Law No 361/2022 on the protection of whistleblowers in the public interest
Law no. 361/2022 on the protection of whistleblowers in the public interest ( "Law no. 361/2022") was published in the Official Gazette of Romania on 19 December 2022. The law entered in force as of 22 December 2022.
Directive (EU) 2019/1937 of the European Parliament and of the Council on the protection of persons reporting infringements of Union law was adopted and published in the Official Journal of the European Union on 26 November 2019. As an EU Member State, Romania was obliged to transpose the Directive.
As of 17 December 2023, companies with over 50 employees, in particular, will be subject to a new set of obligations regarding whistleblowers.
This law regulates the procedure for receiving, examining and resolving reports, the rights and obligations of persons making reports or publicly disclosing information on violations of the law, their protection measures, the obligations of authorities, public institutions, other legal persons under public law, as well as legal persons under private law, the rights of the persons concerned, as well as the powers of the competent authorities.
1. What is whistleblowing and what are whistleblowers
In broad terms, whistleblowing is when an employee reports a breach of the law which she/he has come to learn about, to their employer, the general public or competent authority. Such act is known as whistleblowing.
2. Reporting on violations of the law shall be made, alternatively, by means of:
- internal reporting channels within legal entities;
- external reporting channels;
- the media, professional, trade union or employers' organizations, non-governmental organizations, parliamentary committees.
2.1. The obligation to establish internal reporting channels
- Employers with at least 50 employees, are required to identify or establish internal reporting channels and establish procedures for internal reporting and for follow-up actions. The designated third party is required to apply the reporting procedure outlined within this law.
- Private companies with between 50 and 249 employees, may group together and use or share resources in terms of receiving reports of violations of the law on whistleblowing and in terms of follow-up actions. This is without prejudice to the obligation to maintain confidentiality, keep the whistleblower informed and resolve the issues in the report.
2.2. Content of reports
The report shall include, at a minimum, the following:
- the name and contact details of the whistleblower;
- the professional context in which the information was obtained;
- the person concerned, if known
- a description of the fact that may constitute a breach of the law, as well as evidence in support of the report;
- the date and signature, if applicable.
3. The procedures for dealing with an internal report and for taking follow-up actions shall entail the following:
- establishing the manner in which reports are received so as to protect the confidentiality of the whistleblower and any third party named in the report;
- the obligation to transmit to the whistleblower confirmation of receipt of the report within 7 calendar days at the latest following receipt;
- designate a person, department or third party responsible for receiving, recording, examining, taking follow-up action and resolving reports, who shall act impartially and independently in the exercise of those duties;
- the obligation to inform the whistleblower of the status of the follow-up action no later than 3 months after the date of acknowledgement of receipt or, if the receipt of the report has not been acknowledged, no later than three months after the expiry of the 7-day period;
- the obligation to provide clear and easily accessible information on external reporting procedures to the competent and relevant authorities
- the obligation to inform the whistleblower of the arrangements for handling the report.
- the designated person as well as the means of reporting shall be made known to each employee, by posting on the institution's website and by displaying it at the premises in a visible and accessible place. The employer must ensure that at least one means of reporting is accessible at all times.
4. Reporting records
- Reports shall be entered in a special register. Employers and competent authorities shall be obliged to keep records of reports in the register. The register may be kept in electronic format. Legal entities with at least 50 employees are obliged to keep statistics on reports concerning breaches of the law.
- Legal entities shall keep record of all reports received, subject to confidentiality requirements. Reports shall be kept for 5 years, after which they will be destroyed.
5. Confidentiality
- The person designated to deal with the report shall not disclose the identity of the whistleblower or any information that would allow the whistleblower to be identified directly or indirectly, unless she/he has the express consent of the whistleblower.
- The identity of the whistleblower shall not be disclosed unless so required by law but subject to conditions and limits laid down therein.
- Information within the reports that constitutes trade secrets may not be used or disclosed for other purposes than those necessary to resolve the report.
- There is no duty of confidentiality if the whistleblower has intentionally disclosed his or her identity in the context of a public disclosure.
6. Interdiction against retaliation
Any form of retaliation against whistleblowers is prohibited, especially:
- any suspension of the individual contract of employment or of the employment relationship, such as being made technically unemployed;
- dismissal;
- any change in the employment contract or employment relationship, such as transfer of duties, change of workplace location, reduction of salary, change of working hours;
- demotion or hindering of job promotion and professional development, including through negative performance appraisals or negative recommendations for work performed;
- the application of any other disciplinary sanction;
- coercion, intimidation, harassment;
- discrimination, creating another disadvantage or subjecting to unfair treatment;
- refusal to convert a fixed-term employment contract into an employment contract of indefinite duration where the worker had a legitimate expectation that she/he would be offered a permanent post;
- refusal to renew a fixed-term employment contract or early termination of such a contract;
- causing damage, including damage to the reputation of the person concerned, in particular on social media, or financial loss, including in the form of lost business opportunities and loss of income;
- inclusion on a negative list or database, based on a formal or informal sectoral or industry-wide agreement, which may imply that the person concerned will not find a job in that sector or industry in the future;
- early termination or cancellation of a contract for goods or services;
- cancellation of a license or permit;
- a request for a psychiatric or medical evaluation.
7. Sanctions
- Infringement of the provisions of this Law shall entail, as the case may be, civil, disciplinary, contravention or criminal liability.
- The following acts constitute contraventions, if they have not been committed under such conditions as to be considered, according to the criminal law, offences and shall be sanctioned as follows:
- the prevention, by any means, of reporting by the person designated to receive and record the reports or by the person who is part of the department designated for this purpose within private and public legal entities with a fine ranging from 2,000 lei to 20,000 lei;
- unjustified refusal to respond to the requests of the authorities in the exercise of their duties, with a fine of 3,000 lei to 30,000 lei;
- non-compliance by the private and public legal entities of the obligations to establish internal channels, with a fine of 3,000 lei to 30,000 lei;
- failure by private and public legal entities to fulfil their obligations, including the obligation of confidentiality, with a fine from 4,000 lei to 40,000 lei;
- violation of the obligation to maintain confidentiality regarding the identity of the whistleblowers, the data subject (namely, the person responsible for the breach of law) or third persons, with a fine from 4,000 lei to 40,000 lei in the case of individual persons (in Romanian, persoane fizice);
- reporting information on violations of the law knowing it to be untrue, with a fine of 2,500 lei to 30,000 lei.