Whistleblowing is the act of reporting illegal, unethical or improper activities in an organization by an employee, any collaborator/member of the organization (even trainees) and, if implemented externally, we will also have customers, suppliers and other people who may have had professional contact with the organization’s processes, services and/or products. These reports are generally made with the aim of protecting the public interest and the integrity of the organization.

It is a secure means of communicating complaints, which allows for anonymity.

It is based on a whistleblowing management system designed to guarantee confidentiality throughout the process.

The identity of the whistleblower will only be disclosed as a result of a legal obligation or court decision.

The Whistleblowing Channel is essentially preventative in nature.

It is an instrument of self-regulation and self-control that will allow the entity, in the face of facts known and reported in good faith, to act and correct any unlawful actions and prevent their future occurrence, guaranteeing compliance with the law, regulations and procedures in force.

In accordance with Article 2(1) of Law no. 93/2021 of 20 December º 93/2021 of December 20, only the following shall be considered infringements for the purposes of this law, any act or omission contrary to the rules contained in the European Union acts referred to in the Annex to Directive (EU) 2019/1937 of the European Parliament and of the Council, to national rules implementing, transposing or complying with such acts or to any other rules contained in legislative acts implementing or transposing them, including those providing for crimes or administrative offenses, relating to the fields of:

i) Public procurement;
II) Financial services, products and markets and the prevention of money laundering and terrorist financing;
iii) Product safety and compliance;
iv) Transport safety;
v) Environmental protection;
vi) Radiation protection and nuclear safety;
vii) Food and feed safety, animal health and animal welfare;
viii) Public health;
ix) Consumer protection;
x) Protection of privacy and personal data and network and information systems security.
Any act or omission that falls within the scope of the general regime for the prevention of corruption and related offenses, approved in annex to Decree-Law no. 109-E/2021, of December 9, and which constitutes an act of corruption and related offenses.

The complaint may cover offenses that have already been committed, are in the execution phase or whose commission can be anticipated.

Any person who has information relating to the offenses identified in Law no. 93/2021, of December 20, knowledge obtained within the scope of their professional activity – this includes candidates, private, social and public sector workers, former workers and also service providers, subcontractors, suppliers (or any persons under their supervision), holders of shareholdings or members of statutory bodies, volunteers or interns (regardless of whether or not they are paid).

Any person in possession of information relating to acts of corruption and related offenses for the purposes of the general regime for the prevention of corruption and related offenses, approved in annex to Decree-Law no. 109-E/2021, of December 9.

Reports that do not fall within the scope of the provisions will be filed.

In addition to the existence of a dedicated channel for this purpose, available online, reports can also be submitted in writing and/or verbally, in the latter case they can be made in a face-to-face meeting if requested by the whistleblower (be careful in the latter two cases how to guarantee restricted access to information, protection of the complainant’s identity and even anonymity whenever desired).

In order to be dealt with effectively, the report must include the following information:

The service in which the infraction occurred.

A description of the infraction, in as much detail as possible, including locations.

The date or period in which the facts occurred.

How you became aware of the facts.

Evidence supporting the report.

And, if applicable, the identification of the suspects or all the data considered relevant to identifying the perpetrators and possible witnesses.

The use of the Whistleblowing Channel is an exercise in citizenship, so misuse and/or knowingly making false statements can compromise its purpose. It is the whistleblower’s duty to make their complaint in good faith, presenting substantiated and detailed evidence/facts and, as far as possible, accompanied by proof.

It should be clarified that the protection of the whistleblower does not affect the rights or procedural guarantees granted, in general terms, to the persons concerned by the complaint, who, if the allegations against them are not proven, have the right to take legal action, namely under the provisions of article 365 of the Penal Code.

The whistleblower benefits from special conditions of protection which, among other things, aim to prevent retaliatory actions (direct or indirect).

In order for the whistleblower to benefit from the protection afforded by law, the report must be made in good faith, i.e. there must be serious grounds for believing that the information is true at the time of the report or public disclosure.

If these requirements are not met and the whistleblower is an employee of any organization, the general rules of Labor Law and the Public or Private Employment Law (depending on the organization and the whistleblower) relating to these matters will apply.

Many countries have whistleblower protection laws to ensure that those who report wrongdoing do not suffer retaliation. In the United States, for example, there is the Whistleblower Protection Act. Laws can vary according to country and jurisdiction. In Portugal, the Whistleblower Protection Act (Law no. 93/2021, of December 20) transposes Directive (EU) 2019/1937 of the European Parliament and of the Council on the protection of persons who report breaches of European Union law.

Through the application of Law no. 93/2021, regarding the prohibition of retaliation against the whistleblower, without prejudice to special regimes that guarantee greater protection, namely not allowing the reversal of the burden of proof and presuming that the practices of certain acts, in the 2 years following the report or disclosure, are motivated by its presentation.

Any act or omission which, directly or indirectly, in a professional context and motivated by the report, is capable of causing or actually causes patrimonial or non-patrimonial damage to whistleblowers is considered retaliatory.

In this context, the following are presumed to be acts of retaliation:

• changes to working conditions
• suspension of an employment contract;
• negative performance evaluation or negative reference for employment purposes;
• failure to convert a fixed-term employment contract into an open-ended contract, whenever there are legitimate expectations of conversion;
• disciplinary sanction applied to the whistleblower.

Threats or attempts are also considered acts of retaliation.

The whistleblower is entitled, in general terms, to legal protection and can benefit from witness protection measures in criminal proceedings.

The report of an infraction, made in accordance with the requirements imposed by Law no. 93/2021, of 20/12, does not in itself constitute grounds for disciplinary, civil, misdemeanor or criminal liability of the whistleblower.

The whistleblower has the right to follow up on the report, i.e. they will be notified within seven days of receipt of the report; they will be informed, within a maximum of three months of receipt of the report, of the measures planned or adopted to follow up on the report and the reasons for them.

You can request at any time (once 15 days have elapsed since the complaint was processed) that the result of the analysis carried out on the report be communicated to you.

The whistleblower also has the right to add new elements to their report, using the same means as the initial report.

When submitting a report through the channel available for this purpose, when filling in the form, the whistleblower must answer that they wish to remain anonymous, by ticking the box.

The system must guarantee this condition and there is no possibility of identifying the person who made the report, either individually or by any organic unit.

It should be noted that anonymity must at all times allow the entity to notify the whsitleblower whenever it is necessary to request further clarification of the facts reported. If a report is submitted by email or in a face-to-face meeting, this may guarantee (depending on the processes implemented by the organization and the access to information defined and practiced) the confidentiality of the whistleblower’s identity, but not their anonymity.

The identity of the whistleblower can only be revealed by virtue of a legal obligation or court decision, preceded by communication to the whistleblower stating the reasons for the disclosure.

The Whistleblowing Channel must be managed by trained staff to receive, process and follow up reports, guaranteeing their independence, impartiality, confidentiality, absence of conflict of interest and respect for data protection in the exercise of these functions.

The confidentiality of the whistleblower’s identity must always be guaranteed, except in situations of compliance with a legal obligation or court order.

The processing of personal data collected through the report form must comply with the provisions of the General Data Protection Regulation and the Privacy Policy of Portuguese legislation.

The identity of the whistleblower may only be disclosed by virtue of a legal obligation or court decision, preceded by communication to the whistleblower stating the reasons for disclosure.

Public disclosure can only occur when the whistleblower has reason to believe that:

• the infringement may constitute an imminent or manifest danger to the public interest;
• the infringement cannot be effectively identified or resolved by the competent authorities, given the specific circumstances of the case;
• there is a risk of retaliation, including in the case of an external report;
• appropriate measures have not been taken, within the legal time limits, following an internal and/or external report.

A person who fails to comply with these legal requirements and reports an infringement to a media outlet or journalist does not benefit from the protection afforded by the law, without prejudice to the applicable rules on journalistic secrecy and the protection of sources.

Following an internal report, the entity should proceed as follows:

1. Notifies the whistleblower within seven days of receipt of the report; with the notification the whistleblower is also informed, in a clear and accessible manner, of the requirements, competent authorities and form and admissibility of the external report, in accordance with Article 7(2) and Articles 12 and 14.
2. It shall carry out the appropriate activities to verify the allegations contained in the report and, where appropriate, to bring the reported infringement to an end, including by opening an internal investigation or notifying the competent authority investigating the infringement, including the institutions, bodies, offices or agencies of the European Union.
3. Within a maximum period of three months from the date of receipt of the complaint, it shall report to the complainant on the measures envisaged or adopted to follow up the complaint and the reasons for them.

7 days to notify the whistleblower of receipt of the report, or of the identification of the requirements for submitting an external report (if applicable);

15 days after the respective conclusion – in the event that the whistleblower has requested (which they can do at any time) communication of the result of the analysis carried out.

Following an internal report, the entity must proceed as follows:

1. Notifies the whistleblower within seven days of receipt of the report; with the notification the whistleblower is also informed, in a clear and accessible manner, of the requirements, competent authorities and form and admissibility of the external report, in accordance with Article 7(2) and Articles 12 and 14.
2. It shall carry out the appropriate activities to verify the allegations contained in the report and, where appropriate, to bring the reported infringement to an end, including by opening an internal investigation or notifying the competent authority investigating the infringement, including the institutions, bodies, offices or agencies of the European Union.
3. Within a maximum period of three months from the date of receipt of the complaint, it shall report to the complainant on the measures envisaged or adopted to follow up the complaint and the reasons for them.

The confidentiality of the report, including the protection of the identity of the whistleblower and the whistleblower, are essential elements for compliance with the rules of the ethics channels, and failure to comply may lead to the application of fines as provided for in the EU GDPR regulation.

Access to all information relating to reports submitted through the various channels should only be managed by the team of Whistleblowers appointed by the entity in question, who are responsible for drawing up the report and supervising the whistleblower.

When a report is registered in the appropriate channel, available online, the whistleblower automatically receives a message confirming the registration. Whenever there is a change in the status of the report as a result of a change in the respective processing process, the whistleblower will receive automatic notifications, taking into account the defined legal deadlines.

A valid report usually involves truthful and substantial information about illegal, unethical or improper activities within the organization. The report must be made in good faith and not with malicious motives.

Procedures can vary, but generally involve the following:

• Identifying a whistleblowing channel, either internal (through company access) or external (such as a regulatory agency).
• Gathering solid evidence.
• Making the report through the appropriate channel.
• Protect your identity, if desired, by opting for anonymous reporting.
• Cooperate with any subsequent investigation.

Depending on the irregularities reported and the subsequent investigations, the reported organization may face legal sanctions, fines, loss of reputation and other consequences. The specific actions will depend on local laws and the circumstances of the case.

Whistleblower protection laws are designed to prevent retaliation. In addition, many organizations have internal policies to prohibit retaliation and provide safe communication channels for whistleblowers (click and read our article: Whistleblowing law: Protecting and empowering employees).

Making a report can help prevent illegal or unethical activities, protect the public interest, improve the transparency and integrity of organizations and, in some cases, reward the whistleblower with legal or financial protection.

Remember that laws and policies relating to whistleblowing can vary significantly by country and jurisdiction, so it is advisable to seek specific guidance when considering making a report.

For the purposes of the general regime for the prevention of corruption and related offenses, approved in annex to Decree-Law no. 109-E/2021, of December 9, corruption and related offenses are understood to be the crimes of corruption, undue receipt and offering of an advantage, embezzlement, economic participation in business, concussion, abuse of power, prevarication, influence peddling, money laundering or fraud in obtaining or diverting a subsidy, grant or credit, provided for in the Penal Code, approved in annex to Decree-Law no. º 48/95, of March 15, in its current wording, in Law no. 34/87, of July 16, in its current wording, in the Code of Military Justice, approved in annex to Law no. 100/2003, of November 15, in Law no. 50/2007, of August 31, in its current wording, in Law no. 20/2008, of April 21, in its current wording, and in Decree-Law no. 28/84, of January 20, in its current wording.

An anonymous report is a report of an irregularity, crime or misbehavior made by an individual who chooses not to reveal their identity.

In order to obtain the desired anonymity, you must choose to make your report anonymously, using means that can guarantee it, such as specific secure applications for managing reporting channels that increase the level of security of the processes and management of very restrictive accesses (of who accesses or can access the content of the reports). This is because telephone lines, online forms cannot always be certified as secure, or even by post (other precautions apply to this medium). It is important to follow the instructions provided by the organization receiving the report to ensure security and anonymity and, if you feel comfortable with the platforms and processes in use, go ahead.

People may choose to make anonymous reports out of fear of retaliation, concern for their personal or professional safety, or to avoid any kind of negative repercussions in their life.

Yes, anonymous reports should be treated with the same seriousness as identified reports. Organizations and authorities generally have specific protocols for dealing with anonymous reports and ensuring a fair and impartial investigation.

Although reporting anonymously is designed to protect the identity of the whistleblower, there may still be some risks involved, such as the possibility that the identity will be discovered during the investigation. However, organizations should implement measures to minimize these risks and protect the whistleblower’s privacy. Keep a close eye on every step of the process.

Although reporting anonymously is designed to protect the identity of the whistleblower, there may still be some risks involved, such as the possibility that the identity will be discovered during the investigation. However, organizations should implement measures to minimize these risks and protect the whistleblower’s privacy. Keep a close eye on every step of the process.

Yes, it is generally possible to make anonymous reports on a wide range of irregularities, from fraud and corruption to unethical or illegal behavior. However, it is important to check the specific policies of the organization or authority receiving the report to ensure that the report is appropriate and will be dealt with properly.

Organizations should implement security measures, such as data encryption, restricted access to information and clear whistleblower protection policies, to ensure that the whistleblower’s identity remains anonymous throughout the investigation process.

In many cases, organizations offer the possibility of following up on anonymous reports to get updates on the progress of the investigation. However, it is important to follow the guidelines provided by the organization receiving the report to ensure that the follow-up is done safely and does not compromise the anonymity of the whistleblower.

Yes, making false anonymous reports can have serious legal consequences, including defamation proceedings, loss of credibility and even criminal sanctions, depending on the seriousness of the report and local laws.

If you have concerns about making an anonymous report, it is important to seek appropriate support and guidance. This may include speaking to a lawyer, contacting whistleblower protection organizations or looking for secure reporting channels that guarantee the protection of your identity.