On 24 November 2021, a group of members of Parliament submitted for Parliament approval a draft law on the protection of whistleblowers for reasons of public interest (the “Whistleblowing Draft Law“), implementing EU Directive no. 2019/1937 on the protection of persons who report breaches of Union law (the “Whistleblowing Directive“). The Whistleblowing Draft Law is available here (Romanian language only).
The Whistleblowing Draft Law foresees to become applicable as of 17 December 2021 to meet the transposition deadline under the Whistleblowing Directive.
In a nutshell, the Whistleblowing Draft Law requires Romanian companies to implement whistleblowing reporting channels and procedures, as well as related processes, and to appoint specialised staff to manage whistleblowing reports received, internally or via outsourcing, as follows:
Immediate action for compliance is required for companies with 250 or more employees as well as for qualifying companies that already have in place whistleblowing policies and processes, which must revise them to implement the requirements of the Whistleblowing Draft Law.
Failure to implement internal reporting channels and whistleblowing procedures and to appoint a designated person is sanctioned, as per the Whistleblowing Draft Law, with fines. The amounts of the fines are not particularly high in the Whistleblowing Draft Law (e.g., the failure to implement reporting channels is sanctioned with fine up to RON 25,000, the failure to implement a whistleblowing procedure is sanctioned with fine up to RON 30,000, the application of retaliation measures is sanctioned with fine up to RON 50,000, etc.). However, companies may consider the benefits of keeping whistleblowing reports under control via solid internal reporting channels, as well as the risk of reputational damage in case of publicity of a breach to the law reported using external channels or media disclosure, or individual damages awarded to aggrieved whistleblowers, which could be material.
The National Integrity Agency is the public authority designated for purposes related to the Whistleblowing Draft Law, inter alia in charge of external reporting channels.
Who is concerned
The Whistleblowing Draft Law requires public authorities and companies with at least 50 employees, or companies active in certain industries and sectors, such as financial services, irrespective of the number of employees, to implement reporting channels and whistleblowing procedures for persons who wish to report breaches of legal requirements at the standards of the Whistleblowing Draft Law.
How does whistleblowing reporting work
Persons involved with companies or public authorities in a professional context (e.g., as employees, contractors, self-employed, members of management and boards, trainees, volunteers, partners’ staff, job applicants, etc.), referred to as whistleblowers, may report breaches to legal provisions, generally, occurred or that are likely to occur at those entities.
Whistleblowers are protected by the legislation provided they had reasonable grounds to believe that what they report was true at the time of reporting and reporting is made in accordance with the available reporting channels. There are no further conditions for protection, such as reporting in good faith or a public interest condition for reporting.
Practice note: companies should favour internal reporting by putting in place robust whistleblowing systems to have an opportunity to manage potentially harmful reporting internally and prevent exacerbating effects that may come with external reporting or public disclosure of breaches to legal provisions by the company or its staff.
The Whistleblowing Draft Law extends the protection to anonymous reporting received by companies.
What protection for whistleblowers
The Whistleblowing Draft Law sets out several protective measures for persons who report breaches of applicable laws. The most relevant include an obligation to ensure confidentiality of reporting, liability exoneration for whistleblowers and prohibition of retaliation, as well as protection in case of disciplinary proceedings. Persons responsible for retaliatory measures against whistleblowers will be held jointly liable with the company for damages and may be subject to fines as well.
What are companies required to do
The Whistleblowing Draft Law requires companies to (1) implement internal reporting channels, (2) implement whistleblowing procedures, and (3) appoint staff specialised in the management of whistleblowing reports (the “designated person”). Companies are required to consult unions or employees’ representatives in relation to the implementation of the whistleblowing channels and procedures.
Practice note: designated persons may be employees of the companies, dedicated exclusively to the management of whistleblowing reports received or already occupying positions within the company, provided they can act free of conflicts of interests. Also, companies may appoint third-party specialised services providers to carry out the designated person duties.
Companies will also draw up and maintain a whistleblowing registry documenting all whistleblowing reports received and ensuring reports are kept for a 5-year period. Trainings to staff may be needed to ensure understanding of the legal requirements. Also, impact assessments (from a data protection perspective) to assess the risks of the process may be considered for implementation.
Practice note: companies must consider the impact of the whistleblowing procedures and processes on existing internal documentation on matters such as general compliance, data protection, internal control, etc.
Each company that is a member of corporate groups must implement its own whistleblowing channels and procedures, as per the European Commission. Certain flexibilities may be applied in practice at group level, though.
Companies that already have in place whistleblowing policies and processes should revisit them to implement the requirements of the Whistleblowing Draft Law, especially those in terms of range of whistleblowers and protection measures.
When are the requirements due
The Whistleblowing Draft Law is set to become applicable on 17 December 2021.
Companies with 250 or more employees will be required to implement whistleblowing channels and procedures, as well as to appoint the whistleblowing designated person and implement the related processes on or about 17 December 2021. Given the short period before 17 December 2021, we do not exclude that a longer compliance period will be laid down in the final form of the law.
Companies with 50 to 249 employees will be required to comply with the requirements of the law by 1 January 2023, as per the Whistleblowing Draft Law.
The above does not represent legal advice or assistance in relation to the provisions of the draft whistleblowing legislation in Romania. For further details on the above, we kindly ask you to contact us at email@example.com