Revised and improved whistleblowing law adopted in Romania

Consultation round results in positive changes

This alert is a follow up to our previous Q3/Q4 updates on whistleblower protection in Romania and implementation of the EU Whistleblowing Directive from the perspective of compliance and internal investigations.

The previous form of the Romanian whistleblowing law adopted in Parliament was subject to various criticisms, and the Romanian President sent it back to the Parliament for re-examination. After recommendations from compliance specialists, members of the civil society and from the European Commission, a revised, improved form of the law was adopted by the Parliament on 13 December 2022. Soon after, it was promulgated by the Romanian President, published in the Official Gazette on 19 December 2022 and entered into force on 22 December 2022. It was a lengthy process, as was seen similarly in other EU jurisdictions.

1. The local discussions and recent compliance and practical amendments in the latest form of the law

Some of the main points of criticism concerning the previous form of the law approved in the summer 2022 concerned insufficient protection for whitsleblowers in certain instances and the failure to ensure enough protection for anonymous reporting. Such points and others have been raised by, inter alia, compliance professionals, civil society and the European Commission in the context of the Romanian National Recovery and Resilience Plan. Therefore, a significant improved version of the law has been approved, published and recently entered into force.

2. What does the latest form of the law bring from an internal compliance and investigations perspective?

The following are among the main improvements in the law:

• Clarifications on the status of whistleblowers, submitting of anonymous reports and adding instances where they can report, such as, for example, whistleblowers can report on violations of law found out during the recruitment process, during other pre-contractual negotiations or when the employment or services relationship has been terminated. Furthermore, anonymous reports (i.e. a report that does not contain the name, surname, contact details or signature of the whistleblower) will also be analysed to the extent that it contains substantiated indications of violations of the law. Also, an interesting aspect is that persons/candidates whose employment relation has not yet started and who make public reports/disclosures in relation to information obtained during the recruitment process and persons whose employment/employment has ended can also act now as whistleblowers.
• Aspects regarding reporting have been also clarified. The law sets out three procedures that the whistleblower must follow in order to benefit from the protection of the law:
  • internal reporting – the communication of information about infringements of the law within a company, carried out by means made available by the company (through its own channels);
  • external reporting – communication of information about violations of the law to one of the following public authorities: public authorities and institutions that receive and deal with reports in their field of competence; the National Integrity Agency; and other authorities/institutions to which the National Integrity Agency forwards reports for assessment, etc.; and
  • public disclosure – making information about violations of the law available in the public domain in any way. However, this action must meet one of the following conditions: (i) the whistleblower has first reported internally and externally or directly externally, but considers that appropriate action has not been taken within 3 months of receipt of the report (6 months in justified cases); or (ii) has reasonable grounds to consider that the breach may constitute an imminent or manifest danger to the public interest or a risk of damage that cannot be remedied or in the case of external reporting there is a risk of retaliation or a low likelihood that the breach will be effectively remedied, given the specific circumstances of the report.

• The main obligations of companies and risks to which they are subject: apart from addressing reports received in a timely fashion, another main obligation of companies is to identify and establish internal reporting channels and establish internal reporting procedures (the procedures for internal reporting and follow-up actions should include, among other things: the designation of a person, a department or a third party to receive, record, examine, take follow-up action and settle reports, acting impartially and independently in the exercise of those duties). This obligation will enter into force on 17 December 2023 and is mainly addressed to companies which have between 50 and 249 employees. Failure to comply with this obligation is punishable by a fine of up to RON 30,000. Companies operating in specific sectors (e.g. insurance or financial services, the oil industry) must fulfil the above obligation regardless of their number of employees. Also, for companies with less than 50 employees, such procedures can be implemented, and their employees can submit such reports (however, if there are no internal reporting channels put in place, the whistleblower will have to report externally).

• On the protection of whistleblowers, the law prohibits forms of retaliation against whistleblowers in the public interest, threats of retaliation or attempts at retaliation, especially those concerning: any suspension of the individual employment contract or of the employment relationship; dismissal or dismissal from public office; modification of the employment contract or the employment relationship or reduction of salary and a change of working hours. If, nevertheless, retaliation measures were to be taken by a company against a whistleblower, then the law stipulates that a fine up to RON 40,000 (i.e. app. EUR 8,000) can be applied to the company, in certain cases.

3. Conclusions and wider regional and EU context

Even if some of the topics covered by the law could be further improved, the latest form of the law demonstrates progress on a practical level. It should be expected nevertheless that that certain aspects will still be subject to discussion on their practical implementation (such as, for example, the interpretation and scope of “substantiated indications” for of violations of the law, etc.). The law at the same time also creates some more proactive compliance steps and approaches with regard to companies, not only on establishing internal reporting and related processes, but also on more actively dealing with and addressing such reports.

Also, some of the efforts in other EU jurisdictions to enact local legislation implementing the EU Whistleblowing Directive will have a further impact on shaping compliance steps and processes in companies which are part of international groups operating in several jurisdictions. Our team’s experience has shown that a timely and coordinated approach among several jurisdictions and authorities involved is preferable.

There are also already comments that the recent ‘Qatargate’ corruption case in the European Parliament has had an accelerating effect on some of the jurisdictions to enact or enhance their local whistleblower legislation and processes. This would be another reason to ensure a coordinated approach among several jurisdictions.

We will continue to publish additional alerts and comment on issues as they arise in 2023. Our team is available to advise on how these topics affect your business and compliance programmes.