The internal reporting channel duty in Romania

2022-12-22 (published in Monitorul Oficial nr. 1218 of 19 December 2022; amended by Law 67/2023 with effect from 31 March 2023)

Mis-cited. It is Art. 9(1) that covers public authorities, public institutions and other public legal persons "indiferent de numărul de angajaţi", in the same sentence as the 50-employee rule for private legal persons. Art. 9(2) does only one thing: extend that duty to those bodies' structures without legal personality having at least 50 employees. Split the citation: public bodies regardless of headcount = Art. 9(1); their structures without legal personality with 50+ = Art. 9(2).

17 December 2023. Art. 36 (Intrarea în vigoare): the Chapter III obligation to identify or establish internal reporting channels entered into force for private legal entities with between 50 and 249 employees on 17 December 2023. Entities with 250+ employees were covered from 22 December 2022.

Must be examined, subject to substance. Art. 6(2), as amended by Law 67/2023: a report that does not contain the whistleblower's name, surname, contact details or signature "se examinează şi se soluţionează în măsura în care conţine indicii referitoare la încălcări ale legii" - is examined and dealt with to the extent it contains indications of breaches of the law. Conversely, a report that is anonymous and does not contain sufficient information about breaches may be closed. So Romania goes further than most: an anonymous report with usable substance cannot simply be ignored.

Agenţia Naţională de Integritate (ANI) - National Integrity Agency (Art. 3 pt. 15(b) and Art. 16). Sectoral public authorities that already receive reports under special laws are also competent authorities in their own field (Art. 3 pt. 15(a) and (c)). ANI's specialised structure both handles external reports and imposes the fines (Art. 30(1)).

Failure by the covered legal persons to establish the internal reporting channels required by Art. 9(1) is a contravention punishable by a fine of RON 3,000 to RON 30,000 (Art. 28(2)(c)) - roughly EUR 600 to EUR 6,000. Obstructing reporting by any means, by the designated person or the designated department, carries RON 2,000 to RON 20,000 (Art. 28(2)(a)). Failure to comply with the confidentiality-by-design duty in Art. 10(1)(a) carries RON 4,000 to RON 40,000 (Art. 28(2)(d)). Breach of the confidentiality of the whistleblower's identity by a natural person: RON 4,000 to RON 40,000 (Art. 28(2)(e)). All apply only if the conduct is not a criminal offence. Findings and sanctions are made by ANI staff (Art. 30).

Yes, expressly. Art. 3 pt. 16 provides that, depending on the number of employees, the tasks of the designated person may be exercised by a person, a department, or "pot fi externalizate către un terţ, denumit în continuare terţ desemnat" (may be outsourced to a third party, the designated third party). Art. 9(1) adds that the designated third party is obliged to apply the reporting procedure set out in Art. 10(1), and Art. 10(1)(c) allows the designation of a third party to receive, register, examine, follow up and resolve reports, acting impartially and independently.