The EU Whistleblower Directive. Particularities of Transposition to Romanian Law

“The purpose of this Directive is to enhance the enforcement of Union law and policies in specific areas by laying down common minimum standards providing for a high level of protection of persons reporting breaches of Union law.” This is Article 1 of the EU Directive 2019/1937 of the European Parliament and of the Council on the protection of persons who report breaches of Union law (also referred to as the “Whistleblower Directive” or herein the “Directive”). The Directive lays out several measures which legal entities in the private and public sector need to implement and observe in order to attain the purpose outlined in the cited Article 1.

As per Union law, EU Member States were under an obligation to transpose the Directive in national legislation, with the observance of two deadlines, namely 17 December 2021 and 17 December 2023. The last deadline concerned legal entities in the private sector with 50 to 249 workers, in relation to which Member States were required to bring into force the laws, regulations and administrative provisions necessary to comply with the obligation to establish internal reporting channels.

In Romania, the transposition of the provisions of the Whistleblower Directive due until 17 December 2021 has been carried out through amendments brought to several normative acts,[1] while the provisions due on 17 December 2023 have been transposed by Law No 361/2022 on the protection of whistleblowers in the public interest (“Law 361”).

Below is a non-exhaustive, selective overview of the national particularities included in Law 361 transposing the Directive.

Provision in the Directive allowing discretion of the Member States	Particularity included in Law 361
Anonymous reporting The Directive does not affect the power of Member States to decide whether legal entities in the private or public sector and competent authorities are required to accept and follow up on anonymous reports of breaches.[2]	Law 361 applies to persons who report or publicly disclose information about violations of the law anonymously.[3] However, the report shall not be pursued when it is submitted anonymously and does not contain sufficient information to allow for analysis and resolution, and the designated person has requested its completion within 15 days, without this request being fulfilled.[4]
Obligations for private sector legal entities with fewer than 50 workers Member States may require legal entities in the private sector with fewer than 50 workers to establish internal reporting channels and procedures.[5]	Law 361 does not impose reporting obligations for legal entities employing less than 50 workers but does not exclude this possibility. According to the law, in absence of internal reporting channels in the case of private legal persons with fewer than 50 employees, the whistleblower reporting a breach of the law shall use the external channel.[6]
Appointment of competent authority Member States shall designate the authorities competent to receive, give feedback and follow up on reports, and shall provide them with adequate resources.[7]	The main whistleblowing supervisory authority in Romania according to Law 361 is the National Integrity Agency (Agenția Națională de Integritate).
Keeping of records Obligation of legal entities in the private and public sector and competent authorities to keep records of every report received. Reports shall be stored for no longer than it is necessary and proportionate.[8]	Reports are kept for 5 years. After the expiry of the 5-year retention period, they are destroyed, regardless of the medium on which they are kept.[9]
Prohibition of retaliation Member States shall take the necessary measures to prohibit any form of retaliation against whistleblowers.[10]	Any form of retaliation against whistleblowers in the public interest, threats of retaliation or attempted retaliation is prohibited.[11]
Sanctions Implementation of effective, proportionate and dissuasive penalties applicable to natural or legal persons that:[12]
hinder or attempt to hinder reporting;	The following are administrative offences and are punishable by fines: hindering, by any means, the reporting by the person designated to receive and record the reports or by the person who is part of the department designated for this purpose → fine ranging from RON 2,000 to RON 20,000;[13] the unjustified refusal of authorities, public institutions, legal persons governed by public law, as well as legal persons governed by private law to respond to requests from authorities competent to receive reports of violations of the law in the exercise of their duties → fine from RON 3,000 to RON 30,000;[14] non-compliance by the legal persons with the obligation to set up the internal reporting channels → fine from RON 3,000 lei to RON 30,000;[15]
breach the duty of maintaining the confidentiality of the identity of reporting persons.[16]	legal persons’ failure to design, set up and manage the way in which reports are received to protect the confidentiality of the identity of the whistleblower and any third party named in the report and to prevent unauthorised personnel from accessing the report → fine from RON 4.000 to RON 40.000;[17] natural persons’ failure to maintain the confidentiality of the identity of the whistleblower, the data subject or third parties → fine from RON 4.000 to RON 40.000.[18]

[1] Including the Civil Code, the Labour Code, the Civil Procedure Code, the Criminal Procedure Code, as well as other laws containing provisions relevant to citizen rights and justice.[

[2] Article 6 para. 2) of the Directive.

[3] Article 2 para. 3) of Law 361.

[4] Article 11 para. 1) letter b) of Law 361.

[5] Article 8 para. 7 of the Directive.

[6] Article 5 para. 3) of Law 361.

[7] Article 11 para. 1) of the Directive.

[8] Article 18 para. 1) of the Directive.

[9] Article 7 para. 2) of Law 361.

[10] Article 19 of the Directive.

[11] Article 22 para. 1) of Law 361.

[12] Article 23 of the Directive.

[13] Article 28 para. 2 letter a) of Law 361.

[14] Ibid letter b).

[15] Ibid letter c).

[16] The duty of confidentiality is included in Article 16 of the Directive.

[17] Article 28 para. 2 letter d) of Law 361.

[18] Ibid letter e).