Opinion
19-2897
11-04-2019
THOMAS REILLY, Appellant v. GLAXOSMITHKLINE LLC
Scott M. Pollins Pollins Law Attorney for Appellant Thomas Reilly
On Appeal from the United States District Court For the Eastern District of Pennsylvania (E.D.Pa. No. 17-CV-2045) District Judge: Honorable J. Curtis Joyner
BRIEF AND JOINT APPENDIX FOR APPELLANT VOLUME I OF III (pgs. JA1 to JA37)
Scott M. Pollins Pollins Law Attorney for Appellant Thomas Reilly
TABLE OF CONTENTS FOR APPELLANT'S BRIEF
STATEMENT OF JURISDICTION.............1
STATEMENT OF ISSUES PRESENTED FOR APPELLATE REVIEW ... 2
LAR 28.1 STATEMENT OF RELATED CASES AND PROCEEDINGS ... 2
CONCISE STATEMENT OF THE CASE .................3
SUMMARY OF ARGUMENT ..........5
ARGUMENT ............6
A. STANDARD OF REVIEW ...........6
B. RECORD FACTS IN LIGHT MOST FAVORABLE TO REILLY .........6
1. Reilly makes a SOX-protected complaint .........7
2. Reilly makes another SOX-protected complaint ..........8
3. Reilly's warnings about uncapping processors go unheeded .... 8
4. GSK users complain about major business disruptions ..........9
5. Reilly makes another SOX-protected complaint..............10
6. GSK continues to ostracize Reilly and label him as not a team player ............11
7. GSK excludes Reilly from discussions about outsourcing his department ..........11
8. Reilly makes more SOX-protected complaints ...........12
9. GSK discourages Reilly from applying for open position ...........13
10.Reilly's SOX-protected complaint to GSK Global Compliance ..........13
11. After Global Compliance substantiated Reilly's complaints about computer security and stability, he makes a SOX-protected complaint to GSK's CEO............14
12. GSK fails to inform its shareholders about Reilly's complaints and then terminates Reilly ...........17
C. ISSUES OF MATERIAL FACT EXIST REGARDING WHETHER REILLY MADE SOX-PROTECTED COMPLAINTS...........18
D. ISSUES OF MATERIAL FACT EXIST REGARDING WHETHER REILLY'S SOX-PROTECTED ACTIVITY CONTRIBUTED TO GSK TERMINATING HIS EMPLOYMENT............23
CONCLUSION..........29
TABLE OF AUTHORITIES
Cases Page
Araujo v. New Jersey Transit Rail Operations, Inc., 708 F.3d 152 (3rd Cir. 2013) ...........24-26
Benjamin v. Citationshares Management LLC, ARB Case No. 12-029, 2013 WL 6385831 (DOL Nov. 5, 2013) ...........21-22`
Blunt v. Lower Merion Scho. Dist., 767 F.3d 247 (3rd Cir. 2014) ..............6
EEOC v. Allstate Ins. Co., 778 F.3d 444 (3rd Cir. 2016) ..............6
Hana Financial, Inc. v. Hana Bank, 135 S.Ct. 907 (2015)........23
In re Harman Int'l Indus., Inc. Securities Litigation, No. 14-7017, 2015 WL 3852089 (D.C. Cir. June 23, 2015)...........19-20
Kewley v. Dep't of Health &Human Servs., 153 F.3d 1357 (Fed. Cir. 1998) 26-27
Klopfenstein v. PCCFlow Techs. Holdings, Inc., ARB Case No. 04-149, 2006 WL 3246904 (DOL May 31, 2006)........24
Marano v. Dept, of Justice, 2 F.3d 1137 (Fed. Cir. 1993) ...........24-25
Matrixx Initiative, Inc. v. Siracusano, 131 S.Ct. 1309 (2011) ..............19
Pa. Coal Ass'n v. Babbitt, 63 F.3d 231 (3rd Cir. 1995) .............6
Powers v. Union Pacific Railroad Company, ARB Case No. 13-034, (DOL March 20, 2015) ...............24-27
Prioleau v. Sikorsky Aircraft Corp., ARB Case No. 10-060 (ARB Nov. 9,2011) ...............20-21
Rhinehimer v. U.S. Bancorp Investments, Inc., 787 F.3d 797 (6th Cir. 2015) 22
Rudolph v. National Railroad Passenger Corporation (Amtrak), ARB Case No. 11-037 (DOL March 29, 2013).............25
Singleton v. Wulff, 428 U.S. 106 (1976) ..........23
Sylvester v. Parexel, ARB No. 07-123, ALJ Nos. 2007-SOX-039, -042, 2011 WL 2517148 (May 25, 2011) ............21-22
Thomas v. Tyco Int'l Mgmt. Co., LLC, 262 F.Supp.3d 1328 (S.D.Fla. 2017) 20
Walker v. Am. Airlines, Inc., ARB No. 05-028, ALJ No. 2003-AIR-017, (ARB Mar. 30, 2007) ...................24
Wiest v. Lynch, 710 F.3d, 121 (3rd Cir. 2013)................................ 18, 21-22
Wiest v. Lynch, 15 F.Supp.3d 543 (E.D. Pa. 2014) ..............24
Zinn v. Am. Commercial Lines Inc., ARB Case No. 10-029, 2012 WL 1143309 (DOL March 28, 2012)..................24
Statutes
15 U.S.C. § 7213 ...........20
18 U.S.C. §1514A .............1, 22.
28 U.S.C. § 1291 ................1
28 U.S.C. § 1331............1
Regulations
29 C.F.R. § 1980.104 ..........26
Rules
LAR 28.1 ............2
STATEMENT OF JURISDICTION
The United States District Court for the Eastern District of Pennsylvania exercised original subject matter jurisdiction over this case pursuant to 28 U.S.C. § 1331 and 18 U.S.C. § 1514A, Sarbanes-Oxley Act of 2002, as amended (SOX).
The District Court granted Defendant, GlaxoSmithKline, LLC's (GSK), motion for summary judgment. Plaintiff-Appellant, Thomas Reilly (Reilly), is appealing because there are issues of material fact regarding whether his repeated internal complaints were SOX-protected and whether his complaints were a contributing factor in GSK's decision to terminate him.
The United States Court of Appeals for the Third Circuit may properly exercise jurisdiction over Reilly's appeal based on 28 U.S.C. § 1291 (final decisions of District Courts). The Order entered by the District Court on July 18, 2019 granted summary judgment to GSK on all of Reilly's claims; therefore the Order is considered "final" for purposes of 28 U.S.C. § 1291. Reilly's appeal is timely because he filed his Notice of Appeal on August 15, 2019, which is within 30 days of the District Court's July 18 Order.
STATEMENT OF ISSUES PRESENTED FOR APPELLATE REVIEW
1. Did the District Court err in granting summary judgment to GSK by finding that there was no issue of material fact for a jury to decide regarding whether any of Reilly's complaints about GSK's global manufacturing and financial computer systems' compromised security, lack of effective internal controls and server instability issues were SOX-protected?
Suggested Answer: Yes.
2. Did the District Court err in failing to analyze and then conclude that there are issues of material fact about whether there is an inference that any of Reilly's SOX-protected complaints were a contributing factor in GSK terminating his employment?
Suggested Answer: Yes.
LAR 28.1 STATEMENT OF RELATED CASES AND PROCEEDINGS
There are no related cases or proceedings.
CONCISE STATEMENT OF THE CASE
Reilly worked for GSK for 16 years as their IBM AS-400 computer server subject matter expert. During Reilly's employment, GSK ran most of its multibillion-dollar pharmaceutical manufacturing operations and financial reporting through the computer systems Reilly was in charge of keeping secure and functional. Starting in about early 2012, Reilly began making complaints about numerous serious and potentially debilitating computer security, stability and internal control issues. Over the next three years, Reilly complained up the chain of command in his department and to GSK's Global Compliance, GSK's internal 'Speak Up' hotline, human resources and eventually to GSK's CEO and Chairman of the Board.
As Reilly continued to complain about issues he reasonably believed compromised GSK's manufacturing operations and financial reporting and should be disclosed to GSK's shareholders, he became more and more ostracized within his department as well as the company. Several years after Reilly first complained, GSK announced that it was partially outsourcing Reilly's department. GSK led Reilly to believe his job could be saved based on the legitimacy of his complaints. After telling Reilly his complaint to the CEO was unfounded, GSK finally and unequivocally terminated him.
Reilly sued GSK in the USDC-EDPa in May 2017 for terminating his employment in retaliation for his SOX-protected whistleblower complaints and for creating a SOX-based hostile work environment. The parties engaged in a massive course of discovery, including exchanging about 100,000 documents and conducting depositions in the U.S. and U.K. GSK filed a motion for summary judgment earlier this year. On July 18, 2019, the District Court granted GSK's motion. Reilly is appealing because there are issues of material fact a jury should be allowed to decide about whether his complaints were SOX-protected and whether his complaints contributed to GSK terminating him.
SUMMARY OF ARGUMENT
The District Court dismissed Reilly's SOX whistleblower retaliation case against GSK because it determined there was no issue of material fact that any of of Reilly's repeated complaints about the security and stability of GSK's business-critical computer information systems were SOX-protected. The District Court did not address the possibility that if any of Reilly's complaints were SOX-protected whether any of those complaints contributed to GSK's termination of his employment.
The District Court wrongly took a rigid view of what SOX-protected complaints are. The District Court also inappropriately weighed the credibility of what GSK's witnesses said versus what Reilly said and wrote in emails and determined that GSK's witnesses were more believable than Reilly. The Third Circuit should reverse the District Court's decision and send Reilly's SOX whistleblower retaliation case back to the District Court so that a jury can assess the weight and sufficiency of Reilly's evidence that GSK violated SOX.
ARGUMENT
A. STANDARD OF REVIEW
Exercising plenary review over the District Court's summary judgment, we will affirm only if, viewing "the underlying facts and all reasonable inferences therefrom in the light most favorable to the party opposing the motion," we conclude that a reasonable jury could not rule for the nonmoving party. Blunt v. Lower Merion Sch. Dist., 767 F.3d 247, 265 (3rdCir.2014) (quoting Pa. Coal Ass'n v. Babbitt, 63 F.3d 231, 236 (3rdCir.1995)).EEOC v. Allstate Ins. Co., 778 F.3d 444, 448 (3rd Cir. 2016).
B. RECORD FACTS IN LIGHT MOST FAVORABLE TO REILLY
Reilly started working at GSK in 1999 as an AS/400 Analyst. JA-386. The AS/400 is an IBM-manufactured computer system that GSK uses and used for its financial processing and manufacturing. JA-140.
Reilly's job responsibilities intersected with GSK's SOX-compliance and internal audit efforts. As far back as November 2005, GSK's Global Internal Audit requested Reilly's assistance with a Sarbanes readiness review. JA-456-58. Sarbanes means SOX. JA-465. At that time, Global Internal Audit needed Reilly's help assessing key SOX risk areas including gaps in assurance testing for policy compliance, inappropriate user access to GSK computer server resources and unauthorized access privileges assigned to users. JA-456-57.
From early 2012 through 2015, Reilly reported to Jo Taylor (Taylor). JA- 392. Taylor worked in the UK while Reilly worked in the United States. JA-153.
1. Reilly makes a SOX-protected complaint.
On April 18, 2012, Reilly emailed Taylor to alert her to concerns he had following a Sarbanes-Oxley (Sarbox) audit discussion the day before. JA-484-85.
Reilly explained in his deposition why he emailed Taylor:
A ... The system had to be Sarb-Ox compliant. One of the controls was to have security reports. There were a lot of internal controls. And in order to be -
Q But-
A - Sarb-Ox compliant, we had Sarb-Ox audits every once in a while, and we had to have security reports so the Access Management people could see what was happening so that if we had an internal or an external audit they'd be ready.
JA-393. Reilly said in his email to Taylor that the GSK computer servers that hosted business critical production data did not have monitoring of security reports and Reilly believed that auditors would take exception to this. JA484. One of the servers Reilly mentioned in his email was the Enterprise One Financial (El) server.
EnterpriseOne is an integrated system chosen by GSK for use for order management and financial services in the US. ... The Revenue Cycle application processes approximately $100 million dollars in customer orders a day. The inability to continue operations would result in the loss of a significant business function.JA-539.
2. Reilly makes another SOX-protected complaint
In January 2013, Reilly alerted Taylor to computer server performance problems including memory faulting, disk arm utilization and end user response time. JA-487-90. Taylor instructed Reilly to conceal his concerns under the guise of his concerns being unrelated to an upcoming audit.
Hi Tom
Understand but let's keep the focus and scope tight on the audit. We do not want PWC picking up any insights that are not part of the current scope
Do not mention this to [G]raciela. If she does just politely request that its discussed on another day.
JA-487. PwC is PricewaterhouseCoopers, GSK's external auditor, and these emails were about a physical security and data integrity audit. JA-479-80.
3. Reilly's warnings about uncapping processors go unheeded.
Previously in 2011, Reilly's co-worker, Rick Oberholtzer, enabled uncapped processors on GSK's El server. JA-395. Reilly strongly recommended against doing this. JA-395. In addition to being responsible for $100Million per day in revenue and supporting 90% of GSK's North America orders, El ran in conjunction with GSK servers that did financial reporting. JA-396-97. As a result of the processors being uncapped, orders from large GSK clients like Wal-Mart were being lost and GSK users around the world had their workstations lock up. JA-402-03. This chaotic state went on for weeks until an emergency hardware upgrade was implemented. JA-404.
Taylor testified in her deposition that IBM did not make a recommendation one way or the other about capping or uncapping the processors. JA-160. However, Taylor was wrong because previously in March 2013 an IBM representative emailed Taylor and Reilly and said that he would not have suggested uncapping the processors. JA-496. After receiving IBM's email, Taylor decided that uncapped processors would be turned off across GSK's computer fleet. JA-500.
4. GSK users complain about major business disruptions.
Even after Taylor finally heeded Reilly's warnings about uncapping computer processors, GSK users were complaining about significant business delays.
Taking more than 1 HOUR time release the *OUTQ. Since morning we are facing this issue, because of this issue we could not release the Local trucks in time, we are paying truck detention charges for halting trucks.
JA-512.
All Southern warehouse are facing severe issue in invoice generation. It is taking almost 2-3 hours to generate a single invoice , (emphasis in original)
JA-511.
System taking too much time to process jobs and jobs are getting piled up in job queues.....Sales invoicing process which used to take cycle time of around 10-15 minutes now take more than 60 minutes which is not acceptable by business. Business is suffering due to this, (emphasis in original)
JA-510.
Taylor responded to these GSK internal customer concerns by saying
UnCapped Processing is not recommended by IBM [she denied this in her deposition] for the AS400s and we are working to resolve other Capacity and Performance issues that having this turned on has caused us.
............
I understand that this is causing some business delays but please be assured we are working on this as quickly as possible.
JA-506.
5. Reilly makes another SOX-protected complaint.
As the computer stability and security issues continued to spiral out of control, Reilly emailed Taylor in advance of a conference call to remind her he has been complaining on deaf ears about these business disruption issues for well over a year.
... I was clear in the previous thread as to the criticality of the situation but haven't heard back from you in advance on the meeting and have seen no response to Joao. I've been warning for the past 16 months that the entire US/UK fleet are unpredictable because of Uncapped Processors... I communicated the same warnings and predications about EnterpriseOne production but they were also disregarded and the business suffered. The lights are and have been flashing red so someone with authority and ability to align resources needs to step up and act , (emphasis added)
JA-516-17.
By this point, Taylor was angry with Reilly and his repeated complaints and told him "I'm well aware of the situation, history and impact and don't need to be reminded yet again!" JA-516.
6. GSK continues to ostracize Reilly and label him as not a team player.
By late 2013, Reilly had been complaining to GSK for years about computer security and stability issues severely impacting GSK's day to day business activities. As a whistleblower in a large corporation, Reilly felt isolated and picked on. He emailed Taylor as follows.
It was humiliating being verbally threatened by you in my last 1/1, being scolded after taking an unacceptable extended lunch break for a doctor appointment (after I'd come to work extremely sick for days trying to work through it), having you express your disappointment in my security analysis/recommendations in front of Steve then seeing that same work forwarded to senior management unchanged as your own, having you YELL at me in OCS then pasting the same OCS conversation in an email copying Rick. You regularly send emails pointing unacceptable work/behavior on my part, usually involving relative minutia.
JA-547. By 2014, Taylor did not consider Reilly a team player. JA-156.
7. GSK excludes Reilly from discussions about outsourcing his department.
By January 2014, Taylor had been working on outsourcing her department for more than six months but had not involved Reilly at all in the process. JA-555 where Reilly says that the "the REP process has been going on now for more than a half year but I've not been approached on even a single occasion and asked to contribute."
Taylor wanted Reilly out of the outsourcing discussions because he might reveal that performance is bad and security is a disaster. JA-424. What would normally happen is that the technical subject expert would be retained to oversee the outsourced service. JA-425. However, instead of GSK retaining Reilly as the technical expert to oversee the outsourced service, Taylor was ultimately retained even though she had never even signed onto an AS/400. JA-425.
8. Reilly makes more SOX-protected complaints.
Shortly after Henry Bolton (Bolton) transitioned into Taylor's role after she began an adoption leave of absence, Reilly emailed Bolton to alert him about the computer security and stability issues he had been complaining about for the past several years.
From a performance standpoint, I've been warning in no uncertain terms that the lights are and have been flashing red on many of the production servers, some of which are completely CPU and I/O unstable and have experienced serious disruptions. From a security standpoint, the platform is a train wreck and nowhere near compliant so auditors would have kittens if they became aware of the detail.
JA-570. A few months later, Reilly again warned Bolton that he's "been on record in no uncertain terms since Jo took over the service that the U.S. AS400 fleet is I/O unstable but all of my warnings and recommendations were disregarded and the problems and tickets were instead covered up." JA-574.
9. GSK discourages Reilly from applying for open position.
After a town hall meeting about the outsourcing of Reilly's department during which his co-worker Daniel Mong (Mong) was outspoken against the outsourcing, Vice President Steven Miller (Miller) spoke with Mong and asked him to get involved in the outsourcing process. JA-422.
They decided instead of outsourcing everybody but Taylor they were going to keep one person. Once Miller came up and recruited him [Mong], indoctrinated him, created a position that would be retained and everybody knew he would get it, gave him some other lucrative jobs of being like the liaison to the leadership team, he was way on board. Dan went from being vocally outspoken, and I mean that, outspoken at a town hall meeting to being completely on board.
JA-423. Reilly and his co-workers were allowed to apply for the open position even though everyone knew Mong would get the position. JA-427. Taylor discouraged Reilly from applying for the position. JA-427. Bolton later allowed Reilly to apply with the warning that if he did not get the position he was agreeing to be terminated. JA-428.
10. Reilly's SOX-protected complaint to GSK Global Compliance.
In early 2014, Reilly complained to GSK's Global Compliance. JA-428-29. Reilly complained about extremely serious problems with the global manufacturing and enterprise financial systems that were impacting GSK around the world. JA-433. Global Compliance told Reilly that based on what he had shown them GSK could not wrongfully terminate him for making serious allegations and Global Compliance would protect him. JA-429-30. Global Compliance also told Reilly that his allegations were getting attention at the highest levels of GSK, including CEO Andrew Witty, and that his complaints could impact share value if it were found out that GSK was withholding information from PwC. JA-432.
Reilly was running on two parallel tracks - one track where GSK's Global Compliance was telling him that his employment was protected and they were investigating his serious complaints and another track where his department was telling him his job was going to be eliminated. JA-434. Global Compliance instructed Reilly not to share his complaints with anyone, internally at GSK or externally. JA-442. Reilly understood this to mean he could not report his allegations to a government agency. JA-442.
11. After Global Compliance substantiated Reilly's complaints about computer security and stability, he makes a SOX-protected complaint to GSK's CEO.
Global Compliance's investigation report concluded that several of Reilly's complaints regarding access management and privileges and configuration and performance issues were legitimate and warranted further review and potential remediation. JA-777-78.
Thereafter, Reilly emailed a lengthy complaint to GSK's CEO. JA-591-99. Reilly said the following to the CEO in his email.
I'm contacting you directly in a final effort to raise awareness to serious problems regarding a GSK computer system I designed, delivered and support which hosts a good portion of our global drug manufacturing and enterprise financial applications. I've been attempting for the past 3+ years to raise awareness to these issues via management and internal reporting channels but have been met with stonewalling, professional and financial retribution, hostility, threats, harassment and character assassination. The computer instability, security, quality and noncompliance issues I've raised are irrefutable and have been acknowledged by many as fact so are not in dispute but my personal integrity and character has instead been attacked as a way to deflect attention away from the fact that people in positions of responsibility authority with the ability to address them have chosen to do nothing and these issues are being ignored.
............
Senior IT management in a position to act on these issues have been made fully aware but have done nothing and the auditors and PwC would have a field day with GSK if aware of how bad it was.
JA-591.
Although a number of factors contributed to the Cidra debacle, the manufacturing process is highly automated so the computer infrastructure neglect I warned of back then had a huge negative impact on the computer-dependent BPCS manufacturing process which in turn contributed to the breakdown of drug manufacturing process and quality control.
...................
The Cidra plant was able to reopen but the damage had been done so the plant eventually shut down permanently and the company received one of the largest fines ever leveled against a pharmaceutical company. GlaxoSmithKline suffered both financially and from a public relations standpoint, the stock price and retirement savings of me and all employees was severely impacted.
JA-592.
As a direct result of the 2010 $750m Cidra settlement as well as the 2012 $3b Fraud, Safety and Unlawful Promotion Settlement, GSK has a 5 year Corporate Integrity Agreement in place with the Department of Justice and The Department of Health and Human Services which specifically requires we honor our published Code of Conduct and the Policy and Procedure contained within it. Many of the quality, security, data integrity, compliance, risk management and misconduct issues I've raised are in violation of Policy and Procedure contained within our Code of Conduct which the CIA mandates the company be compliant with. This is a huge exposure to the company because the government is the largest single buyer of pharmaceutical drugs so falsely claiming to be computer GMP, Quality, Security, Risk Management, Sarbanes-Oxley, CFR21 Part 11, etc compliant could constitute Medicare and Medicaid fraud against the government per the U.S. False Claims Act. I was told by someone in global compliance that falsely claiming compliance to auditors and shareholders by withholding and/or misrepresenting policy non compliance and risk could potentially impact company share price and financial status if independent oversight organizations like PWC were found to have signed off on the company books based on false or misleading information.
..............
I also took time to review the 2013 Annual Report which makes no reference to any of these serious performance, security, quality, compliance issues, risk management or corporate responsibility deficiencies so I suspect that the internal reporting channels have not made the people who sign off on the annual report aware of these issues which also puts them at risk.
JA-593.
The treatment I've received is similar to that of Cheryl Eckard who reported problems in Cidra after reaching out unsuccessfully to the top of the company. She attempted as I have done to raise awareness that all systems are broken and the lights are flashing red. Like me, her concerns were ignored, she was threatened and her job was labeled redundant in an unsuccessful effort to silence her even though she was also eventually found to be right.
JA-595.
It's incomprehensible that reports of serious issues regarding the same computer platform which resulted in Cidra debacle resulted in not a single follow up question by the investigating global compliance officer.
As a loyal employee and single parent, I have a profound sense of unfairness as to what's happened to me both professionally and personally.
JA-598.
Several days after Reilly complained to the CEO, GSK placed him on administrative leave with instructions that "[w]e will get back to you following the outcome of the investigation regarding your employment status." JA-604.
12. GSK fails to inform its shareholders about Reilly's complaints and then terminates Reilly.
Reilly reviewed GSK's 20-F submitted to the U.S. Securities and Exchange Commission (SEC) in February 2015. JA-121-22, 610-64. GSK failed to disclose that their manufacturing systems are obsolete and unstable, the security of both their manufacturing and financial reporting systems is in ruins, a financial reporting server was built without change management and security and their internal controls have been compromised and are not effective. JA-122.
On April 8, 2015, GSK informed Reilly that its investigation into Reilly's complaints to the CEO were complete and the official notification of his employment separation was effective immediately. JA-607.
C. ISSUES OF MATERIAL FACT EXIST REGARDING WHETHER REILLY MADE SOX-PROTECTED COMPLAINTS.
To establish a prima facie case for a Section 806 claim, the employee must allege that he or she (1) "engaged in a protected activity;" (2) "[t]he respondent knew or suspected that the employee engaged in the protected activity;" (3) "[t]he employee suffered an adverse action;" and (4) "[t]he circumstances were sufficient to raise the inference that the protected activity was a contributing factor in the adverse action." 29 C.F.R. § 1980.104(e)(2)(i)-(iv).Wiest v. Lynch, 710 F.3d, 121, 129 (3rd Cir. 2013). The District Court found that none of Reilly's complaints were the 'protected activity' SOX was meant to protect. Specifically, the District Court found that Reilly could not have reasonably believed that the conduct he was complaining of violated SOX because GSK disclosed hypothetical risks even though it knew those risks were actual and not hypothetical. The District Court referenced GSK's 2013 and 2014 20-F's filed with the SEC. Each of the four examples the District Court cited support that Reilly was making repeated complaints that GSK was failing to disclose actual instead of hypothetical risks.
1. GSK disclosed the risk to business activity if (instead of because) critical or sensitive information systems or information are not available when needed or are accessed by those not authorized. JA-34.
2. GSK reported the risk to their business posed by failure to adequately protect critical and sensitive systems and information which could (instead of were) materially and adversely affect financial results. JA-34-35.
3. GSK identified the potential (instead of reality) that malicious and careless actions expose the company's computer systems or information to misuse or unauthorized disclosure. JA-35.
4. GSK identified the risk (instead of actuality) that the company was failing to comply with Good Manufacturing Practice requirements through inadequate controls. JA-35.
Had GSK been honest in its reports to the SEC, shareholders would have been alerted to the serious issues Reilly had been complaining about and could have decided whether GSK stock was a worthwhile investment and whether GSK executives should be held accountable to take action based on Reilly's complaints and not hide behind disclosure of hypothetical risks they knew were actual problems.
Many large corporations like GSK disclose generalized security risks in their public filings. If they do so while failing to disclose known actual risks, the omission can give rise to a shareholder fraud action. See Matrixx Initiative, Inc. v. Siracusano, 131 S.Ct. 1309 (2011). Although the law provides a safe harbor for such forward looking statements, if misleading statements or omissions of fact are included in forward looking statements the corporation will not be insulated. E.g, In re Harman Int'l Indus., Inc. Securities Litigation, No. 14-7017, 2015 WL 3852089 (D.C. Cir. June 23, 2015). In other words, a "warning that identifies a potential risk, but' implies] that no such problems were on the horizon even if a precipice was in sight,' would not meet the statutory standard for safe harbor protection." Id. at *9 (internal citations omitted). Section 404 of SOX requires a corporation to assess the effectiveness of its internal controls in its annual reports, and an outside auditing firm must evaluate that assessment. Material weaknesses in those internal controls must be identified. See, e.g., 15 U.S.C. § 7213(a)(2)(A)(iii)(III).
Reilly's complaints about GSK's computer instability and security and breakdown of internal controls are SOX-protected. Disclosures about deficient information security controls are protected under SOX. Thomas v. Tyco Int'l Mgmt. Co., LLC, 262 F.Supp.3d 1328 (S.D.Fla. 2017).
Data security, approvals, and segregation of duties are controls that exist to ensure the accuracy of financial reporting. See Commission Guidance Regarding Management's Report on Internal Control Over Financial Reporting Under Section 13(a) or 15(d) of the Securities Exchange Act of 1934, Release Nos. 33-8810; 34-55929; FR-77; File No. S7-24-06, 72 Fed.Reg. 35,343 n.27 (June 27, 2007) ("Controls have unique characteristics, for example, they can be: Automated or manual; reconciliations; segregation of duties; review and approval authorizations; safeguarding and accountability of assets; preventing or detecting error or fraud."). An employee's complaint concerning inadequate internal control over financial reporting can constitute protected activity.Thomas, 262 F.Supp.3d at 1337.
Disclosures can be protected even if they do not mention fraud, illegal activity, or anything that could reasonably be perceived to be a violation of the six enumerated categories in SOX. Prioleau v. Sikorsky Aircraft Corp., ARB Case No. 10-060 (ARB Nov. 9, 2011). In Prioleau, the whistleblower disclosed information security concerns. Id. However, at the time of the disclosure, the whistleblower made no mention of SOX or any of the enumerated categories. Id. Rather, the whistleblower reported his concern that two company policies were in conflict regarding a program that automatically deleted e-mails. Id. The Administrative Review Board reversed an administrative law judge's decision that the whistleblower failed to engage in protected activity. Id. The board held the disclosures could be protected based on evidence the whistleblower introduced during litigation, which indicated he was aware his disclosures were related to SOX compliance and that his belief was objectively reasonable. Id.
A protected report includes a communication about a violation that has not yet occurred "as long as the employee reasonably believes that the violation is likely to happen." Wiest, 710 F.3d at 133. "A whistleblower complaint concerning a violation about to be committed is protected as long as the employee believes that the violation is likely to happen. Such a belief must be grounded in facts known to the employee, but the employee need not wait until a law has actually been broken to safely register his or her concern." Sylvester v. Parexel, ARB Case No. 07-123, 2011 WL 2165854, at *13 (DOL, May 25, 2011).
An employee's report is also protected when the employer ultimately agrees with the employee even though the law is never violated. Benjamin v. Citationshares Management LLC, ARB Case No. 12-029, 2013 WL 6385831 (DOL Nov. 5, 2013). "The fact that management agrees with the employee's assessment and communication of a safety concern does not alter the status of the communication as protected activity under the Act, but rather is evidence that the employee's disclosure was objectively reasonable." Id.
The issue of whether a SOX whistleblower's complaint is objective reasonableness should be decided by a court only in limited circumstances. "If. .. 'reasonable minds could disagree about whether the employee's belief was objectively reasonable, the issue cannot be decided as a matter of law.'" Rhinehimer v. U.S. Bancorp Investments, Inc., 787 F.3d 797, 811-12 (6th Cir. 2015). The Department of Labor's Administrative Review Board's (ARB's) interpretation of 18 U.S.C. § 1514A(a) is expressed in Sylvester, 2011 WL 2165854 at *15 ("[T]he objective component is evaluated based on the knowledge available to a reasonable person in the same factual circumstances with the same training and experience as the aggrieved employee." [Internal quote and citation omitted]). The ARB's interpretation of the statute is entitled to a degree of deference. Wiest, 710 F.3d at 132.
[T]he issue is not whether the contemplated accounting treatment was or was not part of a scheme to defraud. The issue is whether such accounting treatment could reasonably be believed by Wiest to be fraudulent. Given the [firm's past] scandal, a jury could find that Wiest reasonably believed that the sins of [the past] were being repeated.Wiest, 710 F.3d at 135, n.5.
In Hana Financial, Inc. v. Hana Bank, 135 S.Ct. 907 (2015), the Supreme Court emphasized that juries are best equipped to resolve disputes about what reasonable persons would do or perceive. The determination of objective reasonableness under § 1514A does not turn on whether GSK was in fact violating some relevant federal prohibition, a determination that could involve assessment of a voluminous record and resolution of complex disputes of law. The issue, rather, is what "impression" the facts known to Reilly would have had on a reasonable person. That is "not 'one of those things judges often do' better than jurors." 135 S.Ct. at912n.2.
D. ISSUES OF MATERIAL FACT EXIST REGARDING WHETHER REILLY'S SOX-PROTECTED ACTIVITY CONTRIBUTED TO GSK TERMINATING HIS EMPLOYMENT.
Although the District Court did not address whether Reilly's SOX-protected complaints contributed to GSK terminating his employment, this Court may determine that there is an issue of material fact about this and remand Reilly's case to the District Court for a jury trial. Both parties fully briefed this issue before the District Court. "The matter of what questions may be taken up and resolved for the first time on appeal is one left primarily to the discretion of the courts of appeals, to be exercised on the facts of individual cases." Singleton v. Wulff, 428 U.S. 106, 121 (1976).
The causation standard under SOX is "broad and forgiving"; it is "significantly more lenient than other causal standards." Wiest v. Lynch, 15 F.Supp.3d 543, 562 (E.D. Pa. 2014). In a SOX case, an employee is required to show only that his protected complaints were a contributing factor to the adverse action. "A contributing factor is any factor, which alone or in combination with other factors, tends to affect in any way the outcome of the decision." Id. (quoting Klopfenstein v. PCC Flow Techs. Holdings, Inc., ARB Case No. 04-149, 2006 WL 3246904 at * 13 (DOL May 31, 2006). All a plaintiff needs to do at the prima facie stage is establish "an inference of causation." Zinn v. Am. Commercial Lines Inc., ARB Case No. 10-029, 2012 WL 1143309 at *6 (DOL March 28, 2012).
The "contributing factor" standard was employed to remove any requirement on a whistleblower to prove that protected activity was a "'significant', 'motivating', 'substantial', or 'predominant' factor in a personnel action in order to overturn that action." [Araujo v. New Jersey Transit Rail Operations, Inc., 708 F.3d 152, 158 (3rd Cir. 2013)] (quoting Marano v. Dept, of Justice, 2 F.3d 1137, 1140 (Fed. Cir. 1993)). Consequently, "[a] complainant need not show that protected activity was the only or most significant reason for the unfavorable personnel action, but rather may prevail by showing that the respondent's reason, while true, is only one of the reasons for its conduct, and another [contributing] factor is the complainant's protected' activity." Hutton, ARB No. 11-091, slip op. at 8 (quoting Walker v. Am. Airlines, Inc., ARB No. 05-028, ALJ No. 2003-AIR-017, slip op. at 18 (ARB Mar. 30, 2007)).Powers v. Union Pacific Railroad Company, ARB Case No. 13-034, slip op. at 11 (DOL March 20, 2015) (opinion attached at JA666-702). "Proof of causation or 'contributing factor' is not a demanding standard."
Rudolph v. National Railroad Passenger Corporation (Amtrak), ARB Case No. 11037 (DOL March 29, 2013)(decided under the analogous provisions of the Federal Rail Safety Act). A plaintiff will prevail if he demonstrates that the protected activity was one factor in the employer's decision-even if there were also other factors at play:
To establish that his protected activity was a "contributing factor" to the adverse action at issue, the complainant need not prove that his or her protected activity was the only or the most significant reason for the unfavorable personnel action. The complainant need only establish by a preponderance of the evidence that the protected activity "alone or in combination with other factors," tends to affect in any way the employer's decision or the adverse action taken. Thus, for example, a complainant may prevail by proving that the respondent's reason, "while true, is only one of the reasons for its conduct, and [that] another factor is the complainant's protected activity."Id. at 16.
"The contributing factor element of a complaint may be proven by direct evidence or indirectly by circumstantial evidence." Powers v. Union Pacific Railroad Co., ARB Case. No. 13-034, at 11 (Mar. 20, 2015). It is "well established" that "an employee need not provide evidence of motive or animus by the employer." Id. (quoting Araujo, 708 F.3d at 158). "Quite simply, 'any weight given to the protected [activity], either alone or even in combination with other factors, can satisfy the 'contributing factor' test.'" Id. (quoting Marano v. Dep't of Justice, 2 F.3d 1137, 1140 (Fed. Cir. 1993).
To show protected activity was a contributing factor, a plaintiff need not prove that the employer's articulated reason for the action was pretextual; this is because the plaintiff "alternatively can prevail by showing that the respondent's reason while true, is only one of the reasons for its conduct." Powers, ARB Case. No. 13-034, at 15. For this reason, when evaluating whether the plaintiff has made a prima facie case showing "contributing factor," it is error to consider the respondent's affirmative defense evidence of a legitimate, non-retaliatory reason for its actions. Id. at 18 (discussing Kewley v. Dep't of Health &Human Servs., 153 F.3d 1357 (Fed. Cir. 1998)).
The question is whether any of Reilly's complaints played any role in GSK's decision to eliminate Reilly's job and terminate him in 2015. Drawing all inferences in Reilly's favor, there is a dispute about whether Reilly's numerous complaints contributed to GSK terminating him.
To overcome the prima facie case, the burden shifts to the employer to demonstrate, by clear and convincing evidence, that the employer would have taken the same personnel action in the absence of the protected action. 29 C.F.R. § 1980.104(e)(4); Araujo, 708 F.3d at 159 (decided under the analogous provisions of the Federal Rail Safety Act).
In its summary judgment papers, GSK incorrectly suggested that the District Court should weigh evidence and determine that the partial outsourcing of Reilly's department is clear and convincing evidence that it did not retaliate against Reilly. However, given the higher burden of proof on GSK to prove by clear and convincing evidence that it would have taken the same actions without regard to Reilly's protected activity, the weighing of this evidence in the prima facie "contributing factor" portion of this case would be error. In Kewley, the Federal Circuit held that it was error for the ALJ to consider evidence that was part of the employer's rebuttal case when considering whether the employee had made a prima facie case. Id. at 1363.
Similarly, in Powers v. Union Pacific Railroad Company, supra, the ARB held that the ALJ erred in ruling that the employee failed to prove contributing factor based on the testimony of company managers of nondiscriminatory motive for the adverse action. "Just as a complainant's burden of proof does not require a showing of employer motivation, non-retaliatory motive cannot rebut complainant's evidence of contribution when that rebuttal evidence is comprised of the self-serving testimony of Company managers." Powers, ARB Case. No. 13034, at 26. "Since proof of contributing factor does not require evidence of retaliatory motive, long understood to be a very difficult element of proof for complainants generally, it stands to reason that complainant has no obligation to disprove evidence of a subjective non-retaliatory motive in the context of advancing evidence supporting a showing of contributory factor." Id. at 25.
GSK relied on the outsourcing of the entire AS/400 department as clear and convincing evidence that regardless of Reilly's SOX-protected complaints he still would have lost his job as part of the outsourcing. Except the entire AS/400 department was NOT outsourced. It's more accurate and honest to say that GSK executed a partial and selective outsource which resulted in Taylor, Reilly's manager and one of the people Reilly repeatedly complained to and who got progressively frustrated at Reilly for doing so, and Mong, Reilly's co-worker, keeping their jobs and still working at GSK today.
Drawing all inferences in Reilly's favor and particularly with GSK mischaracterizing the scope and breadth of the outsourcing, GSK cannot show as a matter of law by clear and convincing evidence that Reilly's complaints did not contribute to GSK eliminating his job and terminating him.
CONCLUSION
For 16 years, Reilly loyally and reliably protected and preserved the integrity of GSK's most business-critical computer information systems. As GSK evolved into a multi-billion-dollar global pharmaceutical company, Reilly's job became more challenging. In his last few years at GSK, Reilly alerted his managers, GSK's Global Compliance department and the company's CEO of serious security and performance problems. His complaints directly bore on GSK's corporate viability and the accuracy of what it reported to the SEC and to its shareholders about how secure and stable its information systems were.
The District Court, like GSK, downplayed Reilly's complaints and determined his complaints to be run of the mill minor computer issues. The District Court was wrong. SOX was enacted to empower employees to make the kind of complaints Reilly made without fear of retaliation. Based on the record and any oral argument, Reilly is entitled to a jury trial. The District Court's summary judgment decision should be reversed and Reilly's case remanded for a jury trial.
Respectfully submitted, By: Scott M. Pollins, Pollins Law 303 W. Lancaster Ave., Ste. IC Wayne, PA 19087 (610) 896-9909 (phone)/(610) 896-9910 (fax) scottffipollinslaw.com (email) Attorney for Plaintiff/Appellant, Thomas Reilly
Date: 11/4/19
CERTIFICATIONS OF COUNSEL
I, Scott M. Pollins, certify as follows:
1. This brief contains 6464 words using Microsoft Word software.
2. The text of the electronic brief is identical to the text in the paper copies.
3. A virus detection program has been run on the file and no virus was detected.
4. Opposing counsel is a Filing User as provided in L.A.R. Misc. 113.4 and has consented to electronic service of the brief and appendix through the court's electronic docketing system (cm/ecf). I certify that on this 4th day of November 2019 I am causing to be mailed to opposing counsel via first class U.S. Mail, postage pre-paid, a paper copy of Appellant's Brief and all volumes of the Joint Appendix.
5. lam admitted to practice in this Court of Appeals.
By:Scott M. Pollins
TABLE OF CONTENTS TO JOINT APPENDIX
Page
VOLUME I (BOUND WITH BRIEF)
Notice of Appeal to the Third Circuit, ECF 44, August 15, 2019..................................JA-1
U.S. District Court, Eastern District of PA Order, ECF 42, July 16, 2019..........................JA-2
U.S. District Court, Eastern District of PA Memorandum Opinion, ECF 41, July 16, 2019......................................................................................JA-3
VOLUME II
U.S. District Court, Eastern District of PA Civil Docket Entries.................................JA-38
Exhibits to Defendant Glaxosmithkline, LLC's Motion for Summary Judgment...... JA-44-378
Defendant's Motion for Summary Judgment Exhibit No. 1: Thomas Reilly's SOX Complaint........................................................................................JA-44
Defendant's Motion for Summary Judgment Exhibit No. 2: Secretary of Labor's Findings..............................................................................................JA-56
Defendant's Motion for Summary Judgment Exhibit No. 3: February 22, 2017 ALJ Order..................................................................................JA-61
Defendant's Motion for Summary Judgment Exhibit No. 4: Thomas Reilly's Deposition Excerpts.................................................................................. JA-81
Defendant's Motion for Summary Judgment Exhibit No. 5: Steven Miller's Deposition Excerpts................................................................................JA-133
Defendant's Motion for Summary Judgment Exhibit No. 6: Jo Taylor's Deposition Excerpts) .................................................................................JA-148
Defendant's Motion for Summary Judgment Exhibit No. 7: Henry Bolton's Deposition Excerpts ..................................................................................JA-171
Defendant's Motion for Summary Judgment Exhibit No. 8: Steven C. Miller Declaration (Exhibits 8(A) and 8(B) are filed under seal)......................... JA-184
Defendant's Motion for Summary Judgment Exhibit No. 9: Dan Mong's Deposition Excerpts...............................................................................JA-189
Defendant's Motion for Summary Judgment Exhibit No. 10: May 15, 2012 Email and Attachment to Global Compliance.............................................JA-200
Defendant's Motion for Summary Judgment Exhibit No. 11: Response to Review...........................................................................................JA-209
Defendant's Motion for Summary Judgment Exhibit No. 12: January 10, 2013 Email.................................................................................................JA-219
Defendant's Motion for Summary Judgment Exhibit No. 13: January 23, 2013 Email..............................................................................................JA-230
Defendant's Motion for Summary Judgment Exhibit No. 14: February 18, 2013 Email Chain................................................................................JA-244
Defendant's Motion for Summary Judgment Exhibit No. 15: March 2013 Email Chain..........................................................................................JA-248
Defendant's Motion for Summary Judgment Exhibit No. 16: April 15, 2013 Email.....................................................................................................JA-253
Defendant's Motion for Summary Judgment Exhibit No. 17: May 28, 2013 Email Chain...........................................................................................JA-255
Defendant's Motion for Summary Judgment Exhibit No. 18: October 8, 2013 Email Chain...........................................................................................JA-265
Defendant's Motion for Summary Judgment Exhibit No. 19: Michele Mulkern Declaration............................................................................................JA-271
Defendant's Motion for Summary Judgment Exhibit No. 20: January 2, 2014 Email.....................................................................................................JA-277
Defendant's Motion for Summary Judgment Exhibit No. 21: Michael Woods' Deposition Excerpts...............................................................................JA-292
Defendant's Motion for Summary Judgment Exhibit No. 22: May 6, 2014 Email....................................................................................................JA-305
Defendant's Motion for Summary Judgment Exhibit No. 23: GSK's "Safeguarding GSK Employees Who Report Unethical or Illegal Conduct" Policy.....................JA-312
Defendant's Motion for Summary Judgment Exhibit No. 25: December 19, 2014 Email.....................................................................................JA-320
Defendant's Motion for Summary Judgment Exhibit No. 26: Reilly January 15, 2015 email to Andrew Witty.............................................................................JA-322
Defendant's Motion for Summary Judgment Exhibit No. 27: January 14, 2015 Email................................................................................................JA-332
Defendant's Motion for Summary Judgment Exhibit No. 28: Jason Lord's Deposition Excerpts...............................................................................JA-334
Defendant's Motion for Summary Judgment Exhibit No. 29: Relevant Portions of GSK's 2013 20-F Form...............................................................JA-342
Defendant's Motion for Summary Judgment Exhibit No. 30: Relevant Portions of GSK's 2014 20-F Form...........................................................JA-357
Defendant's Motion for Summary Judgment Exhibit No. 31: Reilly's Production of 2014 20-F Excerpts..............................................................JA-372
Defendant's Motion for Summary Judgment Exhibit No. 32: April 8, 2015 Email.....................................................................................JA-375
VOLUME III
Exhibits to Plaintiff's Response to Defendant's Motion for Summary Judgment........JA-379-702
Plaintiff's Response to Motion for Summary Judgment Exhibit No. 1: Reilly's Deposition............................................................................................JA-379
Plaintiff's Response to Motion for Summary Judgment Exhibit No. 2: Mong's Deposition.............................................................................................JA-443
Plaintiff's Response to Motion for Summary Judgment Exhibit No. 3: Woods' November 4, 2005 Email to Reilly and Mong......................................JA-455
Plaintiff's Response to Motion for Summary Judgment Exhibit No. 4: Woods' Deposition............................................................................................JA-459
Plaintiff's Response to Motion for Summary Judgment Exhibit No. 5: Taylor's Deposition............................................................................................JA-466
Plaintiff's Response to Motion for Summary Judgment Exhibit No. 6: March 9, 2012 Email..................................................................................JA-481
Plaintiff's Response to Motion for Summary Judgment Exhibit No. 7: Reilly's April 18, 2012 Email to Taylor...........................................................JA-483
Plaintiff's Response to Motion for Summary Judgment Exhibit No. 8: Reilly's January 15-16, 2013 Email exchange with Taylor..............................JA-486
Plaintiff's Response to Motion for Summary Judgment Exhibit No. 9: Reilly's April 10, 2013 Email to Taylor.........................................................JA-491
Plaintiff's Response to Motion for Summary Judgment Exhibit No. 10: March 27, 2013 Ralph Sassano Email to Taylor, copied to Reilly and others.................JA-495
Plaintiff's Response to Motion for Summary Judgment Exhibit No. 11: Taylor's April 15, 2013 Email to Reilly and his co-workers...........................JA-499
Plaintiff's Response to Motion for Summary Judgment Exhibit No. 12: Taylor's April 17, 2013 Email to Reilly....................................................JA-501
Plaintiff's Response to Motion for Summary Judgment Exhibit No. 13: Taylor's May 28, 2013 Email...................................................................JA-505
Plaintiff's Response to Motion for Summary Judgment Exhibit No. 14: June/July 2013 Email thread.....................................................................JA-515
Plaintiff's Response to Motion for Summary Judgment Exhibit No. 15: Taylor's August 16, 2013 Email to Reilly......................................................JA-533
Plaintiff's Response to Motion for Summary Judgment Exhibit No. 16: September 11, 2013 Email from Supriya Patnaik to Reilly..............................JA-538
Plaintiff's Response to Motion for Summary Judgment Exhibit No. 17: Early October 2013 Emails exchanged between Taylor and Reilly....................JA-540
Plaintiff's Response to Motion for Summary Judgment Exhibit No. 18: Reilly's October 9, 2013 11:40am Email to Taylor.......................................JA-546
Plaintiff's Response to Motion for Summary Judgment Exhibit No. 19: Reilly's Progress Report for Week Starting 11/25/2013..................................JA-552
Plaintiff's Response to Motion for Summary Judgment Exhibit No. 20: Reilly's January 31, 2014 Email to Taylor .............................................JA-554
Plaintiff's Response to Motion for Summary Judgment Exhibit No. 21: Bolton's deposition ..................................................................................... JA-558
Plaintiff's Response to Motion for Summary Judgment Exhibit No. 22: Late March/early April 2014 Emails............................................................JA-566
Plaintiff's Response to Motion for Summary Judgment Exhibit No. 23: Reilly's June 18, 2014 15:17 Email to Bolton..................................................JA-572
Plaintiff's Response to Motion for Summary Judgment Exhibit No. 24: Reilly returned to work the first business day of 2015 in early January......................JA--582
Plaintiff's Response to Motion for Summary Judgment Exhibit No. 25 :January 15, 2015 Email between Tom and CEO Witty......................................JA-590
Plaintiff's Response to Motion for Summary Judgment Exhibit No. 26: January 5, 2015 Email with Nick Hirons, GSK's SVP....................................JA-600
Plaintiff's Response to Motion for Summary Judgment Exhibit No. 27: January 21, 2015 Email with Michelle Mulkern.........................................JA-602
Plaintiff's Response to Motion for Summary Judgment Exhibit No. 28: April 8, 2015 Email exchange with Jason Lord and Reilly............................JA-605
Plaintiff's Response to Motion for Summary Judgment Exhibit No. 29: GSK's 20-F........................................................................................JA-609
Plaintiff's Response to Motion for Summary Judgment Exhibit No. 30: Powers v. Union Pacific Railroad Company, ARB Case No. 13-034, slip op. at 11 (DOL March 20, 2015).......................................................JA-665
Certificate of Service....................................................................................JA-703
VOLUME IV (FILED UNDER SEAL)
Defendant's Motion for Summary Judgment Exhibit 8(A).......................................JA-704
Defendant's Motion for Summary Judgment Exhibit 8(B)........................................JA-728
Defendant's Motion for Summary Judgment Exhibit 24..........................................JA-770
IN THE UNITED STATES DISTRICT COURT FOR THE EASTERN DISTRICT OF PENNSYLVANIA
THOMAS REILLY Plaintiff
v.
GLAXOSMITHKLINE, LLC Defendant
CIVIL ACTION NO. 17-2045
NOTICE OF APPEAL
Notice is hereby given that Plaintiff, Thomas Reilly, appeals to the United States Court of Appeals for the Third Circuit from the Order granting Defendant's, GlaxoSmithKline, LLC's, motion for summary judgment entered on July 18, 2019.
Respectfully, By: Scott M Pollins (Pa. Atty. Id. No. 76334) Pollins Law 303 W. Lancaster Ave., Ste. IC Wayne, PA 19087 (610) 896-9909 (phone) (610) 896-9910 (fax) scott@pollinslaw.com (email) Attorney for Plaintiff, Thomas Reilly
Date: 8/15/19
IN THE UNITED STATES DISTRICT COURT FOR THE EASTERN DISTRICT OF PENNSYLVANIA
THOMAS REILLY Plaintiff
v.
GLAXOSMITHKLINE, LLC Defendant
CIVIL ACTION NO. 17-cv-2045
ORDER
AND NOW, this 16th day of July, 2019 upon consideration of Defendant's Motion for Summary Judgment (Doc. No. 33), Plaintiff's Opposition thereto (Doc. No. 39), and Defendant's Reply in Support thereof (Doc. No. 40), it is hereby ORDERED as follows:
1. Defendant's Motion for Summary Judgment is GRANTED;
2. Judgment shall be entered in favor of Defendant and against Plaintiff.
J. CURTIS JOYNER, J.
July 16, 2019
MEMORANDUM
Joyner, J.
Before the Court are Defendant GlaxoSmithKline, LLC's ("GSK") Motion for Summary Judgment (Doc. No. 33), Plaintiff Thomas Reilly's ("Reilly") Opposition thereto (Doc. No. 39), and Defendant's Reply in Support thereof (Doc. No. 40). For the reasons set forth below, the Court GRANTS Defendant's Motion.
I. Factual Background
Plaintiff Thomas Reilly ("Reilly") alleges that he was wrongfully discharged by his former employer, Defendant GlaxoSmithKline ("GSK"), in retaliation for reporting his concerns pertaining to computer stability and security in GSK's global manufacturing and financial servers. See Compl. ¶¶64-66. Defendant has moved for summary judgment on Plaintiff's claim that GSK violated the corporate whistleblower provision of the Sarbanes-Oxley Act ("SOX," "Act"), 18 U.S.C.S. § 1514A.
For sixteen years, Plaintiff Reilly was employed by Defendant GSK, a publicly traded global pharmaceutical company in the Information Technology ("IT") Department. Compl. ¶6 (Doc. No. 1). In 2003, Mr. Reilly was promoted from Analyst to Senior Consultant for the AS/400 Computer System ("A/S 400"). Reilly Deposition, ("Reilly Depo."), Def. Ex. 4 at 38-39; Pl. Ex. 1 at 38-39. The AS/400 is a computer operating system manufactured by IBM that hosts manufacturing and financial applications for portions of GSK's business. Miller Deposition, Def. Ex. 5 at 29-30; Taylor Deposition, Def. Ex. 6 at 18, 30-33; Def. Ex. 7 at 40; Miller Declaration, Def. Ex. 8 at ¶3. GSK has a "backup system" for the AS/400 that saves all information in the event of an outage that lasts continuously for 24 hours or more. Def. Ex. 8 at ¶4; Def. Ex. 6 at 111. GSK has never needed to use this system. Mong Deposition, Def. Ex. 9 at 83-84. GSK does not consider a server shut-down of less than 24 hours to have a "significant business impact." Def. Ex. 6 at 111.
A. Alleged Protected Activity: Complaints Regarding Computer Stability and Security
To better understand the context of Plaintiff Reilly's claim that GSK retaliated against him in violation of the whistleblower provision of the Sarbanes-Oxley Act, we will set out relevant requirements for corporate disclosures to the SEC, since SOX requires compliance with SEC rules and regulations. To satisfy SOX's requirements for complying with SEC rules and regulations, a qualifying corporation, like GSK, is required to file "periodic reports" in which high-level corporate officer(s) certify that based on their knowledge, the report does not contain untrue statements or material omissions. 15 U.S.C. § 7241(a)(1)-(2). Further, for the certifications to be SOX-compliant, signatory officers must certify that based on their evaluation, internal controls are effective. Id. at §7241(a)(4). Additionally, signatory officers are required to certify that they have disclosed to the company's auditors "significant deficiencies in the design or operation of internal controls which could adversely affect" reporting on financial data, and any fraud involving anyone with a "significant role" in the internal controls of the company. Id. at §7241(a)(5)(A)-(B). Also relevant is Section 404 of the Sarbanes-Oxley Act, which requires a company's annual SEC report to contain an internal control report, 15 U.S.C.S. § 7262 (a); further, a public accounting firm tasked with auditing the issuing company must attest to the company's evaluation of its financial reporting controls. Id. at § 7262 (b).
As a Senior Analyst in GSK's IT department, Mr. Reilly was a member of the AS/400 Service Team ("AS/400 Team") which was dedicated to maintaining the AS/400 operating system. Def. Ex. 8 at ¶4. Mr. Reilly's job responsibilities entailed designing, engineering, and delivering the AS/400 servers, in addition to remediating performance and security issues relating to them. Reilly Depo. at 43; Def. Ex. 8 at ¶4. Mr. Reilly did not have responsibility for setting internal security controls. Reilly Depo. at 69.
In late 2011, Plaintiff Reilly reported to his AS/400 Team coworker, Rick Oberholzer ("Oberholzer"), that he was concerned with performance instability in computer servers on the AS/400 system that he attributed to Mr. Oberholzer's decision to implement uncapped processors. Id. at 75. Uncapping processors allows a server to use available CPU capacity from another server. Id. at 80. However, Mr. Reilly perceived that enabling uncapped processors posed a risk to the stability of GSK's servers for two reasons. First, uncapping processors does not automatically add memory to a server. Second, uncapping processors can cause the computer's memory component to "thrash" or "lock up." Id. Notedly, adding additional memory to the server could prevent the risk of "lock up," while an uncapped processor is enabled. Id. at 81. Nevertheless, after the uncapped processors were enabled, GSK users experienced lost orders, "bad performance," and "corrupted data" (which, in Plaintiff's words, means "a lot of different things," from "the data is garbage to the files are out of sync to something doesn't get reported or recorded."). Id. at 105-106.
When Plaintiff told Mr. Oberholzer that he disagreed with his decision to enable uncapped processors, Mr. Oberholzer screamed at him. Id. at 85-86, 88. The confrontation was witnessed by Robert Mattie ("Mattie"), a Senior Director (a level above Mr. Reilly's manager at the time, Brian Gillies, who was on vacation that week). Id. According to Mr. Reilly, Mr. Mattie blamed Mr. Reilly for the confrontation. Mr. Reilly believes that his career was "irreparably damaged" by Mr. Mattie's perception of this altercation. Id. at 89.
In April 2012, Reilly emailed his supervisor, AS/400 Service Manager, Jo Taylor ("Taylor") detailing his concerns regarding server performance along with security risks that could have implications for an SOX audit. See Doc. No. 39-1, Pl. Ex. 7 at 106; Def. Ex. 11. Ms. Taylor responded two days later by email, stating, in sum, that she believed it "was IBM's recommendation to turn on Shared Processors, so I would like IBM to review this data and work with you to resolve." Ms. Taylor's email went on to say that in the meantime, the AS/400 Team should monitor the server response times over a 24-hour period, and that if performance issues persisted during a full 24 hours, "then I'll authorise [sic] turning the shared processing off" as the AS/400 Team continued to monitor and track server performance. Def. Ex. 12.
In January 2013, in response to a communication by a GSK employee, Sony Leons, that users were complaining about "screen to screen time lag," Ms. Taylor placed Mr. Reilly in charge of remediating poor performance on GSK's AS/400 India Server. Def. Ex. 12; Reilly Depo. at 136-137. Mr. Reilly's analysis attributed the performance issues to uncapped processors; he emailed Ms. Taylor as such. Def. Ex. 12.
Shortly thereafter, Mr. Reilly again alerted Ms. Taylor to server performance problems including memory and response timelag. On January 16, 2013, Ms. Taylor responded in an email to Mr. Reilly stating, "[I] [u]nderstand but let's keep focus and scope tight on the audit. We do not want [PriceWaterhouseCoopers, GSK's external auditor at the time] picking up any insights that are not part of the current scope." Pl. Ex. 8 at 109.
On January 23, 2013, Mr. Reilly emailed Ms. Taylor's supervisor, Steve Miller ("Miller"), Vice President of Enterprise Systems and Technologies, to report the same concerns regarding server stability and uncapped processors which he brought to Ms. Taylor's attention earlier that month. Def. Ex. 6 at 63-65; Def. Ex. 13.
On February 18, 2013, an IBM representative emailed Mr. Reilly to address his concerns. The IBM representative wrote, "[r]egarding uncapped verses capped [processors], there is no right or wrong answer. It depends on the workload and what other resources are assigned. If you choose to run uncapped the demand for memory and IO will increase as processor is added. My suggestion would be to increase memory...." Def. Ex. 14. The same representative later emailed both Ms. Taylor and Mr. Reilly that he "would not have suggested" using uncapped processors. Pl. Ex. 10. Mr. Oberholzer was later assigned to cap the processors. Reilly Depo. at 131. GSK eventually purchased additional memory to help remediate the risk that a server could "lock-up." Reilly Depo. at 81. Ultimately, performance issues persisted on the GSK India server even after the processors were capped. Reilly Depo. at 132-136, 139-141.
In 2013, Plaintiff Reilly reported additional concerns about computer security. Namely, AS/400 "users that are identified as having more authority than the standard or [GSK's] system access management plan would" allow. Reilly Depo. at 113-117. Mr. Reilly was placed in charge of remediating these "access privileges" issues. Id. Eventually, Ms. Taylor took over the remediation effort and addressed the security risk. Def. Ex. 6 at 152-154.
Dissatisfied with GSK's response to his previous complaints, on January 2, 2014, Plaintiff escalated his complaints to GSK's Global Compliance Office, through the company's internal "Speak Up" line. His complaint detailed his concerns with AS/400 server performance issues and his disagreement with Mr. Oberholzer about enabling uncapped processors.
Nearly a year later, on January 15, 2015, Plaintiff again escalated his complaints to Andrew Witty ("Witty"), GSK's CEO. Def. Ex. 26; Reilly Depo. at 230. Plaintiff's email to CEO Witty stated his fear that due to the computer stability and security concerns he had reported previously, the company was not in compliance with its internal Code of Conduct and "Corporate Integrity Agreement with the Department of Justice and The Department of Health and Human Services which specifically requires we honor our . . . Code of Conduct [policies and procedures]." Def. Ex. 26 at 6. It was Mr. Reilly's belief that the company's certifications to the SEC in 2013 and 2014 falsely claimed compliance with GSK's internal code of conduct, and thereby violated Sarbanes-Oxley, which requires compliance with SEC rules that mandate corporate disclosure of the effectiveness of internal controls. Mr. Reilly went on in his email to CEO Witty that he had reviewed the company's 2013 annual report to the SEC ("Form 20-F") and believed it materially omitted reference to "any of these serious performance, security, quality, compliance issues, risk management or corporate responsibility deficiencies. . . ." Id.
B. Investigation of Mr. Reilly's Complaints
After Plaintiff complained to GSK's Global Compliance Office in 2014, GSK assigned Global Compliance Officer Michael Woods ("Woods"), who had responsibility over IT and HR, to lead an internal investigation. Def. Ex. 21 at 10, 13, 30, 32. Plaintiff and Mr. Woods communicated about his complaints from January through approximately May 2014.
In September 2014, Mr. Woods issued a report from GSK's investigation, which found Mr. Reilly's complaints unsubstantiated. Def. Ex. 24 at GSK010589. The report acknowledged that "there are some aspects of access management and privileges which should be reviewed and remediated if found to be overly broad." Id.
Following Mr. Reilly's report to CEO Witty, GSK conducted another internal investigation into his complaints, headed by Jason Lord ("Lord"), Director of Corporate Investigations. Def. Ex. 26; Def. Ex. 28 at 22-23. GSK maintains that Mr. Lord's investigation is privileged. Def. Ex. 26.
C. GSK's SEC Disclosures
The following disclosures by GSK on its 2013 and 2014 Form 20-F are undisputed. Def. Ex. 29; Def. Ex. 30, Pl. Ex. 31. Both certifications certified that
[t]he company's other certifying officer and I, [GSK CEO Andrew Witty] have disclosed, based on our most recent evaluation of internal control over financial reporting, to the company's auditors and the audit committee of the company's board of directors. . .all significant
deficiencies and material weaknesses in the design or operation of internal control over financial reporting which are reasonably likely to adversely affect the company's ability to record, process, summarize and report financial information; and (b) any fraud, whether or not material, that involves management or other employees who have a significant role in the company's internal control over financial reporting.
Def. Ex. 29; Def. Ex. 30, Pl. Ex. 31. The disclosure form goes on to explain that "[t]he principal risks discussed [therein]. . . .are the risks and uncertainties relevant to our business, financial condition and results of operations that may affect our performance and ability to achieve our objectives." Def. Ex. 29 at 3; Def. Ex. 30 at 3.
What's more, the 2013 and 2014 20-F Reports identify numerous risk impacts to the company. Specifically, that
[f]ailure to adequately protect critical and sensitive systems and information may result in . . . business disruption including litigation or regulatory sanction and fines, which could materially and adversely affect our financial results....We rely on critical and sensitive systems and data, such as . . . manufacturing systems. . . . There is the potential that malicious or careless actions expose our computer systems or information to misuse or unauthorised disclosure.Id. at 10; Id. at 9. Additionally, the company disclosed its "[f]ailure to comply with current Good Manufacturing Practice requirements in commercial manufacture, . . . through inadequate controls. . .and in supporting regulated activities." Id. at 3. Finally, GSK disclosed the "[r]isk to the Group's business activity if critical or sensitive computer systems . . .are not available. . ., are accessed by those not authorized, or are deliberately changed or corrupted." Id. at 8.
D. Alleged Unfavorable Personnel Action: Outsourcing the AS/400 Team Positions
In 2013, GSK started a program to reorganize the End User and Infrastructure Services ("EIS") Department, of which Mr. Reilly was a member. Def. Ex. 19 at ¶2-4. As part of the reorganization of EIS, in December 2013, GSK decided to outsource the AS/400 system to a third party vendor, Blue Chip. Def. Ex. 8 at ¶5; Def. Ex. 9 at 139-140; Reilly Depo. at 166.
In March 2014, GSK announced the outsourcing. It was at this time that Plaintiff was made aware that every position in the AS/400 Team was being eliminated, except for Jo Taylor's, who remained as manager, and one AS/400 Service Analyst position. Mr. Reilly was invited to apply for the remaining Analyst position, along with Mr. Oberholzer and another co-worker, Mr. Mong ("Mong"). Reilly Depo. at 166-167, 169, 186-187; Def. Ex. 8 at ¶7. On May 6, 2014, Henry Bolton ("Bolton") (then the acting AS/400 Service Manager while Ms. Taylor was out on leave), informed the AS/400 Team that pursuant to the outsourcing, any AS/400 Team members who were not selected for the remaining Analyst position would be terminated, effective September 28th, 2014. Def. Ex. 22; Reilly Depo. at 186.
Plaintiff understood that the outsourcing would eliminate the AS/400 Team except for manager and one Service Analyst role. Reilly Depo. at 190. In fact, he testified that he was informed by GSK that if he chose not to apply for the Service Analyst role, he would be "agreeing to be let go," as was also the case for his AS/400 Team co-workers, Mike Bacon, Steve Farden, and Rick Oberholzer. Reilly Depo. at 169. Nonetheless, Mr. Reilly decided not to apply for the Analyst position. Reilly at 184185. Mr. Mong, who had applied for the position, filled the role. Def. Ex. 8 at ¶7.
Mr. Reilly maintains that he did not apply for the Service Analyst position that would remain after the AS/400 Service was outsourced to a vendor because he assumed that his position would be "protected." Reilly Depo. at 188. "I was in a different situation [from the other AS/400 Team employees] because I was escalating to Global Compliance, and they were trying to save my job." Id. "I was living in parallel realities. One was Michael Woods was telling me I was protected. . ., and the other was GSK IT telling me that I was going to be terminated." Id. "I was going on the word of Michael Woods who had instructed me that based on what I showed him I could not be wrongfully terminated for making serious allegations and he was going to protect me. So, in my mind, I was not going to be terminated." Reilly Depo. at 171, 172.
In fact, GSK has an anti-retaliation policy entitled, "Safeguarding GSK Employees Who Report Unethical or Illegal Conduct" ("Safeguarding Policy"). Def. Ex. 23. The policy requires GSK compliance investigators to communicate the existence of the policy to employees involved in an internal investigation. Def. Ex. 23. The policy does not state that GSK will keep or create a job for an employee whose job has been outsourced, in the event that an investigation substantiates an employee's complaints. See generally, Def. Ex. 23.
After Mr. Reilly declined to apply for the AS/400 Service Analyst position that would remain after the Service was outsourced, the date on which the termination of his position would become effective changed more than once. Initially, Mr. Bolton's (acting-manager of the AS/400 Team at the time) May 6, 2014 email stated that Plaintiff's termination would become effective in September 2014. Yet, Plaintiff had also been told his termination could become effective as early as June 2014, immediately following his decision not to apply for the Service Analyst position. Reilly Depo. at 204. GSK rescinded that date too, pushing the date to October 2014. Id.
Before any effective termination dates arrived, Mr. Reilly took a short-term disability leave in early July 2014, during which his "official notification of separation" was "postponed." Reilly Depo. at 205; Def. Ex. 19 at ¶6.
Following his leave, Mr. Reilly returned to work in January 2015. Reilly Depo. 203, 232-233. Mr. Reilly testified that he believed that upon his return, his position would not be outsourced, reasoning that if his complaints were substantiated by the company's investigation, GSK would fire his manager, Ms. Taylor, and promote Plaintiff to her position. Id. at 231. See id. (". . .[M]aybe I was naive, I was just thinking it's just a matter of time before they see that Jo Taylor has just screwed everything up and she's covering things up and it's a disaster, and they're going to come back and say, 'Tom, my God, we need you.'").
On January 21, 2015, Michelle Mulkern, GSK's HR Director for Global Support Functions from 2014 to 2015, sent Mr. Reilly a memo with the subject "Administrative Leave," stating that
[t]he purpose of this letter is to update you about your employment status at [GSK] and provide some background details leading to this status. On January 28, 2014, the Phase 2 CBS it [EIS] proposed organization change was communicated and that you would be a part of a reduction in force....As a result of your short-term disability leave of absence . . ., the official notification was postponed until your return to work status, January 2, 2015. On January 15, 2015, you brought to our attention matters which . . .require an internal investigation. At this time, we are going to postpone your January 23, 2015 official notice of separation from [GSK] and place you on paid administrative leave during the pending investigation. . . . We will get back to you following the outcome of the investigation regarding your employment status.
Def. Ex. 19 (A).
On April 8, 2015, Mr. Lord, lead corporate investigator for the second internal investigation into Plaintiff's complaints, notified Mr. Reilly that based on the outsourcing of the AS/400 Team, his "official notification of separation from GSK is 8th April 201[5]." Def. Ex. 32. Mr. Reilly's last day of employment was June 30, 2015. Reilly Depo. at 283, 284, 309.
On July 20, 2015, Plaintiff Reilly filed a complaint with the Occupational Safety and Health Administration ("OSHA") ("SOX Complaint," Def. Ex. 1). On September 6, 2016, the Secretary of Labor, acting through the Regional Administrator, dismissed Plaintiff's SOX Complaint as untimely. See Def. Ex. 2. When Plaintiff appealed, an ALJ issued an Order consistent with the Secretary of Labor's Findings and also dismissed Plaintiff's SOX Complaint as untimely. See Def. Ex. 3 at 11-13. On March 3, 2017, Plaintiff Reilly filed his Petition for Review of the ALJ's decision with the Administrative Review Board ("ARB"). On May 4, 2017, Plaintiff filed his Complaint in this matter. ("Compl.", Doc. No. 1).
This Motion is fully briefed and ripe for the Court's adjudication. The Court has considered the parties' submissions and decides this matter without oral argument. Fed.R.Civ.P. 78; Loc. R. Civ. P. 7.1(f).
II. Legal Standard
Summary judgment is appropriate "if the movant shows that there is no genuine dispute as to any material fact and the movant is entitled to judgment as a matter of law." Fed.R.Civ.P. 56(a). A court deciding a motion for summary judgment must view the facts in the light most favorable to the nonmoving party and draw all inferences in that party's favor. Matsushita Elec. Indus. Co. v. Zenith Radio Corp., 475 U.S. 574, 587 (1986) (quoting United States v. Diebold, Inc., 369 U.S. 654, 655 (1962)). Nonetheless, "[u]nsupported assertions, conclusory allegations, or mere suspicions are insufficient to overcome a motion for summary judgment." Betts v. New Castle Youth Dev. Ctr., 621 F.3d 249, 252 (3d Cir. 2010).
A dispute is "genuine" if the non-movant shows evidence on which a "reasonable [fact-finder] could return a verdict" in their favor. Anderson v. Liberty Lobby, Inc., 477 U.S. 242, 248 (1986). A "material" dispute "'might affect the outcome of the suit under the governing law.'" Wiest v. Tyco Elecs. Corp., No. 10-3288, 2015 U.S. Dist. LEXIS 47935 at *14-15 (E.D. Pa. Apr. 10, 2015) (citing Kaucher v. Cnty. of Bucks, 455 F.3d 418, 423 (3d Cir. 2006) (quoting Anderson, 477 U.S. at 248).
The burden is on the movant "to show that the plaintiff has failed to establish one or more essential elements of her case." Brown v. Aria Health, No. 17-1827, 2019 U.S. Dist. LEXIS 66266 at *9-10 (E.D. Pa. Apr. 17, 2019) (quoting Burton v. Teleflex Inc., 707 F.3d 417, 425 (3d Cir. 2013)). This burden can be met by "pointing out to the district court that there is an absence of evidence to support the nonmoving party's case." Celotex Corp. v. Catrett, 477 U.S. 317, 325 (1986). Once the moving party meets their initial burden, the non-moving party must "go beyond the pleadings" and "designate specific facts" that create a "genuine issue for trial." Celotex, 477 U.S. at 324.
"[T]he mere existence of a scintilla of evidence in support of [the non-movant's] position," "will not defeat an otherwise properly supported motion for summary judgment." Anderson, 477 U.S. at 247-48, 252. Summary judgment is appropriate if the non-moving party fails to rebut by making a factual showing "sufficient to establish the existence of an element essential to that party's case, and on which that party will bear the burden of proof at trial." Wiest v. Tyco Elecs. Corp., No. 103288, 2015 U.S. Dist. LEXIS 47935 (E.D. Pa. Apr. 10, 2015) (citing id. at 322).
III. Discussion
Section 806 of the Sarbanes-Oxley Act provides corporate employees protection from retaliation by their employers for reporting fraud or a violation of an SEC rule or regulation by a covered company or one of its employees. See generally 18 U.S.C.S. § 1514A(a). See Wiest v. Lynch, ("Wiest I") 710 F.3d 121, 129 (3d Cir. 2013) (quoting id. at § 1514A). Plaintiff Reilly claims that his complaints are protected by the SOX whistleblower provision for two reasons: first, he believes GSK failed to disclose material information regarding breakdowns in internal controls; second, after he reported his complaints to the company, his work unit was outsourced, an internal investigation found that his complaints were unsubstantiated, and his position was eventually terminated. The focus of Defendant GSK's motion for summary judgment is twofold: first, that Mr. Reilly's SOX Complaint was not timely filed and should be barred by the statute of limitations; and second, that Mr. Reilly is not a whistleblower within the scope of SOX's protections because his complaints about computer stability and security are too attenuated from corporate fraud. Further, Defendant argues that even if Plaintiff's complaints are protected by the Act, Mr. Reilly has failed to establish causation. In other words, that Mr. Reilly cannot establish a material dispute as to whether his complaints were a contributing factor in GSK's decision to outsource his position.
Relevantly, the SOX whistleblower provision provides that "[n]o company with a class of securities registered under section 12 of the Securities Exchange Act of 1934 (15 U.S.C. 78l), or that is required to file reports under section 15(d) of the Securities Exchange Act of 1934 (15 U.S.C. 78o(d)). . .or any officer, employee, contractor, subcontractor, or agent of such company. . . may discharge, demote, suspend, threaten, harass, or in any other manner discriminate against an employee in the terms and conditions of employment because of any lawful act done by the employee." 18 U.S.C.S. § 1514A(a).
In the Plaintiff's opinion, the company's disclosures on its 2013 and 2014 annual reports to the SEC were not specific enough in naming the computer risks he had brought to the company's attention.
1. Timeliness
As a threshold issue, Defendant argues that Plaintiff's retaliation claim is time-barred by the 180-day statute of limitations for filing a whistleblower complaint under SOX. The thrust of Defendant's procedural argument is that Mr. Reilly was made aware of GSK's decision to eliminate his position, via outsourcing, in March 2014, yet Mr. Reilly waited to file his claim with OSHA until July 20,2015.
Plaintiff avers that he did not receive final, definitive notification that his position would be eliminated until April 8, 2015. It is this date that Mr. Reilly argues should trigger the running of the statute of limitations. Plaintiff acknowledges that GSK announced the outsourcing in March 2014. Yet, he establishes evidence that GSK postponed his official notification of termination more than once; and, further, that personnel employees used language that Mr. Reilly interpreted to mean that the outcome of the investigation might "save" his job. Reilly Depo. at 196.
On April 8, 2015, Mr. Reilly received an email from Mr. Lord (who had led the second internal investigation into Mr. Reilly's complaints) stating that his "official notification of separation from GSK is 8th April 2015 (sic)." Def. Ex. 32.
The first step for a plaintiff seeking protection from retaliation under SOX is to file for an administrative resolution. "Before an employee can assert a cause of action in federal court under [SOX], the employee must file a complaint with the Occupational Safety and Health Administration ("OSHA") and afford OSHA the opportunity to resolve the allegations administratively." Willis v. Vie Fin. Grp., Inc., No. 04-435, 2004 U.S. Dist. LEXIS 15753 at *8 (E.D. Pa. Aug. 6, 2004) (citing 18 U.S.C.S. § 1514A (b)(1)(A)). A plaintiff has 180 days to file their SOX Section 806 complaint with OSHA after the date on which the violation [of SOX] occurs, or after the plaintiff became aware of the violation. See 18 U.S.C.S. § 1514A (b)(2)(D); 29 C.F.R. § 1980.103 (a, d).
A plaintiff's awareness of the SOX violation, which starts the limitations period running, is marked by when the employer makes and reasonably communicates the discriminatory adverse employment decision to the employee. Delaware State College v. Ricks, 449 U.S. 250, 258 (1980). Ricks focused on when the "decision was made" and when an employee was "notified," not when the employer's adverse employment decision took effect. Ricks, 449 U.S. at 258. See Sneed v. Radio One, Inc., 2007-SOX-18, 2007 WL 7135802 at *4 (A.L.J. Apr. 16, 2007) (citing Halpern v. XL Capital, LTD., 2004 SOX 54 (ARB) (Aug. 31, 2005)) (holding that a "violation" under the whistleblower provision occurs, for the purpose of starting the statute of limitations, "when the employer communicates to the employee its intent to implement an adverse employment decision, rather than the date the employee experiences the consequences"). Also relevant, "a notification of termination to be executed on a future certain date is sufficient to trigger the running of the filing time limit." Sneed, 2007 WL 7135802 at *3 (citing Chardon v. Fernandez, 454 U.S. 6 (1981)).
Essentially, "[f]or the clock to start, the complainant must have received final, definitive, and unequivocal notice of an adverse employment decision." Id. at *4. "Final" and "definitive" notice denotes communication that is decisive or conclusive, i.e., leaving no further chance for action, discussion, or change. "Unequivocal" notice means communication that is not ambiguous, i.e., free of misleading possibilities. Id. (citing Halpern v. XL Capital, LTD., 2004 SOX 54 (ARB) (Aug. 31, 2005) (citing Jenkins v. United States Envtl. Prot. Agency, 1988-SWD-2 (ARB) (Feb. 28, 2003))). See also Smith v. Potter, 445 F.3d 1000 (7th Cir. 2006) (quoting Flannery v. Recording Indus. Ass'n of Am., 354 F.3d 632, 637 (7th Cir. 2004)) ("'(1) there must be a final, ultimate, non-tentative decision to terminate the employee'; and (2) 'the employer must give the employee 'unequivocal' notice of its final termination decision.'").
The standard for assessing whether the plaintiff received "final, definitive, and unequivocal notice of an adverse employment decision. . ." is "an objective one, based not on what the complainant subjectively thought, but rather what a reasonable person in her position would have understood." Id. (citing E.E.O.C. v. United Parcel Service, Inc., 249 F.3d 557, 562 (6th Cir. 2001) ("[o]nce the employee is aware or reasonably should be aware of the employer's decision, the limitations period commences."). See also Jakimas v. Hoffmann-LaRoche, Inc., 485 F.3d 770, 780 (3d Cir. 2007) (applying the "accrual rule from Ricks" and Chardon, and holding that an employee's retaliatory discharge claim under §510 of ERISA "accrues when the decision to terminate is made and the employee is informed of the pending termination.").
Here, the threshold determination at summary judgment is whether Plaintiff Reilly has established a genuine dispute as to the objective reasonableness of his belief that GSK had wavered from their decision to terminate his employment by outsourcing. The Supreme Court in Ricks focused the timeliness inquiry on whether the employer's communication to the plaintiff suggested that their earlier decision to terminate his employment was "in any respect tentative." Ricks, 449 U.S. at 261. There, an employee argued that a grievance procedure through which he challenged a prior tenure decision should have reset the limitations clock. The Court disagreed, holding that the "unbroken array of negative decisions" (the tenure committee's recommendation to deny tenure, the Senate vote to support the tenure committee's recommendation, and the Board of Trustees' formal vote to deny plaintiff tenure) showed that the College "had established its official position - and made that position apparent to [plaintiff]" before the "Board notified Ricks that his grievance had been denied." Id. at 262, 260. In the Court's view, the grievance procedure was a "remedy for a prior decision, not an opportunity to influence that decision before it is made (emphasis in original)." Id. at 261. Therefore, notwithstanding the Board's "willingness to change its prior decision if Ricks's grievance were found to be meritorious," the Board's initial notification of their decision to deny tenure was sufficiently final to trigger the limitations period. Id.
In this case, it is undisputed that Plaintiff first became aware of GSK's decision to outsource his position by May 2014, when Mr. Bolton, his supervisor at the time, sent him an email communicating the following: First, that the AS/400 Team member positions would be outsourced. Second, that any AS/400 Team member who was not hired as the sole remaining AS/400 Service Analyst would be notified in August 2014 of their official termination. And third, that the termination would be effective in September 2014.
It is also undisputed that GSK changed the effective termination date of Plaintiff's position more than once. After Plaintiff declined to be considered for the AS/400 Service Analyst position that would remain after the outsourcing, GSK changed the effective date of his termination from September 2014, to June 2014; then changed it again to October 2014. Reilly Depo. at 204.
Finally, Mr. Reilly has established a material issue as to whether Mr. Woods, who led the first internal investigation into his complaints, communicated to him that the outcome of the investigation could change GSK's decision to terminate him. Although GSK disputes Mr. Woods's communications, Reilly Depo. at 171, Plaintiff maintains that he understood the company's safeguarding policy to mean "[y]ou can't be terminated." Id. at 207. See id. at 172-175 ("[Mr. Woods] said I could not be terminated if my allegations were true.").
Defendant argues that Plaintiff's belief that he would be promoted after the investigation into his complaints is objectively unreasonable because he was aware that all AS/400 Team positions would be eliminated through the outsourcing except the Service Analyst role that he chose not to apply for, and he had never been promoted to a managerial position during his 16-year tenure as a GSK employee.
However, we find otherwise. Here, the internal investigation into Plaintiff Reilly's complaints was not, as in Ricks, a "grievance, or some other method of collateral review of an employment decision," which "does not toll the running of the limitations periods." Ricks, 449 U.S. at 261 (citing Electrical Workers v. Robbins &Myers, Inc., 429 U.S. 229 (1976)). Plaintiff has established language in Ms. Mulkern's memo during the pendency of GSK's internal investigation, stating "[w]e will get back to you following the outcome of the investigation regarding your employment status." Def. Ex. 19 (A). More, Plaintiff testified that Mr. Woods communicated that the company's "safeguarding" policy could "save" his job. Thus, as the court found sufficient to establish a genuine dispute in Clark v. Resistoflex Co., here, this evidence shows "mixed official signals" regarding whether Mr. Reilly's termination would take effect. Clark v. Resistoflex Co., Div. of Unidynamics Corp., 854 F.2d 762, 766 (5th Cir. 1988). We find this evidence to be "collectively sufficient to cast doubt upon whether a reasonable employee in [Reilly]'s position should have known that he had been discharged." Id. Based on this material issue as to whether Plaintiff's SOX Complaint is time-barred, we will proceed to considering the merits of his retaliation claim.
See id. (reversing the District Court's decision to grant summary judgment for the employer on timeliness grounds because the employer's communication to the employee, minutes after telling him he was fired, "that the company personnel office would send him a letter 'clarify[ing] his status' as an employee" established a genuine dispute as to which communication by the employer "triggered the running of the [administrative] filing deadline").
2. Protected Activity
Here, Plaintiff Reilly asserts one count of retaliatory discharge in violation of 18 U.S.C. § 1514A. Mr. Reilly argues that he qualifies for SOX whistleblower protection because he believed that GSK's annual disclosures to the SEC omitted material facts about computer system risks and that GSK outsourced his position because he reported his concerns. Defendant GSK argues that Mr. Reilly's complaints are not protected by SOX because they are too attenuated from corporate fraud or any violation contemplated by the Act.
SOX "protects whistleblowing employees from retaliation for providing information, either directly or indirectly, about certain types of expressly enumerated illegal activities. The statute provides, in relevant part, that: 'no [publicly-traded] company . . . or any officer, employee, contractor, subcontractor, or agent of such company . . . may discharge, demote, suspend, threaten, harass, or in any other manner discriminate against an employee in the terms and conditions of employment because of any lawful act done by the employee.'" Wiest v. Tyco Elecs. Corp. ("Wiest II"), 812 F.3d 319, 328 (3d Cir. 2016) (quoting § 1514A (a)(1)(A)-(C)).
The statute then defines the scope of protected activity. Specifically, Section 806 protects whistleblowing employees who
(1). . .provide information, cause information to be provided, or otherwise assist in an investigation regarding any conduct which the employee reasonably believes constitutes a violation of section 1341 [mail fraud], 1343 [wire fraud], 1344 [bank fraud], or 1348 [securities fraud], any rule or regulation of the Securities and Exchange Commission, or any provision of Federal law relating to fraud against shareholders, when the information or assistance is provided to or the investigation is conducted by - (C) a person with supervisory authority over the employee (or such other person working for the employer who has the authority to investigate, discover, or terminate misconduct)[.]§ 1514A(a)(1)(C)(emphasis added).
"To establish a prima facie case for a Section 806 claim, the employee must allege that he or she (1) 'engaged in a protected activity;' (2) '[t]he respondent knew or suspected that the employee engaged in the protected activity;' (3) '[t]he employee suffered an adverse action;' and (4) '[t]he circumstances were sufficient to raise the inference that the protected activity was a contributing factor in the adverse action.'" Wiest v. Lynch ("Wiest I"), 710 F.3d 121, 129 (3d Cir. 2013) (quoting 29 C.F.R. § 1980.104(e)(2)(i)-(iv)). It follows that "[f]or [Plaintiff Reilly's] anti-retaliation claim to survive summary judgment, [Reilly] 'must [first] identify evidence in the record from which a jury could deduce . . . [he] 'engaged in a protected activity' under Section 806." Westawski v. Merck &Co. ("Westawski II"), 739 Fed.Appx. 150, 152 (3d Cir. 2018) (quoting Wiest II, 812 F.3d at 329 (internal citations omitted)). See Safarian v. Am. DG Energy Inc. ("Safarian I"), No. 10-6082, 2014 U.S. Dist. LEXIS 59684 at *11-12 (D.N.J. Apr. 29, 2014) (quoting § 1514A) ("To receive protection under the Sarbanes-Oxley Act, a plaintiff must convey an objectively reasonable belief that the company violated 'section 1341, 1343, 1344, or 1348, any rule or regulation of the Securities and Exchange Commission, or any provision of Federal law relating to fraud against shareholder.'").
Of note, the "reasonable belief" standard for establishing that an employee's complaints warrant SOX whistleblower protection is not defined by the statute. See Wiest I, 710 F.3d at 130 (citing 2011 DOLSOX LEXIS 39 at *11-12) "SOX does not define what constitutes a 'reasonable belief.'" Courts determining whether an employee's lawful reports are protected follow the ARB's interpretation of the standard, which requires "that the plaintiff have a subjective belief that the employer's conduct violates a provision listed within Section 806 and that the belief is objectively reasonable." Id. See also Westawski II, 739 Fed.Appx. at 152 (citing id. at 134) (requiring, to be "protected" by the Act, "'both a subjective and an objective belief that the conduct that is the subject of [an employee's] communication relates to an existing or prospective violation of one of the federal laws referenced in [Section] 806.'"). See Sylvester v. Parexel Int'l, LLC, ARB Case No. 07-123, 2011 WL 2165854, at *11 (DOL, May 25, 2011) (noting Congressional intent to "impose the normal reasonable person standard used and interpreted in a wide variety of legal contexts."). As to scope, Congress intended to encompass within the whistleblower provision's protections "[a]ll good faith and reasonable reporting of fraud." Id. at 12 (quoting Van Asdale v. Int'l Game Tech., 577 F.3d 989 (9th Cir. 2009) (citing 148 Cong. Rec. S7418-01, S7420 (daily ed. July 26, 2002))).
"To satisfy the subjective component of the 'reasonable belief' test, the employee must actually have believed that the conduct he complained of constituted a violation of relevant law." Id. at *12. Expounding on the subjective prong of this standard, the Third Circuit has specified that "[t]he [employee's] communication itself need not reveal all the facts that would cause a reasonable person with the whistleblower's training and background to conclude that a referenced federal law has been or will be violated. That determination should be based upon all the attendant circumstances, and not be limited to the facts conveyed by a whistleblower to the employer." Wiest I, 710 F.3d at 134. Further, the employee's belief that a violation exists "must be grounded in facts known to the employee, but the employee need not wait until a law has actually been broken to safely register his or her concern." Sylvester, 2011 WL 2165854, at *11. See Wiest I, 710 F.3d at 133 (holding that a protected report may pertain to an SOX-violation that has not yet occurred "as long as the employee reasonably believes that the violation is likely to happen."). Still, the whistleblower claim must be based on an "an extant or likely, not theoretical or hypothetical, violation of the law." Lamb v. Rockwell Automation, Inc., 249 F.Supp.3d 904, 193 (E.D. Wis. 2017).
"[A] belief is objectively reasonable 'when a reasonable person with the same training and experience as the employee would believe that the conduct implicated in the employee's communication could rise to the level of a violation of one of the enumerated provisions in Section 806.'" Westawski v. Merck &Co. ("Westawski I"), 215 F.Supp.3d 412, 423-24 (E.D. Pa. 2016) (emphasis added) (quoting Wiest I, 710 F.3d at 132). "Although a plaintiff is not required to show 'a reasonable belief that each element of a listed anti-fraud law is satisfied,' she must still 'have an objectively reasonable belief of a violation of one of the listed federal laws.'" Id. (emphasis in original).
At summary judgment, we note that "[t]he issue of objective reasonableness should be decided as a matter of law only when 'no reasonable person could have believed' that the facts amounted to a violation. . . ." Sylvester, 2011 WL 2165854, at *13 (quoting Livingston v. Wyeth, Inc., 520 F.3d 344, 362 (4th Cir. 2008) (Judge Michael, dissenting) (quoting Clark Cty. Sch. Dist. v. Breeden, 532 U.S. 268, 271 (2001))).
Here, GSK argues that summary judgment is appropriate because Mr. Reilly's complaints were not based on an objectively reasonable belief that GSK's conduct violated SEC rules covered by Sarbanes-Oxley. Def. Mot. at 43. In evaluating Plaintiff Reilly's reasonable belief that GSK omitted material facts about computer risks from its required annual reports to the SEC, we consider that Plaintiff's responsibilities as Senior Consultant for the AS/400 system were to design, engineer, and deliver AS/400 servers, as well as to remediate server performance issues. Reilly Depo. at 57; Def. Ex. 8 at ¶¶4, 7. It is undisputed that Mr. Reilly was responsible for configuring GSK's AS/400 servers to honor the company's internal controls, yet he was not responsible for setting internal security controls. Reilly Depo. at 69-70; Def. SUMF ¶3. Id.
Next, we consider Plaintiff's subjective belief that GSK's conduct constituted a violation. Plaintiff understood Sarbanes-Oxley this way: "Sarbanes-Oxley doesn't have any particular rules other than you follow your own rules and your own internal controls are effective." Reilly Depo. at 69. "....If you're on a plant floor manufacturing pharmaceutical drugs and every time you hit 'enter' you have to wait 15 minutes, that's a problem." Id. at 253-356. Plaintiff believed the company had an obligation to disclose to the SEC "if [a computer] goes down for an hour and comes back up once a week for a year." Id. at 265. In Plaintiff's view, GSK failed to follow its internal controls by omitting the intricacies of computer performance issues from their annual SEC reports. Id. at 250. When asked during his deposition why he believed the company's disclosures were inadequate, Plaintiff responded, "they're throwing out 'what-ifs' but they're not disclosing that . . .internal controls are failing." Id. at 263.
Next, we move on to the objective prong of evaluating Plaintiff's reasonable belief that the conduct he complained of violated SOX. We find that notwithstanding Mr. Reilly's dissatisfaction with the specificity of the company's disclosures, GSK did disclose the "[r]isk to the Group's business activity if critical or sensitive computer systems or information are not available when needed, are accessed by those not authorized, or are deliberately changed or corrupted." Def. Ex. 30 at 8. Specifically, the company reported the risk to their business posed by "[f]ailure to adequately protect critical and sensitive systems and information....which could materially and adversely affect our financial results. . . .[t]here is the potential that malicious or careless actions expose our computer systems or information to misuse or unauthorised disclosure." Def. Ex. 29 at 10; Def. Ex. 30 at 9. Additionally, the company identified the risk of "[f]ailure to comply with current Good Manufacturing Practice requirements in commercial manufacture, . . . through inadequate controls. . .and in supporting regulated activities." Id. at 3.
Based on these facts, we agree with Defendant that "[n]o reasonable person in [Mr. Reilly]'s place, with [his] training and experience, could have believed that [GSK's] conduct violated SOX." Lamb, 249 F.Supp. at 193. As in Westawkski II, where the Third Circuit found that the plaintiff's reports were not protected because she failed to explain how [her employer's] conduct was fraud [under SOX], 739 Fed.Appx. at 152-3, Mr. Reilly's complaints regarding computer stability and security are similarly disconnected from shareholder fraud.
This case is more like Safarian v. Am. DG Energy Inc. ("Safarian II"), 622 Fed.Appx. 149 (3d Cir. 2015), in which the Third Circuit affirmed the District Court's holding that the plaintiff's report of "overbilling, improper construction, and the failure to obtain proper permits to Defendant's employees," was not protected under Section 806. Safarian I, 2014 U.S. Dist. LEXIS at *12. The plaintiff argued that "he reasonably believed that the fraudulent billing of customers 'result[s] in misstatement[s] of accounting records to . . . shareholders and fraudulent tax submissions to [the] Internal Revenue Service.'" Id. On the contrary, the New Jersey District Court held "[t]hough overbilling might eventually lead to incorrect accounting records and tax submissions, these kinds of disclosures were not contemplated by the statute, have not been protected by other courts, and should fall outside the scope of the Sarbanes-Oxley Act." Id.
Here, Plaintiff Reilly has not established facts showing that his complaints about computer security were even remotely related to fraud of any kind, either at the time of his complaints or in the future; "far too attenuated from the welfare of the shareholders to fall within the SOX ken." Lamb, 249 F.Supp.3d at 918. No factfinder could find Plaintiff's belief that GSK violated SOX by not naming precise server issues to be objectively reasonable. Therefore, summary judgment on Plaintiff's SOX whistleblower claim is appropriate.
We note that Plaintiff has argued in the alternative that he suffered a hostile work environment, as opposed to a discrete discharge. No matter. Analyzing the "unfavorable personnel action" through the lens of a hostile work environment does not create a material issue as to the objective reasonableness of Plaintiff's belief that he was reporting a violation of SOX. See 49 U.S.C.S. § 42121 (B) (setting forth the legal burdens of proof that govern SOX whistleblower claims under § 1514A).
IV. CONCLUSION
For the foregoing reasons, Defendant's Motion for Summary Judgment is GRANTED. An appropriate Order will follow.