Law no. 361/2022 is one of the much-awaited legal novelties of the end of 2022. Its objective is to regulate the general framework for the protection of persons who report violations of legislation in certain domains, which occurred or are likely to occur, within public authorities and institutions, other public law entities, as well as private law entities such as limited liability companies, joint stock companies (the ”Targeted Entities”).
Overview
Law no. 361/2022 on the protection of whistleblowers in the public interest (”Law 361/2022” or the ”Law”) was published in the Official Gazette no. 1218/2022 – Part I, on 19 December 2022, and it entered into force on 22 December 2022.
The Law seeks to transpose into Romanian law the Directive (EU) 2019/1937 of the European Parliament and of the Council of 23 October 2019 on the protection of persons who report breaches of Union law (the Whistleblowers’ Directive).
The whistleblowers
The whistleblowers are individuals who report violations of legislation based on information obtained in a professional context[1] (the “Whistleblowers”).
The following categories of individuals may be Whistleblowers: (i) workers; (ii) persons carrying out an independent activity within the meaning of the Treaty on the Functioning of the European Union; (iii) shareholders and persons who are part of the administrative, management or supervisory body of an undertaking, including non-executive members of the board of directors, as well as paid or unpaid volunteers and interns; (iv) any person who works under the supervision and management of the natural or legal person with whom he/she concluded the contract, of its subcontractors and suppliers; (v) persons whose labour relationships have not actually started or which have already ended.
Anonymous Whistleblowers can also benefit from the provisions of Law 361/2022 in certain circumstances.
The reports and reporting channels of the Whistleblowers
The reporting of Whistleblowers under Law 361/2022 has the following particularities: (i) it concerns violations of legislation irrespective if such consist in actions or omissions; (ii) it concerns violations of legislation regarding domains expressly listed by Law 361/2022 (e.g. public procurement, prevention of money laundering and terrorism financing, environmental protection, public health, consumer protection); (iii) it may also concern reasonable suspicions, regarding actual or potential legal infringements; (iv) it may be done not only in writing, but also orally; (v) it may be done either through internal channels (i.e. the reporting channels organized at the level of a Targeted Entity within which the violation occurred or is about to occur) or through external channels[2] (i.e. the reporting channels organised at the level of the National Integrity Agency (”NIA”) or other similar public authorities entitled to solve the reports over violations of legislation).
A report has to contain the following elements: (i) the name and the contact details of the Whistleblower; (ii) the professional context in which the information was obtained; (iii) the person concerned by the Report, if its identity is already known; (iv) the description of the presumed violation of the specific legislation; (v) evidence supporting the Report; (vi) the date and the signature of the Whistleblower.
Anonymous reports should be analyzed and resolved only if they contain solid evidence of violations of the specific legislation. In lack of a legal definition for ”solid evidence”, the Targeted Entities will have to conduct their own analysis on a case-by-case basis.
Law 361/2022 imposes on the following Targeted Entities to establish and maintain internal reporting channels and procedures for internal reporting and for subsequent actions (list is not exhaustive):
- private legal entities with at least 50 employees;
- private legal entities which fall within the scope of the legislation provided in Annex no. 3 of the Law (e.g. legislation on capital markets, insurance and reinsurance activities, activities of financial instruments issuance, statutory audit of annual financial statements, activities of e-money issuance, activities of credit institutions), irrespective of their number of employees;
Private legal entities that have between 50 and 249 employees may group and use or share resources for receiving internal reporting on violations of legislation and managing subsequent actions.
The procedure for internal reporting and for subsequent actions will need inter alia to appoint a person, a department or a third party to handle the receipt, registration, examination, performance of subsequent actions and to grant a solution to the reports. The identity of the appointed person, as well as the reporting channels have to be made known to each employee. This information will have to be posted on the website and at the headquarters of the Targeted Entity.
Targeted Entities are required to keep a digital registry of the reports. Reports will be kept by Targeted Entities for a period of 5 years from their registration in the registry, and destroyed at the end of this period.
For private legal entities having between 50 and 249 employees, the obligation to identify and establish internal reporting channels enters into force on 17 December 2023.
Specific sanctions
Law 361/2022 qualifies certain deeds as administrative offenses (the list is not exhaustive):
- failure of the Targeted Entities to comply with the legal obligation to set-up internal reporting channels, case in which the applicable fines may reach RON 30,000 (approx. EUR 6,000);
- failure of the Targeted Entities to adapt the internal channels to the principle of confidentiality, case in which the applicable fines may reach RON 40,000 (approx. EUR 8,000).
NIA is the legal authority empowered to find and sanction these administrative offenses.
* * *
DISCLAIMER: This free electronic publication is edited by the law firm Leroy si Asociaţii and is intended to provide non-exhaustive, general legal information. This publication should not be construed as providing legal advice. The addressee is solely liable for any use of the information contained herein. Leroy si Asociaţii shall not be held responsible for any damages, direct, indirect or otherwise, arising from the use of this information
[1] The terms “in a professional context” encompass professional activities of any nature, current or previous, paid or not paid, carried out within the Targeted Entities, on the basis of which Whistleblowers could obtain information regarding the violations and might suffer retaliation for reporting them;
[2] Law 361/2022 provides that the usual reporting channels are the internal ones, but it gives the Whistleblower the right to use an external channel directly, in certain special circumstances, i.e. in case of a risk of retaliation for reporting through internal channels; or in case the violation is impossible to be effectively remedied through internal reporting channels; or in case of absence of internal reporting channels at the level of the Targeted Entity concerned.
