Whistleblowing

In Portugal, the law that governs the status of whistleblowers is Law No. 93/2021, which transposed Directive (EU) 2019/1937 of the European Parliament and the Council.

Legal persons, including the state and other legal persons governed by public law that employ 50 or more employees must implement a whistleblowing procedure. Regardless of the number of employees, entities operating in the sectoral areas referred to in Part I.B and II of the Annex to the EU Directive, including financial services, products and markets, the prevention of money laundering and terrorist financing, transport safety and protection of the environment must also introduce a process. Finally, in the public sector, local governments with 50 or more employees but with less than 10,000 inhabitants are excluded.

The law does not specify so, in theory, yes provided that we are referring to the general rules of a whistleblowing procedure.

Please note that all companies with 50 or more employees should establish internal reporting channels, irrespective of the nature of their activities.

Nevertheless, in the private sector, companies with 50 up to 249 employees may share resources with other legal entities as regards the receipt of reports and any investigation to be carried out.

Entities that fail to establish a whistleblowing procedure will incur a serious penalty, with fines from 1,000 EUR up to 125,000 EUR.

No, but the provisions of Law No. 93/2021 do not affect the right of employees to consult their representatives or trade unions and the protective rules associated with the exercise of this right, and the right of trade unions, employers' associations, and employers to conclude a collective bargaining agreement.

There are no specific publicity measures for the whistleblowing procedure within companies (as long as the whistleblowing procedure rules are not considered an internal regulation of the company, as this would entail publicity).

The internal reporting channels may be operated internally or externally, and independency, impartiality, confidentiality, data protection, secrecy and the absence of conflicts of interest must be guaranteed.

Any processing of personal data shall be carried out in accordance with Regulation (EU) 2016/679 of the European Parliament and of the Council, the Law No. 58/2019, which ensures the implementation, in the national legal order, of Regulation (EU) 2016/679, and the Law No. 59/2019, which approves the rules on the processing of personal data for the purpose of prevention, detection, investigation or prosecution of criminal offences or the enforcement of criminal sanctions.

Additionally, personal data that is manifestly not relevant to the processing of the report, shall not be retained and must be deleted immediately.

Nevertheless, there is a duty of preservation regarding complaints presented orally by recording the communication in a durable and retrievable form.

The completeness, integrity and preservation of the complaint, the confidentiality or anonymity of the complainants and the confidentiality of any third parties mentioned in the complaint must be guaranteed. Unauthorised access must also be prevented.

For this law, the following shall be considered an infringement:

• anything contrary to the rules contained in the Acts of the European Union referred to in the Annex to Directive (EU) 2019/1937 of the European Parliament and the Council, or any national rules implementing, transposing or complying with such acts or to any other rules contained in legislative instruments implementing or transposing them, including those providing for criminal offences or administrative offences, concerning the fields of:
  • public procurement;
  • financial services, products and markets and the prevention of money laundering and financing of terrorism;
  • product safety and compliance;
  • transport safety;
  • environmental protection;
  • radiation protection and nuclear safety;
  • food and feed safety, animal health and animal welfare;
  • animal health and welfare;
  • public health;
  • consumer protection; and

the protection of privacy and personal data and security of network and information systems;

• anything contrary to and detrimental to the financial interests of the European Union referred to in article 325 of the Treaty on the Functioning of the European Union (TFEU), as specified in the relevant Union measures;
• anything contrary to the internal market rules referred to in article 26(2) TFEU, including competition and state aid rules, as well as corporate tax rules;
• violent, especially violent and highly organised crime, as well as the crimes provided for in article 1(1) of Law No. 5/2002 of 11 January establishing measures to fight organised and financial crime; and
• anything contrary to the rules or provisions covered by paragraphs (a) to (c).

Although it is not expressly foreseen in EU and domestic legislation, it is debatable whether breaches or violations of employment law rules are subject to whistleblowing.

According to article 116-AA of the Legal Framework of Credit Institutions and Financial Companies, credit institutions must implement specific, independent and autonomous means for receiving, processing and filing reports of serious irregularities related to their administration, accounting organisation and internal supervision, and any serious signs of breaches of the duties provided for in the Legal Framework or Regulation (EU) No. 575/2013 of the European Parliament and the Council. Parliament and the Council.

According to Law No. 93/2021, a whistleblower is a natural person who reports or publicly discloses an infringement based on information obtained in the course of a professional activity, regardless of the nature of this activity and the sector in which it is carried out.

The following may be considered whistleblowers: employees in the private, social or public sector; service providers, contractors, subcontractors and suppliers, as well as any persons acting under their supervision and direction; and shareholders and persons belonging to administrative or management bodies, or supervisory or controlling bodies of legal persons, including non-executive members and volunteers and interns, remunerated or unremunerated.

Only persons who report or divulge infringements based on information obtained in the course of their professional activity will be protected as whistleblowers. However, the fact that the complaint or public disclosure of an infringement is based on information obtained in the course of a professional relationship that has ended, or during the recruitment process or other pre-contractual negotiation stage of an existing or unincorporated professional relationship, does not preclude the person from being regarded as a whistleblower.

Not only are they admissible, but internal reporting channels must guarantee the anonymity of whistleblowers or else they will face severe penalties.

The whistleblower should have an opportunity to provide all the necessary information regarding the complaint he or she wishes to report, as well as the date and place where the facts have occurred or are continuing to occur and should have an opportunity to attach documents or audio and video files that may serve as a basis for the complaint. The information provided by the whistleblower should be as detailed as possible, bearing in mind that the complaint creates suspicion towards a subject or a situation.

Please refer, also, to question 23.

The identity of the whistleblower, as well as any information that directly or indirectly allows the identity of the whistleblower to be revealed, is confidential and access is restricted to persons responsible for receiving or following up complaints. Additionally, entities and competent authorities responsible for receiving and handling complaints must keep a record of the complaints received and retain it for at least five years or, regardless of this limit, while judicial or administrative proceedings relating to the complaint are pending. Complaints made verbally, by recorded telephone call or other recorded voice message systems, may be recorded, with the consent of the complainant, by recording the disclosure on a durable and retrievable storage medium or transcribing the communication fully and accurately.

Reports of infringements are submitted by the whistleblower through internal or external reporting channels or are publicly disclosed. The whistleblower may only use external reporting channels when:

• there is no internal whistleblowing channel;
• the internal whistleblowing channel only allows the submission of complaints by employees, and the whistleblower is not an employee;
• it has reasonable grounds to believe that the infringement cannot be effectively disclosed or resolved internally or that there is a risk of retaliation;
• an internal complaint was initially lodged but no communication regarding the measures expected or to be taken following the complaint within the time limits laid down in article 11 of  Law No. 93/2021; and
• the breach is a criminal offence or an infraction punishable with a penalty of more than 50,000 EUR.

The whistleblower can only publicly disclose an infringement if:

• they have reasonable grounds to believe that the breach may constitute an imminent danger to the public interest, that the breach cannot be effectively disclosed to or dealt with by the competent authorities in the specific circumstances of the case or that there is a risk of retaliation, including in the case of an external complaint; or
• they have filed an internal complaint and an external complaint, or an external complaint under the terms of Law No. 93/2021 without appropriate measures being taken within the time limits provided for in articles 11 and 15 of the referred law.

External complaints will be submitted to those authorities that, under their duties and powers, should know the matter covered by the complaint, including:

• the Public Prosecutor’s office (Ministério Público);
• the criminal police bodies;
• the Bank of Portugal;
• independent administrative authorities;
• public institutes;
• the Inspectorates-General, similar entities and other central services of the direct administration of the state with administrative autonomy;
• local authorities; and
• public associations.

The whistleblowing or public disclosure of an infringement, carried out under the requirements imposed by Law No. 93/2021 of 20 December, shall not in itself constitute grounds for disciplinary, civil or criminal liability for the whistleblower.

Nevertheless, if the whistleblower knew, or should reasonably have known, their complaint was false, he or she may be subject to disciplinary proceedings.

It is a very serious infraction to carry out retaliation against the whistleblower. Acts or omissions are considered to be acts of retaliation if, directly or indirectly, they occur in a professional context and are motivated by an internal or external complaint or public disclosure, or they cause the whistleblower to suffer pecuniary or non-pecuniary damage unnecessarily.

A whistleblower who, in good faith and with a serious reason to believe that the information is true at the time of the report or public disclosure, reports or publicly discloses an infringement in the terms established in Chapter II of Law No. 93/2021 – on the means of reporting and public disclosure – will benefit from the protection granted by the referred law.

An anonymous whistleblower who is subsequently identified will benefit from the protection granted by the above-mentioned law, provided that he or she meets the conditions set out for an identifiable whistleblower

The protection provided by Law No. 93/2021 extends, in addition to the cases mentioned above, with the necessary adaptations, to:

• natural persons who assist the whistleblower in the whistleblowing procedure and whose assistance must be confidential, including trade union or employee representatives;
• third parties connected to the whistleblower, such as work colleagues or family members, who may be the target of retaliation in a professional context; and
• legal persons or similar entities owned or controlled by the whistleblower, which employ the whistleblower or are otherwise connected to the whistleblower in a professional context.

Acts of retaliation against whistleblowers are prohibited; they are entitled to legal protection and can benefit from witness protection measures in criminal proceedings.

There may be a risk of retaliation – the following acts are presumed to be motivated by internal or external whistleblowing or public disclosure until proven otherwise, when carried out up to two years after the complaint or public disclosure:

• changes in working conditions, such as roles, hours, workplace or salary, non-promotion of the employee or breach of work duties;
• suspension of employment contract;
• negative performance review or a negative reference for employment purposes;
• failure to convert a fixed-term employment contract into a permanent employment contract, whenever the employee had legitimate expectations of such a conversion;
• non-renewal of a fixed-term employment contract;
• dismissal;
• industry blacklisting;
• termination of a supply or service contract; and
• revocation or termination of an administrative contract, as defined under the Administrative Procedure Code.