictly adhere to the standard that restrictions be necessary and proportionate to protect national security. National security exclusions have traditionally involved information about ongoing defence plans, weapons systems and communications, critical infrastructure and intelligence operations, sources and methods.⁷⁰ States have also long protected sensitive security-related diplomatic activity. National security restrictions on disclosure should apply only in such situations, and disclosure should not be limited in the absence of the Government’s showing of “a real and identifiable risk of significant harm to a legitimate national security interest”.⁷¹ Law should clearly define what may be withheld from disclosure. A “legitimate national security interest” must be genuine, not a cover for “protection of government or officials from embarrassment or exposure of wrongdoing; concealment of information about human rights violations, any other violation of law, or the functioning of public institutions; strengthening or perpetuating a particular political interest, party, or ideology; or suppression of lawful protests”.⁷²

70. See the Global Principles on National Security and the Right to Information, principle 9. ↩
71. Ibid., principle 3 (b). ↩
72. Ibid. To be clear, the relevant national law must also be consistent with international law. ↩

To satisfy the principle of proportionality, the relevant institution should also be prepared to show that the harm to the specific legitimate national security interest outweighs the public interest in disclosure. The Tshwane Principles propose that public disclosure should be protected where the internal or oversight mechanism would be ineffective, futile or lack timeliness in the face of a serious threat. Furthermore, reflecting a point of general applicability, the whistle-blower should disclose only the “amount of information that was reasonably necessary to bring to light the wrongdoing” and do so on the reasonable belief that the public interest in disclosure outweighed any harm to any specific and legitimate national security interest.⁷³ Any disclosures that meet those tests should merit full protection. Those principles should be available to whistle-blowers whether they are claiming protection or defending themselves against investigation or prosecution.

73. Ibid., principle 40. ↩

The question posed most sharply in the national security area is whether, when individuals assess the balance between public interest disclosure and national security harm, they should lose the protection they would otherwise enjoy if their assessment differs from that of the Government, as is likely. Criminal or civil penalties may advance the Government’s interest in concealing certain information, but they do so at a steep cost to the public interest in ensuring that whistle-blowers do come forward to disclose instances of wrongdoing or other information that it is in the public’s interest to know.

Where States nonetheless pursue criminal or civil penalties against whistle-blowers, limiting the spillover risk of deterring whistle-blowing should involve three critical protections. First, in any such action, States should bear the burden of proving that the harm to a legitimate national security interest outweighed the public interest in disclosure. Second, States should provide defendants with the basic tools of defence, including access to the information necessary for a defence, relaxation of secrecy laws in the context of closed court sessions if necessary and the ability to make a genuine case that disclosure’s benefit outweighed the asserted harm. Lastly, in the event of a conviction or penalty, sentences or fines must be proportionate to the underlying act, including taking into account the extent to which the whistle-blower’s disclosure advanced the public interest, even if a court found the harm to national security to outweigh the value of disclosure.

The principles of whistle-blower protection adopted by States and regional mechanisms apply with equal force in the context of international organizations. The United Nations and other international organizations have adopted rules and regulations with the purpose of enabling whistle-blowing and prohibiting retaliation against those who disclose wrongdoing.⁷⁴ Nonetheless, allegations of retaliation against whistle-blowers plague international organizations.⁷⁵

74. See ST/SGB/2005/21; World Bank, staff rule 8.02: Protections and Procedures for Reporting Misconduct (Whistleblowing) (2008). ↩
75. See Government Accountability Project, “International best practices for whistleblower policies” (2013). ↩

Basic structural gaps in international organizations leave whistle-blowers at risk in ways that those who report wrongdoing in national systems may avoid. In particular, nearly all international organizations are opaque to the public, which has limited access to information, and few have effective policies on access to information. As bureaucratically dominated organizations, they avoid the strict scrutinization by the press that is often found in national contexts, and they are naturally isolated from direct contact with members of the public or the press. They are, moreover, subject to reputational demands in order to maintain financial and political support of Governments. Furthermore, persons who report wrongdoing have limited access to independent systems of justice. They generally lack access to national courts when complaining about retaliation, and the human rights bodies are unlikely to apply protection in the face of retaliation. The immunities enjoyed by international organizations in national and other external jurisdictions result in minimal legal pressure on the organizations to respond effectively to allegations of wrongdoing. The mechanisms themselves generally face substantial problems of independence because of those structural barriers.

The track record for whistle-blowers in the United Nations system reinforces the difficulties. Very few whistle-blower complaints are fully investigated. Between 2006 and 2014, only 15 cases of a total of 403 “inquiries” sent to the Ethics Office of the United Nations were found to meet prima facie standards for retaliation, while only 4 were established as retaliatory cases. The low numbers, in a system of more than 40,000 employees, are likely to send a message to employees that the reporting system will not provide effective protection or redress. Some international organizations do have strong formal protections for whistle-blowers.⁷⁶ However, all international organizations should adopt the principles applicable in national situations and consider at least the following steps to improve their approaches.

76. See African Development Bank Group, “Whistle-blowing and complaints handling policy” (Tunis, 2007), sect. 4. ↩

First, whistle-blower definitions should apply broadly to encourage all disclosures of wrongdoing that implicate the interests of the organization and all stakeholders, including Governments and civil society. As it stands, many organizations’ protections apply to reports of staff failures to comply with obligations, rather than applying to the full range of wrongdoing of which a person may gain knowledge. A public interest standard for reporting would cover a wider scope of wrongdoing to which the United Nations and its staff become privy. Policies should also protect all whistle-blowers from retaliation, not just staff members but others who may be associated with the organization.

Second, the existing mechanisms, while well-intentioned, lack real independence and effectiveness. As long as internal reporting channels require implementing actions by various individuals in the organization’s management, they will fail to enjoy the credibility that comes with independent review. Whistle-blowers should enjoy access to formal justice mechanisms, not merely mechanisms that, as is the case with the Ethics Office at the United Nations, involve only recommendatory powers. Punishment of those who retaliate should be serious, not merely disciplinary, and should include the possibility of removal from their post and personal liability.

Third, international organizations — and the States that established and support them — should adopt serious and effective policies of transparency to enable the public to have greater access to information. The public should enjoy access not only to information about the policies and practices of the organizations, but also to information about whistle-blowing. Subject to the requirements of privacy protections, investigations of whistle-blowing complaints should avoid the strictures of confidentiality, providing for public knowledge of complaints. As it stands, whistle-blowing complaints are very rarely made public, or if they are, such publicity follows only after years of delay and secrecy.

Lastly, those who identify wrongdoing — especially evidence of serious legal violations and human rights abuses, such as sexual and gender-based violence — should be protected from retaliation when they make public disclosures to the media, civil society or Governments. To be sure, disclosures should respect the rights and reputations of others, but in the absence of effective internal systems, external disclosure provides a necessary safety valve to promote accountability and ensure that the public has information about serious wrongdoing.

A common thread ties together the right of access to information, the protection of sources of information and the protection of whistle-blowers: the public’s right to know. Human rights law protects the right to seek, receive and impart information and ideas of all kinds, while also permitting restrictions of the right on narrow, specified grounds. When the right and the restriction clash, as they are often purported to do, Governments and international organizations should not adopt laws and policies that default in favour of the restrictions. Rather, laws should favour disclosures of information in the public interest. In cases of source and whistle-blower disclosures, public institutions have most of the power — the power to intimidate, to investigate, to prosecute. They also have greater access to information and, thus, the ability to make their case, while the source or whistle-blower typically has only a window into broader policies and practices, hindered by secrecy laws that preclude an adequate defence. If a disclosure genuinely harms a specified legitimate State interest, it should be the State’s burden to prove the harm and the intention to cause harm. States and international organizations are urged to adopt or revise laws accordingly, consistent with the well-recognized centrality of the right to freedom of expression and access to information in democratic governance.

Basic protections are critical to an effective right to freedom of expression, accountability and democratic governance. Individual cases of disproportionate treatment and retaliation against sources and whistle-blowers have been in the public eye over recent years, relating to intelligence agencies, asylum programmes, public health, environmental protection, corruption in the business and financial sectors, international organizations and many other domains. The Special Rapporteur has avoided mentioning specific cases in the present report. Moving forward, the principles identified in the present report will be applied in communications with Governments and international organizations on specific cases. The Special Rapporteur looks forward to a dialogue with Governments to help to improve their legal frameworks and establish effective protection of sources and whistle-blowers.

National legal frameworks establishing the right to access information held by public bodies should be aligned with international human rights norms. Exceptions to disclosure should be narrowly defined and clearly provided by law and be necessary and proportionate to achieve one or more of the above-mentioned legitimate objectives of protecting the rights or reputations of others, national security, public order, or public health and morals.

National legal frameworks must protect the confidentiality of sources of journalists and of others who may engage in the dissemination of information of public interest. Laws guaranteeing confidentiality must reach beyond professional journalists, including those who may be performing a vital role in providing wide access to information of public interest such as bloggers, “citizen journalists”, members of non-governmental organizations, authors and academics, all of whom may conduct research and disclose information in the public interest. Protection should be based on function, not on a formal title.

Any restrictions on confidentiality must be genuinely exceptional and subject to the highest standards, and implemented by judicial authorities only. Circumventions, such as secret surveillance or metadata analysis not authorized by judicial authorities according to clear and narrow legal rules, should not be used to undermine source confidentiality. States should promote tools, such as encryption and anonymizing programs, to ensure protection of sources. Authorities compelling revelation of sources must demonstrate that reasonable alternative measures to the disclosure do not exist or have been exhausted and that the legitimate interest in the disclosure clearly outweighs the public interest in the non-disclosure. These should be limited to investigations of the most serious crimes or the protection of life.

State law should protect any person who discloses information that he or she reasonably believes, at the time of disclosure, to be true and to constitute a threat or harm to a specified public interest, such as a violation of national or international law, abuse of authority, waste, fraud or harm to the environment, public health or public safety. Upon disclosure, authorities should investigate and redress the alleged wrongdoing without any exception based on the presumed motivations or “good faith” of the person who disclosed the information.

Internal institutional and external oversight mechanisms should provide effective and protective channels for whistle-blowers to motivate remedial action. In the absence of channels that provide protection and effective remediation, or that fail to do so in a timely manner, public disclosures should be permitted. Disclosure of human rights or humanitarian law violations should never be the basis of penalties of any kind.

Protections against retaliation should apply in all public institutions, including those connected to national security. Given that prosecutions generally deter whistle-blowing, States should avoid them, reserving them, if at all, for exceptional cases of the most serious demonstrable harm to a specific legitimate interest. In such situations, the State should bear the burden of proving an intent to cause harm, and defendants should be granted (a) the ability to present a defence of an overriding public interest in the information, and (b) access to all information necessary to mount a full defence, including otherwise classified information. Penalties should take into account the intent of the whistle-blower to disclose information of public interest and meet international standards of legality, due process and proportionality.

Acts of reprisals and other attacks against whistle-blowers and the disclosure of confidential sources must be thoroughly investigated and those responsible for those acts held accountable. When the attacks are condoned or perpetrated by authorities in leadership positions they consolidate a culture of silence, secrecy and fear within institutions and beyond, deterring future disclosures. Leaders at all levels in institutions should promote whistle-blowing and be seen to support whistle-blowers, and particular attention should be paid to the ways in which authorities in leadership positions encourage retaliation, tacitly or expressly, against whistle-blowers.

Law enforcement and justice officials must be trained to ensure the adequate implementation of standards establishing protection of the right to access information and the consequent protections of confidentiality of sources and whistle-blowers. Authorities in leadership positions should publicly recognize the contribution sources and whistle-blowers make by sharing information of public relevance and should condemn attacks against them.

State entities should also support civil society organizations that are expert in the areas of access to information, protection of journalists and their sources, and whistle-blower promotion and protection. Many such organizations may offer technical advice and training. States should ensure that civil society can participate fully in all efforts to adopt or revise source and whistle-blower laws, regulations and policies.

All the above recommendations to States apply to the United Nations and other international organizations. In addition, the United Nations and international organizations should adopt effective norms and policies of transparency to enable the public to have greater access to information. Specific norms protecting whistle-blowers should follow similar criteria to those provided in the recommendations to States: wide scope of application, promotion of disclosure of information in the public interest and clarity in the mechanisms for reporting and requesting protection. Particular attention must be paid to the effectiveness and independence of existing reporting and justice mechanisms, given the lack of access of whistle-blowers to any other formal justice system.