The U.S. Supreme Court's 9-0 ruling this week, Digital Realty v. Somers, holds that to state a retaliation claim under Dodd-Frank, employees must report to the Securities and Exchange Commission (SEC)—internal reporting alone is not enough. The ruling narrows legal protections against workplace retaliation, but employees may still have claims under Sarbanes-Oxley and California state law.

By way of background, financial scandals at Enron, WorldCom and Tyco that cost investors billions of dollars prompted Congress to pass the Sarbanes-Oxley Act in 2002 (SOX). Congress recognized that Enron had perpetrated its massive shareholder fraud thanks to a “corporate code of silence” that kept employees from reporting to law enforcement, or to their supervisors. SOX gives a private right of action to an employee who reports securities fraud, only to be retaliated against by their employer. SOX explicitly protects employees whether they report externally to the government, or internally to the company.

Unfortunately, SOX did not prevent the financial meltdown in 2008. Recognizing that “whistleblow­ers often face the difficult choice between telling the truth and … committing 'career suicide,'” Congress passed Dodd-Frank. Dodd-Frank included a retaliation claim that is broader than SOX in several notable ways: SOX gives a six-month statute of limitations, Dodd-Frank gives six years; SOX gives actual damages, Dodd-Frank doubles back pay; SOX requires the employee to exhaust with the Department of Labor, Dodd-Frank allows a plaintiff to file directly in federal court.

At issue in Digital Realty was whether reporting to the SEC is a necessary prerequisite to state a retaliation claim under Dodd-Frank. Dodd-Frank purports to protect “whistleblowers,” which it defines as individuals who provide “information relating to a violation of the securities laws to the Commission.” However, elsewhere in the statute, Dodd-Frank states that it protects a whistleblower who makes “disclosures that are required or protected under” SOX. SOX protects internal reporting. These two clauses created tension over whether Dodd-Frank covers internal reports that lead to retaliation. The SEC, two appellate courts, and the majority of district courts to address the issue held that it did.

Writing the main opinion in Digital Realty, Justice Ruth Bader Ginsburg rejected this interpretation. She decided that the statute's plain meaning was clear, so there was no need to examine, much less defer, to the SEC's interpretation that the statute covered internal reporting. That Justice Ginsburg authored the main opinion disappointed many whistleblower advocates. Only four years ago she wrote for the majority in Lawson v. FMR, 134 S. Ct. 1158 (2014), which extended SOX's retaliation protection to a broader group of employees. Justice Ginsburg based her analysis in Lawson on a plain reading of the text, too.

Although Digital Realty constricts whistleblower protections, it does not choke them off completely. California law offers some additional protections to whistleblowers. Labor Code Section 1102.5 prohibits retaliation against employees reporting to any individual with authority to investigate, what they reasonably believe to be a violation of state or federal law. This clearly protects internal reporting and does not require California employees to make a report to any outside agency in order to state a valid whistleblower claim. In addition, a California employee may state a cause of action for wrongful termination in violation of public policy—commonly known as a Tameny claim—where they are terminated (or otherwise adversely treated) for engaging in protected activity under California law. Tameny v. Atlantic Richfield (1980) 27 Cal.3d 167. Such activity might include internally reporting violations of securities or other law .

A key passage in the Digital decision could bring some comfort to employees, too. Retaliation claims typically require a plaintiff to show that the employer knew about the reports of wrongdoing and that they contributed to the decision to retaliate. Digital explicitly states that employees need not demonstrate that the external report caused the retaliation, or that the employer even knew about it. The opinion states that Dodd-Frank “protects a whistleblower who reports misconduct both to the SEC and [internally], but suffers retaliation because of the latter, non-SEC, disclosure. That would be so, for example, where the retaliating employer is unaware that the employee has alerted the SEC.”

A final silver lining for employees is that there is a chance —if slim—that Congress could act. Sen. Chuck Grassley (R-IA), chairs the powerful Senate Judiciary Committee and has long been a friend to whistleblowers. His office filed an amicus brief on behalf of the employee in Digital Realty, which argues that Dodd-Frank's retaliation provision should protect internal reporting. Now that the Court has spoken, Sen. Grassley and his colleagues are in the best position to clarify the statute and restore Dodd-Frank's more robust protections.

For employers, the Digital decision may have unintended consequences. Employees who fear that they might be the target of retaliation based on their knowledge of securities violations, might have greater incentive to make a report to the SEC in order to assure self protection down the road. More SEC reporting is unlikely to warm the hearts of most companies.

Jennifer Schwartz is a partner with Outten & Golden. She manages the individual employment practice in the San Francisco office.

Tammy Marzigliano is a partner with the firm in its New York office. She is the co-chair of firm's financial services practice group and its whistleblower and retaliation practice group.

Amy Biegelsen is an associate in the firm's whistleblower and retaliation practice group in the New York office.