Tech firms are using NDAs to illegally muzzle whistleblowers by threatening to sue them for talking, SEC says

Firms, including an Apple Inc. subcontractor, Electronic Arts Inc. and Block Inc. improperly used non-disclosure agreements that prohibit workers from reporting bad behavior to the SEC, according to tipster complaints viewed by Bloomberg News that were filed with the agency by law firm Kohn, Kohn & Colapinto LLP. The contracts, which ban employees from sharing confidential information with any outsider, don’t include an exception for alerting regulators. 

The claims were made as the SEC, under Gary Gensler, has stepped up enforcement of an agency rule stemming from the Dodd-Frank financial reform law. Under that rule, companies are explicitly prohibited from obstructing anyone from whistleblowing to the SEC. Enforcing the regulation is a top priority for Gurbir Grewal, the SEC’s enforcement director, according to a person familiar with his thinking who asked not to be identified discussing internal agency policy. 

A Block spokesperson said the company’s Code of Business Conduct and Ethics affords all employees protection to communicate with government agencies. That policy is different from an employment contract, which legal experts said should include carve-outs for reporting wrongdoing to regulators. An Electronic Arts spokesperson declined to comment.

SEC Whistleblowers

Set up in the wake of the 2008 financial crisis, the SEC’s whistleblower program has taken in thousands of tips, distributed over $1 billion in awards to tipsters, and become one of the agency’s favorite tools to stamp out corporate wrongdoing. The persistence of restrictive non-disclosure agreements threatens the agency’s efforts to hold companies accountable.

The agency has brought 17 enforcement actions against companies for improper non-disclosure agreements since it started enforcing against the practice in 2015. Five of those were brought since President Joe Biden took office in 2021, compared with two during former President Donald Trump’s term. Most of the cases were brought during the Obama administration.  

Former SEC Chairman and Trump-appointee Jay Clayton said in an interview he brought cases as necessary to protect the rights of whistleblowers. “Companies should know how to draft agreements that are compliant with the law,” he said. 

The contracts show a “willful disregard” for the law and SEC rules given the public statements and numerous enforcement actions the agency has brought against such agreements, Kohn, Kohn & Colapinto wrote in a January complaint, which was one of those viewed by Bloomberg. The allegations referenced employment contracts from 2022 issued by Electronic Arts, one of the world’s biggest video game publishers, known for its Star Wars and sports games, and Jack Dorsey’s Block, which operates the Square digital payments service.

Whistleblower attorneys are calling for steeper fines to put a stop to the practice, which has persisted even in the face of the renewed crackdown. They worry that such contracts, even if legally unenforceable, will discourage employees from reporting bad behavior to regulators. Gensler has lauded the whistleblower program since taking office. In August 2022, he said that it “has greatly aided the Commission’s work to protect investors.”

The SEC rule extends beyond contracts that ban employees from talking to the agency. Firms can get in trouble if they require leaving employees to forfeit their rights to get whistleblower awards, as an Atlanta firm was accused of doing by the SEC in 2016. SEC whistleblowers can get up to 30% of the fines collected from an agency enforcement action.

Thomas Le Bonniec, who worked for Apple subcontractor GlobeTech Services Ltd., said he initially struggled with coming forward with allegations about Siri’s privacy practices because of his restrictive non-disclosure agreement.  His contract threatened unspecified “monetary damages” if he shared confidential information “outside of work” — with no exceptions, according to his complaint. 

“It was scary. I thought I may end up broke for the rest of my life,” said Le Bonniec, who is represented by Kohn, Kohn & Colapinto, in an interview. 

As a dedicated Siri data analyst, Le Bonniec said he heard conversations he believed violated users’ privacy, including details about sexual preferences, bank account numbers and health problems. He said that the importance of exposing the existence of the recordings outweighed the risks of breaking his agreement, so he went public. After an outcry by consumers, Apple made changes to Siri to address privacy concerns. 

Le Bonniec said he essentially operated as an Apple employee, used a designated email address and exclusively delivered work for the company. He believes the tech giant should be held accountable for its subcontractor’s employment agreement.

After leaving his job at GlobeTech, Le Bonniec filed a previously unreported complaint with the SEC in 2020, accusing the Apple subcontractor of giving him a nondisclosure form that impeded employees from reporting wrongdoing to the agency.  

“Enforcing against these violations would send a clear message that publicly owned companies in the United States cannot use subcontractors to circumvent regulatory requirements they are bound to comply with regardless of where they operate,” according to his complaint, which accuses both Apple and GlobeTech of violating the SEC rule. 

A spokesperson for Apple declined to comment. GlobeTech didn’t return an emailed request for comment.

SEC Enforcement

Employers have been on notice over the issue since 2015 when government contractor KBR Inc. agreed, without admitting or denying the allegations, to pay a $130,000 fine. The company also changed a confidentiality statement to inform employees they weren’t required to notify the firm before reporting suspected legal violations to any governmental agency.

At least a dozen companies continued to leave out exceptions for reporting to the SEC, according to a review by Bloomberg News of confidentiality agreements issued in the past two years and found in recent filings with the agency.

“To the extent this is still happening, it’s concerning,” said Dan Berkovitz, who served as the SEC’s general counsel until January. “The SEC has issued fines against companies for restrictive confidentiality agreements that don’t provide explicit carve-outs.” 

Last year, cash-management business Brink’s Co. agreed, without admitting or denying wrongdoing, to pay a $400,000 penalty and to change its employment agreements to include a carve-out for whistleblowers to report to any government agency.

Some companies have run into trouble even when using carve-outs.

In February, video game company Activision Blizzard Inc. settled allegations that it violated the rule by using separation agreements that required employees to notify the company first before responding to information requests from administrative agencies. 

The SEC concluded in a settlement about the company’s business practices that even though most of Activision’s agreements included a separate carve-out for reporting to the regulator, the notification requirement undermined the rule. The company didn’t admit or deny wrongdoing.

“As the order recognizes, we enhanced disclosure processes with regard to workplace reporting, and updated our separation contract language,” a company spokesperson said.

As enforcement ramps up, whistleblower advocates are also pushing for tougher penalties, arguing that the current level of fines makes it an acceptable cost of doing business to violate the rule.  

“Until their fines get a little bigger, some companies are going to roll the dice,” said Mary Inman, a partner at Constantine Cannon, who represents whistleblowers. “It is a small price to pay to silence a whistleblower.”