Why foreign workers are not shielded by federal whistleblower laws

Feb 7 (Reuters) - If you work overseas for a U.S. company, you might want to think twice before you step forward to report corporate wrongdoing.

Two federal laws intended to deter corporate misconduct — the Sarbanes-Oxley Act of 2002 and the Dodd-Frank Act of 2010 — include provisions shielding whistleblowers from retaliation. If companies try to exact revenge on U.S. employees who have followed the procedures outlined in Sarbanes-Oxley and Dodd-Frank, they can be held liable for violating the laws.

But it’s a different story when employees are based overseas and work for a foreign subsidiary of a U.S. company, as the 9th U.S. Circuit Court of Appeals explained, opens new tab on Tuesday in a Canadian man’s case against software company Oracle (ORCL.N), opens new tab.

Tayo Daramola, who lives in Montreal, was hired by Oracle’s Canadian subsidiary to work as a product manager on a subscription software service for college bookstores. He came to believe that Oracle was misrepresenting the product to customers. Daramola reported his concerns both internally and to the U.S. Securities and Exchange Commission.

Oracle opened an internal investigation, but while the probe was under way, Daramola resigned. He alleged that he had no other choice after his boss cut his performance rating and revoked a transfer offer. (Oracle has said its internal investigation ultimately concluded that Daramola’s fraud allegations were baseless.)

Daramola sued Oracle, Oracle Canada and several individual defendants in federal court in San Francisco, where Oracle is based. His lawyer, Mary Schultz of Mary Schultz Law, claimed violations of both Sarbanes-Oxley and Dodd-Frank whistleblower provisions.

Neither law specifically addresses whether the shield for whistleblowers extends beyond the U.S. But Daramola argued that he effectively worked for the U.S. parent company, even though he was hired by Oracle Canada, worked exclusively from his home in Montreal and submitted his resignation letter to human resources officials in the company’s Canadian subsidiary.

Among other ties binding him to the U.S. parent company, Daramola cited the company’s requirement that he, like all Oracle employees, conduct his work through Oracle’s main server, which is located in California. Even though Daramola worked remotely, he argued, opens new tab, every action he took as an Oracle employee went through that California server.

There’s no question that Daramola was facing long odds. As Oracle’s lawyers from Morgan, Lewis & Bockius pointed out in their brief, opens new tab to the 9th Circuit, several trial and appellate courts — including the trial judge in Daramola's case — have already ruled that Sarbanes-Oxley and Dodd-Frank do not apply beyond U.S. borders.

The 2nd Circuit issued a landmark ruling, opens new tab on Dodd-Frank’s territorial limits in 2014, holding that the law’s whistleblower protections did not extend to a Taiwanese employee of Siemens’ Chinese subsidiary, even though the employee reported bribery allegations to the SEC. “The plain text of the statute contains no hint that the antiretaliation provision is meant to apply extraterritorially,” the appeals court said.

The D.C. Circuit was equally definitive about Sarbanes-Oxley in a 2022 ruling, opens new tab. In that case, a Morgan Stanley (MS.N), opens new tab employee who worked at the bank’s Tokyo and Hong Kong subsidiaries claimed he was forced to resign after lodging internal complaints about alleged securities law violations. The appeals court, after exhaustive analysis of the text and history of the statute, said “nothing” in Sarbanes-Oxley “indicates that the specified protections for employees against retaliation in fraud cases are meant to apply extraterritorially.”

So Daramola’s only realistic hope, in light of the unanimous precedent on the limited reach of the whistleblower protection laws, was to show that he was, in effect, a U.S. employee. As the 9th Circuit explained the test in Tuesday’s opinion, if the purpose of the two laws is to prohibit employers from retaliating against whistleblowers, employees “must demonstrate that the locus of [their] employment relationship was ‘in United States territory.’”

Daramola fell short, according to the 9th Circuit. It’s true, said Judges Sidney Thomas, Morgan Christen and Daniel Bress in a per curiam opinion, that his employment involved “a mix of domestic and foreign conduct, as is often the case when a foreign employee does work with a U.S. parent.” But the “locus” of his work, the 9th Circuit said, was Canada.

“Any domestic duties he performed were incidental to his foreign employment,” the court said.

The 9th Circuit rejected Daramola’s argument that logging into Oracle’s California server every day made him a U.S. employee.

If that were true, the court said, the ubiquity of computer connections into and out of the U.S. “would effectively negate the presumption against extraterritoriality” in Dodd-Frank and Sarbanes-Oxley.

Oracle counsel Sarah Bouchard of Morgan Lewis didn’t respond to my query.

Daramola’s lawyer, Mary Schwartz, said via email that the decision failed to grapple with the new realities of remote work.

“Remote workers who are explicitly protecting United States customers must be given the protection of United States law in doing so,” Schwartz said. Sarbanes-Oxley, she said, depends on workers like Daramola to speak up when they believe corporations are fleecing U.S. customers or investors. For the law to be effective, she said, those employees must be protected.