The Whistleblower Who Copied the Ledger
Nova Retail Group employs 4,200 staff. A regional accountant, Meera, discovered that her manager had been booking fictitious supplier invoices to meet quarterly targets, inflating revenue by about £3.1m over two quarters. She raised it internally; nothing happened for six weeks. She then emailed the CFO with a spreadsheet she had copied from the finance system, including customer names and bank details. The CFO forwarded it to HR and to the manager's director. Within days Meera was placed on 'administrative leave' for removing confidential data, and a disciplinary process began. The company has a whistleblowing policy promising confidentiality and no detriment, but the policy says reports must go to the line manager or HR. The manager remains in post. Meera's email to the CFO was not marked confidential. The audit committee has asked the general counsel for advice.
1. Advise on whether the company can lawfully continue the disciplinary process against Meera, and what the whistleblowing framework requires.
Read the worked answer
Continuing discipline is high-risk. Meera made a protected disclosure about a suspected fraud; the company's own policy promises no detriment. The timing-leave and discipline within days of her report, while the manager stays in post-creates a strong inference of detriment caused by the disclosure. The fact that she copied customer and bank data is a legitimate concern, but it should be handled proportionately: has she been asked to delete copies, and is there evidence of misuse? A blanket disciplinary response looks retaliatory. The policy is also defective: routing all reports to the line manager or HR fails when the line manager is the subject, and it offers no confidential alternative. The framework should provide multiple routes, including an independent external line, an audit committee or non-executive contact, a clear confidentiality commitment, a prohibition on detriment, and a documented triage process. The general counsel should suspend the disciplinary process pending an independent investigation of the underlying fraud, separate the two matters, and ensure the investigator reports to the audit committee, not to the CFO who forwarded the email.
2. The CFO says the spreadsheet's customer data means Meera breached data protection law, so the company must act. Assess that argument.
Read the worked answer
The argument is overstated. Data protection law permits processing necessary for the prevention and detection of crime and for legal claims, and a whistleblower reporting suspected fraud may rely on those grounds. The company's obligation is to handle the data securely, not to punish the person who surfaced it. The real risk is the company's own handling: the CFO forwarded a file containing customer bank details to HR and a director without a need-to-know assessment, which is a more serious data incident than Meera's disclosure. The correct response is to contain the data-ask Meera to confirm deletion, restrict the file's circulation, log the incident-and to investigate the fraud. Using data protection as a disciplinary weapon against a protected disclosure risks a detriment claim and undermines the policy. The board should treat the data issue as a compliance matter handled separately and proportionately, and should not let it become the reason the fraud investigation stalls.