Our Data Protection, Privacy & Security Briefing Special Edition provides an overview of recent developments in whistleblowing legislation including the issuance of the Joint Ministerial Decision specifying the procedure of submission, receipt, management and monitoring of reports in public and private bodies under Law 4990/2022
A. Introduction
B. Submission of the Whistleblowing Report
C. Receipt of the Whistleblowing Report
D. Management of the Whistleblowing Report
E. Monitoring of the Whistleblowing Report
A. Introduction
1. A Joint Ministerial Decision has been issued1 just a few days before the 17 December 2023 deadline for companies with 50 to 249 employees to establish an internal whistleblowing channel, including appointing an officer to receive and handle whistleblowing reports2.
2. The purpose of the Joint Ministerial Decision is to specify the procedure for submission, receipt and monitoring of the whistleblowing reports in both public and private sector bodies in accordance with the Whistleblowing Law.
B. Submission of the Whistleblowing Report
1. Internal whistleblowing reports may be submitted anonymously or non‐anonymously, in‐writing or orally or via an electronic platform hosted on the website of the company in the ways set out below.
2. Written Submissions can be made:
a. in person; or
b. by post at the registered offices of the company, in an envelope addressed ’To the attention of the RRMR’3 or ‘Report of Law 4990/2022’ or otherwise to show that the report is being made under the ambit of Whistleblowing Law; or
c. by e‐mail to the e‐mail address of the RRMR.
3. Oral Submissions can be made:
a. by a telephone conversation which may be recorded, upon reporting person’s consent;
b. by a voice messaging system if the company has one in place, which may be recorded, upon reporting person’s consent.
In both cases a. and b. above, the content of the report must be documented:
• either by recording the conversation in a format that can be stored and retrieved; or
• by minutes that accurately represent the report’s content verbatim, verified, corrected, agreed and signed by the reporting party.
The contents of unrecorded oral reports must be documented in the form of verbatim minutes, drawn up by the RRMR and verified, corrected, agreed and signed by the reporting party.
c. by means of a personal meeting between the reporting person and the RRMR, which shall take place within a reasonable time from the date of the reporting person’s request, submitted by e‐mail, orally or in writing to the RRMR.
In the case of c. above, verbatim minutes of the meeting shall be kept by the RRMR in a fixed and retrievable form and shall be documented:
• either by recording the conversation, if the reporting person has duly consented; or
• in writing, which shall be verified, corrected, agreed and signed by the reporting party.
4. Submissions via an Electronic Platform can be made online to a specially designed electronic platform. The submission form must be uploaded to a prominent position on the company’s website, with clear instructions for its submission. The electronic platform must be accessible to individuals with disabilities and available in both Greek and English. Throughout the process, the RRMR must assist the reporting individual in submitting their report by providing them upon request with all necessary information on their rights and the procedure for handling reports.
C. Receipt of the Whistleblowing Report
1. The RRMR accepts reports falling within the material scope of Whistleblowing Law4.
2. Acknowledgement of receipt of the report must be made within 7 business days from its receipt, regardless of the manner of submission (unless contact details are unavailable). This can take place by any appropriate means, so long as it is documented and in compliance with the provisions of the Whistleblowing Law on confidentiality and personal data protection.
3. If an oral report is submitted, the signed minutes stand as an acknowledgment of receipt of the report. If the reporting person refuses to sign the minutes, the RRMR will record this in the minutes.
4. The RRMR must ensure the confidentiality and protection of the personal data of reporting persons and any named third person by preventing access to unauthorized persons.
5. The report, regardless of the manner of its submission, must be recorded in a special file kept by the RRMR in written or digital form, in accordance with company’s regulations and in compliance with the provisions on confidentiality and personal data protection of the Whistleblowing Law.
6. In the event that the report is received by an unauthorized person, they must forward it without delay to the RRMR of the company, without altering its content or disclosing information which may lead to the identification of the reporting person or any third party named in the report.
D. Management of the Whistleblowing Report
1. Upon receipt of the report, the RRMR shall forward the pseudonymized whistleblowing report for investigation5 to:
a. the competent bodies of the company and record it in the special protocol book or the special file the RRMR keeps; or
b. the external competent authorities, an indicative list of which follows, taking record of it in the special protocol book or the special file the RRMR keeps:
• the Prosecutor of Economic Crime and, more generally, the Prosecuting Authorities,
• the National Transparency Authority, the Hellenic Competition Commission,
• the Bank of Greece,
• the Hellenic Data Protection Authority,
• the Single Public Procurement Authority,
• the Hellenic Atomic Energy Commission,
• the Hellenic Food Authority,
• the Hellenic Consumer’s Ombudsman,
• the National Cyber Security Authority,
• the Authority for Combating Money Laundering and Terrorist Financing and Control of Asset Declarations,
• the Independent Public Revenue Authority and the General Directorate of Financial Crime Investigation;
c. place the whistleblowing report in record by means of decision and if possible, notify the reporting persons when:
• the report is manifestly unreasonable, vague, incomprehensible, or repetitive in an abusive manner, such as in the case of a resubmission of the same content without the production of new information;
• the content of the report does not fall within the ambit of the material scope of the Whistleblowing Law6; if information regarding violations for which another body is included, the RRMR shall forward the report to them without an obligation to monitor the report;
• there are no serious indications of breaches falling within the material scope of the Whistleblowing Law7.
2. If new evidence is submitted for a report that is put in file, the RRMR shall withdraw the report and forward it to the competent bodies internally or externally as necessary.
3. If the RRMR finds indications of commission of a criminal offence prosecuted ex officio, they must immediately forward a copy of the report to the locally competent public prosecutor, informing the reporting person respectively (subject to the rules of confidentiality and personal data protection). If the breach does not fall within the material scope of the Whistleblowing Law, a copy of the report is forwarded to the locally competent public prosecutor without an obligation to monitor thereafter the report.
4. In case of a report in which allegations are made against the RRMR or the body designated for investigating the reports, the RRMR will record it only in the special protocol book or the special file the RRMR keeps and forward it to the National Transparency Authority as an external channel for reports, informing the reporting person respectively.
5. Reports, minutes and minutes of oral reports are stored for a reasonable and necessary period of time in order to be retrievable and to comply with the requirements under the Whistleblowing Law, Union or national law and in any case until the conclusion of any investigation or judicial proceedings initiated as a consequence of the report.
E. Monitoring of the Whistleblowing Report
1. The RRMR must keep contact with the reporting persons, and if necessary and feasible, request further information and/or data from them.
2. The RRMR must monitor the report by following up with the competent body of the company dealing with the report or the competent bodies to which the report was forwarded outside the company.
3. The competent internal or external body will inform the RRMR in a timely manner of the actions taken, so that the RRMR may inform the reporting person within a reasonable period of time:
a. not exceeding 3 months from the acknowledgement of receipt; or
b. if no acknowledgement has been sent to the reporting person, three months from the expiry of 7 working days from the submission of the report.
If no acknowledgement has been sent to the reporting person, the information referred to above shall be provided on the reporting person’s own initiative and with reference to the relevant protocol number or the content of the report.
1 As per the requirements under Law 4990/2022 “on the protection of persons reporting violations of the union law”, as in force, Official Gazette A’210/11.11.2022 (the Whistleblowing Law).
2 Joint Ministerial Decision 473/2023 “Specification of the procedure of submission, receipt and monitoring of the report in public and private sector bodies pursuant to article 10 of l.4990/2022 by virtue of article 24 par.4(a) of same law”, Official Gazette B’ 6944/11.12.2023.
3 Responsible for Receiving and Monitoring Reports officer (the RRMR).
4 Article 4.
5 Subject to the rules on confidentiality and personal data protection of Whistleblowing Law.
6 See Article 4.
7 Id.
Download our Data Protection, Privacy & Security Briefing Special Edition: Greek Whistleblowing Legislation.
