In 2019, Directive (EU) 2019/1937 of the European Parliament and of the Council of 23 October 2019 on the protection of persons who report breaches of Union law (the "Directive") was adopted at the European Union level.
Romania has adopted a new law implementing the Directive after the draft enactment was returned to Parliament for re-discussion following the President of Romania's request for a review of the bill on 28 July 2022.
Law no. 361/2022 on the protection of whistle-blowers in the public interest (“Law no. 361/2022”) provides a number of directions for the regulation of reporting and imposes obligations on both public law entities (e.g., authorities, public institutions) and private law entities (e.g., limited liability companies, joint stock companies). Law no. 361/2022 entered into force on 22 December 2022.
WHO can report as a whistle-blower?
Persons who have obtained in a professional context information regarding breaches of the law (including during the recruitment process or after termination of the employment relationship)may issue reports. Specifically, this category may include: employees; self-employed persons; persons who are members of the management/supervisory bodies of an undertaking; volunteers, trainees; any person working under the supervision and direction of the natural/legal person with whom the agreement has been concluded, its subcontractors and suppliers.
WHAT types of breaches can be reported?
Actions or omissions that constitute non-compliance with legal provisions in areas such as consumer protection, protection of privacy and personal data and security of networks and information systems, corporate taxation or mechanisms whose purpose is to obtain a tax advantage contrary to the object or purpose of the applicable corporate tax law.
HOW to report?
In principle, reporting can be made verbally (e.g., communication via telephone, voicemail) or in writing including at least information such as: name and surname, signature and contact details of the whistle-blower; description of the fact, including the professional context in which the information was obtained; the person concerned, if known; and evidence in support of the claim.
It will be possible to close reporting that: (i) does not contain the elements set out above, except for the identification of the whistle-blower; (ii) is submitted anonymously and does not contain sufficient information on breaches of the law that allow the report to be analysed and resolved and, after requesting it to be completed, the notified person has not completed it within 15 days.
WHERE to report?
Reports of breaches of the law are made mainly through internal channels. However, a public-interest whistle-blower can choose between internal and external reporting channels.
The obligation to set up internal reporting channels/to pool and/or use resources in terms of receiving reports lies with private legal entities with at least 50 employees; other private entities may pool and use or share resources in terms of receiving reports of breaches of the law and in terms of follow-up actions.
What are EMPLOYERS' OBLIGATIONS?
Employers with at least 50 employees are required to set up internal reporting channels/groups, and/or use resources in terms of receiving reports of breaches of the law and taking follow-up action.
Basically, employers with fewer than 50 employees can group together and use or share resources in terms of receiving reports of breaches of the law and taking follow-up action.
Employers with at least 50 employees, through the designated person or department, are also required to maintain statistics on reports of breaches of the law. The reports shall be written in a register that shall be kept in electronic format and which:
• covers the following information: date of receipt of the report, name and surname and contact details of the whistle-blower in the public interest; the subject of the report and how it was dealt with;
• is held electronically;
• will be kept for five years.
What are the main steps in adopting an INTERNAL REPORTING PROCEDURE?
In preparing internal reporting procedures employers should ensure:
• the designation of an impartial and independent person/department/third party responsible for receiving, recording, examining, taking follow-up action and resolving reports;
• that channels are in place to receive reports so that identity confidentiality is protected;
• acknowledgement of receipt of a report no later than seven calendar days after its receipt;
• the provision of information on the status of the follow-up actions;
• that the public interest whistle-blower is informed on how to deal with the report.
What SANCTIONS do employers risk?
Infringement of the provisions of Law no. 361/2022 shall result in civil, disciplinary, misdemeanour or criminal liability, as appropriate, to the extent that employers do not implement internal procedures within in principle 45 days from the date of entry into force of the Law no. 361/2022.
Employers could be sanctioned, for example, for non-compliance with the provisions of Law no. 361/2022 with a fine:
• from RON 3,000 (approx. EUR 600) to RON 30,000 (approx. EUR 6,000) for failure to establish internal reporting channels;
• from RON 4,000 (approx. EUR 800) to RON 40,000 (approx. EUR 8,000) for failure to design, set up and manage the way reports are received in a confidential manner.
By Remus Codreanu, Partner, Catalin Roman and Mihaela Nastase, Senior Associates, Vlad Simion, Managing Associate and Gabriela-Lazarina Ion, Associate, Kinstellar
