Whistleblowing rules ‘don’t go far enough’