Opinion
CIVIL ACTION No. 17-cv-2045
07-16-2019
THOMAS REILLY, Plaintiff, v. GLAXOSMITHKLINE, LLC, Defendant.
MEMORANDUM Joyner, J.
Before the Court are Defendant GlaxoSmithKline, LLC's ("GSK") Motion for Summary Judgment (Doc. No. 33), Plaintiff Thomas Reilly's ("Reilly") Opposition thereto (Doc. No. 39), and Defendant's Reply in Support thereof (Doc. No. 40). For the reasons set forth below, the Court GRANTS Defendant's Motion.
I. Factual Background
Plaintiff Thomas Reilly ("Reilly") alleges that he was wrongfully discharged by his former employer, Defendant GlaxoSmithKline ("GSK"), in retaliation for reporting his concerns pertaining to computer stability and security in GSK's global manufacturing and financial servers. See Compl. ¶¶64-66. Defendant has moved for summary judgment on Plaintiff's claim that GSK violated the corporate whistleblower provision of the Sarbanes-Oxley Act ("SOX," "Act"), 18 U.S.C.S. § 1514A.
For sixteen years, Plaintiff Reilly was employed by Defendant GSK, a publicly traded global pharmaceutical company in the Information Technology ("IT") Department. Compl. ¶6 (Doc. No. 1). In 2003, Mr. Reilly was promoted from Analyst to Senior Consultant for the AS/400 Computer System ("A/S 400"). Reilly Deposition, ("Reilly Depo."), Def. Ex. 4 at 38-39; Pl. Ex. 1 at 38-39. The AS/400 is a computer operating system manufactured by IBM that hosts manufacturing and financial applications for portions of GSK's business. Miller Deposition, Def. Ex. 5 at 29-30; Taylor Deposition, Def. Ex. 6 at 18, 30-33; Def. Ex. 7 at 40; Miller Declaration, Def. Ex. 8 at ¶3. GSK has a "backup system" for the AS/400 that saves all information in the event of an outage that lasts continuously for 24 hours or more. Def. Ex. 8 at ¶4; Def. Ex. 6 at 111. GSK has never needed to use this system. Mong Deposition, Def. Ex. 9 at 83-84. GSK does not consider a server shut-down of less than 24 hours to have a "significant business impact." Def. Ex. 6 at 111.
A. Alleged Protected Activity: Complaints Regarding Computer Stability and Security
To better understand the context of Plaintiff Reilly's claim that GSK retaliated against him in violation of the whistleblower provision of the Sarbanes-Oxley Act, we will set out relevant requirements for corporate disclosures to the SEC, since SOX requires compliance with SEC rules and regulations. To satisfy SOX's requirements for complying with SEC rules and regulations, a qualifying corporation, like GSK, is required to file "periodic reports" in which high-level corporate officer(s) certify that based on their knowledge, the report does not contain untrue statements or material omissions. 15 U.S.C. § 7241(a)(1)-(2). Further, for the certifications to be SOX-compliant, signatory officers must certify that based on their evaluation, internal controls are effective. Id. at §7241(a)(4). Additionally, signatory officers are required to certify that they have disclosed to the company's auditors "significant deficiencies in the design or operation of internal controls which could adversely affect" reporting on financial data, and any fraud involving anyone with a "significant role" in the internal controls of the company. Id. at §7241(a)(5)(A)-(B). Also relevant is Section 404 of the Sarbanes-Oxley Act, which requires a company's annual SEC report to contain an internal control report, 15 U.S.C.S. § 7262 (a); further, a public accounting firm tasked with auditing the issuing company must attest to the company's evaluation of its financial reporting controls. Id. at § 7262 (b).
As a Senior Analyst in GSK's IT department, Mr. Reilly was a member of the AS/400 Service Team ("AS/400 Team") which was dedicated to maintaining the AS/400 operating system. Def. Ex. 8 at ¶4. Mr. Reilly's job responsibilities entailed designing, engineering, and delivering the AS/400 servers, in addition to remediating performance and security issues relating to them. Reilly Depo. at 43; Def. Ex. 8 at ¶4. Mr. Reilly did not have responsibility for setting internal security controls. Reilly Depo. at 69.
In late 2011, Plaintiff Reilly reported to his AS/400 Team co-worker, Rick Oberholzer ("Oberholzer"), that he was concerned with performance instability in computer servers on the AS/400 system that he attributed to Mr. Oberholzer's decision to implement uncapped processors. Id. at 75. Uncapping processors allows a server to use available CPU capacity from another server. Id. at 80. However, Mr. Reilly perceived that enabling uncapped processors posed a risk to the stability of GSK's servers for two reasons. First, uncapping processors does not automatically add memory to a server. Second, uncapping processors can cause the computer's memory component to "thrash" or "lock up." Id. Notedly, adding additional memory to the server could prevent the risk of "lock up," while an uncapped processor is enabled. Id. at 81. Nevertheless, after the uncapped processors were enabled, GSK users experienced lost orders, "bad performance," and "corrupted data" (which, in Plaintiff's words, means "a lot of different things," from "the data is garbage to the files are out of sync to something doesn't get reported or recorded."). Id. at 105-106.
When Plaintiff told Mr. Oberholzer that he disagreed with his decision to enable uncapped processors, Mr. Oberholzer screamed at him. Id. at 85-86, 88. The confrontation was witnessed by Robert Mattie ("Mattie"), a Senior Director (a level above Mr. Reilly's manager at the time, Brian Gillies, who was on vacation that week). Id. According to Mr. Reilly, Mr. Mattie blamed Mr. Reilly for the confrontation. Mr. Reilly believes that his career was "irreparably damaged" by Mr. Mattie's perception of this altercation. Id. at 89.
In April 2012, Reilly emailed his supervisor, AS/400 Service Manager, Jo Taylor ("Taylor") detailing his concerns regarding server performance along with security risks that could have implications for an SOX audit. See Doc. No. 39-1, Pl. Ex. 7 at 106; Def. Ex. 11. Ms. Taylor responded two days later by email, stating, in sum, that she believed it "was IBM's recommendation to turn on Shared Processors, so I would like IBM to review this data and work with you to resolve." Ms. Taylor's email went on to say that in the meantime, the AS/400 Team should monitor the server response times over a 24-hour period, and that if performance issues persisted during a full 24 hours, "then I'll authorise [sic] turning the shared processing off" as the AS/400 Team continued to monitor and track server performance. Def. Ex. 12.
In January 2013, in response to a communication by a GSK employee, Sony Leons, that users were complaining about "screen to screen time lag," Ms. Taylor placed Mr. Reilly in charge of remediating poor performance on GSK's AS/400 India Server. Def. Ex. 12; Reilly Depo. at 136-137. Mr. Reilly's analysis attributed the performance issues to uncapped processors; he emailed Ms. Taylor as such. Def. Ex. 12.
Shortly thereafter, Mr. Reilly again alerted Ms. Taylor to server performance problems including memory and response time-lag. On January 16, 2013, Ms. Taylor responded in an email to Mr. Reilly stating, "[I] [u]nderstand but let's keep focus and scope tight on the audit. We do not want [PriceWaterhouseCoopers, GSK's external auditor at the time] picking up any insights that are not part of the current scope." Pl. Ex. 8 at 109.
On January 23, 2013, Mr. Reilly emailed Ms. Taylor's supervisor, Steve Miller ("Miller"), Vice President of Enterprise Systems and Technologies, to report the same concerns regarding server stability and uncapped processors which he brought to Ms. Taylor's attention earlier that month. Def. Ex. 6 at 63-65; Def. Ex. 13.
On February 18, 2013, an IBM representative emailed Mr. Reilly to address his concerns. The IBM representative wrote, "[r]egarding uncapped verses capped [processors], there is no right or wrong answer. It depends on the workload and what other resources are assigned. If you choose to run uncapped the demand for memory and IO will increase as processor is added. My suggestion would be to increase memory. . . ." Def. Ex. 14. The same representative later emailed both Ms. Taylor and Mr. Reilly that he "would not have suggested" using uncapped processors. Pl. Ex. 10. Mr. Oberholzer was later assigned to cap the processors. Reilly Depo. at 131. GSK eventually purchased additional memory to help remediate the risk that a server could "lock-up." Reilly Depo. at 81. Ultimately, performance issues persisted on the GSK India server even after the processors were capped. Reilly Depo. at 132-136, 139-141.
In 2013, Plaintiff Reilly reported additional concerns about computer security. Namely, AS/400 "users that are identified as having more authority than the standard or [GSK's] system access management plan would" allow. Reilly Depo. at 113-117. Mr. Reilly was placed in charge of remediating these "access privileges" issues. Id. Eventually, Ms. Taylor took over the remediation effort and addressed the security risk. Def. Ex. 6 at 152-154.
Dissatisfied with GSK's response to his previous complaints, on January 2, 2014, Plaintiff escalated his complaints to GSK's Global Compliance Office, through the company's internal "Speak Up" line. His complaint detailed his concerns with AS/400 server performance issues and his disagreement with Mr. Oberholzer about enabling uncapped processors.
Nearly a year later, on January 15, 2015, Plaintiff again escalated his complaints to Andrew Witty ("Witty"), GSK's CEO. Def. Ex. 26; Reilly Depo. at 230. Plaintiff's email to CEO Witty stated his fear that due to the computer stability and security concerns he had reported previously, the company was not in compliance with its internal Code of Conduct and "Corporate Integrity Agreement with the Department of Justice and The Department of Health and Human Services which specifically requires we honor our . . . Code of Conduct [policies and procedures]." Def. Ex. 26 at 6. It was Mr. Reilly's belief that the company's certifications to the SEC in 2013 and 2014 falsely claimed compliance with GSK's internal code of conduct, and thereby violated Sarbanes-Oxley, which requires compliance with SEC rules that mandate corporate disclosure of the effectiveness of internal controls. Mr. Reilly went on in his email to CEO Witty that he had reviewed the company's 2013 annual report to the SEC ("Form 20-F") and believed it materially omitted reference to "any of these serious performance, security, quality, compliance issues, risk management or corporate responsibility deficiencies. . . ." Id.
B. Investigation of Mr. Reilly's Complaints
After Plaintiff complained to GSK's Global Compliance Office in 2014, GSK assigned Global Compliance Officer Michael Woods ("Woods"), who had responsibility over IT and HR, to lead an internal investigation. Def. Ex. 21 at 10, 13, 30, 32. Plaintiff and Mr. Woods communicated about his complaints from January through approximately May 2014.
In September 2014, Mr. Woods issued a report from GSK's investigation, which found Mr. Reilly's complaints unsubstantiated. Def. Ex. 24 at GSK010589. The report acknowledged that "there are some aspects of access management and privileges which should be reviewed and remediated if found to be overly broad." Id.
Following Mr. Reilly's report to CEO Witty, GSK conducted another internal investigation into his complaints, headed by Jason Lord ("Lord"), Director of Corporate Investigations. Def. Ex. 26; Def. Ex. 28 at 22-23. GSK maintains that Mr. Lord's investigation is privileged. Def. Ex. 26.
C. GSK's SEC Disclosures
The following disclosures by GSK on its 2013 and 2014 Form 20-F are undisputed. Def. Ex. 29; Def. Ex. 30, Pl. Ex. 31. Both certifications certified that
[t]he company's other certifying officer and I, [GSK CEO Andrew Witty] have disclosed, based on our most recent evaluation of internal control over financial reporting, to the company's auditors and the audit committee of the company's board of directors. . .all significant
deficiencies and material weaknesses in the design or operation of internal control over financial reporting which are reasonably likely to adversely affect the company's ability to record, process, summarize and report financial information; and (b) any fraud, whether or not material, that involves management or other employees who have a significant role in the company's internal control over financial reporting.Def. Ex. 29; Def. Ex. 30, Pl. Ex. 31. The disclosure form goes on to explain that "[t]he principal risks discussed [therein]. . . .are the risks and uncertainties relevant to our business, financial condition and results of operations that may affect our performance and ability to achieve our objectives." Def. Ex. 29 at 3; Def. Ex. 30 at 3.
What's more, the 2013 and 2014 20-F Reports identify numerous risk impacts to the company. Specifically, that
[f]ailure to adequately protect critical and sensitive systems and information may result in . . . business disruption including litigation or regulatory sanction and fines, which could materially and adversely affect our financial results. . . .We rely on critical and sensitive systems and data, such as . . . manufacturing systems. . . . There is the potential that malicious or careless actions expose our computer systems or information to misuse or unauthorised disclosure.Id. at 10; Id. at 9. Additionally, the company disclosed its "[f]ailure to comply with current Good Manufacturing Practice requirements in commercial manufacture, . . . through inadequate controls. . .and in supporting regulated activities." Id. at 3. Finally, GSK disclosed the "[r]isk to the Group's business activity if critical or sensitive computer systems . . .are not available. . ., are accessed by those not authorized, or are deliberately changed or corrupted." Id. at 8.
D. Alleged Unfavorable Personnel Action: Outsourcing the AS/400 Team Positions
In 2013, GSK started a program to reorganize the End User and Infrastructure Services ("EIS") Department, of which Mr. Reilly was a member. Def. Ex. 19 at ¶2-4. As part of the reorganization of EIS, in December 2013, GSK decided to outsource the AS/400 system to a third party vendor, Blue Chip. Def. Ex. 8 at ¶5; Def. Ex. 9 at 139-140; Reilly Depo. at 166.
In March 2014, GSK announced the outsourcing. It was at this time that Plaintiff was made aware that every position in the AS/400 Team was being eliminated, except for Jo Taylor's, who remained as manager, and one AS/400 Service Analyst position. Mr. Reilly was invited to apply for the remaining Analyst position, along with Mr. Oberholzer and another co-worker, Mr. Mong ("Mong"). Reilly Depo. at 166-167, 169, 186-187; Def. Ex. 8 at ¶7. On May 6, 2014, Henry Bolton ("Bolton") (then the acting AS/400 Service Manager while Ms. Taylor was out on leave), informed the AS/400 Team that pursuant to the outsourcing, any AS/400 Team members who were not selected for the remaining Analyst position would be terminated, effective September 28th, 2014. Def. Ex. 22; Reilly Depo. at 186.
Plaintiff understood that the outsourcing would eliminate the AS/400 Team except for manager and one Service Analyst role. Reilly Depo. at 190. In fact, he testified that he was informed by GSK that if he chose not to apply for the Service Analyst role, he would be "agreeing to be let go," as was also the case for his AS/400 Team co-workers, Mike Bacon, Steve Farden, and Rick Oberholzer. Reilly Depo. at 169. Nonetheless, Mr. Reilly decided not to apply for the Analyst position. Reilly at 184-185. Mr. Mong, who had applied for the position, filled the role. Def. Ex. 8 at ¶7.
Mr. Reilly maintains that he did not apply for the Service Analyst position that would remain after the AS/400 Service was outsourced to a vendor because he assumed that his position would be "protected." Reilly Depo. at 188. "I was in a different situation [from the other AS/400 Team employees] because I was escalating to Global Compliance, and they were trying to save my job." Id. "I was living in parallel realities. One was Michael Woods was telling me I was protected. . ., and the other was GSK IT telling me that I was going to be terminated." Id. "I was going on the word of Michael Woods who had instructed me that based on what I showed him I could not be wrongfully terminated for making serious allegations and he was going to protect me. So, in my mind, I was not going to be terminated." Reilly Depo. at 171, 172.
In fact, GSK has an anti-retaliation policy entitled, "Safeguarding GSK Employees Who Report Unethical or Illegal Conduct" ("Safeguarding Policy"). Def. Ex. 23. The policy requires GSK compliance investigators to communicate the existence of the policy to employees involved in an internal investigation. Def. Ex. 23. The policy does not state that GSK will keep or create a job for an employee whose job has been outsourced, in the event that an investigation substantiates an employee's complaints. See generally, Def. Ex. 23.
After Mr. Reilly declined to apply for the AS/400 Service Analyst position that would remain after the Service was outsourced, the date on which the termination of his position would become effective changed more than once. Initially, Mr. Bolton's (acting-manager of the AS/400 Team at the time) May 6, 2014 email stated that Plaintiff's termination would become effective in September 2014. Yet, Plaintiff had also been told his termination could become effective as early as June 2014, immediately following his decision not to apply for the Service Analyst position. Reilly Depo. at 204. GSK rescinded that date too, pushing the date to October 2014. Id.
Before any effective termination dates arrived, Mr. Reilly took a short-term disability leave in early July 2014, during which his "official notification of separation" was "postponed." Reilly Depo. at 205; Def. Ex. 19 at ¶6.
Following his leave, Mr. Reilly returned to work in January 2015. Reilly Depo. 203, 232-233. Mr. Reilly testified that he believed that upon his return, his position would not be outsourced, reasoning that if his complaints were substantiated by the company's investigation, GSK would fire his manager, Ms. Taylor, and promote Plaintiff to her position. Id. at 231. See id. (". . .[M]aybe I was naive, I was just thinking it's just a matter of time before they see that Jo Taylor has just screwed everything up and she's covering things up and it's a disaster, and they're going to come back and say, 'Tom, my God, we need you.'").
On January 21, 2015, Michelle Mulkern, GSK's HR Director for Global Support Functions from 2014 to 2015, sent Mr. Reilly a memo with the subject "Administrative Leave," stating that
[t]he purpose of this letter is to update you about your employment status at [GSK] and provide some background details leading to this status. On January 28, 2014, the Phase 2 CBS it [EIS] proposed organization change was communicated and that you would be a part of a reduction in force. . . . As a result of your short-term disability leave of absence . . ., the official notification was postponed until your return to work status, January 2, 2015. On January 15, 2015, you brought to our attention matters which . . .require an internal investigation. At this time, we are going to postpone your January 23, 2015 official notice of separation from [GSK] and place you on paid administrative leave during the pending investigation. . . . We will get back to you following the outcome of the investigation regarding your employment status.Def. Ex. 19 (A).
On April 8, 2015, Mr. Lord, lead corporate investigator for the second internal investigation into Plaintiff's complaints, notified Mr. Reilly that based on the outsourcing of the AS/400 Team, his "official notification of separation from GSK is 8th April 201[5]." Def. Ex. 32. Mr. Reilly's last day of employment was June 30, 2015. Reilly Depo. at 283, 284, 309.
On July 20, 2015, Plaintiff Reilly filed a complaint with the Occupational Safety and Health Administration ("OSHA") ("SOX Complaint," Def. Ex. 1). On September 6, 2016, the Secretary of Labor, acting through the Regional Administrator, dismissed Plaintiff's SOX Complaint as untimely. See Def. Ex. 2. When Plaintiff appealed, an ALJ issued an Order consistent with the Secretary of Labor's Findings and also dismissed Plaintiff's SOX Complaint as untimely. See Def. Ex. 3 at 11-13. On March 3, 2017, Plaintiff Reilly filed his Petition for Review of the ALJ's decision with the Administrative Review Board ("ARB"). On May 4, 2017, Plaintiff filed his Complaint in this matter. ("Compl.", Doc. No. 1).
This Motion is fully briefed and ripe for the Court's adjudication. The Court has considered the parties' submissions and decides this matter without oral argument. Fed. R. Civ. P. 78; Loc. R. Civ. P. 7.1(f).
II. Legal Standard
Summary judgment is appropriate "if the movant shows that there is no genuine dispute as to any material fact and the movant is entitled to judgment as a matter of law." Fed. R. Civ. P. 56(a). A court deciding a motion for summary judgment must view the facts in the light most favorable to the non-moving party and draw all inferences in that party's favor. Matsushita Elec. Indus. Co. v. Zenith Radio Corp., 475 U.S. 574, 587 (1986) (quoting United States v. Diebold, Inc., 369 U.S. 654, 655 (1962)). Nonetheless, "[u]nsupported assertions, conclusory allegations, or mere suspicions are insufficient to overcome a motion for summary judgment." Betts v. New Castle Youth Dev. Ctr., 621 F.3d 249, 252 (3d Cir. 2010).
A dispute is "genuine" if the non-movant shows evidence on which a "reasonable [fact-finder] could return a verdict" in their favor. Anderson v. Liberty Lobby, Inc., 477 U.S. 242, 248 (1986). A "material" dispute "'might affect the outcome of the suit under the governing law.'" Wiest v. Tyco Elecs. Corp., No. 10-3288, 2015 U.S. Dist. LEXIS 47935 at *14-15 (E.D. Pa. Apr. 10, 2015) (citing Kaucher v. Cnty. of Bucks, 455 F.3d 418, 423 (3d Cir. 2006) (quoting Anderson, 477 U.S. at 248).
The burden is on the movant "to show that the plaintiff has failed to establish one or more essential elements of her case." Brown v. Aria Health, No. 17-1827, 2019 U.S. Dist. LEXIS 66266 at *9-10 (E.D. Pa. Apr. 17, 2019) (quoting Burton v. Teleflex Inc., 707 F.3d 417, 425 (3d Cir. 2013)). This burden can be met by "pointing out to the district court that there is an absence of evidence to support the nonmoving party's case." Celotex Corp. v. Catrett, 477 U.S. 317, 325 (1986). Once the moving party meets their initial burden, the non-moving party must "go beyond the pleadings" and "designate specific facts" that create a "genuine issue for trial." Celotex, 477 U.S. at 324.
"[T]he mere existence of a scintilla of evidence in support of [the non-movant's] position," "will not defeat an otherwise properly supported motion for summary judgment." Anderson, 477 U.S. at 247-48, 252. Summary judgment is appropriate if the non-moving party fails to rebut by making a factual showing "sufficient to establish the existence of an element essential to that party's case, and on which that party will bear the burden of proof at trial." Wiest v. Tyco Elecs. Corp., No. 10-3288, 2015 U.S. Dist. LEXIS 47935 (E.D. Pa. Apr. 10, 2015) (citing id. at 322).
III. Discussion
Section 806 of the Sarbanes-Oxley Act provides corporate employees protection from retaliation by their employers for reporting fraud or a violation of an SEC rule or regulation by a covered company or one of its employees. See generally 18 U.S.C.S. § 1514A(a). See Wiest v. Lynch, ("Wiest I") 710 F.3d 121, 129 (3d Cir. 2013) (quoting id. at § 1514A). Plaintiff Reilly claims that his complaints are protected by the SOX whistleblower provision for two reasons: first, he believes GSK failed to disclose material information regarding breakdowns in internal controls; second, after he reported his complaints to the company, his work unit was outsourced, an internal investigation found that his complaints were unsubstantiated, and his position was eventually terminated. The focus of Defendant GSK's motion for summary judgment is twofold: first, that Mr. Reilly's SOX Complaint was not timely filed and should be barred by the statute of limitations; and second, that Mr. Reilly is not a whistleblower within the scope of SOX's protections because his complaints about computer stability and security are too attenuated from corporate fraud. Further, Defendant argues that even if Plaintiff's complaints are protected by the Act, Mr. Reilly has failed to establish causation. In other words, that Mr. Reilly cannot establish a material dispute as to whether his complaints were a contributing factor in GSK's decision to outsource his position.
Relevantly, the SOX whistleblower provision provides that "[n]o company with a class of securities registered under section 12 of the Securities Exchange Act of 1934 (15 U.S.C. 78l), or that is required to file reports under section 15(d) of the Securities Exchange Act of 1934 (15 U.S.C. 78o(d)). . .or any officer, employee, contractor, subcontractor, or agent of such company. . . may discharge, demote, suspend, threaten, harass, or in any other manner discriminate against an employee in the terms and conditions of employment because of any lawful act done by the employee." 18 U.S.C.S. § 1514A(a).
In the Plaintiff's opinion, the company's disclosures on its 2013 and 2014 annual reports to the SEC were not specific enough in naming the computer risks he had brought to the company's attention.
1. Timeliness
As a threshold issue, Defendant argues that Plaintiff's retaliation claim is time-barred by the 180-day statute of limitations for filing a whistleblower complaint under SOX. The thrust of Defendant's procedural argument is that Mr. Reilly was made aware of GSK's decision to eliminate his position, via outsourcing, in March 2014, yet Mr. Reilly waited to file his claim with OSHA until July 20,2015.
Plaintiff avers that he did not receive final, definitive notification that his position would be eliminated until April 8, 2015. It is this date that Mr. Reilly argues should trigger the running of the statute of limitations. Plaintiff acknowledges that GSK announced the outsourcing in March 2014. Yet, he establishes evidence that GSK postponed his official notification of termination more than once; and, further, that personnel employees used language that Mr. Reilly interpreted to mean that the outcome of the investigation might "save" his job. Reilly Depo. at 196.
On April 8, 2015, Mr. Reilly received an email from Mr. Lord (who had led the second internal investigation into Mr. Reilly's complaints) stating that his "official notification of separation from GSK is 8th April 2015 (sic)." Def. Ex. 32.
The first step for a plaintiff seeking protection from retaliation under SOX is to file for an administrative resolution. "Before an employee can assert a cause of action in federal court under [SOX], the employee must file a complaint with the Occupational Safety and Health Administration ("OSHA") and afford OSHA the opportunity to resolve the allegations administratively." Willis v. Vie Fin. Grp., Inc., No. 04-435, 2004 U.S. Dist. LEXIS 15753 at *8 (E.D. Pa. Aug. 6, 2004) (citing 18 U.S.C.S. § 1514A (b)(1)(A)). A plaintiff has 180 days to file their SOX Section 806 complaint with OSHA after the date on which the violation [of SOX] occurs, or after the plaintiff became aware of the violation. See 18 U.S.C.S. § 1514A (b)(2)(D); 29 C.F.R. § 1980.103 (a, d).
A plaintiff's awareness of the SOX violation, which starts the limitations period running, is marked by when the employer makes and reasonably communicates the discriminatory adverse employment decision to the employee. Delaware State College v. Ricks, 449 U.S. 250, 258 (1980). Ricks focused on when the "decision was made" and when an employee was "notified," not when the employer's adverse employment decision took effect. Ricks, 449 U.S. at 258. See Sneed v. Radio One, Inc., 2007-SOX-18, 2007 WL 7135802 at *4 (A.L.J. Apr. 16, 2007) (citing Halpern v. XL Capital, LTD., 2004 SOX 54 (ARB) (Aug. 31, 2005)) (holding that a "violation" under the whistleblower provision occurs, for the purpose of starting the statute of limitations, "when the employer communicates to the employee its intent to implement an adverse employment decision, rather than the date the employee experiences the consequences"). Also relevant, "a notification of termination to be executed on a future certain date is sufficient to trigger the running of the filing time limit." Sneed, 2007 WL 7135802 at *3 (citing Chardon v. Fernandez, 454 U.S. 6 (1981)).
Essentially, "[f]or the clock to start, the complainant must have received final, definitive, and unequivocal notice of an adverse employment decision." Id. at *4. "Final" and "definitive" notice denotes communication that is decisive or conclusive, i.e., leaving no further chance for action, discussion, or change. "Unequivocal" notice means communication that is not ambiguous, i.e., free of misleading possibilities. Id. (citing Halpern v. XL Capital, LTD., 2004 SOX 54 (ARB) (Aug. 31, 2005) (citing Jenkins v. United States Envtl. Prot. Agency, 1988-SWD-2 (ARB) (Feb. 28, 2003))). See also Smith v. Potter, 445 F.3d 1000 (7th Cir. 2006) (quoting Flannery v. Recording Indus. Ass'n of Am., 354 F.3d 632, 637 (7th Cir. 2004)) ("'(1) there must be a final, ultimate, non-tentative decision to terminate the employee'; and (2) 'the employer must give the employee 'unequivocal' notice of its final termination decision.'").
The standard for assessing whether the plaintiff received "final, definitive, and unequivocal notice of an adverse employment decision. . ." is "an objective one, based not on what the complainant subjectively thought, but rather what a reasonable person in her position would have understood." Id. (citing E.E.O.C. v. United Parcel Service, Inc., 249 F.3d 557, 562 (6th Cir. 2001) ("[o]nce the employee is aware or reasonably should be aware of the employer's decision, the limitations period commences."). See also Jakimas v. Hoffmann-LaRoche, Inc., 485 F.3d 770, 780 (3d Cir. 2007) (applying the "accrual rule from Ricks" and Chardon, and holding that an employee's retaliatory discharge claim under §510 of ERISA "accrues when the decision to terminate is made and the employee is informed of the pending termination.").
Here, the threshold determination at summary judgment is whether Plaintiff Reilly has established a genuine dispute as to the objective reasonableness of his belief that GSK had wavered from their decision to terminate his employment by outsourcing. The Supreme Court in Ricks focused the timeliness inquiry on whether the employer's communication to the plaintiff suggested that their earlier decision to terminate his employment was "in any respect tentative." Ricks, 449 U.S. at 261. There, an employee argued that a grievance procedure through which he challenged a prior tenure decision should have reset the limitations clock. The Court disagreed, holding that the "unbroken array of negative decisions" (the tenure committee's recommendation to deny tenure, the Senate vote to support the tenure committee's recommendation, and the Board of Trustees' formal vote to deny plaintiff tenure) showed that the College "had established its official position - and made that position apparent to [plaintiff]" before the "Board notified Ricks that his grievance had been denied." Id. at 262, 260. In the Court's view, the grievance procedure was a "remedy for a prior decision, not an opportunity to influence that decision before it is made (emphasis in original)." Id. at 261. Therefore, notwithstanding the Board's "willingness to change its prior decision if Ricks's grievance were found to be meritorious," the Board's initial notification of their decision to deny tenure was sufficiently final to trigger the limitations period. Id.
In this case, it is undisputed that Plaintiff first became aware of GSK's decision to outsource his position by May 2014, when Mr. Bolton, his supervisor at the time, sent him an email communicating the following: First, that the AS/400 Team member positions would be outsourced. Second, that any AS/400 Team member who was not hired as the sole remaining AS/400 Service Analyst would be notified in August 2014 of their official termination. And third, that the termination would be effective in September 2014.
It is also undisputed that GSK changed the effective termination date of Plaintiff's position more than once. After Plaintiff declined to be considered for the AS/400 Service Analyst position that would remain after the outsourcing, GSK changed the effective date of his termination from September 2014, to June 2014; then changed it again to October 2014. Reilly Depo. at 204.
Finally, Mr. Reilly has established a material issue as to whether Mr. Woods, who led the first internal investigation into his complaints, communicated to him that the outcome of the investigation could change GSK's decision to terminate him. Although GSK disputes Mr. Woods's communications, Reilly Depo. at 171, Plaintiff maintains that he understood the company's safeguarding policy to mean "[y]ou can't be terminated." Id. at 207. See id. at 172-175 ("[Mr. Woods] said I could not be terminated if my allegations were true.").
Defendant argues that Plaintiff's belief that he would be promoted after the investigation into his complaints is objectively unreasonable because he was aware that all AS/400 Team positions would be eliminated through the outsourcing except the Service Analyst role that he chose not to apply for, and he had never been promoted to a managerial position during his 16-year tenure as a GSK employee.
However, we find otherwise. Here, the internal investigation into Plaintiff Reilly's complaints was not, as in Ricks, a "grievance, or some other method of collateral review of an employment decision," which "does not toll the running of the limitations periods." Ricks, 449 U.S. at 261 (citing Electrical Workers v. Robbins & Myers, Inc., 429 U.S. 229 (1976)). Plaintiff has established language in Ms. Mulkern's memo during the pendency of GSK's internal investigation, stating "[w]e will get back to you following the outcome of the investigation regarding your employment status." Def. Ex. 19 (A). More, Plaintiff testified that Mr. Woods communicated that the company's "safeguarding" policy could "save" his job. Thus, as the court found sufficient to establish a genuine dispute in Clark v. Resistoflex Co., here, this evidence shows "mixed official signals" regarding whether Mr. Reilly's termination would take effect. Clark v. Resistoflex Co., Div. of Unidynamics Corp., 854 F.2d 762, 766 (5th Cir. 1988). We find this evidence to be "collectively sufficient to cast doubt upon whether a reasonable employee in [Reilly]'s position should have known that he had been discharged." Id. Based on this material issue as to whether Plaintiff's SOX Complaint is time-barred, we will proceed to considering the merits of his retaliation claim.
See id. (reversing the District Court's decision to grant summary judgment for the employer on timeliness grounds because the employer's communication to the employee, minutes after telling him he was fired, "that the company personnel office would send him a letter 'clarify[ing] his status' as an employee" established a genuine dispute as to which communication by the employer "triggered the running of the [administrative] filing deadline").
2. Protected Activity
Here, Plaintiff Reilly asserts one count of retaliatory discharge in violation of 18 U.S.C. § 1514A. Mr. Reilly argues that he qualifies for SOX whistleblower protection because he believed that GSK's annual disclosures to the SEC omitted material facts about computer system risks and that GSK outsourced his position because he reported his concerns. Defendant GSK argues that Mr. Reilly's complaints are not protected by SOX because they are too attenuated from corporate fraud or any violation contemplated by the Act.
SOX "protects whistleblowing employees from retaliation for providing information, either directly or indirectly, about certain types of expressly enumerated illegal activities. The statute provides, in relevant part, that: 'no [publicly-traded] company . . . or any officer, employee, contractor, subcontractor, or agent of such company . . . may discharge, demote, suspend, threaten, harass, or in any other manner discriminate against an employee in the terms and conditions of employment because of any lawful act done by the employee.'" Wiest v. Tyco Elecs. Corp. ("Wiest II"), 812 F.3d 319, 328 (3d Cir. 2016) (quoting § 1514A (a)(1)(A)-(C)).
The statute then defines the scope of protected activity. Specifically, Section 806 protects whistleblowing employees who
(1). . .provide information, cause information to be provided, or otherwise assist in an investigation regarding any conduct which the employee reasonably believes constitutes a violation of section 1341 [mail fraud], 1343 [wire fraud], 1344 [bank fraud], or 1348 [securities fraud], any rule or regulation of the Securities and Exchange Commission, or any provision of Federal law relating to fraud against shareholders, when the information or assistance is provided to or the investigation is conducted by —§ 1514A(a)(1)(C)(emphasis added).
(C) a person with supervisory authority over the employee (or such other person working for the employer who has the authority to investigate, discover, or terminate misconduct)[.]
"To establish a prima facie case for a Section 806 claim, the employee must allege that he or she (1) 'engaged in a protected activity;' (2) '[t]he respondent knew or suspected that the employee engaged in the protected activity;' (3) '[t]he employee suffered an adverse action;' and (4) '[t]he circumstances were sufficient to raise the inference that the protected activity was a contributing factor in the adverse action.'" Wiest v. Lynch ("Wiest I"), 710 F.3d 121, 129 (3d Cir. 2013) (quoting 29 C.F.R. § 1980.104(e)(2)(i)-(iv)). It follows that "[f]or [Plaintiff Reilly's] anti-retaliation claim to survive summary judgment, [Reilly] 'must [first] identify evidence in the record from which a jury could deduce . . . [he] 'engaged in a protected activity' under Section 806." Westawski v. Merck & Co. ("Westawski II"), 739 F. App'x 150, 152 (3d Cir. 2018) (quoting Wiest II, 812 F.3d at 329 (internal citations omitted)). See Safarian v. Am. DG Energy Inc. ("Safarian I"), No. 10-6082, 2014 U.S. Dist. LEXIS 59684 at *11-12 (D.N.J. Apr. 29, 2014) (quoting § 1514A) ("To receive protection under the Sarbanes-Oxley Act, a plaintiff must convey an objectively reasonable belief that the company violated 'section 1341, 1343, 1344, or 1348, any rule or regulation of the Securities and Exchange Commission, or any provision of Federal law relating to fraud against shareholder.'").
Of note, the "reasonable belief" standard for establishing that an employee's complaints warrant SOX whistleblower protection is not defined by the statute. See Wiest I, 710 F.3d at 130 (citing 2011 DOLSOX LEXIS 39 at *11-12) "SOX does not define what constitutes a 'reasonable belief.'" Courts determining whether an employee's lawful reports are protected follow the ARB's interpretation of the standard, which requires "that the plaintiff have a subjective belief that the employer's conduct violates a provision listed within Section 806 and that the belief is objectively reasonable." Id. See also Westawski II, 739 F. App'x at 152 (citing id. at 134) (requiring, to be "protected" by the Act, "'both a subjective and an objective belief that the conduct that is the subject of [an employee's] communication relates to an existing or prospective violation of one of the federal laws referenced in [Section] 806.'"). See Sylvester v. Parexel Int'l, LLC, ARB Case No. 07-123, 2011 WL 2165854, at *11 (DOL, May 25, 2011) (noting Congressional intent to "impose the normal reasonable person standard used and interpreted in a wide variety of legal contexts."). As to scope, Congress intended to encompass within the whistleblower provision's protections "[a]ll good faith and reasonable reporting of fraud." Id. at 12 (quoting Van Asdale v. Int'l Game Tech., 577 F.3d 989 (9th Cir. 2009) (citing 148 Cong. Rec. S7418-01, S7420 (daily ed. July 26, 2002))).
"To satisfy the subjective component of the 'reasonable belief' test, the employee must actually have believed that the conduct he complained of constituted a violation of relevant law." Id. at *12. Expounding on the subjective prong of this standard, the Third Circuit has specified that "[t]he [employee's] communication itself need not reveal all the facts that would cause a reasonable person with the whistleblower's training and background to conclude that a referenced federal law has been or will be violated. That determination should be based upon all the attendant circumstances, and not be limited to the facts conveyed by a whistleblower to the employer." Wiest I, 710 F.3d at 134. Further, the employee's belief that a violation exists "must be grounded in facts known to the employee, but the employee need not wait until a law has actually been broken to safely register his or her concern." Sylvester, 2011 WL 2165854, at *11. See Wiest I, 710 F.3d at 133 (holding that a protected report may pertain to an SOX-violation that has not yet occurred "as long as the employee reasonably believes that the violation is likely to happen."). Still, the whistleblower claim must be based on an "an extant or likely, not theoretical or hypothetical, violation of the law." Lamb v. Rockwell Automation, Inc., 249 F. Supp. 3d 904, 193 (E.D. Wis. 2017).
"[A] belief is objectively reasonable 'when a reasonable person with the same training and experience as the employee would believe that the conduct implicated in the employee's communication could rise to the level of a violation of one of the enumerated provisions in Section 806.'" Westawski v. Merck & Co. ("Westawski I"), 215 F. Supp. 3d 412, 423-24 (E.D. Pa. 2016) (emphasis added) (quoting Wiest I, 710 F.3d at 132). "Although a plaintiff is not required to show 'a reasonable belief that each element of a listed anti-fraud law is satisfied,' she must still 'have an objectively reasonable belief of a violation of one of the listed federal laws.'" Id. (emphasis in original).
At summary judgment, we note that "[t]he issue of objective reasonableness should be decided as a matter of law only when 'no reasonable person could have believed' that the facts amounted to a violation. . . ." Sylvester, 2011 WL 2165854, at *13 (quoting Livingston v. Wyeth, Inc., 520 F.3d 344, 362 (4th Cir. 2008) (Judge Michael, dissenting) (quoting Clark Cty. Sch. Dist. v. Breeden, 532 U.S. 268, 271 (2001))).
Here, GSK argues that summary judgment is appropriate because Mr. Reilly's complaints were not based on an objectively reasonable belief that GSK's conduct violated SEC rules covered by Sarbanes-Oxley. Def. Mot. at 43. In evaluating Plaintiff Reilly's reasonable belief that GSK omitted material facts about computer risks from its required annual reports to the SEC, we consider that Plaintiff's responsibilities as Senior Consultant for the AS/400 system were to design, engineer, and deliver AS/400 servers, as well as to remediate server performance issues. Reilly Depo. at 57; Def. Ex. 8 at ¶¶4, 7. It is undisputed that Mr. Reilly was responsible for configuring GSK's AS/400 servers to honor the company's internal controls, yet he was not responsible for setting internal security controls. Reilly Depo. at 69-70; Def. SUMF ¶3. Id.
Next, we consider Plaintiff's subjective belief that GSK's conduct constituted a violation. Plaintiff understood Sarbanes-Oxley this way: "Sarbanes-Oxley doesn't have any particular rules other than you follow your own rules and your own internal controls are effective." Reilly Depo. at 69. ". . . .If you're on a plant floor manufacturing pharmaceutical drugs and every time you hit 'enter' you have to wait 15 minutes, that's a problem." Id. at 253-356. Plaintiff believed the company had an obligation to disclose to the SEC "if [a computer] goes down for an hour and comes back up once a week for a year." Id. at 265. In Plaintiff's view, GSK failed to follow its internal controls by omitting the intricacies of computer performance issues from their annual SEC reports. Id. at 250. When asked during his deposition why he believed the company's disclosures were inadequate, Plaintiff responded, "they're throwing out 'what-ifs' but they're not disclosing that . . .internal controls are failing." Id. at 263.
Next, we move on to the objective prong of evaluating Plaintiff's reasonable belief that the conduct he complained of violated SOX. We find that notwithstanding Mr. Reilly's dissatisfaction with the specificity of the company's disclosures, GSK did disclose the "[r]isk to the Group's business activity if critical or sensitive computer systems or information are not available when needed, are accessed by those not authorized, or are deliberately changed or corrupted." Def. Ex. 30 at 8. Specifically, the company reported the risk to their business posed by "[f]ailure to adequately protect critical and sensitive systems and information. . . .which could materially and adversely affect our financial results. . . .[t]here is the potential that malicious or careless actions expose our computer systems or information to misuse or unauthorised disclosure." Def. Ex. 29 at 10; Def. Ex. 30 at 9. Additionally, the company identified the risk of "[f]ailure to comply with current Good Manufacturing Practice requirements in commercial manufacture, . . . through inadequate controls. . .and in supporting regulated activities." Id. at 3.
Based on these facts, we agree with Defendant that "[n]o reasonable person in [Mr. Reilly]'s place, with [his] training and experience, could have believed that [GSK's] conduct violated SOX." Lamb, 249 F. Supp. at 193. As in Westawkski II, where the Third Circuit found that the plaintiff's reports were not protected because she failed to explain how [her employer's] conduct was fraud [under SOX], 739 F. App'x at 152-3, Mr. Reilly's complaints regarding computer stability and security are similarly disconnected from shareholder fraud.
This case is more like Safarian v. Am. DG Energy Inc. ("Safarian II"), 622 F. App'x 149 (3d Cir. 2015), in which the Third Circuit affirmed the District Court's holding that the plaintiff's report of "overbilling, improper construction, and the failure to obtain proper permits to Defendant's employees," was not protected under Section 806. Safarian I, 2014 U.S. Dist. LEXIS at *12. The plaintiff argued that "he reasonably believed that the fraudulent billing of customers 'result[s] in misstatement[s] of accounting records to . . . shareholders and fraudulent tax submissions to [the] Internal Revenue Service.'" Id. On the contrary, the New Jersey District Court held "[t]hough overbilling might eventually lead to incorrect accounting records and tax submissions, these kinds of disclosures were not contemplated by the statute, have not been protected by other courts, and should fall outside the scope of the Sarbanes-Oxley Act." Id.
Here, Plaintiff Reilly has not established facts showing that his complaints about computer security were even remotely related to fraud of any kind, either at the time of his complaints or in the future; "far too attenuated from the welfare of the shareholders to fall within the SOX ken." Lamb, 249 F. Supp. 3d at 918. No factfinder could find Plaintiff's belief that GSK violated SOX by not naming precise server issues to be objectively reasonable. Therefore, summary judgment on Plaintiff's SOX whistleblower claim is appropriate.
We note that Plaintiff has argued in the alternative that he suffered a hostile work environment, as opposed to a discrete discharge. No matter. Analyzing the "unfavorable personnel action" through the lens of a hostile work environment does not create a material issue as to the objective reasonableness of Plaintiff's belief that he was reporting a violation of SOX. See 49 U.S.C.S. § 42121 (B) (setting forth the legal burdens of proof that govern SOX whistleblower claims under § 1514A).
IV. CONCLUSION
For the foregoing reasons, Defendant's Motion for Summary Judgment is GRANTED. An appropriate Order will follow.