Whistleblowers

A whistleblower is protected by the provisions of Law 6(I)/2022 when all the following conditions are met:

1.Falls into the categories of persons referred to in articles 5 and 32 of Law 6(I)/2022 and has collected the information through the work environment:

For example,

1.1 Whistleblowers can be:

• employed in the private, public or broader public sector,
• self-employed,
• company shareholders,
• persons belonging to the administrative/management/supervisory body or body of a company,
• volunteers,
• interns/trainees, whether they are paid or not,
• persons working under the supervision or instructions of contractors, subcontractors and suppliers,
• persons who obtained the information in the work context but no longer work or provide their services to the specific employer,
• persons who obtained the information during the stage of the recruitment process or any other stage before the conclusion of the employment contract or the start of the employment relationship.

1.2 Persons who, while they have not personally made a report or made a public disclosure, are nevertheless connected to the whistleblowers and fall into one of the following categories:

• mediator, i.e. a person who has supported the whistleblower during the reporting process and has kept this assistance confidential,
• persons related to the whistleblower, such as colleagues, relatives by blood or by blood up to the fourth degree (i.e. parents, siblings, uncles and first cousins),
• legal entities that the whistleblower owns or is associated with.

2. The information concerns violations of national or European legislation referred to in articles 4 and 31 of Law 6(I)/2022, respectively.

3. Had valid reasons to believe that the information regarding violations he reported was true at the time of the report and that this information falls within the scope of Law 6(I)/2022.

4. The report was made internally through the internal reporting channels or externally to the National Betting Authority or the whistleblower made a public disclosure under the conditions set by Law 6(I)/2022.

5. The information must not have been given in violation of the rules for the protection of classified information, legal or medical confidentiality, the confidentiality of judicial meetings and the rules of criminal procedure, or access to it and its disclosure do not constitute a criminal offense.

It is clarified that Law 6(I)/2022 also applies in case of anonymous reporting of violations, provided that after the anonymous reporting the whistleblower is identified. In this case, the whistleblower has a right to protection in the event of retaliation.

The Cyprus Public Audit Oversight Board («CyPAOB») has established the following reporting channels for receiving and following up on ‘external reports’ of violation, which can be submitted either in writing or verbally and/or both:

1) by completing the relevant violation report form (anonymous or by name),

2) by phone, at 22284801: Conversations during the use of the phone line are recorded only with the consent of the whistleblower. Otherwise, full and accurate minutes of the conversation are kept. In cases where the whistleblower has disclosed his identity, the whistleblower is given the opportunity to verify, correct and agree to the minutes of the conversation by signing them.

3) via email to whistleblowing@cypaob.gov.cy

4) by post, to the address:

[marked «CONFIDENTIAL»]

The Cyprus Public Audit Oversight Board («CyPAOB»),

Attn: Responsible Officer

56 Makarios Avenue & 1-3 Dimofontos Street, Lamda Tower, 2nd Floor | 1075

Nicosia, Cyprus

5) to be formulated in a personal meeting, following a telephone call by the whistleblower on the telephone line 22284801. In such a case, the same procedures apply, in relation to the recording of the conversation and/or the keeping of minutes, as described above.

It is noted that disputes or complaints in relation to a Class A or B licensed bookmakers or an authorized agent do not fall under the concept of violations referred to in Law 6(I)/2022. In relation to such cases, you can submit your complaint by email to info@cypaob.gov.cy or by letter to the Authority’s offices.

The reports should include the following:

• the details of the person reporting the violation (name, contact phone number, e-mail address, employer), with the exception of the case of an anonymous report,
• the information in the possession of the whistleblower,
• type and description of the violation,
• when and where the offense occurred,
• when and how it came to the attention of the whistleblower,
• evidence in the whistleblower’s possession (if applicable),
• if there are other persons involved,
• if there are other witnesses who are aware of the violation,
• if the whistleblower has reported the violation to another competent Authority,
• any other information that is useful to mention.

Upon receipt of the report, and within (7) seven days, an acknowledgment of receipt is communicated to the whistleblower, unless something different is expressly requested by the whistleblower or if the CyPAOB reasonably believes that the acknowledgment of the report may jeopardize the protection of the identity of the person. The confirmation is given either in writing to the whistleblower’s postal or email address, if such has been provided, or orally by telephone. With said acknowledgment of receipt, the whistleblower is also informed of the time period within which he will receive information regarding the results of the investigation of the report, which does not exceed three (3) months from the date of receiving the acknowledgment or six (6) months in duly justified cases.

Subsequently, designated officer of the CyPAOB monitor the report, assessing the accuracy of its allegations and the likelihood of taking action to address the reported violation. Specifically, if they assess the accuracy of the allegations by conducting an investigation, based on the powers granted to the CyPAOB by the relevant national or EU legislation, the officials examine whether the CyPAOB will proceed with further actions, such as referring the report to another competent authority for further action, or the termination of the procedure due to lack of sufficient evidence. During the follow-up of the report, the officer may require the whistleblower, either in writing to the whistleblower’s postal or email address, if such has been provided, or orally by telephone, to clarify the information disclosed or to provide additional information that is available to the informant. The notification of the whistleblower, which includes the results of the investigation of the report, is given in the same way as the acknowledgment of receipt, as described above.

In case the whistleblower has not provided any contact information, he can receive the above information orally by contacting the officers on the telephone line mentioned above. The information received, exchanged or transmitted when receiving reports of actual or potential violations of Union or national law, are handled in accordance with the requirements of confidentiality, as provided for in article 17 of N.6(I)/2022.

The CyPAOB transmits a violation report to a competent authority, within a reasonable period of time and in a secure manner, informing the whistleblower regarding the transmission, without delay, in the case where the whistleblower submits a report to a channel that is not competent to deal with the alleged violation.

The CyPAOB has designated a person who manages violation reports.

The CyPAOB complies with article 17 of Law 6(I)/2022, articles 5 and 13 of EU Regulation 2016/679, Law providing for the Protection of Natural Persons with regard to the Processing of Personal Data and for the Free Movement of such Data of 2018, article 15 of the Protection of Natural Persons with Regard to the Processing of Personal Data by the Competent Authorities for the Purpose of Prevention, Investigation, Detection or Prosecution of Criminal Offenses or the Enforcement of Criminal Penalties Law, and article 15 of EU Regulation 2018/1725.

Specifically, a record is kept for each report received. The personal data collected in the context of receiving reports is deleted within three (3) months from the date of completion of the procedure. In the event that judicial or disciplinary proceedings have been initiated against the person referred to or the whistleblower, the personal data shall be kept for the entire duration of said proceedings, including the case of an appeal or objection, and are deleted after one (1) year has passed from the proceedings.

A whistleblower who submits a report, in accordance with the provisions of Law 6(I)/2022, is automatically protected from a series of actions that could be characterized as vindictive behavior or retaliation, while, at the same time, he enjoys important protection measures.

1. Judicial measures to stop retaliatory conduct and claim damages

In the event that a whistleblower suffers any retaliatory behavior or harm, he/she has the right to apply to a competent court (Labor Disputes Court or District Court or Administrative Court, as the case may be), to remove any retaliation, and at the same time, to claim any damages. The whistleblower must prove that he filed a report or made a public disclosure and that as a result of his action he suffered some harm, e.g., he was fired, or demoted, or a disciplinary investigation was initiated against him, etc. Then, a rebuttable presumption is created that the harm is a result of retaliation because of the report he filed. That is, it is now up to the other person to prove that the measure that caused the damage did not constitute retaliatory action, but was based on duly justified reasons, unrelated to the fact of the filing of the report. If the Court decides that the whistleblower has indeed suffered any retaliation and/or harm due to retaliatory conduct, then it will award damages covering both the material damage and any moral or physical harm the whistleblower has suffered. At the same time, any retaliatory measure suffered by the whistleblower is considered void ab initio, i.e. as if it never happened. In fact, if a person was fired because of the filing of a report and wishes to return to work, then the Labor Disputes Court will even order his reinstatement.

2. Protection from any civil liability

In some cases, the whistleblower in order to support his report may need to share with the internal or external reporting mechanism, or during public disclosure, information, data, documents, for which some restriction applies, e.g. confidentiality reasons or personal data protection. If the employee has reasonable grounds to believe that the disclosure of this information was necessary to reveal the violation, then he will not be considered to have violated these restrictions and therefore will not be liable for any civil liability. However, this protection does not extend to cases where obtaining or accessing this information constitutes a separate criminal offence. Therefore, if the whistleblower by sharing the information commits a criminal offense then he can be prosecuted. In addition, the whistleblower who submitted a report in accordance with the provisions of N.6(I)/2022, is not liable in relation to civil proceedings, such as the action for defamation, infringement of intellectual property rights, breach of the obligation of confidentiality, violation of the rules for the protection of personal data, disclosure of trade secrets, or for claims for compensation under private, public or collective labor law. In fact, in the event that such a case is initiated against him, the whistleblower has the right to plead that he submitted a report or made a public disclosure, in accordance with the provisions of N.6(I)/2022 and request that the lawsuit be dismissed.

*Note: Whistleblowers are protected from liability for breach of confidentiality, provided that the information has not been provided in violation of the rules protecting classified information, legal or medical confidentiality, confidentiality of court hearings, and rules of criminal procedure, or access to these and their notification do not constitute a criminal offence, and provided that they do not involve violations of rules on issues or contracts related to defense or security issues, unless they are covered by the relevant acts of the European Union.

3. Witness in criminal proceedings

Depending on the nature of the content of the report and the seriousness of the case, criminal proceedings may be initiated against a person named in the complaint. In such a case, it is possible that the informant will need to testify as a witness before the Court to facilitate the establishment of the charge. N.6(I)/2022 provides that in such cases, the informant enjoys protection measures aimed primarily at preserving his anonymity, such as, for example, testifying in the absence of the accused, testifying through closed circuit television, his testimony was videotaped. In fact, depending on the case, this person can also be included in the Protection of Witnesses and Associates of Justice Plan.

4. Employer’s obligation to contribute

Every employer must protect employees from any act of their supervisor or any person responsible for them, which constitutes retaliation due to the report, and take all appropriate and timely measures to prevent them. Employers, as soon as they become aware of specific retaliation due to the report, take appropriate measures to remove and not repeat the retaliation, as well as to remove its consequences. In the event that employers do not take measures to prevent the above behaviors, then they may be considered accomplices, that is, they may be considered to have the same responsibility as if they themselves had carried out retaliation, threats or retaliatory actions against the whistleblower.

Further information on the procedures and remedies available for protection against retaliation and the rights of whistleblowers is available to the general public in the form of “Guidelines” and can be found at the link below on the Ministry of Justice and Public Order’s website (125 Athalassis Ave., 1461 Strovolos, Nicosia – Cyprus, Tel.: 22805950, Fax: 22518356, E-mail: registry@mjpo.gov.cy).

1. The Protection of Persons Reporting Violations of Union and National Law of 2022
2. Ministry of Justice and Public Order Guidelines