Privacy vs. Whistleblowing: Can Data Breaches Be Justified During Public Disclosure?

Whistleblowing has recently been at the forefront of the public consciousness increasingly often. Wikileaks, Theranos, and Cambridge Analytics have become household names due to the efforts of internal whistleblowers. However, the history of whistleblowing stretches thousands of years into the past. Its first recorded instances occurred in Ancient Greece, where it was referred to as parrhesia, meaning "speak freely". Although it was not formally codified, parrhesia was extremely valued and considered a cornerstone of democratic society.²Foxley, I. (2021). An ancient virtue. Index on Censorship, 50(2), 54.https://doi.org/10.1177/03064220211033791 Today, the role of whistleblowing is not less significant. Within the European Union, there has been an increased focus on protecting those who blow the whistle, which resulted in the introduction of the Directive (EU) 2019/1937, commonly known as the Whistleblowing Directive³Directive (EU) 2019/1937 of the European Parliament and of the Council of 23 October 2019 on the protection of persons who report breaches of Union law.. While its main purpose is to "enhance the enforcement of Union law and policies in specific areas"⁴Article 1 of the Whistleblowing Directive, it also seeks to establish common standards for the protection of the whistleblowers by providing protection in cases of justified internal and external reporting as well as public disclosure. Simultaneously, the EU upholds one of the strictest data privacy regimes through the General Data Protection Regulation (GDPR)⁵Regulation (EU) 2016/679 of the European Parliament and of the Council of 27 April 2016 on the protection of natural persons with regard to the processing of personal data and on the free movement of such data, and repealing Directive 95/46/EC (General Data Protection Regulation) by imposing strict obligations on the processing of personal data, with significant penalties for non-compliance. The co-existence of these two strict regimes introduces an inherent tension: blowing the whistle can easily involve the dissemination of personal data, potentially constituting a data breach under GDPR. This is especially relevant in the case of public disclosure⁶WB directive 'public disclosure' or 'to publicly disclose' means the making of information on breaches available in the public domain., when the information reported becomes widely accessible. This presents not only a complex legal dilemma but an ethical discussion, creating a confrontation between two deeply valued principles: the pursuit of justice, accountability, and protection of the public interest through whistleblowing, and the safeguarding of individual privacy. This article seeks to examine the situations when a data breach, occurring as part of a public disclosure by a whistleblower, might be justified within the EU legal framework. It analyses the specific conditions for public disclosure, and examines whistleblower liability and its exemptions. The article also provides insights on navigating these complex legal and ethical dilemmas and analyses the extent to which organisations can hold whistleblowers accountable for such data breaches, considering the protections afforded by the Whistleblowing Directive and the case law of the European Court of Human Rights (ECtHR).