New obligations imposed on companies – Whistleblower Protection Law

Law 361/2022 on the protection of Whistleblowers in the public interest brings new obligations for companies, it transposes Directive 2019/1937 EU issued on 23 October 2019.

Who are whistleblowers?

The role of whistleblowers is to disclose and communicate facts of breaches of EU law carried out within an organisation and the areas of applicability are: public purchasing, financial services, money laundering prevention, product safety, transport safety, environmental protection, nuclear safety, public health, food safety, consumer protection and personal data protection.

The whistleblowers’ scope is not limited to employees, but includes all those who have become aware of irregularities within companies/authorities: former employees, shareholders, volunteers, trainees, applicants for positions in the company, persons belonging to the administrative, management or supervisory board of a company.

Protection of whistleblowers

The law aims to provide numerous safeguards, establishing rules on the creation of a secure framework through which anonymous reporting can be carried out, as well as obligations regarding the receiving, examination and handling of reports. In this regard, the whistleblower, upon acquiring this status, acquires several rights. These include the prohibition of reprisals, namely actions/omissions, direct or indirect, occurring in a professional context, which are caused by the disclosure and which may cause harm to the whistleblower (such as dismissal, change of employment contract, reduction of salary or change of working hours).

What are the reporting procedures?

For the whistleblowers to benefit from the protection afforded by the law, they must use one of the reporting mechanisms provided for by the law:

• Internal reporting: this consists of communicating information through the channels provided by the company where the irregularities occurred;
• External reporting: consists of reporting through external channels represented by the specialised public authorities and institutions, the National Integrity Agency and other public authorities and institutions to which the Agency sends reports for resolution;
• Public disclosure: is the making available, in any way, in the public space of information relating to violations of the law.

Public disclosure, however, is a measure that can only be used in the following situations:

• there has previously been an internal, subsequently an external or only an external report, and no appropriate action has been taken as a result within 3 months of receiving the report;
• the breach may constitute an imminent or manifest danger to the public interest or there is a risk of damage that cannot be remedied; or in the case of external reporting there is a risk of retaliation or a low likelihood that the breach will be effectively remedied.

According to Article 6 of the Law, the report shall include, at least, the following: name and surname, contact details of the whistleblower in the public interest, the professional context in which the information was obtained, the person concerned, if known, a description of the fact likely to constitute a breach of the law, date and signature.

The reporting channel must respect confidentiality, be secure, allow for both written and oral reporting; be easily accessible, and be accessed by an impartial person/department.

Companies are required, following the implementation of this law, to set up internal reporting channels and establish procedures for internal reporting. This obligation will become effective on 17 December 2023 and is mainly addressed to companies with between 50 and 249 employees, and failure to comply with this obligation is punishable by a fine of up to RON 30,000.