The internal reporting channel duty in Portugal

2022-06-18 (Art. 31: the law enters into force 180 days after its publication on 20 December 2021)

Art. 8(1): legal persons, including the State and other public-law legal persons, employing 50 or MORE workers; and, IRRESPECTIVE OF HEADCOUNT, entities falling within the scope of the EU acts referred to in Parts I.B and II of the Annex to Directive (EU) 2019/1937 (financial services, products and markets; AML/CFT; transport safety; environmental protection). Art. 8(3) extends the duty, with the necessary adaptations, to branches located in Portugal of legal persons headquartered abroad. Art. 8(6) exempts municipalities that employ 50+ workers but have fewer than 10,000 inhabitants.

No separate deadline, Portugal did not use the Directive's 17 December 2023 derogation. The duty bound every obliged entity, including private entities with 50-249 workers, from the law's entry into force on 18 June 2022. The only concession for that band is Art. 8(2): non-public obliged entities employing between 50 and 249 workers may SHARE RESOURCES for receiving reports and following them up.

REQUIRED. Art. 10(1): internal reporting channels must permit reports to be submitted in writing and/or orally by workers, "anónimas ou com identificação do denunciante", anonymous or with the reporter identified. Art. 9(1) requires the channel to guarantee the confidentiality of the reporter's identity or their anonymity. Failure to guarantee the possibility of an anonymous report is itself a serious administrative offence under Art. 27(3)(d). Portugal and Spain are the two that mandate anonymity.

No single authority. Art. 12(1) routes external reports to whichever authority is competent for the subject matter, expressly including: the Ministério Público (Public Prosecution Service), criminal police bodies, the Banco de Portugal, independent administrative authorities, public institutes, inspectorates-general and equivalent central State services with administrative autonomy, municipalities, and public associations. Where no competent authority exists, or where the report targets a competent authority, it must be addressed to the Mecanismo Nacional Anticorrupção (MENAC, National Anti-Corruption Mechanism), or to the Public Prosecution Service where MENAC itself is the target (Art. 12(3)). MENAC also processes the administrative offences under Art. 27 and imposes the corresponding fines (Art. 29(1)), except where a sectoral authority holds the sanctioning power (Art. 29(2)).

For failing TO HAVE an internal reporting channel under Art. 8 and Art. 9(2)-(3): serious administrative offence (contraordenação grave) under Art. 27(3)(a), punishable by a fine (coima) of €1,000 to €125,000 for legal persons and €500 to €12,500 for natural persons (Art. 27(4)). For obstructing the submission or follow-up of a report contrary to Art. 7: very serious administrative offence (contraordenação muito grave) under Art. 27(1)(a), punishable by €10,000 to €250,000 for legal persons and €1,000 to €25,000 for natural persons (Art. 27(2)). Retaliation, breach of the confidentiality duty in Art. 18, and knowingly reporting or publicly disclosing false information are also very serious offences in the same band. Attempt and negligence are punishable, with the maximum fines halved (Art. 27(5)-(6)). Note the long list of serious offences in Art. 27(3)(b)-(h) covering defective channels: no exhaustiveness/integrity/retention/confidentiality guarantees, no independence or freedom from conflicts of interest, no anonymous or written/oral option, refusing an in-person meeting, missing the acknowledgement or feedback deadlines.

Partly, this is the key Portuguese restriction and the one most likely to be misstated. Art. 9(2) requires the internal channel to be operated INTERNALLY, by persons or services designated for the purpose, for the RECEIPT AND FOLLOW-UP of reports. Art. 9(3) then allows: "Os canais de denúncia podem ser operados externamente, para efeitos de receção de denúncias", external operation is permitted for the RECEIPT of reports only. The follow-up (seguimento) must remain in-house. Whoever operates the channel, internally or externally, must guarantee independence, impartiality, confidentiality, data protection, secrecy and absence of conflicts of interest (Art. 9(4)); breaching that is a serious offence under Art. 27(3)(c).