Comments on the Draft Law on “Whistleblowing and Whistleblower Protection”

Comments on the Draft Law on Whistleblowing and Whistleblower Protection:

1. The new draft law does not explicitly repeal Law No. 60/2016, which creates legal uncertainty and the possibility of overlapping competences between the new provisions and the existing ones.
2. The draft law does not include transitional provisions for existing whistleblowing structures, which may lead to disruptions in the continuity and practical functioning of current mechanisms.
3. The draft law refers to the HIDAACI as an independent body but does not define concrete guarantees for functional and budgetary independence, as required by the EU Directive, particularly given that the institution remains financially dependent on the government.
4. Cooperation with other law enforcement bodies (SPAK, High Inspector of Justice, Prosecution Office) is not clarified, creating risks of overlap or lack of coordination in administrative and criminal investigations.
5. The deadlines stipulated in the draft law (7 days for confirmation of receipt and 3 months for response) are inconsistent with the standard deadlines under the Code of Administrative Procedures (30-day case-processing deadline), potentially creating ambiguity in cases of complaint or appeal.
6. The draft law’s provisions on protection from retaliation are not harmonised with the existing reinstatement and compensation mechanisms provided under the Labour Code.
7. The draft law does not clearly clarify whether HIDAACI or the Labour Inspectorate holds the competence to intervene and protect whistleblowers in cases of unjust workplace retaliation, resulting in an institutional gap.
8. The draft law does not establish the obligation to immediately refer cases with criminal elements to SPAK or the Prosecution Office, creating a gap in inter-institutional cooperation, delays in action, and a decrease in the effectiveness of the whistleblowing mechanism.
9. The draft law does not provide a guarantee that whistleblowers acting in good faith will not face criminal prosecution for “false reporting” (Article 300 of the Criminal Code).
10. The draft law does not clearly reference Law No. 124/2024 “On the Protection of Personal Data” and the EU General Data Protection Regulation (GDPR), even though it even though it involves the processing of sensitive personal information. Clear reference to these frameworks is crucial to guarantee compliance with European standards, ensure strong confidentiality protections, and provide legal certainty in handling whistleblower data.
11. The proposed five-year retention period is excessive and inconsistent with the purpose-limitation principle set out in data protection legislation. In most EU Member States, retention periods are limited to 2–3 years, and the prolonged storage of data beyond the conclusion of administrative investigations generates additional and unjustified risks.
12. The proposed administrative sanctions 50,000–500,000 ALL (approx. 520 – 5,200 EUR) are too low to have a deterrent or punitive effect. In several EU Member States, administrative sanctions for retaliation or disclosure of a whistleblower’s identity can reach 600,000 to 900,000 EUR. The draft law also fails to differentiate between public bodies and large private entities, or between natural and legal persons. Moreover, there are no provisions addressing repeated violations and does not foresee additional disciplinary measures for responsible public officials.
13. The draft law does not specify whether sanctions will be imposed by HIDAACI or another authority (e.g., the Labour Inspectorate), creating procedural uncertainty.
14. It does not define which court has jurisdiction to review complaints, which may lead to divergent interpretations.
15. The term “volunteer” should also be reflected in Article 3, paragraph 2, in order to harmonise the scope of implementation.
16. The competent authority (e.g., HIDAACI) for conducting training for responsible units should be defined.
17. It is recommended to add a specific article assigning HIDAACI the obligation to undertake regular awareness-raising and training measures in the field of whistleblowing and whistleblower protection. This article may include:
    ✓ organizing periodic trainings for public and private employees;
    ✓ conducting awareness campaigns and publishing guidance materials for the public;
    ✓ preparing annual public reports on the implementation of the law.
18. It is recommended to add a provision after Article 26 “Misdemeanours and administrative measures” establishing disciplinary measures against those responsible for breaching confidentiality or engaging in retaliatory actions against whistleblowers. The provision should specify that:
    ✓ in addition to fines, public officials face disciplinary measures under the Civil Service Law;
    ✓ HIDAACI is obliged to notify the relevant institution to initiate disciplinary proceedings;
    ✓ disciplinary measures do not exclude administrative sanctions.