New law on the protection of whistleblowers

On 22 December 2022, Law No. 361/2022 on the protection of whistleblowers in the public interest (hereinafter “Law No. 361/2022“) will enter into force, following a long and sinuous legislative process, in order to harmonise national legislation with European legislation [1] on the mechanism for reporting breaches of law both in the public and private sectors.  In this respect, Law No. 361/2022 regulates the possibility for persons (whistleblowers in the public interest) to report breaches of law that occurred within authorities, public institutions, other public legal entities, as well as within private legal entities, of which they became aware in a professional context.  Below are some of the most important new elements introduced into national legislation by Law No. 361/2022:

Whistleblowers in the public interest

The persons who may report such breaches of law (as defined by Law No. 361/2022) include workers, self-employed persons, shareholders and persons who are part of the administrative, management or supervisory body of a company, volunteers and trainees, as well as any person working under the supervision and management of the natural or legal person with whom the contract has been concluded, its subcontractors and suppliers.

Whistleblowers in the public interest may also be persons who became aware of breaches of law during the recruitment process or pre-contractual negotiations, as well as when the employment relationship has ended.

The object of the report

According to Law No. 361/2022, reported breaches may concern, for example, areas such as public procurement, services, products and financial markets, as well as the prevention of money laundering and terrorist financing, product safety and compliance, transport safety, environmental protection, radiation protection and nuclear safety, food and feed safety, animal health and welfare, public health, consumer protection, as well as the protection of privacy and personal data and the security of networks and information systems. Breaches may also relate to non-compliance with European legislation on the internal market, competition and state aid, as well as the fight against fraud and any illegal activity affecting the financial interests of the European Union.

In order to fall within the scope of Law No. 361/2022, the reported breaches must be qualified as disciplinary offences, contraventions or criminal offences, or they must contravene the object or the purpose of the law.

New obligations for private legal entities

Law No. 361/2022 lays down a number of obligations for private legal entities with more than 50 employees or which, regardless of the number of employees, fall within the scope of the regulations set out in Annex No. 3 to Law No. 361/2022 (e.g. private legal entities subject to special regulations in the field of capital markets, financial instruments markets, payment services, insurance and reinsurance activity, private legal entities subject to the regulations on prevention of money laundering and terrorist financing, etc.).

Among the obligations of the private legal entities mentioned above are: (a) the obligation to identify or establish internal reporting channels, as well as the obligation to establish or maintain such channels; (b) the obligation to establish procedures for internal reporting and for the resolution and remediation of reported breaches, where necessary; (c) the designation of a person, department or third party responsible for receiving, recording, reviewing, taking follow-up action and resolving reports, which must act impartially and independently in the exercise of those responsibilities; (d) the obligation to keep records of internal reports in a special registry; (e) the obligation to keep confidential the identity of the whistleblower in the public interest and of other third parties named in the report. Failure to comply with certain above-mentioned obligations is punishable by a fine of up to 40,000 RON.

It should be noted that for private legal entities with between 50 and 249 employees the obligation to identify or establish internal reporting channels will come into force on 17 December 2023.

[1] Directive (EU) 2019/1937 of the European Parliament and of the Council of 23 October 2019 on the protection of persons who report breaches of Union law, published in the Official Journal of the European Union L 305 from 26 November 2019.