New whistleblower protection framework in Portugal

Law No. 93/2021 was published on December 20, establishing the general regime for the protection of whistleblowers, transposing Directive (EU) 2019/1937 of the European Parliament and of the Council of 23 October 2019 on the protection of persons who report breaches of Union law.

This law foresees mechanisms and procedures applicable to whistleblowing based on information obtained in the context of a professional activity, as well as measures intended to protect whistleblowers.

In addition, this new Law establishes a punitive framework for non-compliance with the measures set out therein, foreseeing a set of serious and very serious administrative offences, and imposing fines of up to €250,000 for legal persons and up to €25,000 for individuals.

During the law-making process, it was highlighted the privileged position of people inside organizations, both public and private, to be aware of and report infractions, internal threats or injuries, and the inherent fragility and need of protection of such people as an employee or collaborator of the respective organization.

This new law addresses the legislative gap in this area and contributes to a balanced and cohesive legal framework for the protection of whistleblowers.

Therefore, we highlight some of the aspects foreseen in this new law:

1. WHICH CONDUCTS MAY THE COMPLAINT RELATE TO?

The complaint may concern offences that have been committed, are in the process of being committed or whose commission can be reasonably expected, as well as attempts to conceal such offences arising from information obtained in a professional environment.

Acts and omissions considered to be an offence, for the purposes of this law, can cover a wide range of subjects, namely in the fields of: i)public procurement; ii) financial services, products and markets and prevention of money laundering and terrorist financing; iii) product safety and compliance; iv) transport safety; v) environmental protection; vi) radiation protection and nuclear safety; vii) food and feed safety, animal health and animal welfare; viii) public health; ix) consumer protection; x) privacy and personal data protection and network and information systems security; xi) violent crime, especially violent and highly organized crime and xii) crimes related to economic and financial crimes and bribery and corruption related offences.

2. WHO CAN SUBMIT A COMPLAINT?

According to the new law, a whistleblower is a natural person who reports or publicly discloses an offence based on information obtained in the course of his/her professional activity (even if the professional activity has ceased in the meantime), regardless of the nature of said  activity and the sector in which it is/has been carried out. This also includes offences based on information obtained or known during the recruitment process or during another stage of pre-contractual negotiation of an established or unestablished employment relationship.

In this context, the following may be considered whistleblowers, inter alia:

1. Workers in the private, social or public sector;
2. Service providers, contractors, subcontractors and suppliers, as well as any persons acting under their supervision and direction;
3. Shareholders and persons belonging to administrative or management bodies or to supervisory or controlling bodies of legal persons, including non-executive members;
4. Volunteers and interns, remunerated or unremunerated.

3. HOW CAN COMPLAINTS BE FILED?

Complaints are submitted through internal or external reporting channels or are publicly disclosed. The whistleblower may only publicly disclose an offence and/or use external reporting channels when: a) there is no internal reporting channel; b) the internal channel may only be used by employees and the whistleblower is not an employee; c) the whistleblower has reasonable grounds to believe that the offence cannot be acknowledged or solved internally or that there is the risk of retaliation; d) the whistleblower presents an internal complaint and is not informed about the measures adopted afterwards within the deadlines foreseen in the law.

Those who report an offence to a media entity or to a journalist and are not in at least one of the above referred circumstances shall not benefit from protection under this law.

4. CAN COMPLAINTS BE MADE ANONYMOUSLY?

Yes. In accordance with Law No. 93/2021, both internal and external complaints may be submitted in writing and/or verbally, anonymously or with identification of the whistleblower.

5. ARE COMPANIES OBLIGED TO HAVE INTERNAL REPORTING CHANNELS?

Yes. The entities which must have internal reporting channels are legal persons, including the State and other legal persons governed by public Law, employing 50 or more workers and, irrespective of that, entities falling within the scope of the European Union acts referred to in part i.B and ii of the Annex to Directive (EU) 2019/1937.

Branches located in the national territory of legal persons with registered offices in a foreign country, the State and autonomous regions of Azores and Madeira must also have internal reporting channels.

The law also provides that entities in the private sector employing between 50 and 249 workers may share resources with regard to the receipt of complaints and their subsequent follow-up.

Concerning local authorities, those that employ 50 or more workers but have less than 10 000 inhabitants are not required to have reporting channels.

All these entities are also obliged to keep a record of the complaints received and to retain it for at least 5 years and, regardless of that period, while any judicial or administrative proceedings relating to the complaint are pending.

The processing of personal data for the purposes set forth of this new law must observe General Regulation (EU) 2016/679 and Laws nos. 58 and 59/20219, of August 8^th.

6. AUTHORITIES TO WHICH EXTERNAL COMPLAINTS CAN BE ADRESSED

External complaints are addressed to the authorities that, according to their powers and responsibilities, should or may have knowledge of the subject matter of the complaint, including: a) the Public Prosecutor’s Office; b) criminal police bodies; c) the Bank of Portugal; d) independent administrative authorities; e) public institutes; f)  inspection bodies and similar entities and other central services of the direct administration of the State with administrative autonomy; g) local authorities; and h) public associations.

7. HOW IS THE PROTECTION OF THE WHISTLEBLOWER GUARANTEED?

In addition to the right to legal protection and the duty to keep the confidentiality of the whistleblower’s identity of, the law also provides for the prohibition of any acts of retaliation against the whistleblower. Acts of retaliation are considered to be those that, directly or indirectly, occurring in a professional context and motivated by a complaint, cause or may cause the whistleblower, in an unjustified manner, material or non-material damage.

In this regard, the law presumes that certain acts are motivated by complaint until proven otherwise when committed up to two years after the complaint:

1. Changes in working conditions, such as job functions, working hours, place of work or remuneration, non-promotion of the employee or breach of work obligations;
2. Suspension of employment contract;
3. Negative performance evaluation or negative reference for employment purposes;
4. Failure to convert a fixed-term employment contract into an indefinite-term contract, whenever the employee had legitimate expectations in this conversion;
5. Non-renewal of a fixed-term employment contract;
6. Dismissal;
7. Inclusion in a list, based on an industry-wide agreement, that may lead to the impossibility of the whistleblower finding employment in the sector or industry in question in the future;
8. Termination of a supply or service contract;
9. Revocation of an act or termination of an administrative contract, as defined in terms of the Administrative Procedure Code.

Any disciplinary measure taken against the whistleblower up to two years after the complaint are to be presumed abusive.

It should be noted that failure to comply with the provisions of this new law may lead to the fines ranging from €10,000 to €125,000, in case of legal persons, and €1,000 to €12,500, in case of individuals, when serious offences are at stake; or ranging from €1,000 to €250,000, in the case of legal persons, and €1,000 to €25,000, in the case of individuals, when they incur into very serious offences.

Attempt and negligence are punishable, in which case the maximum limits of fines are reduced by half.

This new legislative framework, which will come into force in June 2022, is generally intended to focus not only on the protection of whistleblowers but also on the effectiveness of the reporting of the complaint, revealing itself to be a positive initiative in the fight against offences committed in a professional context. It also demands attention and preparation of the entities to which it applies, in order to fully comply with the new measures that have to be implemented until June 2022.