The Portuguese framework for whistleblowers was approved by Law 93/2021, of 20 December 2021, implementing the 'Whistleblowing Directive' (Directive (EU) 2019/1937 on the protection of whistleblowers) into Portuguese law.
The publication of this law, which, according to the Directive, should have been transposed by 17 December 2021, comes with the anti-corruption strategy approved by the Portuguese Parliament, and introduces a wide range of rights for whistleblowers and mandatory obligations and procedures for Portuguese companies.
Compared to the Whistleblowing Directive, Law 93/2021 is much more comprehensive, as it was expected, considering that the Directive itself determined that its content only set minimum requirements for the Member-States.
This Law applies to complaints regarding (i) public procurement; (ii) financial markets and prevention of money laundering and terrorist financing; (iii) food safety for human and animal consumption, animal health and animal welfare; (iv) public health; (v) protection of privacy and personal data and security of network and information systems; (vi) violent and organised crime, among others.
As to the beneficiaries of the protection, Law 93/2021 is clear when considering as ''whistleblowers'' only those natural persons who report or publicly disclose an infringement based on information obtained during their professional activity regardless of the nature of the activity and the sector in which it is carried out.
“Professional activity” is not limited to employment relationships in force, as it includes relationships that have already ended, pre-contract negotiations and recruitment processes. Shareholders and members of corporate bodies of legal persons, volunteers, and interns, paid or unpaid, are just some of the examples of people who benefit from the protection of this law.
To benefit from the protection, it is only required that the whistleblower acts in good faith and has serious grounds to believe that the information is true, at the time of the report or public disclosure.
In addition to the whistleblower, the safeguard is extended to those who are related to the whistleblower, being covered (i) natural persons who confidentially assist the whistleblower in the whistleblowing procedure, in particular, trade union representatives; (ii) the third party who is connected to the whistleblower who may be subject to retaliation in a professional context; and (iii) legal persons or similar entities that are owned or controlled by the whistleblower, for which the whistleblower works or with which the whistleblower is connected in any way in a professional context.
To make a complaint, the law provides for the existence of:
- Inside channels;
- External channels (managed by the competent authorities); and
- Public disclosure.
Inside reporting channels are mandatory for private and public sector entities employing 50 or more employees and legal persons operating in the fields of financial services, products and markets and the prevention of money laundering and terrorist financing ("obliged entities"). However, local governments which, despite employing 50 or more people, have less than 10,000 inhabitants been excluded from this obligation.
Inside reporting channels must meet certain requirements: (i) they must ensure the secure submission and tracking of reports to ensure completeness, integrity, and preservation of the report; (ii) they must ensure the confidentiality of the identity or anonymity of whistleblowers and the confidentiality of the identity of third parties named in the report; and (iii) they must prevent access by unauthorised persons.
Inside reporting channels may be operated: (i) internally, to receive and follow up on complaints, by persons or services designated for this purpose, or (ii) externally, to receive complaints. In either case, the law provides that independence, impartiality, confidentiality, data protection, secrecy, and absence of conflict of interest must be guaranteed.
Reports may be submitted in writing, verbally, or both. In this context, a verbal report may be made using a voice message or, at the request of the whistleblower, in a face-to-face meeting.
The whistleblower can only resort to external reporting channels when: (i) there is no inside whistleblowing or reporting channel; (ii) the inside whistleblowing channel only admits the submission of complaints by employees, and the whistleblower is not; (iii) it has reasonable grounds to believe that the breach cannot be effectively-known or resolved internally or that there is a risk of retaliation; (iv) when, although the whistleblower has initially complained internally, the measures envisaged or adopted as a result of the complaint are not communicated in the legally prescribed terms; or (v) the infraction constitutes a crime or administrative offence punishable by a fine of more than EUR 50,000.
In turn, public disclosure may only occur in very exceptional circumstances, namely when the whistleblower has reason to believe that (i) the breach may constitute an imminent or manifest danger to the public interest; that (ii) the breach cannot be effectively-known or addressed by the competent authorities, given the specific circumstances of the case; or that (iii) there is a risk of retaliation, including in the case of an external report; or (iv) he/she has made an internal and/or an external report, without adequate measures being taken within the mandatory time-limits.
As regards the procedure to be adopted, obliged entities must, within seven days of receiving the complaint, notify the complainant of the receipt and the requirements for lodging a complaint through external channels managed by competent authorities and within three months at the latest communicate the measures envisaged or taken to act on the complaint. Upon request from the complainant, obliged entities must also communicate to the complainant the outcome of the review of the complaint within fifteen days after its conclusion.
The law also establishes measures to protect whistleblowers:
- Confidentiality of the whistleblower's identity, which can only be revealed by a legal obligation or a court order, preceded by a communication to the whistleblower indicating the reasons for disclosure;
- Prohibition of retaliation against the whistleblower, including, for this purpose, the inversion of the burden of proof and the presumption that certain acts, such as changes in working conditions or the application of a disciplinary sanction, when committed up to two years after the complaint or public disclosure, are motivated by the complaint or public disclosure;
- Legal protection in general terms, such as protection for witnesses in criminal proceedings; and
- Non-imposition of a disciplinary, civil, misdemeanour or criminal liability in cases of denunciation or public disclosure of offences made by the requirements imposed by law.
The violation of these rules constitutes an administrative offence, to which procedure is to be carried by the National Anti-Corruption Mechanism:
- Between €1,000 and €25,000 (natural persons) or €10,000 and €250,000 (legal persons), in case of a very serious offence, namely: preventing the lodging or not following up on the complaint; retaliatory acts; breach of the duty of confidentiality; communication or public dissemination of false information;
- Between €500 and €12,500 (individuals) or €1,000 to € 125,000 (legal persons) in case of a serious administrative offence, such as not having an inside reporting channel or having an internal channel without guarantees of completeness, integrity or preservation of complaints or confidentiality of the identity or anonymity of the complainants or third parties mentioned in the complaint, or without rules preventing access to unauthorised persons; failure to inform the complainant of the outcome of the analysis of the complaint, if the complainant has requested it; failure to train the staff responsible for handling complaints; failure to record or retain the complaint received for at least five years or during the pendency of judicial or administrative proceedings.
Bearing in mind the adaptation to the new procedures and obligations, the law provides for a transitional period of 180 days, so it will come into force on 18 June 2022. During the first half of 2022, companies should prepare themselves by establishing a whistleblowing channel, allowing the guarantees of confidentiality, anonymity and independence set out in the law to be safeguarded, and with well-defined procedures to follow up on complaints within the legal deadlines, without retaliation.