Ana Paula Barcellos (email@example.com) is aFull Constitutional Law Professor at Rio de Janeiro State University in Brazil; a Brazilian Lawyer and Consultant Partner at BFBM Advogados Associados; and a foreign legal consultant in New York and Massachusetts, USA.
Countries without a whistleblower protection legislative framework are a weak link in the chain of efforts against global corruption. Until 2019, Brazil was such a country. Although Brazil had provisions on leniency agreements offering benefits to people willing to cooperate who were directly involved in corrupt practices—widely used in the Operation Car Wash, for instance—there was no whistleblower protection law. This legal scenario recently changed. Article 15 of Federal Law 13.964, 12.24.2019 (Anticrime Law), now provides a set of protections and incentives to whistleblowers reporting criminal activity and administrative misconduct.
The new Brazilian Anticrime Law applies to whistleblowers reporting general public corruption and any fraud related to government procurement and contracts, government-owned companies, and government-funded programs. But it also applies, more broadly, to criminal activities and administrative misconduct harming what the law identifies as “public interest.”
Brazil is a highly regulated country with a vast state bureaucracy in charge of most of what one can consider to be within the public interest; therefore, the two concepts—public corruption and illegal activities harmful to the public interest—will probably overlap in most cases. However, detrimental to the public interest is a broader concept than corrupt practices, which may expand the scope of the new law’s application.
What protections are offered to whistleblowers under the new law?
The new legislation offers a monetary reward to whistleblowers: 5% of what the government recovers. It also provides four different protections to whistleblowers:
Protection against retaliation,
Immunity from civil and criminal liability, and
The set of protections arranged by the Brazilian Victim and Witness Protection Act (Federal Law 9.807/1999).
But how exactly does the new law frame each of these protections?
The first protection offered by the new Brazilian law to a whistleblower is labeling their identity as confidential information and requiring authorities to treat it accordingly. The new law does not provide for anonymity, and it allows disclosure of the whistleblower’s identity if it is relevant to the public interest or the investigation. Which standards, though, should guide this assessment? The law offers no answer to that. The regulation will need to fill in the blanks.
There is an additional complication to this topic: The law mentions that the whistleblower should agree to the disclosure of their identity. It is not clear at this point what this clause means precisely and who will have the final say on the matter in case the whistleblower and the authorities in charge of investigation evaluate the issue differently.
Protection against retaliation
The new law protects whistleblowers against retaliation, offering several examples of what it looks like: unfair dismissal, demotion, discontinuation of benefits, denial of reference letters, unfair changes in job responsibilities or activities, etc. According to the law, if retaliation takes place, the whistleblower is entitled to double repayment for damages and also punitive damages. These consequences, however, will most often strike those responsible for the retaliatory conduct only after a court order in a lengthy judicial proceeding.
The new law also stipulates that retaliation against a whistleblower may lead to the punitive dismissal of civil servants, which may strengthen the deterrence effect of its provisions. Retaliation against public administration employees or contractors is undoubtedly a frequent scenario worthy of providing for by the law.
It is, however, easy to imagine retaliation taking place outside the government workplace, in a completely private environment. Law 13.964/2019 does not lay down specific sanctions—aside from monetary ones—for private players involved in retaliation. However, other pieces of Brazilian legislation may come in handy at this point. There is already legislation in the country requiring companies willing to do business with the government to commit to internal ethical and compliance practices and policies, and these may also eventually lead to whistleblower protections.
Immunity from civil and criminal liability
The Brazilian law offers whistleblowers immunity from civil and criminal liability for disclosing information. The protection will not apply if the whistleblower knowingly reports false facts and information. The standard used by the Brazilian law seems more protective than the formula used in some other jurisdictions that require whistleblowers to “reasonably believe” the information is true. The Brazilian law requires proof that the person knew the information or facts were not true. In any case, regulation will need to establish which standards must apply to the “knowingly” exception to the immunity.
Further, the law provides broad immunity from civil liability, and it does not design any specific framework to deal with provisions imposed by other legislation such as the duty of confidentiality of professionals (lawyers, health professionals), data protection, etc. Also, it does not have an explicit provision prohibiting employers from imposing nondisclosure or confidentiality clauses on their employees as a means to restrict their ability to report misconduct. In this case, however, it is worth mentioning that Brazilian labor courts already apply strict scrutiny when examining the fairness and the extent of these sorts of clauses. It is reasonable to expect the same judicial understanding may prevent nondisclosure or confidentiality clauses from being used against a whistleblower by employers.
The law also provides immunity from criminal liability. Whistleblowers may eventually be sued for defamation or violation of some secrecy provisions. In Brazil, private players have very limited standing to bring criminal charges, but federal and state public prosecutors are individually independent and may bring criminal charges according to their conviction about the facts. It is not impossible, nor even improbable, that some prosecutors may be investigating a corruption case with the help of a whistleblower, and, at the same time, others may view the whistleblower reporting activity as illegal. The individual independence of public prosecutors has proven to have many pros over time but also has its cons. The immunity against criminal charges provided by the law, therefore, is a critical issue in Brazil.
The Victim and Witness Protection Act
Finally, the law applies the Victim and Witness Protection Act (Federal Law 9.807/1999). According to the Victim and Witness Protection Act provisions, depending on the circumstances, whistleblowers may be granted, among others, police escort and other security measures; temporary or permanent relocation; as well as financial, medical, and psychological support. The federal and state governments already have their Victim and Witness Protection programs in place. The regulation will need to deal with this new group of potential users, and budget concerns are already being raised.
How should compliance professionals prepare?
The new legislation will increase the risk of government enforcement actions. Therefore, the priority for compliance professionals should be reviewing Brazilian regulations (as they can change frequently); Brazilian operations, including third-party relationships; and the company’s existing internal controls—in paper and in practice—to update its risk assessment.
The new whistleblower legislation also acknowledges the need to build trust in the effectiveness of the company’s internal reporting systems to encourage early internal reporting.
Finally, another focus for compliance professionals should be preventing breaches of the Brazilian Data Protection Law in the context of government enforcement actions. If the same person has access to sensitive data from several clients, this may increase the company’s risk, so mapping who has access to sensitive data inside the company’s organization can be a good starting point.
The new Brazilian law’s implementation and enforcement will not be immediate. It will require extensive regulatory activity from the federal government, states, and cities and then considerable administrative effort to put in place the necessary structures, policies, and procedures to make the legal provisions happen. Regulations may vary across the country, as is natural in a federal state, and state-owned companies are also required to adapt to enforce the new law within their activities. There is no specific deadline in the bill for the promulgation of the new regulation, so this is an important topic to be watching in the following months.
Brazil has finally enacted a Whistleblower Protection Law (Federal Law 13.964/2019, article 15), bridging the gap in the country’s anti-corruption legal framework.
The law protects whistleblowers reporting criminal activities and administrative misconduct connected to public corruption and, more broadly, those detrimental to the public interest.
Besides a set of different protections to whistleblowers, the Brazilian law also offers 5% of what the government recovers as a monetary reward.
Implementation and enforcement of the law depend now on extensive regulatory activity and administrative effort if it is to happen within the next few months.
Compliance professionals should review Brazilian risk assessments and be aware of the increased risk of Data Protection Law violations in the country.