Whistleblower series: Portugal

With lawmakers in Lisbon currently drafting legislation on corporate internal investigations, Portugal can expect to have legislation soon that transposes the 2019 EU Directive on Whistleblowing.

But during this transposition process, Portugal is not in a legal vacuum when it comes to internal investigations in the corporate world. The Portuguese Data Protection Supervisory Authority (CNPD) promulgated two resolutions that directly apply to the collection of employee data during an in-house inquiry. One ruling (Resolution 765/2009) concerns the processing or collection of personal data for the purposes of internal communication and the other (Resolution 1638/2013) concerns the processing of personal data derived from information and communication technology in the workplace.

Specifically, the resolution regarding the processing of personal data for internal communication expressly prohibits the posting of anonymous reports, requiring accountability in the process in order to discourage slander and discrimination. But the ruling demands that individuals reporting abuse should have their identities protected. In addition, the resolution prohibits an employer from retaliating against a whistleblower by demoting, firing or sanctioning him even if the disclosures contain information that brings embarrassment to the company and its management.

The resolution also regulates the rights of the accused person in an investigation, giving him the right to access any and all information from the data controller about the accusation made against him, and the purposes of this data processing. The accused can also have access to any of his collected data.

The whistleblower also has rights. After a report is filed, the data controller must report back to the whistleblower and verify if an investigation is taking place, its purpose and its scope.

Data protection regulations in Portugal, however, do not regulate investigation procedures, which begs the question: without an ad hoc law in place, are Portuguese companies permitted to conduct internal inquiries when wrongdoing has been brought to their attention?

The answer is yes. As a result of a 2018 Corporate Governance Code issued by the Securities Market Commission, companies must adopt mechanisms for detecting abuses and a whistleblowing policy that guarantees a response to any reports of irregularities and protections for those exposing wrongdoing.

Based on the experiences of companies in the Portuguese banking sector, which has been progressive in creating such policies, a comprehensive internal investigations system should contain the following features: full definitions of what constitutes wrongdoing, corruption and a whistleblowing report; clear communication channels for reporting abuse; a process for conducting internal investigations and a body (i.e. committee) responsible for carrying them out; policies that encourage all misconduct to be reported, making it clear that anyone filing a report must identify himself and that anonymous allegations will not be accepted; policies that protect a whistleblower's identity and safeguard him against harassment; and policies that ensure that the personal data of all employees involved are safeguarded.

No matter what internal procedures are in place, if wrongdoing is exposed, a Portuguese firm must initiate “disciplinary proceedings” as defined by the Portuguese labour code in order to be able to take action against an employee.

A crucial part of disciplinary proceedings is its deadlines. In general terms, a company must initiate disciplinary proceedings within 60 days after a violation has been revealed. This means that the clock begins ticking as soon as the employer becomes aware of the infraction and – presumably – the identity of the wrongdoer. A company’s right to discipline an employee expires one year after the wrongdoing has been exposed.

As far as the structure of disciplinary proceedings is concerned, the Portuguese labour code sets down some basic requirements.

The code allows for an evidence-collection period, which it calls the “Prior Inquiry Procedure”. During this time, evidence should be gathered with the aim of issuing a Notice of Fault (Nota de Culpa) against an employee by fully investigating the circumstances of an abuse and the events leading to it. Note that the deadlines for disciplinary proceedings can be interrupted during the Prior Inquiry Procedure, which means the clock stops ticking on these deadlines if the inquiry procedure begins within 30 days of the allegation and is expeditiously carried out, resulting in a Notice of Fault against an employee, which in turn is issued within 30 days since the conclusion of the Prior Inquiry Procedure.

Once the Notice of Fault has been presented, the disciplinary proceedings, led by the employer or individuals delegated this responsibility (e.g. outside legal advisors), can get underway.

During these proceedings, the labour code affords accused employees certain rights, such as access to any and all documents that are being used in the proceedings. (Failure to respect this right this could endanger an employer's ability to sanction an employee after the proceedings have been concluded.)

In addition, an accused employee can introduce his own exculpatory witnesses and documentation. An employer can only refuse the accused this right if it deems the request dilatory and unfounded. But in this event, the firm must fully explain its reasoning in writing. If an employer doesn’t justify such a refusal in writing, this could result in an “irregularity of procedure” where the employee is eligible for compensation. (In this case, compensation traditionally amounts to approximately half the damages usually received for unlawful dismissal, but never includes reinstatement.)

As a general rule for all witnesses, testimony should be recorded in written form in case the courts must later adjudicate on the proceedings.

An exploration of an accused employee's rights must also include the privileges he does not have. Significantly, the accused does not need to be consulted for documents or any other evidence to be entered into disciplinary proceedings.

Also, an employee can be suspended from work for the duration of the proceedings if the company deems that his presence may adversely affect the investigation. A suspension can be ordered after the Notice of Fault has been issued, and should be recorded in writing. Crucially, even under suspension, an employee is entitled to his full salary.

When collecting evidence for the proceedings, a company can examine an employee’s digital communications, but only as a last resort. When accessing employee data, the employer must adhere to all privacy regulations. Employers, for example, cannot download communication lists or control communication records. Instead, employers are only able to analyse the timing and duration of digital communications, and during this examination, the employee who owns the data (or a representative) must be present.

If the company successfully conducts and concludes disciplinary proceedings within the deadlines, it has the right to render sanctions against an employee, so long as the punishment is proportional to the seriousness of the offence and the degree of guilt; no more than one sanction is levied for a single offence; and the sanction is carried out within three months after the final decision is rendered.

But employers should be aware that the Portuguese labour code prohibits punishment it considers abusive, such as sanctions that were handed out against employees who voice legitimate and reasonable complaints about deficient working conditions; who refuse to carry out orders for tasks, which they are not responsible for; who are part of or applying to be part of a company works council or union; or if they have been the victim of assault or a witness to assault in a court action.