Whistleblower protection and reporting channels in Portugal

Yes. Law no. 93/2021, from 20 December which will enter into force on June 18th, 2022.

Yes, and the local requirement is applicable to both private and public entities. All those that hire at least 50 employees or, regardless of the number of employees, if performing financial services, offering financial products or providing financial markets, and have a legal obligation to prevent money laundering and terrorist financing, or if their operation involves transport safety. This also applies to branches registered in Portugal.

Failure to establish a whistleblowing system (or establishing one that does not comply with all legal requirements) constitutes a serious administrative offence subject to the payment of a penalty between EUR 1.000,00 (one thousand euros and EUR 125.000,00 (one hundred and twenty five thousand euros).

As local labour law has not been amended, there are no mandatory requirements for establishing a whistleblowing system. Nevertheless, it is foreseen in local law that internal channels must allow for secure submission, ensure completeness, integrity and the preservation of the report, and keep the identity of the whistleblower confidential, as well as the identity of any third parties mentioned in the report. Furthermore, it must prevent unauthorised persons from accessing reports. 

Currently - because the local law was not amended - employees’ involvement is not required when establishing a whistleblowing system.

No, but only provided that certain conditions are fulfilled:

• The whistleblower has reasonable grounds to believe that the breach may constitute an imminent or manifest danger to the public interest, that the breach cannot be effectively disclosed or dealt with by the competent authorities, considering the specific circumstances of the case, or that there is a risk of retaliation, including in the case of an external report; or
• The whistleblower has filed an internal report and an external report, or a direct external report, without appropriate measures having been taken within the prescribed time limits as foreseen by Law.

As local labour law has not been amended, no specific legal protection for whistleblowers is currently or specifically foreseen. However, the regulations in force prohibit any acts of retaliation against the whistleblower. Furthermore, any act or omission (including threats or attempts) that, directly or indirectly, take place in a professional context and are motivated by an internal or external whistleblowing or public disclosure, causing or being prone to unreasonably cause the whistleblower to suffer pecuniary or non-pecuniary damages, are considered to constitute retaliation. Moreover, the following acts are presumed to have been motivated by internal or external denunciation or public disclosure, until proven otherwise, if verified within the following two years:

• Changes in working conditions, such as duties, hours, place of work or salary, non-promotion of the employee or breach of labour duties;
• Suspension of employment contract;
• Negative performance evaluation or negative reference for employment purposes;
• Failure to convert a fixed-term employment contract into a permanent contract, whenever the employee had legitimate expectations of such conversion;
• Non-renewal of a fixed-term employment contract;
• Dismissal;
• Inclusion in a list, on the basis of a sectorial scale agreement, which may lead to the impossibility of the whistleblower finding employment in the sector or industry in question in the future;
• Termination of a supply or service contract;
• Revocation of an act or termination of an administrative contract, as defined under the Code of Administrative Procedure.

Whistleblowers are entitled, under general terms, to legal protection and may benefit, under the general terms, from measures for the protection of witnesses in criminal proceedings. 

The law transposing the Whistleblowing Directive into Portuguese law (Law no. 93/2021) contains a specific clause on data protection, which specifically provides that the processing of personal data under this law must be carried out in accordance with the provisions of the General Data Protection Regulation, , and with Law no. 59/2019, of 8 August, which approves the rules on the processing of personal data for the purposes of prevention detection, investigation or prosecution of criminal offences or the execution of criminal penalties.

The GDPR and the national data protection law do not specifically mention whistleblower protection. Therefore, it is important that the general rules and principles set out in the Data Protection Law are complied with. In particular, the provisions of Article 5 of the GDPR concerning the principles applicable to the protection of personal data must be taken into account, with the principles of transparency, confidentiality, lawfulness, purpose limitation and data minimization being of particular relevance in this context.

In addition, the clause foreseen in Law no. 93/2021 on data protection states that personal data that is clearly not relevant for the processing of the complaint must not be retained and must be immediately deleted, reinforcing the importance of the principle of data minimization. It also adds that this is without prejudice to the duty to retain reports submitted verbally, when such retention is made by recording the communication on a durable and retrievable medium.

As with Article 8 of the Directive, Article 8 of Law no. 93/2021 also provides for the possibility of resource sharing with regard to the receipt of complaints and their follow-up. Thus:

1. Obliged entities that are not governed by public law and that employ between 50 and 249 workers may share resources for the receipt of complaints and their follow-up; and
2. Local authorities may share complaint channels for the receipt of complaints and their follow-up.

There is nothing in the law regarding the possibility or impossibility of this sharing of resources taking place across jurisdictions.