Reporting Channels

Law nº 93/2021, of December 20th

Establishes the general regime for the protection of whistleblowers of infringements (RGPDI), transposing Directive (EU) 2019/1937 of the European Parliament and of the Council, of October 23, 2019, on the protection of people who report violations of law of the Union. The Directive aims to strengthen the application of Union law and policies in specific areas by establishing common minimum standards for a high level of protection for persons reporting violations of Union law, falling within the scope of the Union acts set out in the Annex , which concern specific domains.


General Protection Regime for Whistleblowers of Particular Infractions of Law No. 93/2021, of December 20:


  • Violent crimes and organized crime are specifically mentioned as types of offense covered by the Portuguese national whistleblower protection law. This goes beyond the scope of the EU directive, which only includes violations of EU law.
  • The Portuguese legislator now recognizes the importance of anonymous reporting, legally obliging organizations to accept anonymous reports and protecting the whistleblower against retaliation, including when anonymity is waived.
  • The whistleblower may request, at any time, the results of the investigation within 15 days of completion. This is in addition to the guideline's minimum standard of providing information on the status of the investigation within three months of receipt.

Infraction

An act or omission contrary to the rules contained in Directive (EU) 2019/1937 of the European Parliament and of the Council, national standards that implement, transpose or comply with it or any other standards contained in legislative acts is considered an infringement. of execution or transposition, including those that provide for crimes or misdemeanors, relating to the fields of:

  • Public contracting;
  • Financial services, products and markets and prevention of money laundering and terrorist financing;
  • Product safety and compliance;
  • Transportation safety;
  • Protection of the environment;
  • Radiation protection and nuclear safety;
  • Food safety for human and animal consumption, animal health and animal welfare;
  • Public health;
  • Consumer protection;
  • Protection of privacy and personal data and security of network and information systems.

It is also considered an infraction:
  • An act or omission contrary to and detrimental to the financial interests of the European Union;
  • The act or omission contrary to the rules of the internal market, including competition and state aid rules, as well as corporate taxation rules;
  • Violent crime, especially violent and highly organized, as well as the crimes provided for in no. 1 of article 1 of Law no. 5/2002, of January 11, which establishes measures to combat organized and economic-financial crime. (Article 2 of the RGPDI).

Whistleblower


Any public servant or private sector employee who discloses information about these irregularities and who runs the risk of retaliation for that very reason.
It is important to ensure your protection against discrimination, retaliation and other disadvantages that you may suffer in response to the filing of the complaint, including the protection of those who assist you.
A natural person who denounces or publicly discloses an infraction based on information obtained within the scope of their professional activity is considered a whistleblower, regardless of the nature of that activity and the sector in which it is carried out.
The denunciation or public disclosure may be aimed at infractions that have been committed, are being committed or whose commission can be reasonably predicted, as well as attempts to conceal such infractions. (Articles 4 and 5 of RGPDI 50).
They can be whistleblowers, among others:

  • Private, social or public sector workers;
  • Service providers, contractors, subcontractors and suppliers, as well as any persons acting under their supervision and direction;
  • Holders of corporate interests and people belonging to administration or management bodies or tax or supervisory bodies of legal entities, including non-executive members;
  • Volunteers and interns, paid or unpaid. (Article 5 of the RGPDI)

The status of whistleblower also applies:
  • When information is reported about violations obtained in a professional relationship, such as those described above, which has since ended (for example, a former employee);
  • When the professional relationship has not begun, in cases where the complainant has obtained the information for the complaint in the pre-contractual phase.

Protection is also extended to those who, in some way, are related to the whistleblower, such as the person who assists them, third parties who are linked to the whistleblower (notably a co-worker or family member, who may be the target of retaliation) and people collective or similar entities that are owned or controlled by the complainant.

The whistleblower (even anonymous) who, in good faith, and having serious grounds for believing that the information is, at the time of the complaint or public disclosure, is true, reports or discloses an infraction under the terms established in the legal regime benefits from protection. .< br> Only people who report or disclose infractions based on information obtained within the scope of their professional activity are protected, with protection also being extended to those who, in some way, are related to the complainant.
They can benefit from the witness protection regime in criminal proceedings.
Directorate-General for Justice Policy publishes information on the Justice Portal, but no legal or psychological support is available (contrary to the recommendations of the directive). (Articles 6 and 22 of the RGPDI).


Prohibition of retaliation:


An act of retaliation is considered to be an act or omission that, occurring in a professional context and motivated by a complaint, causes or may cause the complainant, in an unjustified manner, material or non-material damage, with the possible consequences:
  • Very serious administrative offense (administrative proceeding initiated by MENAC)
  • Obligation of compensation (recourse to the courts demonstrating causal link between damage and the act of retaliation)

Various acts, such as changing conditions or suspension of the employment contract, negative evaluation, disciplinary sanction, non-renewal of contract, dismissal, blacklisting, termination of supply contract or provision of services, revocation of an act or termination of an administrative contract. (Articles 21 and 23 of the RGPDI).


Responsibility of the whistleblower:


The reporting or public disclosure of an infraction, made in accordance with the requirements imposed by law, does not, in itself, constitute grounds for disciplinary, civil, administrative or criminal liability of the complainant, even when the acquisition of the information raises questions of civil liability , administrative or labor (e.g. access to mail, files or images).
However, the whistleblower will already be responsible for obtaining or accessing the information that motivates the complaint or public disclosure in cases where obtaining or accessing the information constitutes a crime (e.g. invasion of other people's property, computer piracy). (Article 24 of the RGPDI).
The person who assists the whistleblower is jointly and severally liable with the whistleblower for damages caused by the complaint or public disclosure made in violation of the requirements imposed by law.
The targeted person does not see their procedural rights and guarantees jeopardized (the presumption of innocence and the guarantees of defense in criminal proceedings apply). (Articles 24 and 25 of the RGPDI).


Means of reporting


The means of reporting can be, and in order of precedence of the channels:
  • Internal: verbal or written about violations in a private or public sector entity;
  • External: verbal or written about violations to the authorities that the law designates as competent, or Public disclosure, when there is reason to believe that the infraction constitutes an imminent or manifest danger to the public interest, which cannot be effectively known or resolved by the competent authorities, or that there is a risk of retaliation, including in the case of an external complaint, or even, having presented an internal and external complaint, the appropriate measures have not been taken within the stipulated deadlines. (Article 7 of the RGP)


Procedures for receiving and monitoring complaints


Within 7 days of receiving the complaint, the entities notify the complainant of receipt of the complaint, and inform him, in a clear and accessible way, of the requirements, the competent authorities, the form and admissibility of the external complaint;
The necessary acts must be carried out to verify the allegations contained in the complaint presented (e.g. cessation of activity, investigation, communication to the competent authority);
Within a maximum period of 3 months from the date of receipt of the complaint, the entities communicate to the complainant the measures planned or adopted to proceed with the complaint and the respective reasons;
The results of the investigation must be reported within 15 days after the conclusion of the investigation when requested by the reporting party at any time. (Article 11 of the RGPDI).


External reporting channel


External complaints are presented to the authorities that, according to their duties and competencies, should or may know about the matter in question in the complaint, including:
  • The Public Ministry;
  • Criminal police bodies;
  • The Bank of Portugal;
  • Independent administrative authorities;
  • Public institutes;
  • General inspections and similar entities and other central services of direct State administration with administrative autonomy;
  • Local authorities; and
  • Public associations. (Article 12 of the RGPDI).


Personal data protection


It is essential to ensure compliance with data protection principles:
  • Principle of transparency – duty to inform
  • Principle of minimization – non-relevant data should be eliminated
  • Principle of purpose limitation – the use of data is limited to following up on the complaint
  • Principle of conservation – maintenance of the record for at least 5 years, without prejudice to judicial or administrative proceedings relating to the complaint Creation of the reporting channel in accordance with the privacy by design principle (e.g. when there is use of installation or development of specific software).
    Carry out a data protection impact assessment that must be properly documented. Changing the record of processing activities: new purpose. (Article 19 of the RGPDI).


Conservation of reports


Obliged entities and competent authorities responsible for receiving and handling reports under this law must maintain a record of reports received and retain them for at least a period of five years and, regardless of that period, during the pendency of judicial or administrative proceedings relating to the complaint. Article 20 of the RGPDI
The Reporting Channel allows the presentation of complaints, internal or external.
  • Internal complaints include verbal or written communications of information about infractions committed within Cosmopak.
  • External complaints are considered to be verbal or written communications of information about infractions reported to Cosmopak, as the competent authority, under the terms and for the purposes set out in article 12 of Law no. 93/2021, of 20 December.

The Reporting Channel is a secure means of communication and allows for the anonymity of reports.
It assumes an essentially preventive character and is based on a complaints management system designed to guarantee confidentiality throughout the entire process.
Thus, whistleblowers, as long as they comply with the conditions set out in the General Protection Regime for Whistleblowers of Infractions, approved by Law No. 93/2021, of December 20th, benefit from the protection legally conferred, namely the prohibition of acts of retaliation.< br> The identity of the complainant will only be disclosed as a result of legal obligation or court decision.

There are four means available to register your complaint:

1. Web Platform
- Select one of the following options, depending on the complaint you wish to present:
- Internal complaint
- External report

2. By Post
- Download the form available below to send by mail to the following address: Rua do Apeadeiro 1152 – 3885-275 Cortegaça OVR

3. Telephone
- Dial the telephone number: 256755609 /256755679

4. In person
- Schedule your in-person meeting by making the online request available below.

Online request Download form (Draft Communication of specific situation of non-compliance or potential fraud)


Procedure

  1. Sending the complaint;
  2. Preliminary assessment by the competent Organic Unit;
  3. Verification of the complaint;
  4. Notification to the complainant of the measures planned or already adopted to proceed with the complaint.



DOWNLOAD DOCUMENT


I, the undersigned,, , to perform functions in the Department , I hereby report, in accordance with the Code of Ethics and Conduct of Cosmopak - Indústria de Cosméticos e Embalagens, S.A., that I have identified the following situations of non-compliance and/or potential fraud:

Identification of non-compliance:


Identification of possible fraud situations.:


Cortegaça, 22/01/2025