As such, whistle-blowing is not a common practice in the private sector, as reporting mechanisms are notoriously scarce, underdeveloped and poorly publicized. Some multinational companies have, however, adopted hotlines within their compliance departments and deliver corporate governance reports that include chapters on fraud prevention.  But these are for internal compliance reasons and not to comply with Portuguese law.  Labor-wise, there are essentially three provisions that — directly or indirectly — foresee the protection of whistle-blowers.

Labor laws
Law 19/2008 establishes one of the few known legal provisions involving the protection of whistle-blowers. This law contains measures against corruption, including a general principle that protects public officials and employees of state- owned companies against potential retaliation as a result of their reporting of crimes.  Public officials are granted the right to (a) remain anonymous (except toward those responsible for the investigation) until the prosecution and (b) request for transfer after the prosecution. Workers in the private and jurisdictional sectors are not covered by Article 4 of this law.

In the Portuguese Labor Code, employees are only entitled to some protection under Article 129. This provision protects workers from unjustified treatment by their employers, particularly if they are exercising their rights, which also include the civil right-duty to report crimes, entitling the worker to the right to initiate court proceedings against the employer.   However, the dismissal of whistle-blowers is not considered abusive per se, and it is up to the dismissed employees to demonstrate that their dismissal was due to the whistle-blowing.

Recently enacted Law 73/2017, regarding harassment in the workplace, sets out an increased protection of whistle-blowers in harassment cases. To enforce this law, the Authority for Working Conditions and the General Inspectorate of Finance provide their own electronic addresses for the receipt of complaints of harassment in the workplace, both in the private and public sectors, and provide information on their websites with the identification of harassment practices and measures to prevent, combat and respond to harassment.

However, there is no duty to implement internal compliance policies or where autonomous and anonymous reporting channels are established, which could allow human resources to act internally against such illicit behavior.

Data protection issues
Due to the lack of specific legislation in Portugal, in 2009, the Portuguese Data Protection Authority (CNPD) issued a resolution focused on the data protection issues of internal whistle- blowing. Although this was issued under the national privacy law existing prior to the General Data Protection Regulation (Law 67/98, following  Directive  95/46/ EU), we believe the essential principles  and guidelines remain valid. Under this resolution, anonymity is discouraged in favor of a regime of confidentiality as a means of safeguarding the risks of libelous reporting and discrimination, and the management and preliminary assessment of the complaints must be carried out by independent auditors.

This CNPD resolution could, in practical terms, pave the way for further implementation of whistle-blowing channels within companies, which should focus on preserving confidentiality; managing complaints by third-party providers; providing feedback on investigation outcomes to the whistle- blowers; and establishing anti-retaliation protection.