Yes. I will send some examples to the committee, but in the EU directive there are sanctions against breaches of confidentiality, for example. If someone raises a concern and does it in confidence, then those guarantees are now...there are actual sanctions.
There have been cases that have happened in the U.K., for instance, and this is because the private sector is also covered, but I think these examples go across sectors. An individual had tried to find out an identity and had been individually sanctioned within an organization. The organization was sanctioned and the individual—this was at a bank—who tried to find out who it was who had raised a concern, even though it had all been dealt with properly by the whistle-blowing system, undermined the whole system in so doing. They then found themselves with their regulator, who was saying, “You can't do that, because it undermines your system, and it works, you know, until you wanting to know who it was undoes it.” That's one of the key things that has come through.
As well, in Australia, I think there is now a duty of care that they're putting on some of the organizations, so that you have to show that it's not just that you failed an individual whistle-blower. It's that you're failing by a system that clearly won't be taking these into account properly, or there isn't the training or there isn't another aspect.
There are some good examples. Again, Canada has this opportunity to actually put some teeth into its law, and I think that is so important. It isn't just about information flowing. It's about making sure it can flow.