Scope of Federal Statutory Whistleblower Provisions

The Sarbanes-Oxley Act (SOX) and the Dodd-Frank Wall Street Reform and Consumer Protection Act (Dodd-Frank) contain provisions protecting from retaliation individuals who provide information regarding a violation of U.S. securities laws. Various ambiguities in these statutory provisions have been adjudicated, most recently by the Northern District of California, which grappled with a new issue: whether directors who allegedly engage in retaliatory conduct may be liable under SOX and Dodd-Frank.

In Wadler v. Bio-Rad Laboratories, [1] Chief Magistrate Judge Joseph C. Spero held that directors who take retaliatory action against a whistleblowing employee by voting in favor of that employee’s termination are subject to individual liability under both SOX and Dodd-Frank. In addition, the court addressed the unsettled question whether Dodd-Frank’s anti-retaliation protection extends to whistleblowers who report internally but not to the Securities and Exchange Commission (SEC), joining a divided Second Circuit in according deference to the SEC’s view that it does.

Statutory Background

Section 1514A of SOX protects employees of covered companies from discharge and other retaliatory action for reporting or assisting in the investigation of a violation of federal securities laws. [2] Passed in 2010, Dodd-Frank enhanced and expanded pre-existing protections and bounty incentives to encourage whistleblowing, including SOX’s. Dodd-Frank added Section 21F to the Securities Exchange Act, which defines a “whistleblower” as “any individual who provides…information relating to a violation of the securities laws to the Commission, in a manner established, by rule or regulation, by the Commission.” [3]

Dodd-Frank thus says that to qualify as a “whistleblower,” an individual must provide information to the SEC. Uncertainty about the scope of anti-retaliation protection has persisted, however, because for anti-retaliation purposes Dodd-Frank applies to a “whistleblower” who makes disclosures protected under laws such as SOX, including disclosures not made to the SEC. [4] SOX protects not only whistleblowers who provide information to a federal regulatory or law enforcement agency, but also those who report to anyone with “supervisory authority over the employee.”

Individual Directors

In contrast to SOX, which lists categories of individuals and entities who may be sued, Dodd-Frank permits whistleblowers to sue an “employer” for retaliation. In Wadler, Bio-Rad’s former general counsel, Sanford Wadler, brought a whistleblower action against his former employer and the members of Bio-Rad’s board of directors, alleging that he was wrongfully terminated in retaliation for investigating and reporting to Bio-Rad’s upper-level management possible violations of the Foreign Corrupt Practices Act (FCPA) in China. Wadler contended that while his termination was “‘effectuated by the CEO,'” the decision to terminate him was made by vote of the full board. Wadler further alleged that certain board members knew that he had reported misconduct to persons with supervisory authority over him and to other Bio-Rad employees who had investigative authority. Moving to dismiss the complaint, the defendants countered that neither SOX nor Dodd-Frank permits individual liability of directors for retaliation against whistleblowers.

Addressing whether directors may be held individually liable under SOX, the Bio-Rad court noted the absence of applicable case law. The court identified only one decision, issued earlier this year by the U.S. Court of Appeals for the Fourth Circuit, in which that court affirmed a verdict against the corporate defendant, its CEO, and the chairman of its board for retaliatory conduct in violation of SOX.

In Jones v. Southpeak Interactive Corp. of Delaware, [5] just as Wadler had alleged in Bio-Rad, the decision to terminate the plaintiff “was made by a vote of the entire board of directors.” The Jones court, however, did not explain its basis for concluding that the chairman of the board could be liable under SOX.

Looking to the text of Section 1514A of SOX and its prohibition of retaliation by “any officer, employee, contractor, subcontractor, or agent of” a public company, the Bio-Rad court said the issue turns on whether the word “agent” encompasses directors. On the one hand, Black’s Law Dictionary defines an agent as “[s]omeone who is authorized to act for or in place of another; a representative,” and, according to Wadler, “[b]oard members, who after all are responsible for making the most important decisions for the company, are clearly authorized to act on behalf of the company and thus qualify as ‘agents.'” On the other hand, the defendants highlighted the Restatement (Third) of Agency, which explains that agency only arises when one person (a principal) manifests assent to another person (an agent) “that the agent shall act on the principal’s behalf and subject to the principal’s control, and the agent manifests assent or otherwise consents so to act.”

Notably, the comment to this provision specifies that “the directors are neither the shareholders’ nor the corporation’s agents as defined in this section.” The court indicated, however, that the Reporter’s Notes for this comment acknowledge that “some commentators characterize directors as agents and that ‘[s]ome corporation statutes treat directors as agents for specific purposes.'” Given these inconsistent views, the Bio-Rad court concluded that the meaning of the word “agent” in Section 1514A is ambiguous and, therefore, proceeded beyond statutory language to glean Congress’s intent.

In its discussion of legislative intent, the court rejected the defendants’ argument that because Congress explicitly listed specific categories of individuals who may be held liable under Section 1514A, such as officers and employees, but omitted directors from that list, Congress must have intended not to impose individual liability on directors. The court explained that, “[a]s an initial matter, it is not clear that the drafters excluded directors from individual liability in the first place, given that Section 1514A(a) includes ‘agents’—a term that may or may not encompass directors,” as it had previously discussed.

Second, the court reasoned, “there is no indication that the drafters ‘considered and rejected’ an alternative version that specifically named directors as one of the categories of individuals who could be held individually liable.” “Most importantly,” in the court’s words, “the context and general purpose of [SOX] support the conclusion that the term ‘agent’ is intended to encompass directors.” The court explained that a “key feature” of SOX was its protection of corporate whistleblowers from retaliation, “[y]et that purpose would be significantly undermined were the Court to construe the term ‘agent’ … as excluding directors,” as it would allow corporate directors to terminate employees for whistleblowing “even though the exact same conduct on the part of a corporation’s managers would give rise to individual liability.” The court further buttressed its conclusion by reference to the Congressional record’s frequent reference, when discussing whistleblower protection, to the “employer”—a term to which Congress has given “expansive meaning” in some of its statutes.

In Bio-Rad, however, the court determined that the SOX claims against the individual defendants other than the CEO were untimely because the plaintiff’s original complaint to the Department of Labor did not give the board members, other than the CEO, adequate notice that they would be sued in the action. The Bio-Rad court emphasized that Wadler did not cite any particular conduct of the board members “that would have put them on notice that he was accusing them of retaliatory conduct; nor [did] he state that his termination was a result of a vote by the Board of Directors, even though he does not dispute that he was aware of the Board’s vote soon after his termination.” Additionally, explained the court, given the unsettled case law regarding individual liability under Sarbanes-Oxley, the board members would not have anticipated that Wadler would assert claims against them.

Turning to whether the Dodd-Frank Act’s anti-retaliation provision contemplates individual liability for directors, the court revisited the meaning of the word “employer.” This is because, in contrast to Section 1514A of SOX, which enumerates categories of entities and individuals that may be liable for retaliatory conduct against whistleblowers, Dodd-Frank simply prohibits retaliation by an “employer.” [6]

The defendants argued that the plain meaning of “employer” indicates that directors may not be held individually liable under Dodd-Frank. In addition, they pointed to federal statutes, such as the Americans with Disabilities Act (ADA) and Title VII of the Civil Rights Act, which use the term “employer” and have been found to preclude individual liability. The Bio-Rad court rejected the analogy, concluding that “courts that have found that Title VII and the ADA do not impose individual liability have not relied on any generally established definition of ’employer,’ but rather, on specific provisions in those statutes limiting liability to employers with more than 15 employees.”

In contrast, explained the court, Congress defined the term “employer” much more broadly in the context of the Fair Labor Standards Act (FLSA), indicating that the term includes “‘any person acting directly or indirectly in the interest of an employer in relation to an employee.'” Thus, the court determined that “[g]iven that the term ’employer’ has been used in federal statutes in both a narrow sense (in the ADA and Title VII) and a broader sense (in the FLSA), and in the absence of any definition of the term in Dodd-Frank,” the term—as it is used in the Dodd-Frank Act—is ambiguous. The court, therefore, again consulted legislative intent.

In considering Congress’s intent, the court again declined to draw the inference suggested by defendants—this time, that because the Dodd-Frank Act utilizes the term “employer” while Sarbanes-Oxley enumerates specific individuals on which it imposes liability, Dodd-Frank features no individual liability. The court opined that “[t]here is nothing in the legislative history … that suggests that this [textual] difference was intended to eliminate individual liability for those who retaliated against whistleblowers.” To the contrary, as the court reasoned in its analysis of Sarbanes-Oxley’s anti-retaliation provision, “the word ’employer’ appears repeatedly in the legislative history of Sarbanes-Oxley as a short-hand to describe those who could be sued under that statute, suggesting that the use of the term in Dodd-Frank does not reflect an intent to eliminate individual liability under Dodd-Frank.”

Further, the Bio-Rad court reasoned that its conclusion is “consistent with the legislative history of Dodd-Frank indicating that its purpose was to enact more stringent measures that were contained in Sarbanes-Oxley to protect whistleblowers.” The court observed that in accordance with this purpose, the Congressional record reflects that the changes in Dodd-Frank pertaining to the protection of whistleblowers were aimed at increasing whistleblower protection. The court concluded, therefore, that “the suggestion that Congress, when it enacted Dodd-Frank, intended to exclude liability on the part of individuals who retaliate against whistleblowers—which had been a key feature of Sarbanes-Oxley aimed at increasing accountability at the top levels of corporations—is implausible.”

In the court’s opinion, if Congress had intended to reduce whistleblower protections by removing liability for individuals, there would have at least been “some mention of such a significant change,” and there is no such mention anywhere in the statute’s legislative history. Accordingly, the court held that “Congress intended that Dodd-Frank provide for individual liability that is at least as extensive as that of Sarbanes-Oxley, and therefore, that directors may be held individually liable for retaliating against whistleblowers under Dodd-Frank.”

Internal Whistleblowers

In addition to addressing individual liability for directors, Bio-Rad added its voice to the ongoing judicial debate regarding whether the Dodd-Frank’s anti-retaliation protections, as codified in Section 21F and related SEC rules, are available to individuals who report suspected securities law violations internally but not to the SEC. This question of the scope of Section 21F’s protections originates with the provision’s ambiguity. As noted above, Section 21F defines “whistleblower” as an individual who provides information relating to a securities law violation “to the Commission.”

The statute’s anti-retaliation provision, however, prohibits any type of discrimination in the terms and conditions of employment against a whistleblower “because of any lawful act done by the whistleblower…in providing information to the Commission…” or “in making disclosures that are required or protected under” SOX. Of course, as noted above, SOX explicitly extends its anti-retaliation protection to employees of publicly traded companies who provide information or otherwise assist in an investigation relating to fraud when the investigation is conducted not only by a federal or law enforcement agency, but also “a person with supervisory authority over the employee.”

In assessing whether Dodd-Frank’s whistleblower protection reached Wadler even though he did not report suspected violations to the SEC, the court acknowledged that the U.S. Court of Appeals for the Fifth Circuit in Asadi v. G.E. Energy (USA) and “a minority of courts have concluded that Dodd-Frank’s anti-retaliation provisions apply only to individuals who have provided information or assistance regarding possible violations of securities law to the SEC.” Most courts, however, deferred to the SEC’s interpretation of Section 21F as reflected in Rule 21F-2(b)(1), which clarifies that Section 21F’s anti-retaliation protections extend to those who provided information “in a manner described in Section 21F(h)(1)(A)”—the provision that extends protections to those making disclosures covered by Section 1514A of the Sarbanes-Oxley Act. [7]

In deciding which approach to follow, Bio-Rad consulted the Supreme Court’s Chevron, U.S.A. v. Natural Res. Def. Council, which held that if a statute is silent or ambiguous with respect to a question, courts should give deference to the construction of the agency that administers the statute, so long as the agency’s interpretation is “‘based on a permissible construction of the statute.'” Disagreeing with the Fifth Circuit, the Bio-Rad court held that Section 21F’s “whistleblower” definition is ambiguous and determined that the statutory interpretation of the SEC—the agency administering Section 21F—is entitled to deference as “a permissible construction of the statute.” The Bio-Rad court thus followed the majority view in holding that internal whistleblowers are protected from retaliation under the Dodd-Frank Act.

Implications of Bio-Rad

Bio-Rad appears to be the first decision explicitly addressing whether directors can be held individually liable for their role in terminating a whistleblower protected by SOX and Dodd-Frank. Whether other jurisdictions will follow Bio-Rad remains to be seen, but directors of publicly traded companies should be mindful that the door has been opened to individual liability for conduct found to violate the whistleblower protection provisions of SOX and/or Dodd-Frank. Directors should also note that Bio-Rad may embolden prospective whistleblower plaintiffs to name individual directors in their complaints where the board had a meaningful role in the alleged retaliatory conduct.

Bio-Rad‘s view that Dodd-Frank protects internal whistleblowers, while not unique, had not previously been addressed within the Ninth Circuit. In adhering to the majority view, Bio-Rad joined a divided U.S. Court of Appeals for the Second Circuit, which in Berman v. Neo@Ogilvy [8] recently deferred to the SEC’s position that Dodd-Frank whistleblower protection extends to individuals who report suspected violations to “persons or governmental authorities other than the Commission.”

Moreover, although not referencing it, the court also followed the guidance in an interpretive release issued by the SEC earlier this year, which further clarified the SEC’s view that the definition of “whistleblower” as set forth in Rule 21F-2(b) governs Section 21F’s anti-retaliation protections and does not require reporting the violation to the SEC. [9] As indicated in its interpretive release, the SEC believes the Fifth Circuit’s reading of Section 21F “is not consistent with Rule 21F-2 and would undermine [the SEC’s] overall goals in implementing the whistleblower program.” Bio-Rad’s deference to the SEC’s construction of Section 21F reminds us that, in most jurisdictions, whistleblowers who do not report the violation to the SEC are nonetheless fully protected under the Dodd-Frank Act.