Portugal - Whistleblowing Laws in Europe: An international guide

By:

1) Local Laws

a) Has the country implemented any laws / regulations on whistleblowing (Local Law)?

Portugal has no specific law on whistleblowing. The EU Directive has not yet been transposed into the Portuguese legal system. However, it may be transposed by December 17, 2021.

Relevant articles do exist in the Portuguese legal framework regarding benefits to defendants, complainants and protection for witnesses that shall be taken into consideration.

Portuguese Criminal Code

This Code, approved by Decree-Law no. 48/95, March 15, as amended from time to time, establishes mechanisms on incentives for reporting by the agent, under certain conditions and for some specific crimes, namely:

  • The possibility of no sentence if the agent reports the crime within 30 days of its occurrence and before the criminal investigation has started, since the agent voluntarily restores the advantage or the value received.
  • The possibility of reduction of sentence if the agent assists in obtaining or producing decisive evidence for the identification or capture of other person(s) responsible until the end of the first instance trial hearing.

The application of both mechanisms is exceptional and shall be considered on a case-by-case basis.

Measures to prevent the use of the financial system for money laundering or terrorist financing

These measures were approved by Law no. 83/2017, August 18, as amended by Decree-Law no. 144/2019, January 23, and establish preventive and repressive measures to prevent the laundering of illegitimate advantages and the financing of terrorism, determining that reporting persons cannot be held responsible for breaches of professional secrecy.

Law no. 93/99

Law no. 93/99, July 14, 1999, as amended by Law no. 29/2008, July 4, and Law no. 42/2010, September 3, 2010, regulates the application of measures to protect witnesses in criminal proceedings when their lives, physical or psychological integrity, freedom or property of a considerably high value are endangered because of their contribution to the proof of the facts that constitute the scope of the process.

In addition, specific procedures exist on reports by employees and other parties that shall be taken into consideration.

Portuguese Labour Code

This Code, approved by Law no. 7/2009, February 12, establishes that the employer is not allowed to inhibit employees in exercising their rights, nor to dismiss, sanction or treat them unjustifiably for said reason.

Measures to prevent the use of the financial system for money laundering or terrorist financing

These establish that some entities must create specific, independent and anonymous channels internally that ensure the appropriate reception, treatment and archiving of communications of irregularities related to possible violations in the prevention of money laundering and the financing of terrorism.

Portuguese Data Protection Authority’s (CNPD) deliberation no. 765 /2009

Issued on September 21, 2009 in which CNPD establishes guidelines to be followed when processing personal data for the purpose of managing internal communications of irregular practices (whistleblowing/ethics hotline). Please note, these guidelines were issued within the scope of the previous data protection law (prior to the GDPR) and, as such, some parts of the same were derogated as of May 25, 2018.

2) Scope of application

a) What types of wrongdoings are covered by the Local Law? Does it cover breaches of EU law?

Considering there is no specific law on whistleblowing, we are unable to comment on the types of wrongdoings that will/might be covered by Portuguese law when the Directive is transposed.

b) Personal scope

  1. Does the Local Law apply to reporting persons working in both the private and public sectors?

  2. The reporting procedures described previously, which are applicable to similar matters, apply to reporting persons in both the private and public sector.

  3. Does the Local Law apply only to breaches that the reporting person became aware of in a work-related context?

  4. The legislation described previously applies to breaches the reporting person became aware in a work-related context and business context, among others.

  5. Does the Local Law also protect: facilitators; people connected to the whistleblower and who could suffer retaliation in a work-related context; and legal entities the whistleblower owns, works for, or is otherwise connected with?

  6. Law no. 93/99, which regulates the application of measures to protect witnesses in criminal proceedings, establishes an extension of protection to witnesses’ family members and other relatives.

c) Does the Local Law require specific conditions to protect reporting persons?

Law no. 93/99, which regulates the application of measures to protect witnesses in criminal proceedings, only applies to: witnesses who have their lives, physical or psychological integrity, freedom or property of a considerably high value endangered because of their contribution to the proof of the facts that constitute the scope of the process; and particularly vulnerable witnesses.

3) Reporting channels

a) Does the Local Law allow anonymous reports? How are companies/agencies meant to handle them?

The Portuguese Data Protection Authority’s deliberation no. 765/2009 repudiates anonymous reports, privileging the confidentiality of the information reported.

b) Is there a duty of confidentiality and any derogation from this duty?

The legislative acts mentioned previously establish some confidentially duties.

The measures on the prevention of the use of the financial system for the purposes of money laundering or terrorist financing establishes that the channel used for reports shall ensure the confidentiality of the received information. In addition, the Portuguese Data Protection Authority’s deliberation no. 765/2009 establishes a principle of confidentiality of the identity of the whistleblower, subject to certain restrictions in order to guarantee that whistleblowing hotlines are not wrongfully used.

c) Public disclosures: does the Local Law provide for this possibility?

No, there are no specific provisions on public disclosure yet.

4) Reporting channels: internal

a) Is there an obligation for private and/or public legal entities to establish channels and procedures for internal reporting and follow-ups?

The measures to prevent money laundering and financing of terrorism establish channels and procedures for internal reporting of breaches. Such obligations apply to both private and public legal entities and should be proportional to the nature, size and complexity of the obligated entity's activity.

b) Do internal reporting channels need to allow reporting in writing, orally or both?

Despite there being no specific law on whistleblowing, Portuguese laws regarding reporting channels (namely, measures to prevent money laundering) do not establish any specific formalities on the written or oral nature of reporting. Notwithstanding that, considering that the report recipients must keep a copy of the submitted reports, all reports should be made in writing to the competent authorities.

c) Procedures for internal reporting and follow-up: does the Local Law require legal entities to adopt internal reporting systems with the following elements?

  1. Channels able to ensure the confidentiality of the identity of the reporting person and the protection of third parties mentioned in the report:

  2. Measures to prevent money laundering and financing of terrorism establish that the reporting channel must ensure the confidentiality of the reporter’s personal data and the confidentiality of the received reports.

  3. Acknowledgement of receipt of the report to the whistleblower within seven days of receipt:

  4. None of the legislative acts previously identified contain provisions in this respect.

  5. The designation of an impartial function/team to manage follow-ups on reports and maintain communication with the whistleblower:

  6. None of the legislative acts previously identified contain provisions in this respect.

  7. Any other follow-up requirements including those for anonymous complaints:

  8. None of the legislative acts previously identified contain provisions in this respect.

  9. A reasonable timeframe to provide feedback, not exceeding three months from acknowledgment of receipt or if no acknowledgement was sent, three months from the expiry of the seven-day period after a report is made:

  10. None of the legislative acts previously identified contain provisions in this respect.

  11. Providing clear and easily accessible information on internal reporting procedures and external reporting procedures to competent authorities and/or EU institutions/bodies:

  12. Measures to prevent money laundering and financing of terrorism establish that responsible entities shall collaborate promptly with Departamento Central de Investigação e Ação Penal (DCIAP) and Financial Information Unite, as well as other judicial and police or tax authorities.

  13. Should legal entities take any additional measures in order to comply with the above requirements?

  14. Considering that there is no specific law on whistleblowing in Portugal, we are not able to indicate any additional measures that should be taken by legal entities in order to be compliant with the above requirements.

5) Reporting channels: external

a) Has the country designated a competent authority to receive and investigate whistleblower disclosure and retaliation complaints?

No competent authority has been designated to receive and investigate whistleblower disclosure and/or retaliation complaints.

b) Is an independent and autonomous external reporting channel already established in the country?

No such reporting channel has been established yet.

6) Processing of personal data

a) Is personal data concerning the reports processed in compliance with local and EU legislation such as EU Regulation 2018/1725 and local privacy laws?

In the processing of personal data, Portuguese entities shall comply with EU Regulation no. 2016/679 (General Data Protection Regulation, GDPR) and Law no. 58/2019, which implements the GDPR in Portugal, along with the measures to prevent money laundering and financing of terrorism, and the CNPD’s recommendations.

7) Record keeping of reports

a) Is there any obligation regarding record keeping of reports as provided for by the EU Directive?

Measures to prevent money laundering and financing of terrorism establish that the responsible entities, under certain conditions, shall keep the documentation provided by clients or third parties for seven years.

8) Protection

a) Is there any difference between whistleblower protections in the private and public sectors?

Considering that there is no specific law on whistleblowing in Portugal, we are not able to indicate if there are any differences between whistleblowers’ protection in the private and public sectors.

b) Are whistleblowers protected against all forms of retaliation including threats and attempts of retaliation? Which forms of retaliation are expressly indicated?

Measures to prevent money laundering and financing of terrorism establish that the responsible entities shall refrain from any threats or hostile acts and, in particular, from unfavourable or discriminatory work practices against those who, in good faith, provide information, documents and other elements.

c) Does the Local Law provide for any other measures of support such as those indicated in the EU Directive?

Law no. 93/99 regarding witness protection establishes a special security program that may include the creation of conditions for raising means of subsistence and the granting of a subsistence allowance for a limited period.

d) Does the Local Law provide for the necessary measures to prohibit any form of retaliation against whistleblowers?

Measures to prevent money laundering and financing of terrorism establish that providing information, documentation and other elements cannot, by itself, justify the promotion of disciplinary, civil or criminal proceedings against those who provide such elements, except if said provision is deliberately and manifestly groundless.

e) Does the Local Law provide for any remedial measures, including interim relief measures?

Some remedial measures exist to prevent retaliation against whistleblowers, including the possibility of the employee who is dismissed in consequence of a disciplinary proceeding applying to the Court to obtain a judicial review of the dismissal.

f) Does the Local Law provide for exemptions from liability for whistleblowers?

Portuguese law does not provide for exemption from liability for whistleblowers.

g) Does the Local Law provide for sanctions against natural and legal persons that violate whistleblowers’ protection or the duty of maintaining the confidentiality of their identity?

Measures to prevent money laundering and financing of terrorism establish sanctions to natural or legal persons who reveal or help the discovery of the identity of the person who provided information, documents or other elements. The sanctions may involve criminal penalties of up to three years’ imprisonment for natural persons and judicial fines for legal persons.

h) Does the Local Law provide for sanctions in case of false reports?

The Portuguese Criminal Code punishes people who declare false statements before public entities with judicial fines or sanctions of up to one year’s imprisonment.

9) Other issues

a) Under the Local Law, is adopting a whistleblowing system relevant to assess the adequacy of a compliance program? Does this have any value to mitigate or eliminate criminal liability for legal entities?

Although the Directive has not yet been transposed in Portugal, we believe that adopting a whistleblowing system will be relevant in assessing the adequacy of the compliance programs adopted by each company. Regarding the mitigation/elimination of criminal liability for legal entities, as the Directive is not yet transposed, we are unable to indicate if the adoption of a whistleblowing system will have any value in the criminal liability assessment for legal entities.

b) Does the Local Law or another law in your country provide for whistleblower reward programs?

Portuguese law does not provide any reward programs for whistleblowers. The Portuguese Criminal Code does not provide any reward programs for whistleblowers or witnesses.

c) Can companies benefit from any incentives in the case of voluntary self-disclosure of violations they became aware of following an internal report?

Portuguese law does not establish any incentive for companies in the case of voluntary self-disclosure of violations they became aware of following an internal report. However, such conduct might, theoretically, be relevant to provide a reduction of sentence if the company is criminally implicated.

d) Will implementing the EU Directive create any with obligations provided for under other laws / regulations?

When the EU Directive is transposed to Portuguese law, we believe that Portuguese companies with internal reporting channels will assess whether those channels comply with the Directive and will make the necessary adjustments. We believe no issues will be raised with the transposition of the Directive.


Return to Overview page

For a pdf of the full guide please click on the button below.

Issue contents