The compliance officer who went to the supervisor

The dismissal is likely unlawful, but the reasoning must be built step by step, because the bank will argue that disclosing client data is a fundamental breach.

Step 1 - is the disclosure protected? Whistleblower protection does not require a perfect procedure. The EU Whistleblower Directive (2019/1937) covers reports on breaches in the financial sector, including anti-money-laundering, and the national implementing law sets the channels and conditions. Vjosa reported internally first and waited a month; the board did nothing. External reporting to the supervisor was then a reasonable next step rather than a leap. Under Heinisch v. Germany, disclosure of illegality is protected where the public interest in exposing it outweighs the employer's interest in confidentiality and the harm caused.

Step 2 - proportionality. She sent 40 pages of transaction records, which is broader than strictly necessary, and the bank will seize on this. But the data concerned the suspicious transactions themselves and were needed to make the report intelligible; there is no sign of personal gain.

Step 3 - causation and burden of proof. Once she shows a protected disclosure followed closely by dismissal, the burden shifts to the bank to prove a genuine, non-retaliatory reason. The stated reason - breach of confidentiality - is the very conduct that constituted the disclosure, so in substance the reason is the retaliation itself.

Step 4 - sanction and procedure. Immediate termination is the heaviest sanction. The contract required 30 days' notice and a disciplinary procedure; neither was followed. Even if some sanction were justified, dismissal without notice is disproportionate.

Remedy: reinstatement or compensation plus damages, with the burden on the bank; also report the retaliation to the labour inspectorate.

There is a clear conflict, and it is not curable by consent.

The lawyer is asked to act for the bank against Vjosa while also acting for the board member whose conduct is the subject of her report. The bank's interest may be to settle or to distance itself from the board member; the board member's interest is to avoid personal exposure. Those interests diverge, and information he holds from one client is directly relevant to the other.

Under the professional conduct rules (the Bar Association code and the CCBE principles), a lawyer may not act where there is a significant risk that representation of one client will be materially limited by duties to another client or a third person's interest, and may not act for two clients in the same or a related matter with conflicting interests. Where the conflict is fundamental, client consent does not cure it.

What he must do: decline the injunction mandate and, if already instructed, withdraw from at least one engagement; inform both clients in writing of the reason; return the file; and preserve confidentiality - he cannot use information from the bank relationship against the bank, or from the board member against him.

The injunction itself. Even with an unconflicted lawyer, an order to silence a whistleblower raises serious freedom-of-expression issues. The court must balance the bank's reputation and confidentiality against the public interest in AML compliance. Prior restraint is granted only where the harm is imminent and the disclosure clearly unlawful. The bank would be better advised to seek a confidentiality order within the proceedings than an injunction against disclosure.

The starting point is that the documents are the bank's records, to which Vjosa had lawful access in the course of her duties. They are not privileged in the way a client's communications with a lawyer are.

Acquisition. Copying them to a personal email may breach internal policy and data protection rules, but it does not make the documents fabricated. Courts generally admit documentary evidence obtained by an employee where it is relevant, authentic and necessary, and exclude it only where the method of obtaining it was unlawful in a way that outweighs the interest in establishing the truth - a proportionality test. Since the documents came from her employer's own systems and were used to report a suspected offence, exclusion is unlikely.

Use against her. Here the balance shifts. The bank wants the 40 pages to prove she took confidential data, but that is precisely the conduct protected as the disclosure. A labour court applying the anti-retaliation principle may refuse to let the bank rely on the very disclosure it is alleged to be retaliating against; otherwise the protection would be empty.

Return of documents. The bank can ask for the originals back and for an undertaking not to use them further. It cannot obtain an order that prevents her from relying on them in her own proceedings, because that would deny her the evidence needed to prove her case. The court can order that they be filed under seal and used only in the proceedings.

Conclusion: the documents are likely admissible in her case; the bank's attempt to turn them into the ground of dismissal is the weaker position and should be resisted both on evidence and on retaliation grounds.