Portugal - Whistleblowing Laws in Europe: An international guide

1) Local Laws

a) Has the country implemented any laws / regulations on whistleblowing (Local Law)?

On the 20 December 2021, Law no. 93/2021, December 20 (hereinafter, ‘Law no. 93/2021’) transposing Directive (EU) 2019/1937 of the European Parliament and the Council of 23 October 2019 on the protection of persons who report breaches of EU law was published, which will enter into force 180 days after publication, more precisely, on the 18 June 2022.

Besides the recently introduced law, the Portuguese legal framework already possessed certain provisions conceding benefits to defendants, complainants and protection for witnesses, which are still relevant, such as:

Portuguese Criminal Code

This Code, approved by Decree-Law no. 48/95, 15 March, as amended from time to time, establishes mechanisms on incentives for reporting by the agent, under certain conditions and for some specific crimes, namely:

• The possibility of no sentence if the agent reports the crime within 30 days of its occurrence and before the criminal investigation has started, since the agent voluntarily restores the advantage or the value received.
• The possibility of reduction of sentence if the agent assists in obtaining or producing decisive evidence for the identification or capture of other person(s) responsible until the end of the first instance trial hearing.

The application of both mechanisms is exceptional and shall be considered on a case-by-case basis.

Measures to prevent the use of the financial system for money laundering or terrorist financing

These measures were approved by Law no. 83/2017, 18 August, as amended by Decree-Law no. 144/2019, 23 January, Law no. 58/2020, 31 August, Decree-Law no. 9/2021, 29 January and Decree-Law no. 56/2021, 30 June, and establish preventive and repressive measures to prevent the laundering of illegitimate advantages and the financing of terrorism, determining that reporting persons cannot be held responsible for breaches of professional secrecy.

Law no. 93/99

Law no. 93/99, 14 July 1999, as amended by Law no. 29/2008, 4 July, and Law no. 42/2010, 3 September 2010, regulates the application of measures to protect witnesses in criminal proceedings when their lives, physical or psychological integrity, freedom or property of a considerably high value are endangered because of their contribution to the proof of the facts that constitute the scope of the process.

In addition, specific procedures exist on reports by employees and other parties that shall be taken into consideration.

Portuguese Labour Code

This Code, approved by Law no. 7/2009, 12 February, establishes that the employer is not allowed to inhibit employees in exercising their rights, nor to dismiss, sanction or treat them unjustifiably for said reason.

Measures to prevent the use of the financial system for money laundering or terrorist financing

These establish that some entities must create specific, independent and anonymous channels internally that ensure the appropriate reception, treatment and archiving of communications of irregularities related to possible violations in the prevention of money laundering and the financing of terrorism

Portuguese Data Protection Authority’s (CNPD) deliberation no. 765 /2009

Issued on 21 September 2009 in which CNPD establishes guidelines to be followed when processing personal data for the purpose of managing internal communications of irregular practices (whistleblowing/ethics hotline). Please note, these guidelines were issued within the scope of the previous data protection law (prior to the GDPR) and, as such, some parts of the same were derogated as of 25 May 2018.

2) Scope of application

a) What types of wrongdoings are covered by the Local Law? Does it cover breaches of EU law?

In terms of wrongdoings covered by Law no. 93/2021, these encompass any act or omission contrary to rules contained in the EU acts referred in Annex to Directive (EU) 2019/1937, as well as any national rules implementing, transposing or complying with such acts, in the fields of:

1. Public Procurement;
2. Financial services, products and markets, prevention of money laundering and financing of terrorism;
3. Product safety and compliance;
4. Transport safety;
5. Environmental protection;
6. Radiation protection and nuclear safety;
7. Food and feed safety, animal health and welfare;
8. Public health;
9. Consumer protection;
10. Protection of privacy and personal data;
11. Network and information systems security.

Furthermore, a reference is also made to (i) acts or omissions contrary to and detrimental to the financial interests of the European Union referred to in Article 325 of the TFEU; (ii) acts of omissions contrary to internal market rules referred to in Article 26 (2) of the TFEU; and (iii) violent, especially violent and highly organised crime, as well as the crimes provided for in Article 1 (1) of Law no. 5/2002, 11 January, establishing measures to fight organized and economic-financial crime.

It is also noted that, in the fields of national defence and security, only acts or omissions contrary to the procurement rules contained in the acts of the European Union referred to in part i. A of the Annex to Directive (EU) 2019/1937 of the European Parliament and of the Council, or contrary to the purpose of those rules, shall be considered wrongdoings for the purposes of this new law.

b) Personal scope

i . Does the Local Law apply to reporting persons working in both the private and public sectors?

 Law no. 93/2021 applies indistinctively to employees from the private, social or public sector.

ii. Does the Local Law apply only to breaches that the reporting person became aware of in a work-related context?

The new law applies to breaches the reporting person became aware in a work-related context and business context, but not necessarily to employees, also encompassing:

• Service providers, contractors, subcontractors and suppliers, as well as any persons acting under their supervision and direction;
• Shareholders and persons belonging to administrative or management bodies or to supervisory or controlling bodies of legal persons, including non-executive members;
• Volunteers and interns, remunerated or not.

The fact that the complaint or public disclosure of an infringement is based on information obtained in a professional relationship terminated in the meantime, as well as during the recruitment process or during another phase of pre-contractual negotiation of an existing or non-concluded professional relationship, shall not be an obstacle to the classification of a natural person as a whistleblower.

iii. Does the Local Law also protect: facilitators; people connected to the whistleblower and who could suffer retaliation in a work-related context; and legal entities the whistleblower owns, works for, or is otherwise connected with?

The protection granted to whistleblowers is extended, with the necessary adaptations, to:

a) a natural person who assists the whistleblower in the reporting procedure and whose assistance must be confidential, including trade union representatives or workers' representatives;

b) Third parties connected to the whistleblower, such as work colleagues or family members, who may be the target of retaliation in a professional context; and

c) Legal persons or similar entities that are owned or controlled by the whistleblower, for which the whistleblower is employed or otherwise connected in a professional context.

Law no. 93/99, which regulates the application of measures to protect witnesses in criminal proceedings, also establishes an extension of protection to witnesses’ family members and other relatives.

c) Does the Local Law require specific conditions to protect reporting persons?

Protection is granted if the whistleblower: (i) is in good faith; (ii) has good reasons to believe that the information is true at the time of the report or public disclosure; and (iii) complies with the formalities foreseen by the Law for each specific type of report. Please not that whistleblowers who submit an external report without observing the precedence rules established by the law, also benefit from protection if, at the time of the submission and without guilt, they were not aware of such precedence rules.

Anonymous whistleblowers who are later identified and fulfil the conditions mentioned above, also benefit from protection.

Please note that Law no. 93/99, which regulates the application of measures to protect witnesses in criminal proceedings, only applies to: witnesses who have their lives, physical or psychological integrity, freedom or property of a considerably high value endangered because of their contribution to the proof of the facts that constitute the scope of the process; and particularly vulnerable witnesses.

3) Reporting channels

a) Does the Local Law allow anonymous reports? How are companies/agencies meant to handle them?

Anonymous reports are allowed.

Notwithstanding, it is important to recall that whistleblowers will only benefit from the legal protection once they are possible to be identified (and provided that they fulfil the remaining requirements).

Companies are advised to handle these reports in the same manner as any other, given that the Law does not establish any difference of treatment, between anonymous and non-anonymous reports.

b) Is there a duty of confidentiality and any derogation from this duty?

Confidentiality is foreseen by Law no. 93/2021 as a mandatory requirement for reporting channels, regarding both whistleblowers and other third-parties mentioned in the report.

The identity of the whistleblower, as well as information that, directly or indirectly, allows the identity of the whistleblower to be deduced, shall be of a confidential nature and access shall be restricted to the persons responsible for receiving or following up reports.

In terms of derogations, it is possible to highlight the following:

1. The identity of the whistleblower shall only be disclosed as a result of legal obligation or court decision.
2. Disclosure of information shall be preceded by a written communication to the whistleblower, mentioning the reasons for disclosure of the confidential data in question, unless the provision of such information compromises the related investigations or legal proceedings.
3. Reports received by the competent authorities containing information subject to commercial confidentiality shall be treated only for the purpose of following up the complaint, and those who have knowledge thereof, shall be bound by secrecy.

There is also a reference in Law no. 93/2021 to the fact that the provisions regarding the confidentiality of a whistleblower’s identity, shall also apply to the identity of the persons who are mentioned in the report or in the public disclosure, as committing or associated with the offence. The measures on the prevention of the use of the financial system for the purposes of money laundering or terrorist financing also establish that the channel used for reports shall ensure the confidentiality of the received information.

c) Public disclosures: does the Local Law provide for this possibility?

 Yes, but solely under certain conditions, as follows:

1. the whistleblower has reasonable grounds to believe that the breach may constitute an imminent or manifest danger to the public interest, that the breach cannot be effectively known or addressed by the competent authorities, given the specific circumstances of the case, or that there is a risk of retaliation including in the case of an external complaint; OR
2. the whistleblower has filed an internal complaint and an external complaint, or directly an external complaint as provided for in the law, without adequate measures being taken within the time limits enshrined therein.

Outside these conditions the whistleblower will not be under the protection of Law no. 93/2021.

4) Reporting channels: internal

a) Is there an obligation for private and/or public legal entities to establish channels and procedures for internal reporting and follow-ups?

Legal persons - including the State and other legal persons governed by public law - employing 50 or more employees and, irrespective of that, entities falling within the scope of the European Union acts referred to in part i. B and ii of the Annex to Directive (EU) 2019/1937 of the European Parliament and of the Council, shall have internal reporting channels.

The following State entities shall also have, at least, one internal reporting channel:

1. Presidency of the Portuguese Republic;
2. Portuguese Parliament;
3. Each ministry or governmental area;
4. Constitutional Court;
5. The Judiciary Supreme Council;
6. The High Council of Administrative and Fiscal Courts;
7. The Audit Court;
8. The Attorney General's Office;
9. Representatives of the Republic in the autonomous regions.

The autonomous regions shall also have an internal reporting channel within the regional legislative assembly and an internal complaint channel for each regional secretariat.

Local municipalities that employ 50 or more employees, but have fewer than 10,000 inhabitants, shall not be required to have whistleblowing channels.

The measures to prevent money laundering and financing of terrorism establish channels and procedures for internal reporting of breaches. Such obligations apply to both private and public legal entities and should be proportional to the nature, size and complexity of the obligated entity's activity.

b) Do internal reporting channels need to allow reporting in writing, orally or both?

Both are admissible, but the entities may choose solely one option as per Law no. 93/2021.

Other Portuguese laws regarding reporting channels (namely, measures to prevent money laundering) do not establish any specific formalities on the written or oral nature of reporting.

c) Procedures for internal reporting and follow-up: does the Local Law require legal entities to adopt internal reporting systems with the following elements?

i) Channels able to ensure the confidentiality of the identity of the reporting person and the protection of third parties mentioned in the report:

Yes.

Please note that measures to prevent money laundering and financing of terrorism also establish that the reporting channel must ensure the confidentiality of the reporter’s personal data and the confidentiality of the received reports.

ii) Acknowledgement of receipt of the report to the whistleblower within seven days of receipt:

Yes.

Within such seven-days period, the whistleblower must also be informed, in a clear and accessible manner of the requirements, competent authorities and form and admissibility of an external report.

iii) The designation of an impartial function/team to manage follow-ups on reports and maintain communication with the whistleblower:

Internal reporting channels shall be operated internally, for the purpose of receiving and following up reports, by persons or services designated for the purpose (however, the reception of reports may be operated externally).

The persons or services designated for such purpose shall guarantee independence, impartiality, confidentiality, data protection, secrecy and absence of conflict of interest in the performance of their functions.

iv) Any other follow-up requirements including those for anonymous complaints:

Following the complaint, obliged entities shall take the appropriate internal actions to verify the allegations contained therein and, where appropriate, to stop the reported infringement, including by opening an internal investigation or communicating it to the competent authority for investigation of the infringement (including the European Union institutions, bodies, offices or agencies).

Furthermore, obliged entities shall (i) communicate to the whistleblower the measures envisaged or adopted to follow up on the complaint and the respective grounds, within a maximum period of three months from the date of receipt of the report; and (ii) communicate the result of the analysis carried out on the reported infringement within 15 days after its conclusion, at the whistleblower’s request.

v) A reasonable timeframe to provide feedback, not exceeding three months from acknowledgment of receipt or if no acknowledgement was sent, three months from the expiry of the seven-day period after a report is made:

See previous answer.

vi) Providing clear and easily accessible information on internal reporting procedures and external reporting procedures to competent authorities and/or EU institutions/bodies:

As previously mentioned, obliged entities shall take the appropriate internal actions to verify the allegations contained therein and, where appropriate, to stop the reported infringement, including by opening an internal investigation or communicating it to the competent authority for investigation of the infringement (including the European Union institutions, bodies, offices or agencies).

However, the obligation to provide clear and easily accessible information is only foreseen regarding the contact with the whistleblower.

Additionally, measures to prevent money laundering and financing of terrorism establish that responsible entities shall collaborate promptly with Departamento Central de Investigação e Ação Penal (DCIAP) and Financial Information Unite, as well as other judicial and police or tax authorities.

vii) Should legal entities take any additional measures in order to comply with the above requirements?

Companies should assure that the rules are complied and adopt any necessary measures as non-compliance represents a potential ground for fines. There are no specific additional measures foreseen by law.

5) Reporting channels: external

a) Has the country designated a competent authority to receive and investigate whistleblower disclosure and retaliation complaints?

The National Anti-Corruption Mechanism shall be responsible for processing the administrative offences and for imposing the corresponding fines.

Notwithstanding, where the administrative offences are committed by natural persons, legal persons or equivalent entities, subject to the regimes mentioned in Article 3(1) of Law no. 93/2021, the processing of such administrative offences and the application of the corresponding fines shall be incumbent upon the authorities which have sanctioning powers, under the terms of the specific sectorial acts of the European Union or other national legislative acts which provide for the protection regimes of whistleblowers.

b) Is an independent and autonomous external reporting channel already established in the country?

No such reporting channel has been established yet.

6) Processing of personal data

a) Is personal data concerning the reports processed in compliance with local and EU legislation such as EU Regulation 2018/1725 and local privacy laws?

The processing of personal data under Law no. 93/2021, including the exchange or transmission of personal data by competent authorities, shall comply with the provisions of the General Data Protection Regulation, approved by Regulation (EU) 2016/679 of the European Parliament and of the Council of 27 April 2016, Law no. No 58/2019 of 8 August, which ensures the implementation, in the national legal order, of Regulation (EU) 2016/679, and Law no 59/2019 of 8 August, which approves the rules on the processing of personal data for the purpose of prevention, detection, investigation or prosecution of criminal offences or the execution of criminal penalties.

No express reference is made to Regulation 2018/1725, but considering that it applies in the Portuguese legal framework, it shall also be respected.

7) Record keeping of reports

a) Is there any obligation regarding record keeping of reports as provided for by the EU Directive?

The obliged entities and competent authorities responsible for receiving and handling reports under Law no. 93/2021 shall keep a record of the reports received and retain them for at least five years and, irrespective of such period, during the pendency of any judicial or administrative proceedings relating to the report. An express reference is made to the need to eliminate personal data which is not relevant for the subsequent processing of the report.

Please note that special rules apply for the recording of oral reports.

Measures to prevent money laundering and financing of terrorism establish that the responsible entities, under certain conditions, shall keep the documentation provided by clients or third parties for seven years.

8) Protection

a) Is there any difference between whistleblower protections in the private and public sectors?

Same level of protection is granted for whistleblowers on both sectors.

b) Are whistleblowers protected against all forms of retaliation including threats and attempts of retaliation? Which forms of retaliation are expressly indicated?

An act or omission is considered an act of retaliation if (i) it occurs in a professional context; (ii) it is motivated by an internal or external report or public disclosure; and (iii) it causes or may cause the whistleblower, directly or indirectly and in an unjustified manner, monetary or non-monetary damage. Threats and attempts of the acts and omissions referred shall also be deemed as acts of retaliation.

The following are expressly indicated as a form of retaliation, if practiced over the two years following the report or public disclosure:

1. Changes in work conditions, such as functions, hours, place of work or remuneration, non-promotion of the employee or breach of labour duties.
2. Suspension of the employment contract.
3. Negative performance evaluation or negative reference for employment purposes.
4. Non-conversion of a fixed-term employment contract into an employment contract for an indefinite period of time, whenever the employee had legitimate expectations in this regard.
5. Non-renewal of a fixed-term employment contract.
6. Dismissal.
7. Inclusion in a list, on the basis of an industry-wide agreement, that may lead to the impossibility, in the future, of the whistleblower finding employment in the sector or industry concerned.
8. Termination of a supply or service contract.
9. Revocation of an act or termination of an administrative contract, as defined terms of the Administrative Procedure Code.

A disciplinary sanction applied to the whistleblower up to two years after the report or public disclosure is also presumed to be abusive.

Measures to prevent money laundering and financing of terrorism establish that the responsible entities shall refrain from any threats or hostile acts and, in particular, from unfavourable or discriminatory work practices against those who, in good faith, provide information, documents and other elements.

c) Does the Local Law provide for any other measures of support such as those indicated in the EU Directive?

The measures of support provided by Law no. 93/2021 are similar to those referred in the Directive, but no financial or psychological support is expressly mentioned.

Notwithstanding, Law no. 93/99 regarding witness protection establishes a special security program that may include the creation of conditions for raising means of subsistence and the granting of a subsistence allowance for a limited period, which might be relevant for this circumstance, given that whistleblowers may benefit from the measures for the protection of witnesses in criminal proceedings.

d) Does the Local Law provide for the necessary measures to prohibit any form of retaliation against whistleblowers?

According to Law no. 93/2021 whistleblowers are protected against retaliation as mentioned above. If any person obliged to secure such protection fails to do so, administrative fines may be imposed. Also the whistleblower is entitled to damages compensation in relation to retaliation.

e) Does the Local Law provide for any remedial measures, including interim relief measures?

Law n.º 93/2021 does not expressly foresees such remedial measures. However, some remedial measures exist to prevent retaliation against whistleblowers, including the possibility of the employee who is dismissed in consequence of a disciplinary proceeding applying to the Court to obtain a judicial review of the dismissal.

f) Does the Local Law provide for exemptions from liability for whistleblowers?

A report or public disclosure, made in accordance with the requirements imposed by Law no. 93/2021 shall not, per se, constitute grounds for the disciplinary, civil disciplinary, civil, misdemeanour or criminal liability of the whistleblower.

Furthermore, the whistleblower shall not be liable for (i) the violation of any restrictions on the communication or disclosure of information contained in the report or public disclosure (this does not preclude a potential liability for the violation of the provisions of other secrecy regimes enshrined by the law, such as the secret of justice, protection of classified information and protection of religious or professional secrecy); and (ii) obtaining or having access to the information or public disclosure, except in cases where obtaining or having access to the information constitutes a criminal offence.

The abovementioned exemptions from liability, do not preclude the potential liability of the whistleblower for acts or omissions not related to the report or public disclosure, or which are not necessary for the report or public disclosure of an offence under Law no. 93/2021.

g) Does the Local Law provide for sanctions against natural and legal persons that violate whistleblowers’ protection or the duty of maintaining the confidentiality of their identity?

Besides the general rule enshrined in Law no. 93/2021, establishing that whoever commits an act of retaliation against the whistleblower shall compensate the same for all the damages caused, both the violation of whistleblowers’ protection or of the duty of maintaining the confidentiality of their identity are potential grounds for a very serious administrative offense, with fines ranging between EUR1,000 and EUR25,000 for natural persons and between EUR10,000 and EUR250,000 for legal persons.

Please note that measures to prevent money laundering and financing of terrorism also establish sanctions to natural or legal persons who reveal or help the discovery of the identity of the person who provided information, documents or other elements. The sanctions may involve criminal penalties of up to three years’ imprisonment for natural persons and judicial fines for legal persons.

h) Does the Local Law provide for sanctions in case of false reports?

Yes, the communication or public disclosure of false information is deemed a very serious administrative offense.

9) Other issues

a) Under the Local Law, is adopting a whistleblowing system relevant to assess the adequacy of a compliance program? Does this have any value to mitigate or eliminate criminal liability for legal entities?

We believe that adopting a whistleblowing system may be relevant in assessing the adequacy of the compliance programs adopted by each company, but the law does not make any reference on this regard. Similarly, regarding the potential mitigation/elimination of criminal liability for legal entities derived from the adoption of a whistleblowing system, the law is also silent on this circumstance.

b) Does the Local Law or another law in your country provide for whistleblower reward programs?

Portuguese Law does not provide any whistleblower reward programs.

c) Can companies benefit from any incentives in the case of voluntary self-disclosure of violations they became aware of following an internal report?

Portuguese law does not establish any incentive for companies in the case of voluntary self-disclosure of violations they became aware of following an internal report. However, such conduct might, theoretically, be relevant to provide a reduction of the penalty (if the company is criminally implicated) or the fine applied.

d) Will implementing the EU Directive create any with obligations provided for under other laws / regulations?

Still premature to consider.

---