Law 93/2021 establishing the general whistleblower protection framework (“RPDI”) and transposing Directive (EU) 2019/1937, of 23 October 2019, on the protection of persons who report breaches of Union law (“Directive”), was published December 20, 2021.

The RPDI defines whistleblower as any natural person who reports or discloses information obtained in the course of their professional duties on the following offenses:

1. Breaches of European Union law on certain matters (e.g. public procurement, anti-money laundering and terrorist financing, environmental protection, data protection, competition rules); and
2. Violent, highly organized, and economic and financial crimes.

The RPDI protects whistleblowing in respect of a larger range of infractions than the Directive.

To be legally protected, the report must be made in good faith, i.e., the whistleblower must have serious reason to believe that the information is true at the time it is provided.

As for the types of report, the RPDI foresees internal whistleblowing, external whistleblowing, and public disclosure, and establishes the criteria for their sequential prevalence.

Internal whistleblowing is prioritized from the outset through the creation of a legal obligation to implement whistleblowing channels for all entities employing 50 or more workers.

Such channels must be configured in a way that allows meeting several requirements, including:

1. the completeness, integrity and preservation of the report;
2. compliance with the duties to keep confidential the identity or anonymity of the whistleblowers and persons concerned;
3. personal data protection; and
4. compliance with the procedure following the report, including deadlines to notify whistleblowers of the progress of their report.

To ensure compliance with these duties, the entities covered can appoint persons or services to handle the reports or outsource the operation of any existing channels, but the legal requirements must always be ensured.

A central feature of the RPDI is the prohibition of retaliation against whistleblowers, which aims to deter entities from performing any acts or omissions that harm them in a professional context and that are motivated by the report filed. Retaliation is presumed notably in the following situations:

1. dismissal;
2. suspension of the employment contract;
3. change in working conditions (e.g., workplace, working hours or remuneration);
4. negative performance evaluations;
5. non-renewal of fixed-term contracts; or
6. termination of a contract in place with a services provider or a supplier, provided that they occur within two years from the report or the public disclosure of the relevant information.

Failure to comply with the obligations set forth in the RPDI carries liability for administrative offenses for both entities and natural persons. Applicable penalties may include administrative fines of up to EUR 250,000.00, which will be applied by the National Anti-Corruption Mechanism.

In addition to compliance with the RPDI, the creation of internal whistleblowing channels is a structural part of a robust compliance program, which, in light of Law 94/2021, of December 21, 2021, may be relevant to the dismissal of criminal proceedings or to the mitigation of the penalty in case of conviction.

VdA is highly experienced in designing compliance programs, including creating internal policies and procedures applicable to whistleblowing, and supporting entities across several economic sectors in connection with their implementation and monitoring.