- Law No. 361/2022, which implemented the transposition of Directive (EU) 2019/1937 into national legislation
In 2019, Directive (EU) 2019/1937 instituted protection for individuals reporting breaches of European law, and was later transposed into national legislation, creating an obligation for some companies to have internal channels through which employees, and not only them, can report breaches of EU law without suffering negative consequences from the company for these reasons.
In national legislation, the law governing the regime for whistleblowers is Law No. 361/2022, aimed at facilitating whistleblower reports concerning violations of legislation within private entities, as well as violations within public authorities and institutions or other public-law legal entities. It targets both public and private sectors, establishing how internal reporting channels operate.
- Internal and External Reporting Channels
Law No. 361/2022 on the protection of whistleblowers in the public interest establishes the legal framework for protecting individuals who report legal violations through internal and external reporting channels. The internal reporting channel refers to the means provided by public authorities and institutions, public-law legal persons, and private-law legal persons for making reports on legal violations.
All public authorities and institutions (regardless of the number of employees) and employers in the private sector with at least 50 employees must have an internal reporting channel. Entities with between 50 and 249 employees may opt to pool resources regarding the receipt of reports and subsequent actions. Additionally, Local Public Administrations with fewer than 10,000 residents or less than 50 workers can also collaborate.
In cases where a company does not have proper internal reporting channels, employees can directly address the authorities through external reporting channels provided by them. However, internal channels are the rule, with external channels being a subsidiary option, used in cases where the whistleblower believes there is a risk of retaliation and that the reported violation cannot be effectively reported through internal channels, or when internal channels are lacking in private-law legal persons with fewer than 50 workers, other than those exempted.
When reporting cannot be appropriately done through any of the channels, as a last resort, whistleblowers may publicize the irregularities even in the press, or to non-governmental organizations, parliamentary committees, or similar bodies.
Regarding reporting requirements, from the manner of law editing, it is clear that any report containing clues about legal violations should be taken into account, even without an attached name, signature, or contact details. However, Law 67/2023 introduced the obligation to provide the professional context in which the information was obtained, the person targeted by the report if known, a description of the act likely to constitute a violation of the law, and, if applicable, evidence supporting the report and the date.
- Company Obligations – Responsible Person
Reporting legal violations is conditioned by the existence of a responsible person within the company who handles the implementation of reporting channels. This person will also have responsibilities including receiving, recording, examining, taking subsequent actions, and resolving reports, acting with impartiality and independence in exercising these duties.
The responsible person does not necessarily have to be from within the company, i.e., an employee of the company. If the person comes from the employees, it is important to understand that they also have obligations regarding confidentiality and personal data protection, among others.
- Whistleblower Protection Measures and Court Remedies
Considering that in many cases of reporting legal violations, whistleblowers are employees who have learned of these aspects within the company where they work, they are exposed to retaliation if the news spreads to the public. Thus, whistleblowers can be subjects of harassment, wage discrimination, or other treatments derived from their reports.
For such situations, the law provides mechanisms to protect whistleblowers from these retaliation actions, and consequences of reports, to prevent their disadvantage in a potential litigation. During a trial generated by retaliation toward whistleblowers, the law allows judges to suspend measures taken by companies as a result of whistleblower actions. The burden of proof to demonstrate that the measures taken by employers are legal and do not constitute retaliation lies with the latter.
Moreover, legal provisions extend beyond the whistleblower who reported the irregularity, also covering those who facilitated the reporting, such as third parties or entities affiliated with the whistleblowers.
- Sanctions
Failure to meet the demands of the law regarding whistleblowers can lead to civil, disciplinary, contravention, or criminal liability. Actions attracting these liabilities include not implementing internal reporting channels, hindering the responsible person from receiving or recording reports, lack of cooperation with competent authorities, and breaching confidentiality obligations.
Additionally, not only companies can be sanctioned for non-compliance with this law, but also whistleblowers for false reports.
Sanctions range from 2,000 lei to 40,000 lei, depending on the severity of the breach and its consequences. The personnel within the specialty structure of the Agency provided in Article 16 of Law No. 361/2022 are responsible for ascertaining and sanctioning these actions.