In the previous article we talked about the obligation of entities that under Law No. 93/2021 of December 20 are required to adopt whistleblowing channels and institution of the rules that internal whistleblowing must comply with.
As mentioned in this article, violations may be reported through internal or external whistleblowing channels or publicly disclosed, with rules for use and precedence between the different means.
The effective detection and prevention of breaches of Union law requires ensuring that potential whistleblowers can easily and in full confidentiality communicate the information available to them to the competent authorities to investigate and remedy the problem wherever possible.
Precedence between the means of reporting and public disclosure
As a rule, the whistleblower should use internal reporting channels. However, there are cases where internal channels may not exist or may have been used but not function properly, for example, because the report was not handled diligently or within a reasonable timeframe or appropriate action was not taken to resolve the violation even though the results of the relevant internal investigation confirmed the existence of a violation.
In other cases, it is unreasonable to expect the internal channels to function properly. This is particularly the case where whistleblowers have valid reasons to believe that they will suffer retaliation as a result of the report, including as a result of the breach of confidentiality, or that competent authorities will be in a better position to take effective action to address the breach.
Competent authorities would be in a better position, for example, if the person with ultimate professional responsibility is involved in the breach, or there is a risk that the breach or related evidence will be concealed or destroyed, or, more generally, the effectiveness of investigative measures by competent authorities may be compromised, as in the case of reports about cartels and other violations of competition rules, or the breach requires urgent action, for example to protect the health and safety of persons and to protect the environment.
Lack of confidence in the effectiveness of whistleblowing is one of the main discouraging factors for potential whistleblowers. It is therefore necessary to place a clear obligation on competent authorities to put in place adequate channels for external whistleblowing, to diligently pursue reports and to provide feedback to whistleblowers within a reasonable timeframe.
The whistleblower may resort to external whistleblowing channels only when:
– There is no internal whistleblowing channel;
– The internal whistleblowing channel only permits the submission of reports by employees, and the whistleblower isn’t one;
– It has reasonable grounds to believe that the breach cannot be effectively known or resolved internally or that there is a risk of retaliation;
– Has initially lodged an internal report without having been notified of the measures envisaged or taken as a result of the report within the prescribed time limits; or
– The violation is a criminal offense or an administrative offence punishable by a fine of more than 50,000 (euro).
Capacities of the competent authorities
As recipients of the reports, authorities designated as competent authorities should have the capacities and powers to ensure adequate follow-up, including assessing the accuracy of the allegations in the report and addressing reported breaches through the initiation of an internal investigation, investigation, prosecution, recovery of funds measure or other appropriate remedial action, in accordance with their mandate.
Alternatively, such authorities should have the necessary powers to refer the report to another authority for investigation of the reported violation, while ensuring that appropriate follow-up action is taken by that authority.
Competent authorities
External whistleblowing shall be lodged with the authorities which, in accordance with their duties and powers, are required or able to deal with the subject matter of the report, including:
a) The public prosecutor’s office;
b) The criminal police bodies;
c) The Bank of Portugal;
d) The independent administrative authorities;
e) Public institutes;
f) Inspectorates-general and similar entities and other central services of the direct administration of the State with administrative autonomy;
g) Local authorities; and
h) Public associations.
When the report is lodged with an incompetent authority, the report is automatically forwarded to the competent authority, and the whistleblower is notified of this, in which case the date on which the report is received by the competent authority is deemed to be the date of receipt.
In cases where there is no competent authority to deal with the report or in cases where the report is addressed to a competent authority, it must be addressed to the National Anti-Corruption Mechanism and, if this is the authority in question, to the Public Prosecutor’s Office, which will follow it up, in particular by opening an inquiry when the facts described in the report constitute a crime.
If the infraction is a crime or a misdemeanor, external whistleblowing can always be submitted through the external whistleblowing channels of the Public Prosecutor’s Office or the criminal police bodies, in the case of a crime, and of the competent administrative authorities or police and inspection authorities, in the case of a misdemeanor.
Following up on an external report
The competent authorities shall notify the whistleblower of the receipt of the report within seven days.
Following the report, the competent authorities shall take the appropriate action to verify the allegations made in it and, where necessary, to bring about the cessation of the infringement reported of, including by opening an investigation or proceeding or by informing the competent authority.
The competent authorities shall inform the whistleblower of the action envisaged or taken to deal with the report and the reasons therefor within a maximum of three months from the date on which the report was lodged or six months if justified by the complexity of the report.
The whistleblower may at any time request that the competent authorities communicate the result of their examination of the report to the whistleblower within 15 days of its conclusion.
Closure of reports
To ensure the effectiveness of procedures to follow up reports and to resolve violations of Union rules in question, Member States may take measures to alleviate the burden on competent authorities resulting from reports of minor violations.
Such measures consist of allowing the competent authorities, after due evaluation of the matter, to decide that a reported violation is manifestly of a minor nature, and therefore requires no further action other than to close the case.
Information Obligation
Persons who wish to make a report should be able to make an informed decision about whether, how and when to do so. Therefore, competent authorities should provide clear and easily accessible information about the channels available for reporting to the competent authorities, the applicable procedures and the staff that is responsible for dealing with reports in the context of those authorities. All information regarding whistleblowing should be transparent, easily understandable and reliable in order to promote whistleblowing and not to discourage it.
Competent authorities shall publish on their websites in a separate, easily identifiable and accessible section at least the following information:
a) Conditions for protection under the law or under whistleblower protection schemes;
b) Contact details of external whistleblowing channels;
c) Procedures applicable to whistleblowing, including how the competent authority may ask the whistleblower to clarify the report made or to provide additional information, including in situations of anonymity, and the time limit by which the authority must provide the whistleblower with reasoned information on the actions planned or taken to address the report;
d) The confidentiality regime applicable to reports;
e) The type of action that may be taken to follow up on reports;
f) Avenues of redress and procedures for protection against retaliation;
g) Availability of confidential counselling for persons considering making a report; and
h) Conditions under which the whistleblower does not incur liability for breach of confidentiality or other duties.
Establishing Whistleblower Channels
In order to enable effective communication with the staff responsible for handling reports, competent authorities should establish channels that are easy to use, secure, ensure confidentiality for receiving and handling the information provided by the whistleblower about violations, and allow for the lasting storage of information to enable further investigation.
Confidentiality
The identity of the whistleblower, as well as the information that directly or indirectly allows the identity of the whistleblower to be deduced, is of a confidential nature and access is restricted to the persons responsible for receiving or following up on reports.
The confidentiality obligation referred to above extends to anyone who has received information on reports, even if not responsible or incompetent for receiving and processing it.
The identity of the whistleblower is only disclosed as a result of a legal obligation or court order.
Persons responsible for handling external whistleblowing
The staff of the competent authorities who are responsible for handling reports shall be trained, including on applicable data protection standards, to handle the reports and to ensure communication with the respective whistleblowers, as well as to take the appropriate follow-up action on the report.
Processing of personal data
The processing of personal data under this Act, including the exchange or transmission of personal data by the competent authorities, complies with the General Data Protection Regulation1.
It is necessary that the staff of the competent authority, which is responsible for handling reports, and the staff of the competent authority, which is entitled to access the information provided by the whistleblower, respect the duty of professional secrecy and confidentiality when transmitting data within and outside the competent authority.
Retention of reports
The obligated entities and competent authorities responsible for receiving and processing reports under this law shall keep a record of the reports received and retain it for at least five years and, regardless of such period, during the pendency of judicial or administrative proceedings relating to the report.
If the report is made at a face-to-face meeting, obliged entities and competent authorities shall ensure, after obtaining the whistleblower’s consent, that the meeting is recorded by:
– Recording the communication on a durable and retrievable medium; or
– Trusted minutes.
_______________________________
1Approved by Regulation (EU) 2016/679 of the European Parliament and of the Council, of April 27, 2016, in Law No. 58/2019, of August 8, which ensures the implementation, in the national legal system, of Regulation (EU) 2016/679, and in Law No. 59/2019, of August 8, which approves the rules on the processing of personal data for the purpose of prevention, detection, investigation or prosecution of criminal offenses or the enforcement of criminal penalties.
Maria Cristina Freitas, Lawyer
Published at: 24/04/2023