New Cyprus whistleblowing legislation regulates the disclosure or reporting of breaches of EU and Cyprus law in the public and private sectors. The new legislation, the Protection of Persons Reporting Breaches of Union and National Law of 2022 (the Whistleblowing Law), applies to the reporting of breaches of EU or Cyprus law by individuals working in the private or public sector who acquired information on breaches of EU or Cyprus law in a work-related context.
The Whistleblowing Law transposes Directive (EU) 2019/1937 on the Protection of Persons who Report Breaches of Union Law (the Directive) into national law. In transposing the Directive, the Whistleblowing Law applies to breaches of EU law.
Breaches of Cyprus law that may be reportable under the Whistleblowing Law include:
- acts or omissions related to the commission or potential commission of a criminal offence, in particular, corruption offences
- acts or omissions related to non-compliance with any legal obligation imposed on a person
- infringements which endanger or are likely to endanger the safety or health of any person; and
- infringements that cause or are likely to cause damage to the environment.
The ambit of the Whistleblowing Law covers civil servants, self-employed persons, shareholders and persons belonging to the administrative, management or supervisory body of an undertaking (including non-executive members), volunteers, paid or unpaid trainees and persons working under the supervision and direction of contractors, subcontractors and suppliers.
The Whistleblowing Law also applies to persons reporting or disclosing information on breaches which was acquired in the context of a work-based relationship that has since ended or has yet to begin in cases where information on breaches has been acquired during the recruitment process or other pre-contractual negotiations.
Measures of protection of whistleblowers provided under the Whistleblowing Law also apply to facilitators, third persons who are connected with the reporting persons and who could suffer retaliation in a work-related context (such as colleagues or relatives) and legal entities that the reporting person owns, works for or is otherwise connected within a work-related context.
The Whistleblowing Law encourages the voluntary introduction of internal reporting channels in the private sector which are not required to establish channels for internal reporting, where this is not required under the Directive or the Whistleblowing Law.
Any public disclosure, namely, making information on breaches available in the public domain, can also qualify for protection under the Whistleblowing Law where certain conditions are met. The reporting person will not be able to qualify for protection where they directly disclose information to the press.
Confidentiality requirements apply for the processing of personal data and the maintenance of records. The Whistleblowing Law expressly provides that any personal data collected in the course of receiving an internal or external report must be deleted within 3 months from completion of the procedure concerned. Where legal or disciplinary proceedings are initiated against the reporting person or the person concerned, such personal data shall be retained for the duration of those proceedings, including in the event of an appeal or objection, and must be deleted after 1 year from their completion.
The Whistleblowing Law generally protects against retaliation, namely, any direct or indirect act or omission which occurs in a work-related context, prompted by internal or external reporting or by public disclosure, and which causes or may cause unjustified detriment to the reporting person. Witnesses involved in proceedings related to a report will be subject to protection afforded under the applicable witness protection legislation.
Employers are obliged to protect employees from acts of their superiors or any other employee which constitutes retaliation for reporting. A reporting person’s dismissal from employment or any detrimental change to their working conditions or any retaliation measure will be deemed invalid unless the employer proves that such dismissal was based on other grounds.
Persons who hinder whistleblowing, retaliate against reporting persons, bring vexatious proceedings against reporting persons, breach confidentiality on a whistleblower’s identity or who knowingly report or disclose false information, could incur criminal liability. On conviction, such persons may face imprisonment up to 3 years and/or a fine of up to €30.000. The Whistleblowing Law also imposes criminal liability on legal entities for these offences committed by any person acting on behalf of such entity Legal entities may also be prosecuted where lack of supervision or control on behalf of the legal entity makes the commission of any offence possible on behalf of the legal entity by a person hierarchically in a position below such entity.
The Whistleblowing Law provides for mitigating the sentence of offenders convicted by half, where, as a result of such offenders’ cooperation with the authorities, criminal proceedings were initiated against a public official for corruption or bribery.
Private sector companies with 50 to 249 employees are required to establish their internal reporting channels and procedures by 17 December 2023.
Contact us to discuss your precise requirements.