Whistleblowing

The status of whistleblowers in Germany, as in other EU member states, is primarily governed by European law. The relevant legislation is Directive (EU) 2019/1937 of the European Parliament and of the Council on the protection of persons reporting infringements of Union law (EU Whistleblower-Directive).

The German legislature has incorporated the EU-Whistleblower-Directive into German law by enacting the Whistleblower Protection Act (“Hinweisgeberschutzgesetz”) which – largely – entered into force on July 2, 2023.

If the Whistleblower Protection Act (hereinafter referred to as “HinSchG”) should meet specific concerns under European law, this will be pointed out separately in the following.

Romanian Law No. 571/2004 (Law 571)[1] was one of the first laws in Eastern Europe to deal with the protection of whistleblowers in the public sector. As regards the private sector, discussions related to the Draft Law on the Protection of Whistleblowers in the Public Interest, which was passed by the Senate on 19 April 2022, have been tense. Several steps back and forth were necessary before the release of the Law No. 361/2022 (Law 361)[2]. The initial Draft Law (Pl-x 219/2022[3], hereinafter referred to as the Draft Law) sent by the Senate was adopted on 29 June 2022 with major changes (details below) by the Chamber of Deputies and subsequently challenged in the Romanian Constitutional Court. In a ruling on 13 July 2022, the Constitutional Court stated that the Draft Law is not unconstitutional and may be promulgated by President Iohannis. Nevertheless, several NGOs, whistleblowers and stakeholders of civil society have addressed an open letter to President Iohannis, asking him to use the alternative option and send the Draft Law back to Parliament for re-examination. The main reason they invoked was a failure of the Draft Law to comply with the requirements negotiated by the representatives of the Ministry of Justice with the European Commission and hence, a risk of an infringement procedure against Romania. The President took this step and sent the Draft Law back to Parliament.

The Draft Law was meant to implement the EU Whistleblowing Directive (Directive (EU) 2019/1937), but differed significantly from the European regulation. It has been criticised on the one hand because important provisions regarding the protection of whistleblowers in legal proceedings (eg, for defamation, breach of copyright, breach of secrecy, breach of data protection rules, disclosure of trade secrets) had been omitted. On the other hand, the Draft Law has been attacked for reducing the protection standard granted by the previous Law 571/2004 for the public sector (eg, by restricting the possibility of whistleblowers to report directly to the press and by eliminating a presumption of good faith in favour of the whistleblowers). Especially, according to the Draft Law, anonymous reports did not have to be taken into consideration, which was interpreted as a step from the Romanian parliament towards reducing the protection level for whistleblowers as well as high tolerance for non-compliance with the Whistleblowing Directive.

After additional rounds of discussions, the Draft Law was basically changed back to its initial form and came into force on December 22nd, 2022. Soon after its entry into force, though, following the European Commission´s threat to cut EU-funds if anonymous reports are not taken seriously, further changes were performed on 31.03.2023.

In principle, companies that regularly employ 50 or more employees are obliged to set up an internal reporting system (section 12 (1), (2) HinSchG). For companies with between 50 and 249 employees, this obligation will only apply from 17 December 2023 (section 42 HinSchG).

For certain employers, particularly in the financial and insurance sectors or for data provision companies, the obligation to set up an internal reporting office applies irrespective of the number of employees as of the entry into force of the Act (section 12 (3) HinSchG).   

As a general rule, companies with 50 to 249 employees must establish internal reporting procedures from 17 December 2023. Article 8 paragraphs 3 and 4 of the Whistleblowing Directive provides that such a threshold of 50 employees does not apply for companies acting on the capital markets, in banking, credit, investment, insurance and re-insurance, occupational or personal pensions products or securities, meaning that they will have to organise reporting channels irrespective of their number of employees. The initial Draft Law seemed to have misunderstood this stricter rule, hence (even if probably irrelevant in most cases in practice) companies from these sectors with less than 50 employees were not obliged to establish internal channels. However, in the final version of the law, the provisions have been changed so as to be in line with the Whistleblowing Directive.

According to the explanatory memorandum of the Whistleblower Protection Act, it is legally permissible to implement an independent and confidential internal reporting office as a "third party" within the meaning of article 8(5) of the EU Whistleblower Directive at another group company (eg, parent company, sister company or subsidiary), which may also work for several independent companies in the group (section 14 (1) HinSchG). However, the European Commission has already announced in two statements during the legislative process that a group-wide whistleblower system does not meet the requirements of the EU Whistleblower Directive. The question of the compatibility of the regulation with EU law will only arise in practice at a later stage, provided that this question needs to be clarified in court. 

The Whistleblower Protection Act in line with the EU Directive further provides that several private employers with between 50 and 249 employees employed on a regular basis may commonly implement and operate an internal reporting office to receive notifications. However, the legal obligation to take action to remedy the violation and the corresponding duty to report back to the person making the report has to remain with the individual employer.   

As a general rule (article 9 paragraph 4), companies with 50 to 249 employees (regardless of the group) should have the option to share resources as regards the receipt of reports and any investigation to be carried out. Administrative bodies with less than 10,000 inhabitants or less than 50 employees can also pool their resources.

The Commission states that the protection of whistleblowers and a higher number of disclosures will only be achieved if each company having more than 49 employees will establish its own whistleblowing system. According to the current interpretation instructions of the EU Commission regarding the Whistleblowing Directive (dated 2 June 2021 and 29 June 2021), it is not prohibited to establish a centralised system, but such a system must be run in parallel with the mandatory local system.

If there are no whistleblowing procedures in the company (ie, an internal reporting system is not implemented and operated), this constitutes an administrative offence punishable by a fine. This fine may amount to up to 20,000 EUR (section 40 (2) No. 2, (5) HinSchG).

At this point, it should be noted that there is a high incentive for employers to implement an internal reporting channel, since the external reporting channel is available to the whistleblower in any case. Consequently, if an internal reporting office were not implemented or operated, the whistleblower would be forced to report directly to the external reporting office. As a result, the employer would not be able to make internal corrections without the reported information leaving the company.

There are several administrative fines for companies failing to comply with the new whistleblowers’ legislation – they range between 600 EUR and 6,000 EUR for not establishing internal reporting procedures. 

Although the implementation of a whistleblower system is based on a legal obligation, the works council only has to be involved under certain circumstances.

At first, the employer is, in principle, already obliged to inform the works council in good time and comprehensively about everything it requires to carry out its duties. This information requirement should enable the works council to review whether co-determination or participation rights exist or whether other tasks have to be carried out according to the German Works Constitution Act (BetrVG).

For instance, instructions concerning the orderly conduct of employees are subject to co-determination. These instructions are intended to ensure an undisturbed work process or to organise the way employees live and work together in the company.  If, in the course of the implementation of a whistleblower system, the already existing contractual obligations are extended or regulations regarding the specific reporting procedure are introduced (eg, in the form of a reporting obligation on the part of employees), the organisational behaviour would be affected and the works council must therefore be involved (section 87 (1) No. 1 BetrVG).

Furthermore, in the context of setting up an internal reporting channel, the Whistleblower Protection Act only stipulates that whistleblowers must be given the option of submitting a report to the whistleblowing system in text form or verbally. This could, of course, also be provided via digital channels - eg, via software- or web-based solutions. Should the introduction and use of such technical equipment in the relevant case allow the employer to monitor the behavior or performance of employees (eg, those who deal with the complaint), further co-determination rights of the works council according to section 87 (1) No. 6 BetrVG can be triggered.   

The previous proposal of the law implementing the EU Whistleblowing Directive provided for employee representative bodies (ie, generally speaking trade unions, if they exist, or employee representatives) to be consulted when establishing the reporting procedures. The approved version as of 16 December 2022 does not provide for such consultancy procedure anymore; however, it remains recommendable.

The Whistleblower Protection Act does not oblige the company itself to publish any information regarding the internal reporting office or the internal reporting channel implemented. However, the internally implemented reporting office must have clear and easily accessible information available on the external reporting procedure and relevant reporting procedures of European Union institutions, bodies or agencies (section 13 (2) HinSchG).

The current explanatory memorandum to the Whistleblower Protection Act also contains the more detailed, but not legally binding, reference that the information can be made available via a public website, company intranet or a bulletin board that is accessible to all employees. In this context, it is recommended that the company also refers to the internally implemented reporting office or the internal reporting channel in the same way. This helps to counteract the risk that potential whistleblowers will report primarily via the external reporting channel.

Furthermore, the German Supply Chain Due Diligence Act (LkSG) also provides for the implementation of complaint mechanisms so that the regulatory requirements of companies can also be met through a uniform reporting system. Within its scope of application, the LkSG also provides for the publication of procedural rules for such a reporting system in text form as well as for annual reporting obligations on what measures the company has taken as a result of complaints.

According to article 10 paragraph 2 of Law 361, employees are informed about the reporting procedures, including the person or department designated to receive such reports, both through the website of the company and through announcements at its headquarters, provided that there is a visible location accessible to all employees.

In principle, the Whistleblower Protection Act intentionally does not specify which persons or organisational units are best qualified to carry out the tasks of the internal reporting office or to manage the corresponding reporting channel. However, the internal reporting office may not be subject to any conflicts of interest and it also must be independent. The EU Whistleblower-Directive mentions, for instance, the head of the compliance department or the legal or data protection officer as possible internal reporting offices.

If, in addition to the (internal) persons responsible for receiving and processing internal reports, other (external) persons have to be involved in a supporting activity, this supporting activity is legally only permissible to the extent that is necessary for the supporting activity. This applies, for example, to IT service providers that provide technical support for reporting channels.

It is also legally permissible to appoint a third party to carry out the tasks of an internal reporting office, including the reporting channel (section 14 (1) HinSchG). Third parties may include lawyers, external consultants, trade union representatives or employee representatives.

However, engaging a third party does not relieve the employer of the obligation to take appropriate action to remedy a possible violation. In particular, for follow-up actions to check the validity of a report, there must be cooperation between the commissioned third party and the employer.

Both options are available for companies. At a first glance, internal channels controlled by the own employees (auditors or compliance officers, in-house legal counsel or even an internal hotline) may be more efficient for companies, since this ensures that potential wrongdoings are checked internally and do not compromise the image of the company. However, whistleblowers may not trust internal channels that allow easy identification of the individual whistleblower and are usually established to act in the best interest of the company (and not necessarily the whistleblower’s). Groups of companies must give more thought to the organisation; in many cases, outsourcing to third parties (eg, a recognized law firm) may be a better and more cost-effective solution.

The internal reporting office implemented by the employer is, initially, authorised to process personal data insofar as this is necessary for the fulfilment of its task under the Whistleblower Protection Act (10 HinSchG). The wide-ranging processing authority allows the personal data contained in the reports to be both received and analysed by the reporting office. In addition, new personal data may be recorded and further processed during the implementation of the follow-up measures.

The employer's obligation to protect the data collected in the course of the whistleblowing procedure is then directly based on the European General Data Protection Regulation (GDPR) and the German Federal Data Protection Act. This means, for instance, that data processing has to be limited to the extent necessary to fulfil the tasks of the internal and external reporting channel – data minimisation principle, (article 5 (1) lit. c) GDPR).

Finally, the processing of personal data is complemented by the confidentiality requirements of internal (and external) offices, (section 8 HinSchG).

All rules regarding data protection (GDPR and Romanian Law No. 190/2018) apply within the whistleblowing process. Employers are bound to maintain confidentiality, give feedback and address the reported breach.

According to article 7 paragraph 2 of the Law 361, employers are bound to keep electronic records of the reports for a maximum of five years. After that, they are allowed to destroy the reports. Unlike the Romanian transposition, the Whistleblowing Directive provides for an obligation to keep such records for as long as is necessary and proportionate to comply with the requirements imposed by the Directive. The term set by the Romanian transposition (initially two years, in the final version five years) is short and may lead to situations where evidence is concealed or destroyed before all the facts have been thoroughly checked.

The reporting channels must be designed in such a way that only the persons responsible for receiving and processing the reports as well as the persons assisting them in fulfilling these tasks have access to the incoming reports. It must, therefore, be ensured that no unauthorised persons have access to the identity of the person making the report or to the report itself. This has implications for the technical design of the internal reporting channel.

Also, the persons entrusted with running the internal reporting office must indeed be independent in the exercise of their activities and the company must ensure that such persons have the necessary expertise. Therefore, smaller or medium-sized companies should especially assess whether it will be more efficient to assign an experienced external ombudsperson to receive and initially process incoming reports. However, the ombudsperson who takes the call in this case is a witness bound to tell the truth, even if this is, for example, a company lawyer.

According to the German Whistleblower Protection Act, the internal whistleblowing reporting office is not obliged by law to accept or process anonymous reports; however, they “shall” be processed.  Companies should therefore assess carefully whether they provide systems that enable anonymous reports, as this may increase the number of abusive reports and make enquiries impossible. On the other hand, some ISO standards require the receipt of anonymous reports. Therefore, should a company seek certification according to these ISO standards, the whistleblower procedure to be set up must allow for the processing of anonymous reports.

The big challenge is to create a system that would strike a balance between better protection and an increased incentive for the whistleblower to notify breaches. As mentioned in question 7, employers need to make a thorough analysis and decide whether to handle the whistleblowing channel from within the company or outsource it to a specialised provider that is known on the Romanian market and trusted by employees.

The Whistleblower Protection Act´s  material scope of application goes beyond European legal requirements. It extends the material scope of application to all violations that are subject to punishment (section 2 (1) No. 1 HinSchG). Additionally, violations subject to fines are included insofar as the violated regulation serves to protect life, body, health or the rights of employees or their representative bodies (section 2 (1) No. 2 HinSchG). The last alternative covers not only regulations that directly serve occupational health and safety or health protection, but also related notification and documentation requirements, for example under the Minimum Wage Act. Thus, as a result, section 2 (2) No. 2 HinSchG covers the majority of administrative offences in the context of employment.

Finally, the Whistleblower Protection Act also provides for a list of infringements that predominantly correspond to the relevant areas of law according to the recitals of the EU Whistleblower Directive.

The Romanian implementation follows encouragement by the EU to extend the list of sectors (public procurement, financial services, money laundering, product and traffic safety, public health, consumer and data protection) subject to whistleblowing procedures and stipulate a general protection for reports on any breaches of law, including specific rules on ethics and codes of conduct for certain professions. Such an extension of the scope of application, combined with exclusions (see question 11) and the refusal to analyse anonymous reports may, however, have the opposite effect and discourage whistleblowers from reporting any wrongdoing.

The Whistleblower Protection Act itself does not distinguish between different sectors regarding the internal reporting process. However, it contains an enumerative list of regulations from other statutes that take precedence over the Whistleblower Protection Act for the reporting of information on violations; these regulations are therefore lex specialis compared to the Whistleblower Protection Act (section 4 (1) HinSchG). Priority special provisions are, among others, regulated by the Money Laundering Act, the Banking Act, the Insurance Supervision Act and the Stock Exchange Act.    

Appendix 1 to Law 361 contains references to the special procedures applicable both EU-wide and at a national level (ie, stock-listed companies, the insurance sector, managers of alternative investment funds and offshore oil businesses). Specialists have particularly drawn attention to the fact that the wording of article 1 paragraph 4 of Law 361 may exclude a large spectrum of companies involved in national defence and security from the mandatory protection of whistleblowers. Time will show if such exclusion deriving from the Whistleblowing Directive leaves a door open for employers to prohibit reports in this sensitive industry.

A whistleblower is a natural person who, in the context of his or her professional activity or in the preliminary stages of professional activity, has obtained information about violations and reports or discloses it to the – internal or external – reporting offices provided for under the Whistleblower Protection Act (section 1 (1) HinSchG).

The Whistleblower Protection Act also applies to the protection of persons who are subject to a report or disclosure, as well as other persons who are affected by a report or disclosure, (section 1 (2) HinSchG).

According to article 3 paragraph 7 of the Law 361, a whistleblower is “a natural person who reports or publicly discloses information on breaches acquired in the context of his or her work-related activities”.

Whistleblowers may be employees, but also, for instance, self-employed persons, volunteers, members of corporate bodies or employees of suppliers. In addition to persons who obtain knowledge in advance, such as in a job interview or during pre-contractual negotiations, the scope of protection also includes those for whom the employment or service relationship has been terminated. As a result, the status of a whistleblower is not dependent on formal criteria such as type of employment.

The term includes:#

• workers;
• self-employed persons within the meaning of article 49 TFEU;
• shareholders and persons belonging to the administrative, management or supervisory body of an undertaking, including non-executive members, as well as volunteers and paid or unpaid trainees; and
• any persons working under the supervision and direction of contractors, subcontractors and suppliers.

Moreover, former employees or persons who have acquired information during the recruitment process or other pre-contractual negotiations may be whistleblowers.

To be qualified as a whistleblower, the person providing the information must have obtained the information in the context of his or her professional activity or in the preliminary stages of professional activity. Information about violations falls within the substantive scope of the Act only if it relates to the employing entity or another entity with which the whistleblower is or has been in professional contact.

To qualify as a whistleblower and benefit from the protection envisaged for these persons, the individual must:

• belong to the category described in question 13;
• have reasonable grounds to believe that the information reported was true at the time of reporting; and
• have filed an internal or external reporting or public disclosure.

Romanian NGOs have criticised the initial wording of the second condition regarding the whistleblower, which prescribed not only that a whistleblower needed reasonable grounds to believe the information was true, but also that the reporting was necessary. An obligation to verify whether the reporting is necessary or not without any indication what is “necessary” seemed very limitative and was hence deleted from the Draft Law.

In order for a whistleblower to benefit from the remediation measures provided by Law 361, such person must comply with the conditions above and additionally prove that the retaliation suffered was a consequence of the reporting.

The Whistleblower Protection Act does not state that the employer must set up reporting channels in such a way that anonymous reports are admissible (section 16 (1) HinSchG). Also, external reporting offices do not have to process anonymous reports (section 27 (1) HinSchG). According to the Whistleblower Protection Act, however, anonymous reports “shall” be processed by the internal and external reporting offices. Against this background, employers are entirely free to choose whether to provide systems that allow for the submission and processing of anonymous reports or not.

One of the major criticisms brought to the Draft Law in the form sent for promulgation was the fact that it had restricted anonymous reporting. In the previous wording (adopted by the Senate on 19 April 2022) anonymous reports were accepted and analysed as long as they contained sufficient information for verifying the alleged wrongdoing. According to the version of the Draft Law, anonymous reports did not have to be analysed (article 11 paragraph 1b), since a report was supposed to formally bear the name and signature of the whistleblower. After intense discussions, Law 361 finally provided under article 6 par. 2 that reports lacking name and signature of the whistleblower will still be verified, but only provided that they do contain solid indications (Rom. indicii temeinice) as regards the breaches reported.

This remaining reluctant position of the Romanian political class to implement verification obligations in anonymous cases unrestrictedly was interpreted in connection with the communist past and a society in which “everybody sneaked on everybody”[1]. After criticism by the European Commission, on 31.03.2023, the initial wording which stated that anonymous reports were accepted and analysed as long as they contained indications for the alleged wrongdoing was re-introduced.

In principle, the whistleblowers do not have to be direct witnesses to a violation. However, they must have obtained information about violations in connection with or before their professional activities. Violation information is defined as a reasonable suspicion or knowledge of actual or potential breaches and attempts to conceal such breaches that have occurred or are very likely to occur (section 3 (3) HinSchG). However, only whistleblowers acting in good faith are protected from any discriminatory measures as a result of their report.

No, but the whistleblower must have reasonable grounds to believe that the reported information was true at the time of the report. Also, he or she must bring evidence for the reported breaches; if he or she is aware that the reported information is untrue, an administrative fine will be applied (between 500 and 6,000 EUR).

There have been many voices from specialised NGOs stating that such a strict rule will prevent whistleblowers from reporting, since they have to prove good faith before the reported breach is taken seriously. While the previous wording of the Draft Law adopted by the Senate on 19 April 2022 contained the presumption of good faith (which is in line with the provisions of the Law 571/2004 for the public sector), the Draft Law deleted such presumption. The final version of Law 361 reintroduced such presumption, but it will be interesting to follow in practice how it really applies.

The whistleblower procedure requires – in its broad outlines – that the personal and material scope of the Whistleblower Protection Act is applicable. Assuming this, the whistleblower must have obtained information about violations in connection with his or her professional activities or in advance of professional activities. In a further step, the whistleblower must report or disclose these violations to the internal and external reporting bodies responsible. The Reporting Office will issue an acknowledgement of receipt to the person making the report within seven days. Within three months of the acknowledgement of receipt, feedback will be provided to the whistleblower on planned and already taken follow-up measures and their reasoning. This information will be documented in compliance with the principle of confidentiality. This documentation will be deleted two years after the conclusion of the proceedings.

The internal whistleblowing procedure needs to provide for the following:
a.    channels for receiving the reports that are designed, established and operated in a secure manner, ensuring that the identity of the reporting person and any third party mentioned in the report is protected, and preventing access thereto by unauthorised staff members;
b.    acknowledgment of receipt of the report to the reporting person within seven days of that report;
c.    the designation of an impartial person or department competent for receiving and following up on the reports, who will maintain communication with the reporting person and, where necessary, ask for further information from and provide feedback to that reporting person;
d.    diligent verification by the designated person including taking the subsequent steps;
feedback about the status of the report within a reasonable timeframe, not exceeding three months from the acknowledgment of receipt or, if no acknowledgement was sent to the reporting person, three months from the end of the seven days period after the report was made, except for situations when such feedback may jeopardise the process;
e.    information to the competent bodies of public or private nature on the solution for the received reporting; 
; and
f.    clear and easily accessible information regarding the procedures for reporting externally to competent authorities and, where relevant, to institutions, bodies, offices or agencies of the Union;
g.    information to the reporting person on the solution in the reported breach.
 

There is no legally binding hierarchy between internal and external reporting channels. Therefore, the whistleblower has, in principle, the right to choose whether to report the violations externally or internally. However, in cases where effective internal action can be taken against violations, whistleblowers are to give preference to reporting to an internal reporting office. If an internally reported violation is not remedied, the whistleblower making the report is free to contact an external reporting office (section 7 (1) HinSchG).

Whistleblowers are encouraged to use primary reporting systems at the company level – a path that may have an additional chilling effect. External channels should be chosen when the whistleblower identifies retaliation risks in internal channels or does not believe that internal reporting may efficiently lead to a remedy of the breach. Finally, public disclosure should be the last resort according to the Romanian parliament, although studies have shown that this is usually the most powerful tool.

Romanian civil society has criticised the Draft Law since it prevented whistleblowers from addressing the press. According to article 19 paragraph 2 of the Draft Law, whistleblowers were only allowed to publicly disclose information on breaches if at least three months had passed since the internal or external reporting. This period (which is not provided within the Whistleblowing Directive) may have discouraged whistleblowers from using broad disclosure to the press, since it gave the employers the chance to intervene and retaliate. The final version of article 19 par. 2 of Law 361 does not contain any waiting period.

Once the reporting process at the internal reporting office is completed, the internal reporting office can take various follow-up actions. In addition to internal investigations, the process can also be handed over to a competent authority for further investigation (section 18 No. 4 HinSchG).

As a general rule, the person or department designated to check reports is bound to keep information confidential regarding the whistleblower and the reports. However, exceptions apply when the law provides an obligation to inform public authorities (ie, in the context of investigations by national authorities or judicial proceedings).

As a principle, the disclosure of inaccurate information about violations is prohibited under the Whistleblower Protection Act (section 32 (2) HinSchG). A whistleblower may, however, not be sanctioned if the facts, after being verified, are merely not confirmed or do not constitute a violation in the final analysis. If the information disclosed was incorrect, the following legal consequences will apply:

On the one hand, the whistleblower must compensate for any damage resulting from intentional or grossly negligent reporting or disclosure of incorrect information (section 38 HinSchG). The whistleblower's liability for damages is based on the fact that a false report or disclosure has far-reaching consequences for the person affected or accused. The effects may no longer be completely reversible. According to the Whistleblower Protection Act, claims for damages resulting from merely negligent incorrect reporting should not arise. Besides, only whistleblowers acting in good faith are protected from further repercussions.

On the other hand, the whistleblower acts improperly if he intentionally discloses incorrect information in violation of section 32 (2) of the Whistleblower Protection Act (section 40 (1) HinSchG). This administrative offence may be punished with a fine of up to 20,000 EUR (section 40 (5) HinSchG).

Yes, the whistleblower would pay a fine of up to 6,000 EUR if he or she knowingly reports false information. Additionally, criminal sanctions may apply if the details of the case prove that the abusive report constitutes a criminal offence according to the Romanian Criminal Code. Whether or not it is a breach worth reporting is, however, not an analysis the whistleblower needs to perform, hence no sanction will be applied if the reported breach turns out to be irrelevant. Since the presumption of good faith was reinstated, whistleblowers may report without expecting additional stress.

Retaliation against the whistleblower is prohibited under the Whistleblower Protection Act. This also applies to threats and attempts at retaliation (section 36 (1) HinSchG). In addition, it is prohibited to interfere or attempt to interfere with reports or communications between a whistleblower and the reporting office (section 7 (2) HinSchG).

If the whistleblower was nevertheless obstructed, the following legal consequences will apply: if a retaliation occurs, the person causing the violation must compensate the whistleblower for the resulting damage. However, this does not entitle the whistleblower to an employment relationship, a vocational training relationship, any other contractual relationship, or career advancement.

In addition, taking an illegal reprisal or interfering with the communications between the whistleblower and the reporting office constitutes an administrative offence, which can be punished with a fine of up to 50,000 EUR (section 40 (2) No. 3, (5) HinSchG).

There is no clear sanction for preventing a potential whistleblower from reporting, but there are sanctions for not establishing internal channels in line with legal provisions. The wording of the Romanian Law 361 provides in article 28 par. 2 lit. a for a sanction for preventing the designated person or department from reporting further information received from the whistleblowers.

To obtain protection, the whistleblower generally has to contact the responsible internal or external reporting offices. Disclosure of information about violations directly to the public is subject to strict conditions. This is only permissible, for example, if there is a risk of irreversible damage or in cases where the external reporting agency has not taken the required measures (section 32 (1) HinSchG).

The whistleblower providing the information must further act in good faith (ie, must have reasonable cause to believe, at the time of the report or disclosure that the information disclosed is true, and the information relates to violations that fall within the material scope of the Whistleblower Protection Act (section 33 (1) No. 2 and 3 HinSchG).

For a whistleblower to qualify for protection under the Draft Law, he or she must verify whether the personal condition and the work-related context are fulfilled, and file for a report using either the internal or the external channel. Public disclosures to the press are permitted only in exceptional cases (see question18). If the report sent is anonymous, the reporting person needs to make sure that it contains solid indications in order to be verified by the competent persons.

The most fundamental part of the protection is the prohibition of retaliation against the whistleblower. Therefore, the reporting or disclosing of information may not result in unjustified disadvantages such as disciplinary measures, dismissal or other discrimination against the person providing the information. In Addition, the Whistleblower Protection Act still contains a reversal of the burden of proof if the whistleblower suffers a disadvantage in connection with their professional activities. However, it is presumed that the disadvantage is a reprisal for the tip-off only if the whistleblower also asserts this themself. It should be noted, however, that the reversal of the burden of proof in favour of the whistleblower will only apply in labour court disputes and not in fining proceedings.

Furthermore, the Whistleblower Protection Act contains an exclusion of responsibility. Thus, a whistleblower cannot be made legally responsible for obtaining or accessing information that he or she has reported or disclosed, unless the obtaining or accessing of the information and the procurement or access as such constitutes an independent criminal offence (section 35 (1) HinSchG). In addition, a whistleblower does not violate any disclosure restrictions and may not be held legally responsible for the disclosure of information made in a report or disclosure if he or she had reasonable cause to believe that the disclosure of the information was necessary to detect a violation.

The scope of the protection provided by the Law is to prevent retaliation in a work-related context and in a broader context to enhance the enforcement of national and EU law.

At first, the person providing the information may not be subject to legal liability for obtaining or accessing information that he or she has reported or disclosed. This does not apply if the procurement or access as such constitutes an independent criminal offence (section 35 (1) HinSchG).

In addition, whistleblowers are protected by a comprehensive prohibition of retaliation. Therefore, any adverse consequences caused by disclosure are prohibited. These include, for example, dismissal, disciplinary measures or salary reductions (section 36 (1) HinSchG). Measures that violate the prohibition are void under section 134 of the Civil Code. The prohibition of retaliation is rounded off by a reversal of the burden of proof. According to this, it is presumed that a disadvantage that occurs after a disclosure is retaliation. As a consequence, the person who has disadvantaged the whistleblower has to prove that it is factually justified and was not based on the report or the disclosure if the whistleblower also asserts the disadvantage himself (section 36 (2) HinSchG).

In addition, the whistleblower is entitled to damages in the event of a violation (section 37(1) HinSchG).

The law provides for extensive support measures from information and advice received from the Romanian National Integrity Agency to legal aid provided by the local Attorneys Bar, both free of charge. Civil society criticised such shallow support for lacking accompanying norms for the benefit of whistleblowers. Although there were many voices from practice asking for financial incentives for whistleblowers, no such measures have been approved. Also, no rule regarding psychological support, mentioned in article 20 paragraph 2 of the Directive, has been implemented.

If a whistleblower abusively reports a violation, this may initially give rise to criminal liability. Possible criminal offences are pretending to have committed a criminal offence (section 145d of the Criminal Code), false suspicion (section 164 of the Criminal Code) or offences of honour (section 185 et seq of the Criminal Code).

The whistleblower providing the abusive information also must compensate for any damage resulting from intentional or grossly negligent reporting or disclosure of incorrect information (section 38 HinSchG). Furthermore, there may be competing claims for damages, for example under section 823 (2) of the Civil Code in conjunction with a protective law.

Moreover, the whistleblower commits an administrative offence if he or she intentionally discloses inaccurate information. This may be punished with a fine of up to 20,000 EUR (section 40 (1), (6) HinSchG).

In principle, the whistleblower is free to decide whether he or she reports a violation through the internal or the external reporting channel (section 7 (1) HinSchG). However, if a violation is disclosed to the public directly (ie, without first using internal or external reporting channels and without there being an exceptional circumstance for this), the whistleblower is generally not subject to the protection of sections 35 to 37 of the Whistleblower Protection Act. Only in narrow exceptions is the whistleblower still protected, for example, if there is a danger of irreversible damage or comparable circumstances may represent an immediate or obvious threat to the public interest.

If a person reports false information, he or she may be obliged to pay a fine of up to 6,000 EUR if he or she knowingly or abusively reported such facts (see question 20). Another risk for whistleblowers is when he or she reports anonymously and does not fulfil all the “subjective“ conditions (eg solid indications) in order to have his report verified. Given the Romanian transposition of the Whistleblowing Directive, certain provisions may narrow the category of protected whistleblowers. Nevertheless, it is a very important first step which will change the mentality in time and will eventually be replaced by a more “liberal” piece of legislation.If a person reports false information, he or she may be obliged to pay a fine of up to 6,000 EUR if he or she knowingly or abusively reported such facts (see question 20). Another risk for whistleblowers is when he or she reports anonymously and does not fulfil all the “subjective“ conditions (eg solid indications) in order to have his report verified. Given the Romanian transposition of the Whistleblowing Directive, certain provisions may narrow the category of protected whistleblowers. Nevertheless, it is a very important first step which will change the mentality in time and will eventually be replaced by a more “liberal” piece of legislation.