Whistleblower Protection Regime

The transposition of Directive (EU) 2019/1937, of the European Parliament and of the Council, of 23 October 2019 on the protection of people who report breaches of Union law was made through National Portuguese Law No. 93/2021, published on 20th December, which came into force on the 18^th of June.

This law, which gave a wider range of rights to whistleblowers and obligations to companies, public or private, with head office or branch in Portugal came to implement the minimum requirements of the Directive, going beyond its provisions.

What is the basis for the protection of whistleblowers?

“People who work in or with public or private organizations in the context of professional activities are often the first to be aware of threats or situations harmful to the public interest arising in that context. By reporting breaches of Union law affecting the public interest, those people act as whistleblowers, thereby playing an essential role in uncovering and preventing such breaches, as well as in safeguarding the well-being of society by feeding information to national and Union law enforcement systems leading to the detection, investigation, and effective prosecution of breaches of Union law, thereby increasing transparency and accountability.”

However, it is often the case that, for fear of retaliation, potential whistleblowers do not report their suspicions – so it is crucial to ensure that they have the protection they need to act safely.

Who can be a whistleblower?

Whistleblowers can be considered to be individuals who publicly report or disclose information on violations, obtained in the course of their professional activities, regardless of the nature of these activities or the sector to which they belong, whether or not they are performing their duties at the time, in the case of a recruitment process or even in the pre-contractual negotiation phase.

The exercise of professional activities does not imply a specific employment relationship, and the person who has any type or regime of work can be classified as a whistleblower, regardless of whether they are paid or in an internship phase. It should be added that holders of shareholdings and people belonging to management, administrative, supervisory, or controlling bodies of legal people are also included.

Thus, on qualifying as a whistleblower, the person becomes a beneficiary of the protection conferred by this statute, which extends to people who assist them confidentially, to any third party who is associated with the whistleblower and may be the target of retaliation, and to legal or similar people who are owned or controlled by the whistleblower, for whom they work or are professionally connected.

But is it enough to meet the above requirements to qualify as a Whistleblower?

No. It is necessary that the whistleblower 1) has reasonable grounds to believe that the information is true at the date of the report, and is required to 2) act in good faith and 3) have reported internally, externally or made a public disclosure.

What protection is granted by the framework to the whistleblower?

1) The identity of the whistleblower is kept confidential and can only be disclosed due to a legal obligation or a court order, after communication to the whistleblower of the reasons for the disclosure;

2) Retaliation against whistleblowers is prohibited and they are entitled to compensation for the material or non-material damage caused in an unjustified manner, in the professional context, as a result of an internal or external complaint or public disclosure; The reversal of the burden of proof and the presumption that certain acts constitute retaliation, such as changes in working conditions or the application of a disciplinary sanction, when committed two years after the complaint or public disclosure, is also relevant for this purpose;

3) The right to legal protection under the witness protection regime in criminal proceedings;

4) Not to be subject to disciplinary, civil, misdemeanor or criminal liability for the mere reporting or public disclosure of an infraction (if it was made in accordance with the requirements imposed, explained above).

And what about the accused?

They maintain their procedurally recognised rights and guarantees, such as the presumption of innocence and the warranties of defence in criminal proceedings, benefiting from the same regime that the whistleblower has regarding the confidentiality of identity.

What is the consequence of the violation of the whistleblower protection rules?

Violations constitute an administrative offence, and the respective procedure must be carried out by the National Anti-Corruption Mechanism (MNAC).

The following are established as very serious administrative offences: preventing the submission or follow-up of the complaint, the practice of retaliatory acts, the breach of the duty of confidentiality and the communication or public dissemination of false information, punishable by fines of €1,000 to €25,000 for natural people or €10,000 to €250,000 for legal people.

On the other hand, there are offences classified as serious offences, such as the failure of the public or private entity to provide and install an internal channel, or to ensure the completeness, integrity and confidentiality of the identity or anonymity of whistleblowers, among others, for which fines of between €500 and €12,500 will be applied in the case of individuals, or between €1,000 and €125,000 in the case of legal people.

How to report?

Reports may be made of violations that have taken place, are taking place or can reasonably be expected to take place, as well as of attempts to conceal such violations. Reports may be submitted through internal or external reporting channels, or publicly disclosed.

However, they may only make a complaint through an external channel when 1) there is no internal channel, 2) if one exists, it only allows complaints made by the employee (and the whistleblower is not), 3) they have reasonable grounds to believe that the breach cannot be known or resolved internally and there may be a risk of retaliation 4) has initially lodged an internal complaint without either being informed of the measures envisaged or taken as a result of the complaint within three months of receipt, or being informed of the outcome of the investigation within 15 days of its conclusion or, finally, if e) the offence constitutes a crime or administrative offence punishable by a fine of more than € 50. 000.

In addition, they may only publicly disclose an infringement in two cases:

1) If it has reasonable grounds to believe that the breach may constitute an imminent or manifest danger to the public interest, that it cannot be effectively known or addressed by the competent authorities in view of the specific circumstances of the case, or that there is a risk of retaliation including in the case of an external report; or

2) If it has filed an internal complaint and an external complaint, or directly an external complaint under the terms of this law, without appropriate measures being taken within the time limits provided for in articles 11 and 15.

If the whistleblower discloses publicly any infraction, without being part of either of the two cases referred to above, he will not benefit from the protection afforded by the law, but only from the applicable rules on journalistic secrecy and protection of sources.

How to access the internal reporting channels?

• Presentation

The internal channels must be created by the companies themselves, and are operated internally, to receive and follow up on complaints (although they may be operated externally for the purpose of receiving them).

The complaints may be presented orally – by telephone, by voice message or in a face-to-face meeting, at the request of the whistleblower – or in writing, by the employees, anonymously or with identification.

• Follow-up

Within 7 days following the report, the entities shall notify the complainant of the receipt of the complaint and inform him/her of the requirements, competent authorities and form and admissibility of the external complaint.

Within 3 months, after investigating the allegations contained in the complaint, and ending the infringement, if there is any, (with or without recourse to competent external authorities), where appropriate, the entities shall inform the complainant of the measures envisaged or taken. However, the whistleblower may, 15 days after the complaint, request that the entities communicate the result of the analysis to them.

Which entities are obliged to have internal whistleblowing channels?

• Public or private companies, with head office or branch in Portugal, with 50 or more employees (legal persons, including the State and other legal persons governed by public law);
• The entities included in the scope of application of the European Union acts referred to in parts I.B and II of the Directive, with head office or branch in Portugal;

However, obliged entities that are not governed by public law and employ between 50 and 249 workers may share resources about receiving complaints and their follow-up.

How are external whistleblowing procedures carried out?

• Submission

They are submitted to the authorities that, depending on the complaint, should or could have knowledge of the matter in question, namely the Public Prosecutor’s Office, the criminal police bodies, the Bank of Portugal, the Inspectorates General, among others. If the complaint is submitted to an incompetent authority, it is automatically forwarded to the competent one, and the complainant is notified.

In cases where there is no competent authority to deal with the complaint or in cases where the complaint is addressed to a competent authority, it must be addressed to the National Anti-corruption Mechanism.  If the latter is the target, the complaint must be made to the Public Prosecutor’s Office, which will open an enquiry if the facts described therein constitute a crime.

Regarding the content of the complaint, filing may be justifiable when the infraction is of minor, insignificant or irrelevant gravity, is repeated with regard to a first complaint without different follow-up being reasonable and/or is anonymous and no evidence of an infraction is found.

• Follow-up

Within seven days, the competent authorities will notify the complainant that they have received the complaint – unless the complainant explicitly requests otherwise or they have reasonable grounds to believe that the notification may undermine the protection of the identity of the complainant.

They will then take the appropriate steps to verify the allegations and, where necessary, bring about the cessation of the reported breach (including by opening an investigation or proceeding or notifying the competent authority).

Within a maximum of three months from the receipt of the complaint, or six months were justified by the complexity of the complaint, the competent authorities shall inform the complainant of the action envisaged or taken to deal with the complaint and the reasons for it.

As in internal channel procedures, the complainant may request that the competent authorities communicate the outcome of their examination of the complaint within 15 days after its conclusion.

What are the mandatory requirements that external whistleblowing channels must comply with?

• Ensure their independence and autonomy about the other channels;
• Ensure the confidentiality and integrity of each complaint received;
• Ensure the impossibility of access to the channels by unauthorised persons;
• Retain the complaint for five years or during the pendency of judicial or administrative processes;
• Train the employees responsible for handling the complaints.

What are the authorities’ obligations?

The authorities are obliged to provide a series of information on their websites, namely, but not only, the conditions necessary to benefit from the protection of this law, the contact details of the external whistleblowing channels, the procedures applicable to complaints, the confidentiality regime and the processing of personal data, the type of measures that can take.

They are also obliged to submit annual reports on complaints, presented to Parliament by the end of March, which must include the number of external complaints received, cases initiated and results, the nature and type of infractions reported and, finally, anything relevant to improving procedures.