Romania enacts new whistleblowing law

On 22 December 2022, Law No. 361/2022 on the protection of whistleblowers in the public interest entered into force in Romania. This act transposes Directive (EU) 2019/1937 of the European Parliament and of the Council of 23 October 2019 on the protection of persons who report breaches of EU law.

The new whistleblowing law, first whistleblowing framework law in Romania applicable to both private and public sector, was adopted following an intensively scrutinised enactment process with the draft law subject to numerous amendments, comments and significant debates. The law establishes protection measures for persons working in public authorities and institutions, other public legal entities private legal entities, who report (verbally or in writing) irregularities or unlawful acts of which they became aware. The act is intended to be an instrument to encourage reporting and, consequently, the discovery and sanctioning of unlawful acts, as well as to protect those persons against possible negative professional or personal consequences by granting them the status of "whistleblower in the public interest".

Who can be named a whistleblower

A whistleblower can be any natural person who is a worker, self-employed person, shareholder or a person who is part of the administrative, management or supervisory body of a company, volunteers and trainees, or any person working under the supervision and management of the natural or legal person with whom a contract has been concluded. This includes subcontractors and suppliers.

Even if the law stipulates the obligation of the report to contain data such as name, surname, contact details or signature of the whistleblower, the report will also be analysed without this condition being met, to the extent that it contains sufficient indications of violations of the law.

Internal reporting

Authorities, public institutions, other public entities, irrespective of size and also private entities with at least 50 employees are required to identify or establish internal reporting channels and establish procedures for internal reporting and follow-up actions regarding violations of law. Companies operating in specific sectors (i.e. financial services, insurance) must fulfil the stated obligation regardless of the number of employees.

External reporting

The competent authorities to receive reports on violations of the law include public authorities and institutions, which have been mandated to receive and resolve reports relating to violations of the law, according to their field of competence, as well as The National Integrity Agency or other authorities and public institutions to which the Agency forwards reports for resolution.

Protection of a whistleblower who makes a public disclosure

Under the provisions of the law, the reporting person is protected against the eventual consequences triggered by a public disclosure when one of the following conditions have been met:

• the whistleblower first reported via the available (internal or external channels) and only after the respective timeframe for receiving a response has elapsed (respectively, three to six months since the report was received);
• the whistleblower had reasonable grounds to believe that the violation may constitute an imminent or obvious danger to the public interest or trigger the risk of irreparable damage or in the case of external reporting, there is a risk of retaliation or a low probability that the violation will be effectively remedied (upon considering the specific circumstances of the reporting).

Reporting evidence

All entities will keep records of all registered valid reports for a period of five years. After the expiration of the five-year storage period, the reports will be destroyed.

Sanctions

There are several penalties under the law that apply in whistleblowing cases, such as not complying with the obligations of implementing internal reporting channels, preventing by any means reporting to the person designated to receive and record the reports or by the person who is part of the compartment designated for this purpose within the legal entities and not complying with the confidentiality obligations in relations to the reports. Penalties range from the RON equivalent of EUR 400 to EUR 8,000. Knowingly reporting false information regarding violations of the law is qualified as offence and will be sanctioned with a fine ranging between EUR 500 and EUR 6,000, if the act was not committed under conditions considered a criminal offence.

The law also prohibits retaliation against whistleblowers in the public interest, such as any suspension of the individual employment contract or of the employment relationship, dismissal, modification of the employment contract, etc. In case of a breach of this obligation, a fine of up to EUR 8,000 will be issued.

Obligations for medium and large companies

Private entities having between 50 and 249 employees are under the obligation to identify or set forth internal reporting channels as of 17 December 2023. Hence, companies under this scope will need to assess and set up their own internal reporting channels. This will also involve assessing and recalibrating already existing whistleblowing channels, including from a reporting flow, data sharing with group companies, and implementing measures relevant from a personal data protection standpoint.

For advice on setting up internal reporting systems in your Romania-based business that are compliant with this new law, contact your CMS client partner or local CMS experts: Cristina Popescu and Laura Grigore.