Cap. 527 Art. 17Setting up of whistleblowing reports unit.

(1) All authorities referred to in the First Schedule shall:

(a) set up an independent and autonomous whistleblowing reports Unit, for receiving and handling information on breaches and which shall meet all the following criteria:

(i) is designed, established and operated in a manner that ensures the completeness, integrity and confidentiality of the information and prevents access thereto by non-authorised staff members of the authority;

(ii) enables the durable storage of information in accordance with article 21A to allow further investigations to be carried out;

(b) promptly, and in any event within seven (7) days of receipt of the external disclosure, acknowledge that receipt unless the whistleblower explicitly requested otherwise or the whistleblowing reports Unit reasonably believes that acknowledging receipt of the disclosure shall jeopardise the protection of the reporting person’s identity;

(c) diligently follow up on external disclosures;

(d) provide feedback to the whistleblower within a reasonable time frame not exceeding three (3) months, or six (6) months in duly justified cases;

(e) communicate to the whistleblower the final outcome of investigations triggered by the report, in accordance with procedures provided for under national law;

(f) transmit in due time the information contained in the disclosures to competent institutions, bodies, offices or agencies of the European Union, as appropriate, for further investigation, where provided for under law.

(2) The whistleblowing reports Unit shall enable external disclosures in writing and orally. Oral disclosures shall be possible by telephone or through other voice messaging systems and, upon request by the whistleblower, by means of a physical meeting within a reasonable time-frame.

(3) The whistleblowing reports Unit shall ensure that, where an external disclosure is received through channels other than the reporting channels referred to in sub-articles (1) and (2) or by staff members other than those responsible for handling reports, the staff members who receive it are prohibited from disclosing any information that may identify the whistleblower or the person concerned, and that they promptly forward the report without modification to the staff members responsible for handling reports.

(4) The whistleblowing reports Unit shall designate staff members responsible for handling reports, and in particular for:

(a) providing any interested person with information on the procedures for reporting;

(b) receiving and following up on external disclosures;

(c) maintaining contact with the whistleblower for the purpose of providing feedback and requesting further information where necessary.

(5) The staff members referred to in sub-article (4) shall receive specific training for the purposes of handling reports:

(a) providing any interested person with information on the procedures for reporting;

(b) receiving and following up on external disclosures;

(c) maintaining contact with the whistleblower for the purpose of providing feedback and requesting further information where necessary.

(6) The whistleblowing reports Unit shall publish on their websites in a separate, easily identifiable and accessible section at least the following information:

(a) the conditions for qualifying for protection under this Act;

(b) the contact details for the whistleblowing reports Unit as provided for under sub-article (1), in particular the electronic and postal addresses, and the phone numbers for such channels, indicating whether the phone conversations are recorded;

(c) the procedures applicable to the reporting of breaches, including the manner in which the competent authority may request the whistleblower to clarify the information reported or to provide additional information, the time frame for providing feedback and the type and content of such feedback;

(d) the confidentiality regime applicable to reports, and in particular the information in relation to the processing of personal data in accordance with article 6A, Articles 5 and 13 of Regulation (EU) 2016/679 of the European Parliament and of the Council of 27 April 2016 on the protection of natural persons with regard to the processing of personal data and on the free movement of such data, and repealing Directive 95/46/ EC (General Data Protection Regulation), regulation 13 of the Data Protection (Processing of Personal Data by Competent Authorities for the Purposes of the Prevention, Investigation, Detection or Prosecution of Criminal Offences or the Execution of Criminal Penalties) Regulations and Article 15 of Regulation

(EU) 2018/1725 of the European Parliament and of the Council of 23 October 2018 on the protection of natural persons with regard to the processing of personal data by the Union institutions, bodies, offices and agencies and on the free movement of such data, and repealing Regulation (EC) No. 45/2001 and Decision No. 1247/2002/EC, as applicable;

(e) the nature of the follow-up that shall be given to reports;

(f) the remedies and procedures for protection against retaliation and the availability of confidential advice for persons contemplating reporting;

(g) a statement clearly explaining the conditions under which persons disclosing to the competent authority are protected from incurring liability for a breach of confidentiality pursuant to article 4(1); and

(h) contact details of the information centre or of the single independent administrative authority as provided for in article 4(4) where applicable.

(7) The whistleblowing reports Units shall review their procedures for receiving disclosures, and their follow-up, regularly, and at least once every three (3) years. In reviewing such procedures, competent authorities shall take account of their experience as well as that of other whistleblowing reports Unit and adapt their procedures accordingly.

(8) The whistleblowing reports Units may close procedures regarding repetitive reports which do not contain any meaningful new information on improper practice compared to a past report in respect of which the relevant procedures were concluded, unless new legal or factual circumstances justify a different follow-up. In such a case, the whistleblowing reports Units shall notify the reporting person of their decision and the reasons thereof.

(9) In the event of high inflows of reports, whistleblowing reports Units may deal with reports of serious breaches or breaches of essential provisions falling within the scope of this Act as a matter of priority, without prejudice to the time frame as set out in paragraph (d) of sub-article (1).

(10) The whistleblowing reports unit shall be charged with receiving and processing any external disclosures relating to the activities of persons operating within the sector regulated by the relevant authority as set out in the First Schedule so as to determine whether the disclosures should be referred for further investigation and the conditions under which such referral should take place.