United States: SEC Applies Whistleblower Interference Rule To Corporate Confidentiality Requirement

I understand that in order to protect the integrity of this review, I am prohibited from discussing any particulars regarding this interview and the subject matter discussed during the interview, without the prior authorization of the Law Department. I understand that the unauthorized disclosure of information may be grounds for disciplinary action up to and including termination of employment.⁶  

The Commission acknowledged that it was not aware of any instance in which this confidentiality statement prevented any employee from reporting a possible securities law violation to the SEC.⁷ Nor was the Commission aware of any instance in which KBR sought to enforce the confidentiality statement so as to prevent an employee from reporting an alleged securities law violation to the SEC.⁸ Nevertheless, the Commission believed that the confidentiality statement alone constituted a violation of Rule 21F-17(a) because "the language found in the form confidentiality statement impedes such communications by prohibiting employees from discussing the substance of their interview without clearance from KBR's law department under penalty of disciplinary action including termination of employment."⁹
 
The Commission's conclusion that this fact pattern violated Rule 21F-17(a) is surprising for several reasons:
 
First, Rule 21F-17(a), by its terms, is violated only when one takes action for the purpose of impeding ("action[s] to impede") an individual from reporting a securities law violation to the SEC. The adopting release accompanying the rule similarly emphasizes that the rule was directed at "efforts to impede" reporting.¹⁰ There was no evidence in this case of any such intent, and the facts conceded by the Commission in its order undermine the notion that KBR had any such intent. What is more, the Commission made no finding that KBR acted with such an intent. Instead, the Commission adopted a lesser effects test, finding a violation because in the Commission's view the confidentiality statement language "impedes" employee reporting regardless of its intent.¹¹ Even this conclusion seems to be unsupported by the facts described in the order since the SEC acknowledged that it was aware of no situation in which an employee was prevented from reporting.
 
Second, the Commission's finding of a violation seems to contradict the language of the rule itself. The rule makes it unlawful to take action to impede reporting, such as "enforcing, or threatening to enforce, a confidentiality agreement . . . with respect to such communications."¹² Because the language of the rule focuses on attempts or threats to enforce confidentiality agreements with respect to an employee's effort to report misconduct to the SEC, the rule implies that the mere existence of a generalized confidentiality agreement is not violative of the rule. But, the Commission's order could, under the broadest reading, be viewed as having essentially forbidden generalized confidentiality agreements unless they contain an express disclaimer to the effect that the agreement does not prohibit reporting to law enforcement.¹³ In other words, the order could be viewed as requiring companies that use confidentiality agreements to affirmatively advise employees of their right to be whistleblowers. If an accurate read of the Commission's intent, this would be a dramatic expansion of the whistleblower rules as adopted.
 
Third, the Commission's interpretation of KBR's confidentiality statement seems unwarranted. The confidentiality statement prohibited employees interviewed during internal investigations from "discussing any particulars regarding this interview and the subject matter discussed during the interview, without the prior authorization of the Law Department."¹⁴ The Commission read KBR's confidentiality statement as impeding an employee from reporting to the SEC the underlying facts about which the employee was interviewed. But this is far from an obvious reading of the confidentiality statement. As an initial matter, the US Supreme Court has recognized that a company conducting an internal investigation needs to advise employees to maintain the confidentiality of the interview in order to preserve the investigation's privilege.¹⁵ Thus, there cannot be anything improper in advising an employee that he or she is not to recount the contents of the privileged interview to other persons. To the extent the Commission reads KBR's confidentiality statement as going further—i.e., to prohibit discussing with others the underlying facts that were the subject of the interview—this too is nothing more than a widely-used precaution to prevent cross-contamination of witness memories. And, by the SEC's own admission, there was no evidence that any employee understood this language to apply to reports to federal law enforcement.¹⁶  
 
Practical Considerations Going Forward
 
Unless the Commission provides additional guidance, the KBR settlement necessitates that companies take precautionary measures.
 
First, a company should take care that any severance or separation agreements with officers or employees do not contain confidentiality requirements that could be misconstrued by the SEC as prohibiting an employee from making a lawful whistleblower complaint. To the extent that a severance or separation agreement contains a confidentiality or non-disparagement requirement, it may be necessary to include in that agreement an express carve-out for whistleblower complaints.
 
Second, a company should review its corporate policy manuals, employee codes, and related training materials to determine whether there are any confidentiality requirements in those documents that could likewise be misconstrued as prohibiting whistleblowing. Most companies impose confidentiality obligations on their employees with regard to company information so as to, for example, prevent insider trading. A company should evaluate whether such provisions need an express carve-out for whistleblowing.

Third, a company (and its in-house and outside lawyers) should take care regarding the form in which they issue Upjohn warnings. As noted above, the Supreme Court's decision in Upjohn cited the confidentiality obligation imposed on employees with respect to communications with counsel as a critical factor in finding those communications to be subject to the attorney-client privilege.¹⁷ The KBR order, however, raises questions as to whether such warnings must also contain a whistleblowing carve-out. Perhaps the Commission will not require such and instead distinguish the KBR order on the ground that the investigations at issue in KBR were only part of the company's "compliance program."¹⁸ Or perhaps a Commissioner or senior staff member will, through a speech or otherwise, provide some clarification on this point. Such clarification is especially needed in light of the recent threats made by the Commission's Whistleblower Chief to seek to bar attorneys from practicing before the Commission if they run afoul of the whistleblower rules.¹⁹

In sum, the Commission's decision in KBR represents an aggressive reading of the SEC's whistleblower rules, and a company would be well advised to heed its warning. A review of company severance agreements and confidentiality policies is in order. And care in conducting internal investigations is required going forward.

¹ Order Instituting Cease-And-Desist Proceedings, In the Matter of KBR, Inc., No. 3-16466 (SEC Apr. 1, 2015), available at www.sec.gov/litigation/admin/2015/34-74619.pdf.

² 17 C.F.R. § 240.21F-17(a).

³ Id. 

⁴ SEC Rules Implementing the Whistleblower Provisions of Section 21F of Securities Exchange Act of 1934, SEC Release No. 34-64545 (May 25, 2011), 76 Fed. Reg. 34,300, 34,307 (June 13, 2011) [hereinafter SEC Adopting Release].

⁵ Brian Mahoney, "SEC Warns In-House Attys Against Whistleblower Contracts, " Law360 (Mar. 14, 2014, 5:16 p.m. ET), www.law360.com/articles/518815/sec-warns-in-house-attys-against-whistleblower-contracts. 

⁶ KBR, Inc., at 2.

⁷ Id. at 3.

⁸ Id. 

⁹ Id. 

¹⁰ SEC Adopting Release at 201, 76 Fed. Reg. at 34,352.

¹¹ KBR, Inc., at 3.

¹² 17 C.F.R. § 240.21F-17(a).

¹³ KBR, Inc., at 3 (noting that KBR had amended its confidentiality statement to expressly notify employees of their right to make reports of misconduct to the government).

¹⁴ KBR, Inc., at 2. (emphasis added.)

¹⁵ See Upjohn Co. v. United States, 449 U.S. 383, 387 (1981) (noting that company counsel directed company employees "to treat the investigation as 'highly confidential' and not to discuss it with anyone other than Upjohn employees who might be helpful in providing the requested information").

¹⁶ KBR, Inc., at 2.

¹⁷ See Upjohn, 449 U.S. at 387, 395.

¹⁸ KBR, Inc., at 2.

¹⁹ Mahoney, supra note 5.

The content of this article is intended to provide a general guide to the subject matter. Specialist advice should be sought about your specific circumstances.