Brazil publishes its first regulation on whistleblower protection
On December 4, 2019, Decree No. 10,153 was published (the “Decree“), which regulates procedures to protect the identity of whistleblowers of illicit acts against the Brazilian Federal Public Administration. The Decree will enter into force in March 2020.
The Decree is a relevant step towards the consolidation of whistleblower protection in the Brazilian legal framework. The main points of the Decree are as follows:
What is the Decree about?
This is the first rule in Brazil to establish procedures that ensure the protection of the identity of whistleblowers of illicit activity or irregularities committed against federal government agencies and entities.
What will its scope of application be?
The Decree will be applicable to all public administration and/or government-related entities, as well as all state-owned companies (i.e. public and government-controlled companies). Whistleblowers may report illicit acts committed by public agents and private companies alike that perform activities with the Federal Government.
Will protection of the identity of whistleblowers be guaranteed?
The Decree establishes procedures that ensure the protection of whistleblowers from the time of submission of a complaint. Said complaints will be received exclusively by the ombudsman offices of the agencies or entities subject to the provisions of the Decree. The ombudsman offices, in turn, will implement necessary measures for the receipt, screening and forwarding of complaints, as well as the protection of the information received.
How will the identity of whistleblowers be safeguarded?
To safeguard the identity of whistleblowers, the Decree makes use of a mechanism covered by the Brazilian General Data Protection Law (LGPD) called pseudonymization, a process whereby the personal information of whistleblowers is subjected to an additional layer of protection, which makes it impossible to directly or indirectly identify and/or associate said information with an individual, through the use of techniques such as data encryption, masking and hashing. Thus, by using such procedures, the Decree ensures that the confidentiality of name, address and any other personal data that would enable the identification of the whistleblower has been safeguarded.
With the issuance of the Decree, the identification of whistleblowers will be an exception and possible only if indispensable for the review of the facts reported in the complaint, always with the prior authorization of the whistleblower him/herself.
What is the expected effect of the Decree?
It is expected that complaints relating to corruption committed by public agents or private companies that perform activities with the Federal Government will intensify following the entry into force of the Decree in March 2020.