AUTHOR (name and surname)

Ana Neves

COUNTRY

Portugal

YEAR

2021-2022

Name of the act/s*

General whistleblower protection Framework

Subject area

Many areas of law: criminal, civil, labour, and sector-specific laws

Brief description of the contents of the act

The Act under comment is the transposition of the Directive (EU) 2019/1937 of the European Parliament and of the Council of 23 October 2019 on the protection of persons who report breaches of Union law. It was published on 20 December 2021 and entered into force on 18 June 2022[1].

It provides on the protection of persons who report in a work-related context, in private and public sectors, breaches to the European acts listed in Part I of the annex to the Directive (related manly to public procurement, protection of personal data, public health, environmental protection, food and feed safety, animal health and welfare, consumer protection) and to “national rules implementing, transposing or enforcing such acts or any other rules contained in legislative acts implementing or transposing them, including those providing for criminal offences or administrative breaches”. It also encompasses acts and omissions contrary to and detrimental to the financial interests of the European Union referred to in Article 325 of the Treaty on the Functioning of the European Union (TFEU), as specified in the applicable Union measures; and acts or omissions contrary to the internal market rules referred to in Article 26(2) TFEU, including competition and state aid rules, as well as corporate tax rules (Article 2(1)-(a) to (c)).

The protection is extended to whom reports information related to “violent, especially violent and highly organised crime”, as well as to specific economic-financial crimes. It is also included in the material scope of the Act the report of breaches to procurement rules in the defence and security area (Article 2-(1)/d-(2)).

The Act is organized in five Chapters. The first one describes the scope, the relationship with other Union acts and national provisions, and the general conditions for protection of reporting persons. Chapter II provides for the means of reporting and public disclosure. Chapters III and IV establishes, respectively, measures to protect the whistleblowers against retaliation and defines the terms of judicial protection for reporting persons and of protection of persons concerned.

As far as the reporting arrangements are concerned, the following aspects should be highlighted:

1.     Legal persons, including the State and other legal persons governed by public law, employing 50 or more employees and, irrespective of that, entities that are within the scope of the European Union acts referred to in Part I.B and in Part II of the Annex to the Directive (EU) 2019/1937 have to establish internal reporting channels, operated by a person or department designated for that purpose or provided externally by a third party (Article 8-(1), (2) and (9)).

An internal reporting channel shall also be set up in the Presidency of the Republic; the Assembly of the Republic; in each ministry or governmental area; in Constitutional Court; in Superior Council of the Judiciary; in Superior Council of the Administrative and Fiscal Courts; in Court of Auditors; in Office of the Prosecutor General; and in Representatives of the Republic in the Autonomous Regions of Açores and Madeira (Article 8-(4)).

The internal reporting channel must guarantee the completeness, integrity and preservation of the reporting, the confidentiality of the identity or anonymity of the whistleblowers and the confidentiality of the identity of third parties mentioned in the complaint, as well as preventing access by unauthorized persons (Article 9-(1)). In the receiving and following-up of reports, independence, impartiality, confidentiality, data protection, secrecy and absence of conflict of interest must be guaranteed (Article 9-(4)).

2.     “Competent authorities shall establish external reporting channels, independent of and separate from other communication channels, to receive and follow-up reports”. Among these external reporting channels are named the Public Prosecutor's Office, the criminal police bodies, the Bank of Portugal, independent administrative authorities, “inspectorates-general and similar entities and other central services of the State's direct administration with administrative autonomy”, local authorities; public institutes, and public associations (Article 12).

3.     It is only possible to report breaches through an external channel after having reported them internally in the following circumstances: the internal channel only accepts complaints from employees, and the whistleblower is not an employee; the whistleblower has reasonable grounds to believe that the breach cannot be properly addressed or that there is a risk of retaliation; if the whistleblower has initially reported the breach internally without having been informed of the measures envisaged through an internal channel within the prescribed time limits (e.g., within three months from the acknowledgment of receipt, as regards the follow-up – Article 11(3)); and if the breach is a criminal offence or an administrative offence punishable by a fine of more than EUR 50 000 (Article 7(2)).

4.     Regarding the making of information available in the public domain, a whistleblower can only make a public disclosure when it “has reasonable grounds to believe that the breach may constitute an imminent or manifest danger to the public interest, that the breach cannot be effectively known or addressed by the competent authorities, having regard to the specific circumstances of the case, or that there is a risk of retaliation including in the case of an external complaint” without adequate measures being taken within the time limits provided for (Article 7(3)).

5.     The reporting channels allow breaches to be reported anonymously or with identification of the whistleblower, made in writing and/or verbally (Article 10 and 14).

6.     The duty to communicate to the reporting person the final outcome of investigations triggered by a report depends on her/his request within 15 days after that final outcome (Article 11-(4) and 15-(4)).

With regard to protection measures for whistleblowers, the following aspects should be mentioned:

7.     Retaliation against whistleblowers is prohibited (Article 21-(1)), aiming to deter any direct or indirect behaviour in a labour context that could harm him and that is motivated by the reporting breach (Article 21(1)-(2)).

8.     The detriment suffered by the reporting person is presumed to be retaliation for the report or the public disclosure, provided that they occur within two years from the reporting or the public disclosure. In such cases, it shall be for the person who has taken the detrimental measure to prove that this measure - change in working conditions (e.g., workplace, working hours or remuneration); dismissal; suspension of the employment contract; negative performance evaluations; non-renewal of fixed-term contracts; or termination of a contract in place with a services provider or a supplier - was based on duly justified grounds (Article 21-(6)). A disciplinary sanction applied to the whistleblower up also to two years after the report or public disclosure is presumed to be abusive (Article 21-(7)).

9.     The reporting and public disclosure in accordance with the legal requirements shall not, in itself, constitute grounds for disciplinary, civil, administrative or criminal liability (Article 24-(1)).

Reporting persons are not considered to have breached any restriction on disclosure of information and do not incur liability of any kind in respect of a report or public disclosure provided that they had reasonable grounds to believe that the reporting or the public disclosure of such information was necessary for revealing a breach (Article 24-(2). Whistleblowers who report or publicly disclose a breach in accordance with the requirements imposed by law shall not be liable for obtaining or having access to the information that gave rise to the report or public disclosure, except in cases where to obtain or have access to the information constitutes a criminal offence (Article 24-(3)).

The whistleblower is liable for the damages caused by the reporting or public disclosure made in violation of the legal requirements. Those who assist the former, including representatives of trade unions or workers' representatives, are jointly and severally liable (Article 25-(3)).

10. Whistleblowers are entitled, under general terms, to legal protection (Article 22-(1)), which is regulated in Law 34/2004, which ensures legal advice and legal assistance in a situation of economic insufficiency.

11. "Whistleblowers enjoy all guarantees of access to the courts to defend their legally protected rights and interests.” (Article 23).

12.  Persons affected by the reports fully enjoy the presumption of innocence, the right to an effective remedy and to a fair trial, and the rights of defence in criminal procedure (Article 25-(1)).

13.  Penalties are applicable to natural or legal persons that, among other specified behaviours, hinder or attempt to hinder reporting, retaliate against reporting persons and breach the duty of maintaining the confidentiality of the identity of reporting persons (Article 27).

Comment

1.     The context of the Portuguese general whistleblower protection framework

The Act under comment is the transposition into national law of Directive (EU) 2019/1937 of the European Parliament and of the Council of 23 October 2019 on the protection of persons who report breaches of Union law. It is included in National Anti-Corruption Strategy for 2020-2024, adopted by the Resolution of the Council of Ministers no. 37/2021 of 6 April 2021. This “aims at answering a long-standing need to create a robust anti-corruption framework”[2]. Namely, states that the existence of whistleblowing channels and an “adequate protection for whistleblowers of breaches of compliance plans is essential to ensure that those who comply with the law do not become targets of retaliation”[3].

The importance of the Act is better understood if we bear in mind that in the European Commission 2022 Rule of Law Report, Country Chapter on the rule of law situation in Portugal, three of the five recommendations addressed to Portuguese authorities are on the prevention of corruption and transparency. These recommendations are the following: “ensure sufficient resources for preventing, investigating and prosecuting corruption including by ensuring the swift operationalisation of the New Anti-Corruption Mechanism”; “ensure the start of operations of the Transparency Entity [set out in 2019, by the Organic Law No. 4/2019, of 13 September 2019], in view of effective monitoring and verification of asset declarations”; and “continue the reforms to improve the transparency of law-making, particularly on the implementation of impact assessment tools” (p. 2).

The Decree-Law no. 109-E/2021 of 9 December 2001 created the National Anti-Corruption Mechanism - an independent administrative authority with powers to monitor the implementation of the preventive framework and to impose administrative fines for non-compliant entities - and approved the General Regime for Prevention of Corruption. This provides that private legal persons, branches, public legal persons and administrative services employing 50 or more people must adopt and implement compliance programmes aimed at preventing and detecting acts of corruption and related offenses. Namely, they must have internal reporting channels under the provisions of the legislation transposing Directive (EU) 2019/1937 (Articles 2 and 8).

2.     The non-compliance with the whistleblowing Directive

Portugal was one of the first countries to incorporate the whistleblowing Directive into internal legal order (https://eur-lex.europa.eu/legal-content/en/NIM/?uri=CELEX:32019L1937; https://whistleblowingmonitor.eu/). However, Portugal has delayed the entry into force to 180 days after its publication. The European Commission sent a letter of formal notice to Portugal as a result of the delayed entry into force (https://ec.europa.eu/commission/presscorner/detail/en/inf_22_601 - February 2022). Nevertheless, more relevant is the fact that it does not comply with the content of the Directive in two key respects: the reporting model of breaches to European Union Law and the protection of the whistleblowers against retaliation.

The EU Whistleblower Directive defines minimum harmonisation standards that should be adopted at the national level. Two main objectives are at stake. On one hand, “reports and public disclosures by whistleblowers are one upstream component of enforcement of Union law and policies” (Recital 2 and Article 1). On the other hand, “[p]ersons who report information about threats or harm to the public interest obtained in the context of their work-related activities make use of their right to freedom of expression” (Recital 31; and e.g., ECHR, Guja v Moldova, App No 14277/04, 12 February 2008). The Portuguese Act seems unable to ensure both objectives, due to the inadequacy of the whistleblowing channel system and due to the lack of reliable measures to prevent and address any retaliation against whistleblowers.

2.1. The inadequacy of the reporting channels system

As set out in the Directive (EU) 2019/1937, there are three ways to report relevant breaches. The Act under comment diverges from the Directive on the reporting process and on the features of the reporting channels. In fact:

i)      It states that internal reports shall precede external reports in certain (wide-ranging) situations that compromise the alternative provided for in the Directive. According to this - without prejudice to requirements to public disclosure - “reporting persons shall report information on breaches using the channels and procedures referred to in [the Directive]…, after having first reported through internal reporting channels, or by directly reporting through external reporting channels” (Article 10 [emphasis added]; and Article 15(1)-a)), being able, therefore, to choose between reporting a breach through an internal channel or, directly, reporting it externally to the competent authorities. Under the Portuguese Act, this alternative does not really exist:

a.     For instance, it is only possible to report a breach to EU law directly through an external channel if the breach is a criminal offence or an administrative offence punishable by a fine of more than EUR 50 000. It must be borne in mind that Public officials are only rarely liable for administrative offences and that the amounts of the fines are usually much lower (for instance, Article 38 of Law No. 58/2019 of 8 August, that ensures the implementation, in the national legal order, of Regulation (EU) 2016/679 of the Parliament and of the Council of 27 April 2016 on the protection of individuals with regard to the processing of personal data and on the free movement of such data, provides for much lower values).

b.     Secondly, the requirement to report to an internal channel before using an external channel is illogical if we consider the nature of public bodies that constitute the external reporting channels. These are: the Public Prosecutor’s Office and police criminal bodies; independent administrative bodies; control administrative bodies; local authorities; and collective persons of an institutional and associative nature.

That means that for those in a work-related context – differently than for people in general and differently from what happens before the transposition of the Directive (EU) 2019/1937 – it has become mandatory to report breaches of EU to internal reporting channels in a wide range of situations.

ii)     Not all the internal and external reporting channels fulfill the requirement defined in the Directive. According to the Directive, internal reporting channel shall be an “impartial person or department competent” (Article 9(1)-b)); and external reporting channels shall be “independent and autonomous”, which requires that they are designed, established an operated in a manner that ensures that the reported breaches are addressed properly (Article 12(1)).

With the exception of the Public Prosecutor's Office and of the criminal police bodies, there is no guarantee that internal and external whistleblowing channels have the necessary independence, that can do thorough and timely investigations and that can take the necessary measures to protect the whistleblowers.

In addition, for whom who work in an external reporting body, it is not clear which bodies correspond to an external reporting body to them. It is also difficult to understand that local authorities and institutional specialized bodies (under the superintendence and control of the government) can play the role of an external reporting channel.

iii)   Regarding the follow-up procedures, it must be highlighted that it is only under request, within 15 days after its conclusion, that the final outcome of investigations is communicated to the reporting person (Article 11-(4) and Article 15-(4) of Portuguese Act). This communication, provided for in the case of external reporting, in the Directive, does not depend on a request and is not subject to a time limit (Article 11(2)-e)).

Another major problem of the Portuguese transposition Act of whistleblower is the lack of reliable measures to protect against retaliation

2.2.         Lack of reliable measures to protect against retaliation

According to the Directive, the reporting person shall be protected against all forms of retaliation, whether direct or indirect, in the context of his or her work-related activities, such as dismissal, negative impacts on promotions or salary, unjustified negative performance assessments, transfers and changes of workplace, and harassment or discrimination. The reporting person shall have access to appropriate support measures, notably independent information and advice and legal aid in accordance with EU rules on legal aid in criminal and cross-border civil proceedings; and shall have access to appropriate remedial measures. Neither of these two aspects is guaranteed under Portuguese law.

a)     Regarding the first one, once the whistleblower shows that has made a disclosure following the Directive and that faced retaliation, it is on the employer to show that measures taken did not arise as a result of the employee’s disclosure. However, this is only the case if the negative effect occurs within two years from the date on which the report is received. In the case of public employment law, negative decisions for employees (e.g., a disciplinary sanction and a negative performance appraisal) can and are often taken beyond those two years. For instance, a disciplinary proceeding can initiate sixty days after a disciplinary infraction – period that can be suspended up to six months - and the procedure can last until 18 months, timeframe that can also be suspended, without limit; and performances evaluations take place after every two years period of working performance.

b)     Member States should ensure that the reporting person has access to comprehensive and independent information and advice − free of charge − on available procedures and remedies, as well as “effective assistance from competent authorities before any relevant authority involved in their protection against retaliation” (e.g., Article 20(1)-a) and b), of the Directive 2019/1937).

The Portuguese Act provides that whistleblowers have the right to independent information, advice and legal aid in general terms, that is to say under the terms of Law 34/2004, of 29 July 2004 (that amends the system of access to law and courts and transposes into national law Council Directive 2003/8/EC of 27 January 2003 on improving access to justice in cross-border disputes by establishing minimum common rules relating to legal aid for such disputes). According to this, legal protection - legal advice and legal assistance – is available only to whom can prove financial hardship (Article 7). This requirement is not foreseen in the Directive, which determines that Member States shall ensure that reporting persons “have access, as appropriate, to support measures” (Article 20 of the Directive) and “the support necessary for them to access protection effectively” (Recital 90 of the Directive), independently of their economic insufficiency.

c)     Finally, it seems to deter whistleblowing by providing that union representatives or workers' representatives assisting the whistleblower are jointly and severally liable with he or her when any requirement that must be observed is not complied with (Article 25-(3)).

3.     Conclusion

Vigjilenca Abazi highlighted that whether the Directive 2019/1937 will “attain the expected high standards of protection depend, inter alia, on the transposition of the rules into national law, the enforcement of the Directive’s protections and the embeddedness of the rules in organisational culture" (2020, p. 641). The Portuguese transposition Act makes it difficult for such high standards to be achieved. It is even possible to argue that it has decreased the reporting person protection by making mandatory internal reporting in some wide circumstances.

In addition, an affective whistleblower protection depends on “what happens to the whistleblower after she blows the whistle and what measures are taken to address the wrongdoing reported by the whistleblower” (Vigjilenca Abazi, 2020, p. 654). In this regard, the institutional arrangement and the procedural guarantees provided for by Portuguese Act together with the legal protection that already existed, previously, in the legal order (to which it refers) are not sufficient to ensure such effectiveness.

It is said that “full compliance would require a cultural change (Vigjilenca Abazi, 2020, p. 654). In the Portuguese case, first of all, the Act in question should be amended to bring it into line with the Directive which aims to transpose.

Secondary sources/ doctrinal works (if any)

­       Abazi, Vigjilenca, “The European Union Whistleblower Directive: A ‘Game Changer’ for Whistleblowing Protection?”, Industrial Law Journal, Volume 49, Issue 4, December 2020, pp. 640-656 (https://doi.org/10.1093/indlaw/dwaa023).

­       Brandão, Nuno, “O whistleblowing no ordenamento jurídico Português”, Revista do Ministério Público, 2020, n.º 161, janeiro-março, pp. 99-116 (https://estudogeral.uc.pt/handle/10316/89363).

­       Georgiadou, Georgia, “The European Commission’s Proposal for Strengthening Whistleblower Protection”, eucrim, The European Criminal Law Associations Forum, 2018, Issue 3, pp. 166-169 (https://eucrim.eu/issues/2018-03/).

­       Ramos, João, Proteção de Denunciantes em Portugal: Estado da Arte, 2018 Transparência e Integridade, Transparency International Portugal (https://transparencia.pt/proteger-quem-denuncia/).

­       Regodeiro, Bernardo, Djabula, Dussu and Dias, Raquel Burgoa, “The Power Struggle Between the Whistleblower Statute and Freedom of Expression: The Portuguese Case”, Elsa Law Review, 28th June 2020 (https://lawreview.elsa.org/the-power-struggle-between-the-whistleblower-statute-and-freedom-of-expression-the-portuguese-case).

*

­       2021 Rule of Law Report Country Chapter on the rule of law situation in Portugal Accompanying the Communication from the Commission to the European Parliament, the Council, the European Economic and Social Committee and the Committee of the Regions, 2021 Rule of Law Report The rule of law situation in the European Union, 20.7.2021, SWD(2021) 723 final (https://eur-lex.europa.eu/legal-content/EN/TXT/?uri=CELEX%3A52021SC0723).

­       2022 Rule of Law Report Country Chapter on the rule of law situation in Portugal, Accompanying the Communication from the Commission to the European Parliament, the Council, the European Economic and Social Committee and the Committee of the Regions, 2022 Rule of Law Report The rule of law situation in the European Union, 13.7.2022 SWD(2022) 522 final - /2022-rule-law-report-communication-and-country-chapters_en

­       Legislative procedure: https://www.parlamento.pt/ActividadeParlamentar/Paginas/DetalheIniciativa.aspx?BID=120906.

­       Transparência Internacional, Uma Alternativa ao Silêncio: A proteção de denunciantes em Portugal, Country report: Portugal, 2013 (https://transparencia.pt/proteger-quem-denuncia/).

*Act citation /year and number

Law No 93/2021 of 20 December, establishing the general system for the protection of whistleblowers, transposing Directive (EU) 2019/1937 of the European Parliament and of the Council of 23 October 2019 on the protection of persons reporting on breaches of EU law.

Enacted by

Parliament (Assembleia da República)

Official link to the text of the act

https://dre.pt/dre/detalhe/lei/93-2021-176147929 (Diário da República No 244/2021, 1st. Series, 20 December 2021, pp. 3-15).