Romania: Anonymous whistleblowers?

Following our opening article on the General Guidelines for protecting Whistleblowers, we are pleased to continue our whistleblowing compliance mini-series with yet another interesting topic: anonymous whistleblowers. Do anonymous whistleblowers benefit from the same protection? Should anonymous whistleblowing reports be investigated further? Should anonymous whistleblowing reports be regulated as an option, and if so, what would be the consequences?

While trying to address these sensitive questions, we would like to start by mentioning that such are in fact triggered by the second whistleblowing draft law submitted by the Romanian legislator in December 2021. The first Romanian whistleblowing draft law appeared to consider named whistleblowing reports only. Nevertheless, this rather political option is based on the European Whistleblowing Directive (hereinafter “EU Directive”), which stipulates in its preamble that Member States are to decide whether legal entities in the private and public sectors and competent authorities are required to accept and follow up on anonymous reports of breaches which fall within the scope of the Directive. 

However, before delving into more details, let’s start with the basics:

• Anonymous whistleblowers and anonymous whistleblowing reports

Within the meaning of the Directive, anonymous whistleblowers are people who file a whistleblowing report, either internally or externally, or publicly disclose information about a breach, acquired in a work-related context, without providing their name.

According to the Directive, anonymous whistleblowers, should they be identified and suffer retaliation, will benefit from the same protection as known whistleblowers. However, this protection does not necessarily entail an obligation to register and follow up on an anonymous whistleblowing report; such matters are left up to each Member State by the Directive.

In other words, the protection granted by the Directive covers everyone filing a whistleblowing report, regardless of whether they provide their name or not. However, the specific obligations for entities that receive anonymous reports are to be specified by each Member State at its discretion.

• Anonymous reports and whistleblowers in Romania

Comparing the first and the second whistleblowing draft law submitted by the Romanian legislator, it is clear that Romania has had a change of heart with regard to this sensitive topic. While both draft laws ensured that protection was to be granted to all whistleblowers (as set forth by the EU Directive), it was only the second one that left a door open for proper registration and investigation of anonymous whistleblowing reports.

The second whistleblowing draft law first mentions anonymous whistleblowing reports in Art. 2(2), which states that the law also applies to persons filing a report (internally or externally), including an anonymous report, or publicly divulging information on breaches, acquired during the recruitment process or during other preliminary negotiations, or for which the employment or working agreement has ended.

Another (clearer) provision is contained in Art. 6(2), which states that reports that do not include the whistleblower’s name, contact details or signature are to be examined and resolved in the same manner as reports that do provide those details.

Therefore, the logical conclusion is that anonymous whistleblowing reports must be registered and investigated just like any other reports. Omitted information about a whistleblower’s name or contact details does not entitle a company to close the report.

Moreover, the second draft law sets out another option for whistleblowers who do not wish to disclose their names: counsel representation. According to Art. 6(3), whistleblowing reports can be filed by a whistleblower’s lawyer, without the latter being obligated to state the whistleblower’s name, provided that the legal representation agreement concluded in this regard explicitly contains a corresponding provision.

And now, let’s take a closer look at the main consequences and explanations for the above:

• Regulations on mandatory registration and follow-up of anonymous reports are and should be a decision for each Member State, bearing in mind that the legal protection granted for anonymous reports clearly increases the chances of discovering compliance breaches early on;
• In fact, several statistics compiled and surveys conducted indicate that more than 50% of the whistleblowing reports filed through the internal reporting channels of a company are anonymous. From a psychological perspective, it seems that anonymous reports put a greater focus on the issues themselves and the commitment of the company to fixing them, and not on the person who highlights the issues; 
• As with any other right or legal option granted, potentially greater protection may be accompanied by a potential abuse of rights;
• The effectiveness of some whistleblowing reports is unclear if the whistleblower, for example, uses a one-time only email address that is deleted shortly afterwards;

It is yet to be established how a private company can verify whether the report meets the admissibility criteria set forth by the law, i.e. if the whistleblower falls within one of the categories regulated by Art. 2 of the second Whistleblowing Bill (personal scope).While the above considerations highlight some issues that will only be raised once the Whistleblowing Draft Law is passed in Romania, we consider it worthwhile to brainstorm beforehand on the challenges the private sector will face.