Whistleblowers as regulatory intermediaries: Instrumental and re ﬂ exive considerations in decentralizing regulation

This article frames whistleblowers as regulatory intermediaries who provide a response to the problem posed by the fragmentation of knowledge in a complex society and market economy. I identify two ways in which whistleblowers become regulatory intermediaries: The ﬁ rst is by remedying informational asymmetries between the regulator and the target (instrumental approach). Both in the United States and in the European Union, whistleblowers are protected on the basis of the value of the disclosed information for the advancement of regulatory objectives. The second way in which whistleblowers become regulatory intermediaries is by contributing to the development of “ communities of compliance ” and by enhancing the internal self-regulatory capacities of regulatory targets (re ﬂ exive approach). Creating internal channels of reporting and monitoring is perceived as a way to change the organizational culture of targets. Through the instrumentalism – re ﬂ exivity dipole, competing rationales and normative visions of regulatory intermediation become apparent: It could, on the one hand, facilitate state intervention and legal sanctions or, on the other hand, signal the aspiration to embed public and social values in private actors.


Introduction
Regulation literature is increasingly turning its attention to how regulatory intermediaries might be employed by both rule-makers and rule-takers to achieve regulatory goals. (Abbott et al. 2017;Brès et al. 2019;Fransen & LeBaron 2019;Kourula et al. 2019;Paiement 2019). For Abbott et al. (2017, p. 18), the regulator-intermediarytarget (RIT) framework captures how "regulators lack direct access to their targets, means of influence or other capabilities necessary to regulate them, and sufficient channels for information gathering"shortcomings the intermediary is meant to assist in overcoming. In that sense, regulatory intermediation is one configuration within complex systems of governance that are captured by notions such "regulatory governance," "decentered regulation," the "post-regulatory state," or "new governance" (Lobel 2004;Scott 2004;Black 2008;Levi-Faur 2011). At the same time, regulatory intermediaries represent a response to an age-old problem of legal and political theory: Knowledge and its relation to the construction of an economic and social order. How can regulationmuch less planningbe effective when there is no central authority or institution that can have a functional overview over the dispersed knowledge of the market economy? (Hayek 1945). One possible answer is to accept the economy as an "internal limit to government" and to only adhere to the laws seen as necessary to maintain and encase the unknowable economy itself (Slobodian 2018, p. 270). Although this does not constitute a vision of deregulation or of a minimal state (Levi-Faur 2005), it reflects a "kind of state," which only relies on formal rules, as opposed to rules and interventions designed to promote particular visions of substantive justice. By assuming the form most likely to benefit all the people affected by them, formal rules do not differentiate between the needs and wants of different people but only aspire to guarantee formal equality before the law and the foreseeability of state coercion (Hayek 2001). 1 Another possible answer to the conundrum of knowledge, and the one increasingly advanced by systems of governance that feature RIT frameworks, is to decentralize regulation by prioritizing proximity to the sources of information and in the exercise of control. Since the necessary knowledge for inhibiting the expansion of economic rationalities cannot be built from external observation points, such as that of the state, regulation has to be the product of system-specific knowledgeof the regulatory target itself (Teubner 2011a, p. 14).
Whistleblowing is an instrument in this process of decentralization. A guiding definition to a complex phenomenon has been provided by Transparency International, according to which whistleblowing is "the disclosure of information related to corrupt, illegal, fraudulent or hazardous activities being committed in or by public or private sector organizations (including perceived or potential wrongdoing)which are of concern to or threaten the public interestto individuals or entities believed to be able to effect action" (Transparency International 2013, p. 87). As I will show throughout this article, legislative initiatives institutionalizing protection from retaliation and channels of reporting protect whistleblowers as carriers of information, on the basis of the value of the disclosed information for the achievement of regulatory targets. There is no flat standard of protection: If the disclosure of wrongdoing does not align with prescribed regulatory targets (e.g. disclosure of wrongdoing in the field of national security), whistleblowers face increased risks of retaliation and prosecution.
In a setting where whistleblowing is institutionalized to assist in achieving regulatory goals, I identify two ways in which whistleblowers become regulatory intermediaries. These correspond to different normative visions about the function and the role of regulatory intermediation. The first way in which whistleblowers assume the role of regulatory intermediaries is by fulfilling a crucial role in remedying informational asymmetries between the regulator and the target. I call this the instrumental approach. The proximity of whistleblowers to the source of information is a way for regulators to gain indirect access to their targets and thus facilitates implementation. Taking the framework provided by Kourula et al. (2019), whistleblowers fulfill the role of formalized "critics," who, nevertheless, instead of bringing to the table their specialized expertise, they bring their privileged knowledge of the intricacies of corporate conduct, including instances of malfeasance and infractions, occasionally leading to the exposure of corporate scandals. 2 Whistleblowing is then only an instrument for enforcement and the achievement of regulatory goals. The content of these goals is a matter of political prioritieswhistleblowing can be an instrument for a broad spectrum of objectives. As I will show, whistleblower protection and reporting mechanisms have been diffused in the recent years, both in the United States and the European Union, as mechanisms to secure market conditions, protect competition, and warn off market abuse and fraud. However, whistleblowing legislation is currently acquiring a broader scope, as indicated both by the 2019 EU Directive and also by the fact that it is increasingly employed for sustainability policies, consumer protection, or labor enforcement (Lewis 2019).
Yet, there is a second way in which whistleblowers become regulatory intermediaries. This is by contributing to the development of "communities of compliance," that is, by "promoting dialogue among targets, regulators, and others; and changing the organizational culture of targets" (Abbott et al. 2017, p. 23). I call this the reflexive approach. In order to unpack this function of whistleblowing, it is first necessary to underscore that regulatory targets are not mere rule-takers. They have agency, which can be expressed through rule interpretation, regulatory avoidance, creative compliance, or even regulatory capture. In such a setting, a project of comprehensive ex ante regulation is presented as overly ambitious (Schneiberg & Bartley 2008;Teubner 2012). Instead, the focus should be, at least in theory, on enhancing the internal self-regulatory capacities of regulatory targets and on embedding public and social values already at the level of their operations. The incorporation of public values, such as transparency and accountability, would in theory delimit the need for external regulation, while the even more ambitious incorporation of social valuesvalues not related to profit maximization, such as the protection of labor rights or the safeguarding of communities in operational vicinitywould deliver on aspirations of sustainable development. Contrary to the instrumental approach, the key to regulation and compliance, from this perspective, does not come from the "outside" but from the "inside"regulation should ideally develop into a synergetic project of self-change. However, it would be naïve to expect private institutional structures to selfregulate in that way without any incentive or threat from public institutions. It is, therefore, the role of public authority to trigger these self-regulatory dynamics. One way of doing this 3 is by imposing on corporations the obligation to install internal channels of reporting for wrongdoing, guaranteeing at the same time protection from retaliation for employees that make use of them. Empirical evidence supports the conclusion that reporting wrongdoing within organizational hierarchies is exceedingly difficult for employees, who face risks of retaliation (European Commission 2018a, p. 2; Vaughn 2012, p. 55, on the motivations of whistleblowers, Feldman & Lobel 2010;Roberts 2014). By imposing the creation of specialized channels for reporting and by guaranteeing the legal protection and anonymity for whistleblowers, public regulation provides the "irritation" (Luhmann 2012, p. 66) for private organizations to reconfigure their institutional structure in a way that forces them to confront and address their own shortcomings. Internal reporting channels become then, in theory, an ever-present form of monitoring from the inside. This monitoring links corporate operations with the broader social environment, making illegal conduct and even harmful externalities difficult to dismiss or ignore. Considering, also, that it might be in the interest of private actors to see wrongdoing addressed quickly and with the minimal reputational damage, the obligation to institutionalize internal channels of reporting is meant to enhance cooperation with public authorities in addressing reported infractions, to promote institutional dialogue, and to forge long-lasting communities of compliance; in short, to transform the organizational culture of targets, displacing organizational secrecy to the benefit of "reflexive" transparency.
The tension between the instrumental and the reflexive approach in employing whistleblowers as regulatory intermediaries plays out mostly on the level of prioritizing external (to a regulatory agency) or internal (within the company) reporting of wrongdoing. In both cases, however, whistleblowers are employed as regulatory intermediaries to address the fragmentation of knowledge in a market economy. Both the state-centrism of the instrumental approach and the decentralizing impetus of the reflexive approach convey an acknowledgement of the fact that regulators cannot possibly achieve their regulatory goals without some form of intermediation.
In that sense, I argue that whistleblowing legislation is primarily embedded with a regulatory drive, rather than with a concern for expanding freedom of speech in the workplace or labor rights for employees. Whistleblowing legislation protects whistleblower behaviorthe reporting of informationbecause of the supposed value of the information. In Part 2, I will support this argument by discussing the evolution of whistleblowing legislation in the United States, taking into consideration the considerable influence the pioneering U.S. framework has had over later adopters of whistleblowing policies. I will also show how the dilemma between the instrumental and the reflexive approach finds an expression in the question of whether to prioritize external or internal reporting. By highlighting the competing rationales to which this prioritization corresponds, I attempt to outline the significance of the categories of "instrumentalism" and "reflexivity" for regulatory intermediation beyond the case study of whistleblowing. In Part 3, I will turn my attention to the European Union, where whistleblowing has recently received significant attention as a regulatory tool as a result of the passing of the Whistleblowing Directive of 2019. Whistleblowing protection, in both its instrumental and reflexive dimensions, becomes important for a well-functioning single market, the protection of the level-playing field, but also to promote social and environmental sustainability. In Part 4, I will show how whistleblowing is also progressively employed in the field of business and human rights for the purpose of making corporate conduct sustainable and respectful of human rights. Once again, whistleblowing policies can assume the synergetic goal of limiting corporate power from "the inside" or a more confrontational regulatory approach, where transparency is simply instrumental in achieving the regulatory target.
2. The regulatory drive of whistleblower protection in the United States 2.1. The pillars of whistleblowing legislation A defining characteristic of whistleblowing legislation in the United States is that protection against retaliation is provided as an adjunct to the principal objectives of the relevant pieces of legislation, which, in the instances discussed here, is the maintenance of trust in the integrity of the markets. 4 Whistleblowing is institutionalized as a regulatory tool, rather than as an employee or civil rights protection mechanism.
This first became evident in the Sarbanes-Oxley Act (SOX) of 2002, which was passed in the aftermath of the major scandals of Enron and WorldCom. Aiming at solidifying corporate integrity and restoring the confidence in the markets, SOX sought to enhance transparency through new forms of regulatory oversight, among which were the increased protections for whistleblowers. More specifically, the Act, rather than granting rights to employees, purports to protect whistleblower behavior, and as such its chief goal is the procurement of information regarding conduct that the employee reasonably believes constitutes securities fraud or corporate fraud against shareholders (Westman & Modesitt 2004). According to Section 806 of the Act, the information must be provided to (a) a federal regulatory or law enforcement agency, (b) any member of Congress, or (c) a person with supervisory authority over the employee (18 U.S.C § 1514A (a)(1)). Leaks to the media are not protected by Sarbanes-Oxley's anti-retaliation provision (Tides v. Boeing Co., 2011).
The administrative enforcement of Section 806 was placed with the Department of Labor (DOL), which delegated the receipt and investigation of these complaints to Occupational Safety and Health Administration (OSHA), the administrative process of which must be exhausted before pursuing claims in front of the DOL or federal courts. SOX entails a burden-shifting approach similar to anti-discrimination law, whereby once the employee makes a prima facie case, 5 it is up to the employer to demonstrate that he or she "would have taken the same unfavourable personnel action in the absence of that behavior" (49 U.S.C. § 42121(b)(2)(B)(ii); Allen v. Administrative Review Board, 2008). It follows from Section 806 that the whistleblower does not need to report first to the employer in order to receive protection. SOX received attention for the establishment of internal procedures for whistleblowing. Indeed, the introduction of mechanisms for internal whistleblowing is crucial for the understanding of the Act's regulatory significance, as it opens a door to the reflexive approach outlined above. In particular, Section 301 of the Act provides that "[e]ach audit committee shall establish procedures for…the confidential, anonymous submission by employees of the issuer of concerns regarding questionable accounting or auditing matters" (15 U.S.C. §78j-1(m) (4)). The inclusion of anti-retaliation provisions within a framework of stronger corporate compliance mechanisms, independent audit committees, and anonymous reporting procedures was seen as a way to incentivize and strengthen internal compliance efforts (Pearlman 2011). It has been supported that the establishment of internal procedures in whistleblowing statutes reflects the interests of the businesses and may be the result of their effective lobbying, as the internal route has been consistently considered the least harmful for their part, for reasons of reputational, litigation-related, and financial costs (Callahan et al. 2002).
To better understand the regulatory drive behind the institutionalization of whistleblower protection, it is worth taking a step back and examining the modalities of whistleblowing protection prior to the passing of the act. Before SOX, the protection for whistleblowers in the private sector was fragmented and weak (Dworkin & Near 1987;Westman & Modesitt 2004). Aside from the False Claims Act, which applied in case of financial loss to the government (Callahan & Dworkin 1992;Ballan 2017) only employees who raised concerns about public health or safety issues would be protected, a protection that was scattered in different legislative texts and often inefficient. There was no federal protection for private sector employees for reporting wrongdoing or illegalities in general; their access to protection depended on the existence of particular, domain-specific regulations that allow for such reporting. 6 In a system where the majority of employees are employed "at-will," whistleblower provisions may delimit the employer's discretional authority over layoffs, but only if the employee's reporting falls within the ambit of the regulation. More often than not, protective statutes, such as the Civil Rights Act of 1964, require more than the simple provision of information for violations of the statute. Rather, they require that the individual employee "opposed" an unlawful action or "made a charge, testified, assisted, or participated in any manner in an investigation, proceeding or hearing" (42 U.S.C. § 2000e-3 (a); Civil Rights Act 1964).
This personalized, rights-based approach entails a higher barrier for whistleblower protection and is contrasted with the SOX approach in financial regulation, which purports to protect whistleblowers as regulatory intermediaries responsible for corporate oversight. SOX set a new paradigm, where the whistleblowers' protection from retaliation is subsumed under the broader goal of detecting and remedying systemic threats to market integrity. This also meant focusing on the information provided and avoiding subjective requirements, such as good faith or disinterested motivation. The whistleblower is only required to have "reasonably believed" the information he or she procured was true.
Building on the approach of SOX that saw in whistleblowers potential regulatory intermediaries, the Dodd-Frank Wall Street Reform and Consumer Protection Act of 2010 further incentivized whistleblowing against securities law violations, such as market manipulation, fraud in the trading of securities, insider trading, or other violations. Dodd-Frank not only perpetuated and enhanced SOX's anti-retaliation protection, but, most importantly, it also established a system of potentially hefty monetary awards for the reporting of violations of securities laws. Section 922 of Dodd-Frank requires the Securities and Exchange Commission (SEC) to award important monetary awards ("bounties") to those who provide original information to the SEC, which then results in the Commission imposing monetary sanctions exceeding $1 million.
Section 922(h)(1) protects whistleblowers against retaliation through a private right of action. The protection is similar with the one guaranteed in the SOX, with the important difference that it initially appears to apply only to those who report externally, leaving the ones who report to their employer or who opt for the internal whistleblowing routes with the weaker protection of SOX. This is indicated by the fact that the prohibition on retaliation only applies with respect to "whistleblowers" and according to the statute's definition, "the term 'whistleblower' means any individual who provides…information relating to a violation of the securities laws to the Commission" (Section 922(a)(6)). The protection of only external whistleblowers seemed to essentially create a two-tiered system of retaliation protection in which "whistleblowers may receive stronger, more robust protection if they report directly to the SEC, but weaker, less reliable protection if they report to the company" (Dodd-Frank Act 2011).
This bold shift from a reflexive to an instrumental approach on whistleblowing did not remain unchallenged. In the case Berman v. Neo@Ogilvy (2015), the Second Circuit held that Dodd-Frank's whistleblower protection applies to internal complaints. 7 This decision created a circuit split, as it directly contradicted the Fifth Circuit's 2013 decision in Asadi v. G.E. Energy (USA) (2013), which based its narrow interpretation of the provisions on textual and structural analysis and found that interpreting section 922 broadly would render SOX anti-retaliation provisions superfluous. The issue ascended for resolution to the Supreme Court, which in Digital Realty Tr., Inc. v. Somers (2018) ruled that an "employee who did not report any securities-law violations to SEC did not qualify as a whistleblower", abrogating Berman v. Neo@Ogilvy LLC. The Court drew from the letter of the Dodd-Frank Act and its strict definition of a whistleblower, as well as from the Act's "purpose and design." Therefore, according to the Supreme Court, the stronger protection and the financial incentives of the Dodd-Frank Act only apply to those who by-pass internal corporate reporting channels and instead report directly to the SEC. Employers cannot impede disclosures to the SEC by means of Non-Disclosure and Confidentiality Agreements (17 CFR 240, Rule 21F-17(a)(SEC)). Conveying the contemporary distrust of financial self-regulation in the aftermath of the financial crisis of 2008, whistleblowing provisions became part of the larger regulatory framework aiming to guarantee the integrity, transparency, and accountability of financial institutions and private entities in general.

External versus internal reporting: Instrumental and reflexive transparency
The oscillation between less or more interfering policies (internal vs. external reporting channels) highlights the dependence of whistleblowing protection mechanisms on the political economy and the level of trust placed on financial self-regulation. At the state level, most whistleblower protection legislation protects only external whistleblowers. The provisions for internal whistleblowing do not represent the pre-existing norm in U.S. legislation. Through SOX in 2002, Congress adopted a new approach to regulation, relying on "internal monitoring, reporting, and problem solving" (Lobel 2009b(Lobel , p. 1251, thus "revitalizing self-regulation" (Estlund 2005, p. 374). However, following the subprime mortgage crisis and economic recession, it was Congress's belief that "financial institutions cannot be left to regulate themselves, and that without clear rules, transparency, and accountability, financial markets break down, sometimes catastrophically" (Barr 2012, p. 92). Whistleblowing provisions are part of this regulatory framework of transparency and accountability and they reflect the intent to closely oversee the financial industry. Moreover, they are based on the assumption that corporate compliance programs have not been entirely successful, and that self-regulation is insufficient.
It is supported that external whistleblowing is better suited for defending the public interest, as "extending protections for internal reporting does not further the public interest of detection and enforcement" (Lobel 2009a, p. 446). On the contrary, proponents of less intrusive regulation see external whistleblowing as a disturbance to the self-adjustment of the markets, a source of distrust and therefore an inhibitor to discovering fraud, and, eventually a threat to economic growth (Ribstein 2002;Rubinstein 2007). Internal whistleblowing is also preferred for its more delicate balancing of the multiple loyalties an employee holds (toward his or her consciousness, the company, and society) and its pragmatic orientation toward problem-solving (Callahan et al. 2002). It is suggested that it is more speedy and efficient in tackling fraud and securities law violations, while the Dodd-Frank provisions are, from the perspective of public interest, less likely to achieve the regulatory aim (Westman & Modesitt 2004). Furthermore, it has been supported that the potential for enormous bounties might lead corporate insiders to let instances of fraud go undetected without reporting them internally, only to later bring them directly to the SEC in the hopes of securing a large financial award (Daly 2011). The business roundtable, after acknowledging its own efforts in ameliorating corporate governance through soft law initiatives, claims that many companies have enhanced their control systems and whistleblowing channels, creating a culture of trust, which the SEC is corroding through the implementation of the Dodd-Frank Act (Business Roundtable 2010). It therefore asks that the employees must first report internally, before reporting to the Commission.
As mentioned in the introduction, prioritizing internal or external whistleblowing is much more than a technicality: Indeed, it reveals a strategic positioning in the dualism between instrumentalism and reflexivity. Reporting directly to regulatory agencies incorporates whistleblowers as regulatory intermediaries as a result of their operational capacity: Their unique proximity to the source of information regarding instances of fraud. In that sense, whistleblowers can operate as monitors to the extent that the regulatory framework guarantees sufficient independence, protection from retaliation, and possibly incentives. The information whistleblowers provide has an instrumental value for the achievement of the regulatory goal, in this case the protection of market conditions, including of fair competition and the maintenance of a level-playing field.
On the contrary, internal whistleblowing cannot be reduced to simply a tool to achieve direct regulatory goals, such as combatting fraud and protecting market integrity. It also makes part of a broader regulatory aspiration: To strengthen the internal self-regulatory capacities of private actors, side-lining classic, command-and-control type of coercion, it is posited that in conditions of complexity and fragmented knowledge, such top-down coercion cannot be effective (Sunstein 1990;Scott 2004;Schneiberg & Bartley 2008). As a regulatory technique, internal whistleblowing builds on the regulatory paradigm of "new governance" and "decentered regulation" (Black 2001(Black , 2008Ford 2008;Lobel 2004;Scott 2004, see also Lombard & Brand 2020). As already mentioned, one critique of this model is that while the prioritization of internal reporting is meant to speed up problem-solving, it actually protects corporate interests, for example, by reducing reputational damage (Callahan et al. 2002). Indeed, corporations started establishing internal channels of reporting of wrongdoing long before it became a legal requirement (Lewis 1995). A more subtle critique to the reflexive approachwhich is relevant beyond the case of internal whistleblowing, to other instances of new governancehas to do with the degree to which replacing outside constraints with internal checks could entrench corporate power and favor market-based sanctions to the detriment of nonmarket values (Coffee 2009;Stewart 2014;Kampourakis 2020a). Mandating the establishment of internal channels of reporting within corporations turns whistleblowers into private gatekeepers, highlighting the intention to ensure corporate accountability by means of steering the internal affairs of the corporation. Corporate power, according to this governance perspective, cannot be limited from the "outside" but rather from the "inside" (Pargendler 2016). The deflection of more intrusive regulation and external intervention reflects a mistrust to centralized social action (Cioffi 2006) and the aspiration to enhance self-reflective and selfregulatory capacities through exposure to social expectations and market pressure (Teubner 1983;Lobel 2004Lobel , 2012Lange & Haines 2015). This type of reflexive transparency is built on synergetic groundson the assumption that private actors also want to signal to the market that they can be trusted. Efficient systems of identifying and remedying wrongdoing could, in theory, indicate a culture of compliance and mitigate investment risk. Internal reporting channels can also fulfil their reflective orientation even in the absence of instances of reporting: Assuming that protection for whistleblowers is robustly guaranteed, the lack of whistleblowing instances may function as a guarantee for horizontal, unmediated by the state, market trust. Indeed, the bigger aspiration behind the employment of whistleblowers as regulatory intermediaries is to transform a corporate culture of secrecy and propensity to misconduct, building instead communities of trust. It remains questionable whether the degree of confidence in such internal transformation is justified or whether, on the contrary, the attempt to infuse private actors with public values (e.g. transparency, accountability) becomes a source of legitimacy for more diffused privatizations and expanding regimes of private governance (Stewart 2014;Moncrieff 2015).
3. Whistleblowing protection in the European Union: Protecting the single market 3.1. An instrument against market abuse The development of whistleblower protection legislation in the European Union shows significant signs of convergence with the U.S. framework. The construction of a common European policy on whistleblowing is made upon the presumption that it will improve regulatory efficiency, often in abstraction of legal cultures of member States. Indeed, the EU framework for whistleblowing protection reveals a regulatory orientation: Whistleblowing has a role to play for a well-functioning single market and the protection of competition.
The Directive 2015/2392, the first specialized, pan-European framework of whistleblower protection, aims to establish effective mechanisms to enable reporting of actual or potential infringements of the Market Abuse Regulation of 2014. In its aims and scope, it resembles, and possibly draws inspiration from, the Dodd-Frank Act. The Directive outlines the establishment of procedures for anonymous reporting of infringements of the Regulation to the competent authorities set up by Member State. While in practice this encourages external reporting, the Directive remains agnostic to the course of action selected by whistleblowers: "Whistle-blowers should be free to report either through internal procedures, where such procedures exist, or directly to the competent authority" (rec. 2). Although the highlighting of individual choice in the matter could, in theory, expand the spectrum of options for potential whistleblowers, it also conceals the political character of the rift between instrumental and reflexive transparency. In Europe, national protection of whistleblowers is usually structured based on a "threetiered" system (Vandekerckhove 2010). This means that whistleblowers must prioritize reporting to the employer and, if the issue is not resolved, only then disclose to a regulatory agency and, if that also fails, possibly to the press. In addition, in some countries, most notably France (Loi relative à la transparence, à la lutte contre la corruption et à la modernisation de la vie économique n 2016-1691 2016), the protection of whistleblowers is dependent on further requirements, such as good faith. The procurement of information is itself not sufficient. In that sense, the Directive deviates from the most common model of whistleblower protection in the continent, presumably for reasons of efficiency and expediency of the need to address market abuse (on the effectiveness of whistleblowing and path dependence, see Lee et al. 2018;Pittroff 2016). Interestingly, certain Member States used the transposition of the Directive as an opportunity to strengthen internal reporting mechanisms, imposing, for example, the obligation for regulated financial service providers to put in place internal procedures to facilitate whistleblowing. 8 The Directive extends protection against all forms of retaliation or unfair treatment arising as a result of the disclosure and it is not dependent on the motive of the whistleblower. While the institutionalization of financial incentives for reporting of wrongdoing is recommended, no Member State has so far exercised such discretion.
The encouragement to blow the whistle becomes part of the regulatory puzzle, following a broader set of post-financial crisis reforms for the reinforcement of market integrity. The pursuit of the Directive is to protect whistleblowers for their contribution in safeguarding the integrity of financial markets. The emphasis is on the information procured by the employee and its potential value in preventing market abuse. Whistleblowing protection is, in this way, not unlike the example of the United States, depersonalized: The long-held scepticism over anonymous reporting in a number of Member States (CNIL 2005; Strack 2010) is set aside, while the motive of the whistleblower, including for example the recurrent requirements of good faith or being disinterested, become legally insignificant (Resolution 2016/2224(INI) on legitimate measures to protect whistle-blowers acting in the public interest when disclosing the confidential information of companies and public bodies 2016).

The whistleblowing directive of 2019
Facilitating the achievement of regulatory goals and enhancing enforcement is also the driving force of the recently adopted Directive 2019/1937 on the protection of persons who report breaches of Union law. The areas targeted by the Directive are those where increased enforcement would be the most valuable, such as public procurement, financial services, environmental protection, and transport and food safety.
The protection from retaliation applies to both public and private sector employees, including also selfemployed individuals, volunteers, unpaid trainees, the employees of contractors and subcontractors, shareholders, and people whose work-based relationship has ended (art. 4). Insofar as the information procured falls within the scope of the Directive, whistleblowers are protected if they have reasonable grounds to believe that the information reported was true (art. 6(1)(a)). Reasonable belief displaces possible requirements of good faith, facilitating protection for whistleblowers. Protection is guaranteed through a nexus of measures introduced by Member States against retaliation, such as exemption from liability or the reversal of the burden of proof in favour of the whistleblower, and through legal and financial assistance (but not rewards) for whistleblowers (art. 20, 21). The Directive adopts the three-tiered model, whereby Member States are first asked to ensure that public and private entities install internal channels for reporting (art. 8), second to designate authorities competent to receive confidential reports for external reporting (art. 11, 12), and lastly whistleblowers may, under conditions, be protected if they disclose publicly (art. 15). The conditions are that the individual reported first internally or externally and no action was taken, or that there was risk for irreversible damage, or that there is a risk of retaliation or a low prospect of the breach being effectively addressed. In general, internal reporting is prioritized (art. 7 (1)(2)). For the effective detection and prevention of breaches of Union law, it is vital that the relevant information reaches swiftly those closest to the source of the problem, most able to investigate and with powers to remedy it, where possible. As a principle, therefore, reporting persons should be encouraged to first use internal reporting channels and report to their employer, if such channels are available to them and can reasonably be expected to be efficient (rec. 47).
A fundamental idea behind the suggested reform is that whistleblower protection can be an important instrument for a fair and well-functioning single market. This can be achieved through the reporting of infractions that threaten the financial interests of the Union, for example those that relate to competition law or to public procurement rules: The introduction of whistleblower protection rules at EU level would contribute to protecting the financial interests of the Union and to ensuring the level playing field needed for the single market to properly function and for businesses to operate in a fair competitive environment. (European Commission 2018a, p.12) Whistleblowing provides the level of transparency that is necessary for the functioning of competition, for a "level playing field." It is important to note that this was not the only way to flesh out protection for whistleblowers. The Union considered different policy directions and legal bases for the expansion of whistleblower protection. One possibility was Article 50(2)(g) TFEU on enhancing the integrity of the private sector by introducing minimum standards for setting up reporting channels. However, this would have not covered the public sector and it would have left the design and extent of protection of external reporting to the discretion of Member States (European Commission 2018b). Another, more ambitious avenue, was through the Article 153 TFEU on improving the working environment to protect workers' health and safety and on working conditions. However, this option was discarded, first because it would have limited protection only to employees, and second because it was considered far-reaching and costly as regulatory intervention, considering that it would apply where there would be no connection with Union law or with the financial interests of the EU.
The reform that was eventually chosen is simultaneously more limited and broader in scope. On the one hand, it neither offers a flat standard of protection, despite its reference to freedom of expression (rec. 31), nor does it orchestrate a reform of labor rights. 9 Rather, it confines legal protection to the specified areas that reflect contemporary political priorities. On the other hand, the Directive also reflects the broad aspiration not only to protect the efficient functioning of the single market but also to promote social and environmental sustainability. According to the Commission, "by boosting corporate transparency, social responsibility and financial and nonfinancial performance, whistleblower protection can complement measures to increase business transparency on social and environmental matters" (European Commission 2018a, p. 5). Corporate transparency, in its turn, is supposed to indirectly achieve policy related-objectives through the reputational pressure it adds to corporations (Jackson 2010;Vogel 2010). Transparency and social responsibility are projected as solutions to regulatory weaknesses, addressing the limited reach of regulators through an appeal to reflexivity and self-limitation and signaling the reliance on the private sector for broader aspirations of social welfare. While the Directive remains consistent with the identified pattern of protecting whistleblower behavior (i.e. the reporting of information that is valuable for regulatory objectives), its broad material scope marks a move beyond the strict prioritization of economic and financial interests. This is a trend in whistleblowing legislation that is further accentuated in the field of business and human rights.

Whistleblowing in supply chains: An instrument for sustainability
Whistleblowing has indeed been employed in the field of business and human rights for the purpose of making corporate conduct sustainable and respectful of human rights. Once again, the institutionalization of whistleblowing mechanisms can convey both a synergetic, reflexive approach, limiting corporate power from "the inside," and a more confrontational regulatory approach, where transparency is simply instrumental in achieving the regulatory target.
An example of the synergetic approach is provided by the UN Guiding Principles on Business and Human Rights (UNGP) of 2011. In particular, Principle 20 specifies that "in order to verify whether adverse human rights impacts are being addressed, business enterprises should track the effectiveness of their response." Tracking should then be integrated into internal reporting processes, among which are ethics commissions and internal channels of reporting of wrongdoing. The impetus to develop company-level grievance mechanisms and internal channels of reporting is consistent with the decentralizing spirit of the UNGP. John Ruggie, the UN Secretary-General's Special Representative on business and human rights, highlights that "companies should identify and address grievances early, before they escalate. An effective grievance mechanism is part of the corporate responsibility to respect" (Ruggie 2008, p. 24). Yet, the responsibility to respect is not in itself legally binding. Effective operationalization of the corporate responsibility to respect human rights eventually depends on the voluntary corporate uptake of social values. In theory, however, this incorporation of social values within private institutional structures cannot be understood as wholly voluntary, because "failure to meet this responsibility can subject companies to the courts of public opinioncomprising employees, communities, consumers, civil society, as well as investorsand occasionally to charges in actual courts" (Ruggie 2008, p.16;Ruggie 2017;Teubner 2009Teubner , 2011b. The urge to companies to institutionalize effective channels of internal reporting is then in line with the broader UNGP structure, which prioritizes corporate self-limitation, enhancement of self-regulatory capacities, and embeddedness of social values, as opposed to state-centered enforcement (Kampourakis 2019). Internal reporting conveys the synergetic spirit of the UNGP, aspiring to reduce public/private antagonisms and to transform private companies into responsible social agents.
Furthermore, according to Principle 29, "to make it possible for grievances to be addressed early and remediated directly, business enterprises should establish or participate in effective operational-level grievance mechanisms for individuals and communities who may be adversely impacted." Such mechanisms are meant to be accessible to individuals and communities that might be adversely impacted by corporate conduct. This underlines a key difference when reporting of wrongdoing is meant to be utilized for purposes of sustainability and human rights protection, as opposed to counter market abuse: The reporting individual or community is understood as one affected or harmed by the business enterprise. While the whistleblowing protection schemes that target market abuse, such as those in the United States or the European Union, protect or even incentivize whistleblowers as employees observing wrongdoing, their equivalents in the field of sustainability should, according to the UNGP, be designed for those that are personally affected by the wrongdoing.
The French Duty of Vigilance Law of 2017, a pioneering legislation that requires large French companies to implement an effective "vigilance" plan that addresses environmental, health and security, and business-related human rights risks, largely follows the UNGP in its approach toward the reporting of wrongdoing by focusing on internal reporting mechanisms. The Law requires the implementation of an "alert mechanism on the existence or the materialisation of risks, established in cooperation with trade unions considered as representative within the aforementioned company" (Brabant et al. 2017, p.10). This obligation permeates the value chains of lead firms, as the vigilance plan is supposed to cover both controlled companies and suppliers or subcontractors with whom lead firms have an established commercial relationship (Brabant et al. 2017, p. 2-3). It is also important to underscore that this obligation to establish channels of reporting as part of the vigilance plan dovetails with the provision of the recent law n 2016-1691 on transparency, fight against corruption, and modernization of economic life (called "Sapin II"), which similarly required the institutionalization of channels of reporting of wrongdoing in the fields of corruption and market abuse.
Current empirical research shows that while companies have used ethics whistleblowing systems as alert mechanisms within the meaning of the law on the duty of vigilance, 65% of alert procedures are accessible to individuals outside the company (Entreprises pour les Droits de l'Homme 2019). Following up on Principle 29 of the UNGP, this is, at first, an expansive system of accommodating reporting of wrongdoing. Yet, the mechanisms of reporting are often rudimentary: An email address where reports can be addressed has been the sole provision by companies such as Galeries Lafayette, Engie, Casino, Total, Schneider Electrics, and Orange (Forum Citoyen pour la RSE 2019).
Regardless of its pitfalls, the system advanced by the Vigilance Law understands whistleblowers as regulatory intermediaries who build trust between the regulator and the regulatory target (Abbott et al. 2017). The goal of the synergetic approach advanced by internal reporting is to build "communities of compliance" and to transform the organizational culture of private actors. An avenue to achieve such goals is the integration of various stakeholders. This is why, according to the explanatory memorandum of the draft law, a vigilance plan "must undergo a consultation between the company and its stakeholders, defined as all individuals who participate in its economic life and actors of the civil society influenced, directly or indirectly, by its activities" (Report no. 2578, Exposé des motifs de la proposition de loi 2015; Beau de Loménie & Cossart 2017, p. 2). With regard to the development of alert mechanisms, the Law directly involves trade unions, which should participate in the development of the "alert mechanism." The need to build trust with trade unions was also recognized by the UNGP, which clarify that operational-level grievance mechanisms can neither substitute stakeholder engagement or collective bargaining, nor undermine the role of legitimate trade unions in addressing labor-related disputes (Principle 29). This is meant to pre-empt the argument that protecting whistleblowing as an individual action is an attempt to compensate for the eclipse of collective forms of intervention on behalf of the workforce (Estlund 2005). Testifying to the importance of the issue, the lack of consultation or participation of trade unions in the development of reporting mechanisms has been one of the complaints in the first enforcement cases of the law (Brabant & Savourey 2020).
Another instance of transnational labor governance, the Bangladesh Accord on Fire and Building Safety of 2013 exemplified the push to go beyond reflexivity in the design and implementation of reporting mechanisms. 10 The Accord, a legally binding agreement signed between brands, retailers, and trade unions in the aftermath of the collapse of the Rana Plaza building in 2013, aspired to protect workers against dangerous working conditions. Crucial for the success of the Accord has been the Safety and Health Complaints Mechanism, which aims to ensure that workers can call out dangerous occupational safety and health conditions to Accord staff without fear of being fired or retaliated against. Besides safety and health, the Accord covered issues related to personal protective equipment, maternity leave, excessive working hours, forced overtime, sexual harassment, workplace violence, sick pay, maternity pay, and payments of any nature, which may have been impacted as a result of reprisal actions against those who have pursued a claim under safety and health (International Labor Rights Forum 2019). Complaints are followed by inspections, the results of which are made public. Suppliers are forced to comply with the Accord under the penalty of termination of business relationships with brand signatories.
The Accord was an innovative governance initiative, relying on brands, rather than the state, to enforce workers' rights (Anner 2015). As Brès et al. (2019) have pointed out, multistakeholder regulation cannot rely on the monopoly of force associated with nation-states and, therefore, it has to "devise and deploy alternative processes to ensure and control stages of adoption and of implementation." Considering its nature as a contractual agreement already involving a significant degree of self-regulation, the Accord was not primarily characterized by the aspirations of reflexive transparency, of changing, that is, the organizational culture of suppliers and forcing them to incorporate social values in their functioning. Instead, the creation of a complaint mechanism constituted a pragmatic attempt to address instances of wrongdoing that are consequential to workersin other words, it used intermediaries to ensure adoption and implementation (Abbott & Snidal 2009). The Accord was a response to a moment of disaster and as such it constitutes an instance of "supply chains ethics," integrating demands for labor rights without, nevertheless, fundamentally challenging the structure and power balances of Global Value Chains (Sum 2009;Scheper 2017). However, it could be argued that, while whistleblowing mechanisms in the Accord are instrumental, the adoption of the Accord itself was a sign of reflexivity on the behalf of lead firms. Indeed, not only is private governance dynamically employed for purposes of sustainability, but the Accord also incorporated trade unions, empowering them to collectively bring complaints against factories for unsafe workplaces or worker victimization (Donaghey & Reinecke 2018). A relevant example that received traction was that of the Ananta Apparels factory, where a workers' federation, the National Garment Workers Federation, reported structural problems at the factory, leading to inspection and, finally, suspension of production until remediation (bangladeshaccord.org, 2018). In that sense, the complaint mechanism becomes a mechanism of collective voice, highlighting the sui generis character of the Accord and its distancing from classic, top-down corporate social responsibility initiatives (Preuss et al. 2014).
Overall, recent initiatives in transnational labor governance and business and human rights indicate that whistleblowing has a role to play in the design of sustainability policies. Indeed, the provision of information by agents in proximity to its source is crucial for the achievement of regulatory goals regardless of what these may be (e.g. discovering fraud, fighting corruption, uncovering dangerous working conditions). Yet, the different ways of institutionalizing whistleblower protection and reporting channels reflect different visions of how to orchestrate policies of sustainability, with different degrees of autonomy and initiative for private actors.

Conclusions
All the cases discussed in this article point to the conclusion that whistleblowing receives protection based on the value of the exposed information for the achievement of regulatory targets. In both the United States and the European Union, these are often related to the securement of market conditions, the protection of competition, and the avoidance of fraud and corruption. However, the range of objectives for which whistleblowing is being employed has been broadening. Whistleblowing also becomes a tool to pressure corporate conduct into operational frameworks that are more respectful of human rights and environmental standards.
This article has focused on the diffusion of whistleblowing protection and the institutionalization of reporting mechanisms. This should not be taken to imply that it is easy for whistleblowers to report wrongdoing without the fear of retaliation. Legislative and institutional changes do not neatly or immediately translate into social change. Indeed, for many whistleblowers disclosing involves a significant deal of personal suffering (Vaughn 2012). 11 As whistleblowing is not institutionalized as an individual right or a facet of freedom of expression, this is particularly the case if the disclosure of wrongdoing does not align with set regulatory targets. For example, disclosures of wrongdoing in the field of national security areoften emphaticallycriminally prosecuted (Mian 2017;Kampourakis 2020b).
Indeed, whistleblowing legislation is not driven by a concern for expanding individual freedom of speech in the workplace. Rather, it constitutes a response to epistemological queries over the extent, or even the possibility, of regulation in a world increasingly shaped by decentralized private actors. Institutionalizing whistleblowing protection mechanisms reflects the recognition that efficient regulation will necessarily incorporate a multiplicity of agents, going beyond the simplistic regulator-target model. Whistleblowers become regulatory intermediaries either by helping to remedy informational asymmetries between the regulator and the target (instrumental approach) or by contributing to the development of "communities of compliance" (reflexive approach). Throughout the article, I tried to trace the different logics that animate instrumentalism and reflexivity and to indicate their broader significance beyond the case study of whistleblowing. Yet, it is important to highlight that, in both instances, the intermediation provided by whistleblowing provides an answer to the problem posed by knowledge in a complex society. This is, primarily, an answer of compromise and modesty. Intermediation, while endorsing the Hayekian premise of impossibility of comprehensive centralized knowledge, resists the corollary vision of a society where ex ante regulation consists in the bare minimum of formal rules. At the same time, intermediation is also an admission of defeat for centric, top-down approaches and ambitious projects of centralized social action. Between succumbing to the explanatory and normative power of "unknowability" on the one hand and asserting a defiant belief in human reason, calculation, and capacities for ordering on the other, intermediationin this case expressed through whistleblowingopens a third way of decentralizing governance and prioritizing proximity in the exercise of control.
Endnotes 1 For Hayek, the "unknowability" of the economy and the subsequent impossibility of planning is also conducive to individual freedom: "To be impartial means to have no answer to certain questions…In a world where everything was precisely foreseen, the state could hardly do anything and remain impartial. But where the precise effects of government policy on particular people are known, where the government aims directly at such particular effects, it cannot help knowing these effects, and therefore it cannot be impartial. It must, of necessity, take sides, impose its valuations upon people and, instead of assisting them in the advancement of their own ends, choose the ends for them" (Hayek 2001, p. 80). Instances of whistleblowing have exposed major corporate scandals and have triggered legal enforcement. For example, the Volkswagen emissions scandal ("Dieselgate") was only exposed after "an employee disclosed, in direct contravention of instructions from his management, that certain cars could detect when they were being tested in the laboratory and enter low-emissions mode" (McGee 2017). Similarly, the "institutional harassment" committed by France Télécom's restructuring process that was linked to a number of suicides was also first revealed by employees (Waters 2014). 3 The discussed here "governance solution" to regulating corporate conduct and ensuring accountability involves regulation that does not address the content of corporate action; it merely shapes the balance of power and the decisionmaking processes within the corporation. Principal avenues involve strengthening shareholder democracy and independent boards of directors. Corporate transparency is another important element (Pargendler 2016). 4 There is also a number of federal laws under the jurisdiction of the Occupational Safety and Health Administration (OSHA), which protect employees from retaliation for raising or reporting concerns about hazards or violations of various workplace safety and health laws, motor vehicle safety laws, environmental laws, and so on. Protection against retaliation is again provided as an adjunct to the principal objectives of the relevant pieces of legislation (e.g. Asbestos Hazard Emergency Response Act, Federal Railroad Safety Act Solid Waste Disposal Act). 5 A prima facie case is constructed in three steps: (a) the employee engaged in protected activity, (b) the employer was aware of the employee engaging in protected activity, (c) the employee suffered an adverse employment action, and (d) there was causal connection between the protected activity and the adverse employment action. 29 C.F.R §24.104 (2013). 6 See the examples in endnote 4.

7
The court attributed Chevron deference to the SEC's interpretation that Dodd-Frank protects internal whistleblowers. The SEC had promulgated a regulation where it defined whistleblowers as individuals who report possible securities violations not only externally to the SEC, but also internally to supervisors or managers and to governmental authorities other than the SEC (17 C.F.R. §240.21F-2(b)(1) 2011). Furthermore, according to the Court, there was an ambiguity between the definition of whistleblower on one hand, and the description of "protected conduct" on the other. Protected conduct would cover SOX-protected disclosures, that is, reports to the employer and the supervisor. The brief reference to freedom of expression in the recitals highlights how rights and regulation need not be conceived of as incommensurate logics of action, but can rather coexist and overlap (Morgan 2017). 10 The Accord, which was a time-bound initiative, is meant to be replaced by a national supply chain initiative, the RMG Sustainability Council (RSC), from June 2020.

11
The fear of retaliation is well founded, often leading to underreporting, as underlined by the European Commission. The Commission's 2016 Global Business Ethics Survey, covering more than 10,000 workers in 13 countries, showed that while 33% of the workers observed misconduct, only 59% of them reported it, with 36% of the reporters experiencing retaliation (European Commission 2018b).