Romania

General context, key principles and hot topics

1Identify the highest-profile corporate investigation under way in your country, describing and commenting on its most noteworthy aspects.

The most recent high-profile corporate investigation relates to corruption in the information technology (IT) sector. The National Anticorruption Directorate (DNA) alleges that the general manager of the local branch of a leading global IT company received a €870,000 bribe from the representatives of partner IT companies in exchange for better offers for company products (mainly IT licences). According to the DNA, the partner companies used these special offers to win in public tenders.

In another high-profile matter, four directors of a leading Austrian company operating in the wood processing industry are currently being investigated by the Directorate for Investigating Organised Crime and Terrorism (DIICOT) in connection with alleged organised crime, bid rigging, tax evasion and illegal logging that caused €25 million in damage.

The healthcare sector is still making headlines, as one of the largest network of private clinics in Romania is being investigated for allegedly claiming amounts from the National House of Health Insurance for medical services already paid for by the patients.

Prosecutors have also targeted the insurance sector. One of the largest current investigations involves a leading Austrian insurance group, its executive board and 87 individuals in connection with alleged tax evasion (amounting to €6 million) relating to surrendering life insurance policies open on employees’ names and paying the insurance premiums directly into the employees’ accounts each month.

2Outline the legal framework for corporate liability in your country.

Article 135 of the Romanian Criminal Code provides the conditions for criminal liability of legal entities. It very broadly states that corporations (other than state and public authorities) can be held criminally liable for crimes committed in furtherance of the company’s scope of business, for its benefit or in its name – irrespective of the acting capacity of the individuals committing the offence. The scope of individuals who may trigger criminal liability of a company is therefore very broad – it includes: legal representatives (e.g., a director or manager), employees, agents and even third parties who commit a criminal offence for the benefit or in the name of the company.

In practice, to trigger a company’s criminal liability, prosecutors focus on proving that the company either benefited from the criminal activity of the individual perpetrating the offence or that the conduct was performed by the individual within the scope of his or her services for the company (by way of an employment contract, services contract or otherwise).

3Which law enforcement authorities regulate corporations? How is jurisdiction between the authorities allocated? Do the authorities have policies or protocols relating to the prosecution of corporations?

Public prosecution offices are responsible for investigating and prosecuting crimes in Romania – there is not a specialised team focused on corporate crimes. A prosecutor is competent to investigate and prosecute a criminal offence within the jurisdiction of the court to which it is attached.

Romania also has specialist enforcement institutions, such as DIICOT and the DNA, which have exclusive jurisdiction over certain types of crimes.

4What grounds must the authorities have to initiate an investigation? Is a certain threshold of suspicion necessary to trigger an investigation?

Law enforcement authorities can initiate investigations based on any of the following: a complaint by a prejudiced party; self-reporting by a person with knowledge about an offence; a report by a person with a management or other control function of a public institution; the prosecution office’s initiative, on the basis of data available to it; or the commission of an offence being observed.

Although there is no specific threshold of suspicion required to trigger an investigation into the facts of a matter, in practice, prosecutors will launch an investigation if they can identify direct or indirect evidence that gives rise to a suspicion that a crime has been committed.

5How can the lawfulness or scope of a notice or subpoena from an authority be challenged in your country?

A company can challenge a subpoena or orders for production of documents before the relevant chief prosecutor or court. Prosecutors are generally given wide discretion to conduct investigations and, in practice, subpoenas are upheld. However, a warrant to search premises and seize assets cannot be challenged effectively before it is implemented.

6Does your country make use of co-operative agreements giving immunity or leniency to individuals who assist or co-operate with authorities?

No. Individuals who report on others and help the authorities to trigger their criminal liability receive a statutorily provided reduction (by half) of the punishment limits for the charged crime.

In addition, there is a limited number of crimes for which the perpetrator (1) is granted immunity if he or she reports the crime before the law enforcement authorities are notified (e.g., giving a bribe or buying influence) or (2) benefits from leniency (e.g., setting up a criminal organised group, if the perpetrator helps to identify other members of the group).

7What are the top priorities for your country’s law enforcement authorities?

In recent years, Romanian law enforcement authorities have prioritised the targeting of high-level corruption cases, EU funds fraud, tax fraud and money laundering. A notable record of success was achieved in conducting investigations into allegations of corruption at the highest levels of the government, the judiciary and across the IT, energy, infrastructure, real estate and healthcare sectors.

Cyber-related issues

8Does your country regulate cybersecurity? Describe the approach of local law enforcement authorities to cybersecurity-related failings.

Romania has implemented Directive (EU) 2016/1148 concerning measures for a high common level of security of network and information systems (the NIS Directive) through Law No. 362/2018.

The law requires operators of essential services and providers of digital services to have adequate security measures and to report serious incidents to the competent national authority, CERT-RO. Failure to comply may result in a fine ranging from 3,000 Romanian lei to 5 per cent of the turnover for the previous year. Given the recent enactment of the law, the approach by law enforcement authorities is not yet known.

9Does your country regulate cybercrime? What is the approach of law enforcement authorities in your country to cybercrime?

The Romanian Criminal Code has a dedicated chapter on cybercrime, which covers crimes such as illegal access to a computer system and illegal interception of computer data transmission. Computer-related fraud and forgery are also provided in different chapters.

DIICOT handles most cybercrime allegations. In 2018, DIICOT successfully indicted several individuals for cybercrimes related to ransomware attacks and man-in-the-browser/man-in-the middle threats.

Some of these indictments relied on co-operation with similar agencies in other countries, as Romania is part of the Council of Europe’s Convention on Cybercrime, the only binding international instrument on this issue.

Cross-border issues and foreign authorities

10Does local criminal law have general extraterritorial effect? To the extent that extraterritorial effect is limited to specific offences, give details.

In general, Romanian criminal law applies to offences committed on Romanian territory. However, in certain situations (e.g., when the punishment limits for the alleged crime exceed 10 years’ imprisonment), the Romanian Criminal Code will apply to a Romanian citizen or Romanian legal entity that commits a crime abroad (unless an applicable international treaty states otherwise).

11Describe the principal challenges that arise in your country in cross-border investigations, and explain whether and how such challenges depend on the other countries involved.

The principal challenges that arise in cross-border investigations are difficulties in coordinating the investigation efforts across cultures and in communicating effectively in different languages; differences in laws regarding attorney–client privilege, employee rights and data protection laws across various countries; and differences in attitudes and approaches of law enforcement authorities.

12Does double jeopardy, or a similar concept, apply to prevent a corporation from facing criminal exposure in your country after it resolves charges on the same core set of facts in another? Is there anything analogous in your jurisdiction to the ‘anti-piling on’ policy as exists in the United States (the Policy on Coordination of Corporate Resolution Penalties) to prevent multiple authorities seeking to penalise companies for the same conduct?

The principle of double jeopardy applies in Romania and a corporation cannot be tried for the same or a similar crime based on the same conduct and facts, regardless of whether the initial trial occurred in Romania. However, the Romanian Criminal Procedure Code provides that cases can be revised when new evidence later comes to light that proves the previous outcome of the case was not substantiated.

Romania does not have a law similar to the US ‘anti-piling on’ policy, but some of the guiding principles – offsetting of fines and requiring co-operation as a prerequisite – are used in practice.

13Are ‘global’ settlements common in your country? What are the practical considerations?

Global settlements do not occur in Romania; however, at sentencing, the national authorities may take into account any sanctions imposed on companies by their foreign counterparts.

14What bearing do the decisions of foreign authorities have on an investigation of the same matter in your country?

The influence that foreign decisions have on Romanian investigations is determined largely by applicable bilateral treaties and legislation on the provision and receiving of judicial assistance between Romania and the country in question.

Romanian authorities exercise their freedom to investigate matters within their jurisdiction and have discretion in how they view foreign decisions; they also endeavour to co-operate with foreign authorities.

Economic sanctions enforcement

15Describe your country’s sanctions programme and any recent sanctions imposed by your jurisdiction.

As a Member State of the European Union, Romania enforces the sanctions imposed through Common Positions adopted within the Common Foreign and Security Policy. The sanctions include asset freezing, prohibition on making funds available, prohibition on certain financial actions, restrictions on services, restrictions on goods, and prohibition on arms procurement.

Recently, the European Union extended the economic sanctions targeting specific sectors of the Russian economy until 31 January 2020. Separate sanctions banning the European Union from doing businesses in Crimea have also been renewed for another year.

16What is your country’s approach to sanctions enforcement? Has there been an increase in sanctions enforcement activity in recent years, for example?

Romania’s tax authority, the National Agency for Fiscal Administration (ANAF), is responsible for issuing blocking orders and effectively blocking funds belonging to or under the control of persons subject to international sanctions. In recent years, the number of international sanctions enforced by ANAF has been very low.

17Do the authorities responsible for sanctions compliance and enforcement in your country co-operate with their counterparts in other countries for the purposes of enforcement?

Romania authorities co-operate with their counterparts in other countries (especially other EU Member States) by exchanging data and information relevant for the purposes of enforcement.

18Has your country enacted any blocking legislation in relation to the sanctions measures of third countries? Describe how such legislation operates.

The EU Blocking Regulation is directly applicable in Romania and prohibits EU operators from complying with US extraterritorial sanctions and assures them that such sanctions will not be enforced in EU courts. The regulation allows EU operators to request an authorisation to comply with the targeted US laws, if the operator can demonstrate that serious damage would be caused to it or the European Union unless the applicant is allowed to comply.

The Regulation itself does not provide any penalties for the breach of its requirements. However, Member States are obliged to determine the sanctions to be imposed in the event of a breach of any relevant provision of the regulation. According to Romanian law, failure to observe the restrictions and obligations provided by EU regulations results in a fine ranging from 10,000 to 30,000 Romanian lei and confiscation of assets.

19To the extent that your country has enacted any sanctions blocking legislation, how is compliance enforced by local authorities in practice?

Romanian incorporated companies face a difficult decision, considering that the US extra­territorial sanctions and the EU Blocking Regulation are now directly conflicted.

Obtaining authorisation to comply with the US extraterritorial sanctions can be difficult, and a company would need to prove that it has suffered ‘serious damage’, which is not defined by the EU Blocking Regulation and leads to the authorisations being granted in an arbitrary manner.

If the authorisation is not granted, the relevant authorities could be alerted about the applicant’s intention to do business in breach of the EU Blocking Regulation.

Before an internal investigation

20How do allegations of misconduct most often come to light in companies in your country?

Internal investigations are triggered by information from various sources, such as whistleblowers, employees, internal audits, lawsuits, business partners, media reports, as well as from the prosecutor or other government authority. Audits commenced by the Romanian tax authority could bring to light wrongdoing that could create the need to investigate. Corporations must treat any allegations of misconduct very seriously.

Romanian law obliges persons who carry out control duties within a corporation to report suspected wrongdoing to the enforcement authorities. Corporations will want to conduct investigations to make an informed decision prior to self-reporting the matter to the enforcement authorities.

Information gathering

21Does your country have a data protection regime?

The EU General Data Protection Regulation (GDPR) entered into force in all EU Member States on 25 May 2018. The GDPR has a broader scope than the former Romanian legislation and seeks to protect the personal data of all natural persons in the European Union, regardless of the geographical location of the data controller.

The GDPR is directly enforceable in Romania, without any national legislation being required. However, a law implementing the GDPR was adopted in late July 2018. This law maintains the main provisions of the GDPR but also sets forth special rules concerning the processing of genetic data, biometric data, data concerning individuals’ health, national identification numbers and data concerning work relations.

22To the extent not dealt with above at question 8, how is the data protection regime enforced?

The GDPR emphasises mandatory reporting obligations that require data controllers to self-report personal data breaches that may risk the rights and freedom of natural persons. In the event of a GDPR infringement, the Romanian Data Protection Authority (RDPA) can issue a reprimand or impose a fine. Under the GDPR, fines depend on the severity of the infringement; fines for minor infringements can be up to €10 million or 2 per cent of annual global turnover, while fines for significant infringements can be up to €20 million or 4 per cent of annual global turnover.

To date, the RDPA has imposed only four fines for infringement of GDPR provisions. The biggest of these (€130,000) was applied recently to a multinational bank for failure to apply appropriate technical and organisational measures to effectively implement data protection principles, such as minimising data and integrating processing safeguards.

23Are there any data protection issues that cause particular concern in internal investigations in your country?

There are circumstances that arise in which a company cannot process or transfer the personal data of an individual because it requires, but does not have, the consent of an individual. In most cases, lack of consent would not prevent disclosure of information to the law enforcement authority, given that the grounds for disclosure would be the need to comply with a legal obligation.

24Does your country regulate or otherwise restrict the interception of employees’ communications? What are its features and how is the regime enforced?

Under Romanian law, interception of employees’ communications is permitted if the following requirements are met:

• the employer’s legitimate interests are justified and prevail over the targeted persons’ interests or rights and liberties;
• the employees were informed accordingly;
• the employer consulted the labour union or the employees’ representatives prior to introducing the interception system;
• other less intruding methods did not prove effective; and
• the storage period of the data does not exceed 30 days if there is no legal provision that allows this storage or when there are no justifying cases.

Dawn raids and search warrants

25Are search warrants or dawn raids on companies a feature of law enforcement in your country? Describe any legal limitations on authorities executing search warrants or dawn raids, and what redress a company has if those limits are exceeded.

During a criminal investigation, a search warrant may only be issued by a special judge upon the prosecutor’s request; during trial, a search warrant may be issued by the court, ex officio or upon the prosecutor’s request. Search warrants must be executed within 15 days and can only be used once.

Dawn raids can be performed between 6am and 8pm, except for acts in flagrante delicto or when the dawn raid is being performed in a location that is open to the public outside these hours (e.g., bars and clubs).

The company being raided must be provided with the search warrant and informed that it has the right to be assisted by a lawyer. If the presence of a lawyer is requested, the dawn raid shall be delayed until the lawyer arrives on site, but not by more than two hours from the time the company has been informed of its right to be assisted.

Only objects, documents, correspondence and evidence relating to the offence being investigated can be seized; the correspondence between suspects or defendants and their legal counsel is subject to legal privilege and cannot be seized or searched by authorities.

If a search warrant or dawn raid violates legal requirements, any evidence seized may be deemed inadmissible in criminal proceedings and companies should seek to have it excluded. Court decisions based on unlawfully obtained evidence can be overturned. Assistance during a dawn raid by external legal counsel proves extremely useful in ensuring that the prosecutors do not seize documents or assets unrelated to the investigation or that breach privilege.

26How can privileged material be lawfully protected from seizure during a dawn raid or in response to a search warrant in your country?

In 2016, the Lawyers’ Law clarified the rules surrounding legal privilege and specified that, as far as external counsel is concerned:

• documents that include attorney–client communications or attorney notes regarding matters relating to the defence of a client cannot be viewed, taken, seized or confiscated by prosecutors; and
• attorney–client communications can only be obtained if they have been created in furtherance of an illegal or improper purpose or relate to the promotion of an illegal act such as money laundering, terrorism, drug trafficking or various other corruption crimes.

Invoking privilege is crucial in dawn raids. It is important that companies are trained in recognising documents that are subject to legal privilege and in effectively opposing attempts by the investigating authorities to access these materials. For this reason, having external counsel on the ground during a dawn raid is recommended.

27Under what circumstances may an individual’s testimony be compelled in your country? What consequences flow from such compelled testimony? Are there any privileges that would prevent an individual or company from providing testimony?

Witnesses may avoid an obligation to testify in certain situations, such as when they have a family relationship with the defendant or suspect, or when medical, legal or religious circumstances give rise to confidentiality. Otherwise, during Romanian criminal proceedings, a suspect or a witness can be compelled to testify with a bench warrant. If a witness’s or a defendant’s answer could give rise to self-incrimination, he or she has a right to silence. Witnesses can be criminally charged with perjury if they make false statements in their testimony.

Whistleblowing and employee rights

28Describe the whistleblowing framework in your country. What financial incentive schemes exist for whistleblowers? What legal protections are in place for whistleblowers?

Although whistleblowing in the private sector is not broadly regulated, whistleblowing in the public sector is. The law protects individuals who report a breach of law committed within a public authority or state-owned company. Reporting misconduct cannot trigger disciplinary misconduct against the employee, except when the reporting is purely vexatious or in bad faith. Financial incentive schemes for whistleblowers do not exist under Romanian law.

Under the public sector legislation, a whistleblower may report misconduct relating to a defined list of crimes, including corruption and assimilated offences, offences against the financial interests of the European Union, discriminatory treatment or practices, public procurement and non-reimbursable financing.

Whistleblowers in the public sector benefit from a presumption of good faith. Upon request from a whistleblower subject to a disciplinary investigation, the authority or entity must invite the press or broadcast media and a representative of the union to the disciplinary hearing. Any sanction imposed against a good-faith whistleblower in the public sector is likely to be overturned.

29What rights does local employment law confer on employees whose conduct is within the scope of an investigation? Is there any distinction between officers and directors of the company for these purposes?

During a disciplinary investigation, employees are entitled to:

• written notice of the allegations against them before the disciplinary hearing (the notice must provide sufficient information to enable the employees to prepare a proper defence);
• ‘reasonable time’ between the receipt of the notice and any hearing, to prepare a defence; and
• be informed of (and exercise) the right to defend themselves and to seek assistance, either from a lawyer, or from the trade union of which the employee is a member.

At disciplinary investigations, employees may raise all arguments and provide all evidence that they wish to bring in defence. If a disciplinary hearing is held without such prior information on the scope of the allegations being investigated, and a disciplinary sanction is applied, the sanction can be overturned in court.

30Do employees’ rights under local employment law differ if a person is deemed to have engaged in misconduct? Are there disciplinary or other steps that a company must take when an employee is implicated or suspected of misconduct, such as suspension or in relation to compensation?

When allegations of misconduct against an employee (including officers and directors, if retained under an employment agreement) are made, employers may start an investigation into the alleged misconduct.

Employers have discretion to investigate and sanction a particular case of misconduct (including where such misconduct may constitute a criminal offence).

A company cannot take any action (except for issuing a written warning) against an employee suspected of misconduct until it has conducted an internal investigation. In certain situations, employees suspected of criminal conduct may have their employment suspended, including remuneration, until a final decision is rendered in the criminal file.

31Can an employee be dismissed for refusing to participate in an internal investigation?

If the investigation establishes that the employee has violated a law or internal regulation, the company may impose on the employee any sanctions permitted by law or internal regulations, including dismissal, issuing a warning or demotion.

To the extent that an employee refuses to participate in an investigation relating to another employee, if the first employee has knowledge or holds evidence that is crucial to the investigation, that employee may be subject to disciplinary measures. It is unlikely, though, that an employee’s refusal to participate in the disciplinary investigation of another employee would represent sufficient grounds for dismissal.

Commencing an internal investigation

32Is it common practice in your country to prepare a document setting out terms of reference or investigatory scope before commencing an internal investigation? What issues would it cover?

The best practice for commencing an internal investigation is to prepare a plan establishing the scope, approach, responsibilities and steps relating to communication and disclosure, preservation of evidence, and securing witness testimony while information is still fresh in the minds of the various participants in or witnesses to the alleged misconduct. The preparation and execution of this plan are essential for a successful investigation in a manner that allows the company to argue an efficient and consistent corporate culture of compliance within the investigation, while limiting exposure and mitigating the potential risks of a formal investigation.

33If an issue comes to light prior to the authorities in your country becoming aware or engaged, what internal steps should a company take? Are there internal steps that a company is legally or ethically required to take?

In some situations, companies and individuals must report crimes, and potential crimes, to the police. For instance, any person holding a managerial position (or an oversight authority) within a public authority or entity that, in the exercise of his or her responsibilities, has acquired knowledge of the commission of a criminal offence that warrants a criminal investigation, must immediately refer the matter to the relevant criminal investigation body.

This obligation also applies to any person mandated by public authorities to perform (or oversee) a public-interest service who has, in exercising his or her responsibilities, acquired knowledge of the commission of a crime. In general, all individuals must immediately report knowledge of any offence against human life.

Additionally, persons with control functions prescribed by law must notify enforcement authorities if they become aware of information relating to potential corruption or corruption-assimilated offences. Failure to comply with these obligations is in itself a criminal offence and could result in prosecution.

Companies are not legally required to take internal steps, other than in circumstances that give rise to mandatory reporting. It is, however, both prudent and ethical to undertake steps to ensure that the offending behaviour ceases, any evidence relating to the offending behaviour is retained and protected, and future misconduct of that kind is prevented. This helps to build a culture of compliance, and may assist the company – in a future formal investigation – to argue that it has implemented and enforced appropriate mechanisms to curb illegal conduct within the company.

34What internal steps should a company in your country take if it receives a notice or subpoena from a law enforcement authority seeking the production or preservation of documents or data?

Upon receipt of a subpoena, the company should immediately alert its internal compliance and central management representatives and seek legal advice from external counsel. Measures to preserve all relevant documentation and data must be taken immediately. External counsel will assist the company to minimise risks and determine the most appropriate strategy for responding to the subpoena.

35At what point must a company in your country publicly disclose the existence of an internal investigation or contact from a law enforcement authority?

Romanian law does not oblige companies to disclose the existence of an internal investigation or any contact from law enforcement agencies. Depending on the type of investigation conducted, proactive behaviour may be recommended to prevent reputational backlash arising from a press release by the investigating authority (the DNA, for example, regularly publishes reports on investigations that have started, especially if they involve high-profile cases or persons).

36How are internal investigations viewed by local enforcement bodies in your country?

Enforcement bodies view internal investigations positively; however, due care must be taken in performing an internal investigation to ensure that it does not interfere with a prosecution investigation. Internal investigations are also a sign of a healthy corporate culture.

Sometimes, internal investigations may validate a company’s position that it was unaware of, did not condone, or did not permit the conduct in question. Further, some EU doctrine provides for the mitigation of corporate liability and sanctions if an internal investigation exposes the commission of a criminal offence and allows a corporation to improve and optimise its corporate compliance programme to prevent similar offences from occurring.

Attorney–client privilege

37Can attorney–client privilege be claimed over any aspects of internal investigations in your country? What steps should a company take in your country to protect the privilege or confidentiality of an internal investigation?

Documents, information and data of any type and format are protected by attorney–client privilege when they:

• are deemed by the client to be confidential and are provided to the lawyer for the purposes of the legal advice sought;
• were created or issued by the lawyer in relation to the legal advice sought by the client; or
• are communications or correspondence between a client and lawyer (or a lawyer and another lawyer also bound by confidentiality) relating to the legal advice sought by the client, or consist of notes or comments taken or prepared by the lawyer on the basis of information relating to a particular case.

To protect the privilege and confidentiality of an internal investigation, companies should retain an external lawyer to coordinate and execute the investigation, and ensure that retention is explicit in a written agreement and registered in the lawyer’s registry of contacts.

38Set out the key principles or elements of the attorney–client privilege in your country as it relates to corporations. Who is the holder of the privilege? Are there any differences when the client is an individual?

Legal privilege protects confidential communication between a lawyer and client, if the communications relate to the seeking and receiving of legal advice. For legal entities, the definition of a ‘client’ is limited to persons who legally represent the entity (based on the legal entity’s charter), or are empowered by the entity to seek and obtain advice on behalf of the legal entity.

If communication is shared with third parties or parties who are not considered ‘clients’, that communication may no longer be considered confidential and loses its privilege.

39Does the attorney–client privilege apply equally to in-house and external counsel in your country?

Under Romanian law, communications with in-house legal counsel who are not admitted to the bar are not protected by legal privilege. A 2010 European Court decision (CJEU Case C-550/07 P Akzo Nobel Chemicals Ltd and Akcros Chemicals Ltd v. European Commission) found that, at least in terms of competition law, communication with in-house counsel is not considered to be privileged. It was found that, although in-house counsel are enrolled in a bar or law society, and are subject to professional ethical obligations, they are not as independent from their employer as external counsel. Privilege in competition matters now only applies to communications with external counsel who have been retained by a client through a written and registered agreement.

Based on this decision, it is sensible for companies to assume that any in-house counsel communication may not be protected by legal privilege.

40Does the attorney–client privilege apply equally to advice sought from foreign lawyers in relation to (internal or external) investigations in your country?

Attorney–client privilege applies equally to advice sought from foreign lawyers as long as: the foreign attorney is properly qualified in his or her own country; an attorney–client relationship exists; and the other requirements for privilege are satisfied.

41To what extent is waiver of the attorney–client privilege regarded as a co-operative step in your country? Are there any contexts where privilege waiver is mandatory or required?

Waiving legal privilege is not a mitigating circumstance provided by law. It may fall under the wider mitigating factors relating to circumstances that reduce the gravity of the offence or the degree of risk posed by the offender, but applying this criterion is at the discretion of the court. Nonetheless, in determining the penalty applicable in a particular case, the court will consider the gravity of the offence and the degree of risk posed by the offender. Co-operating with the investigation, and being forthcoming with information (for example, by waiving legal privilege), could count towards a more lenient sentence.

42Does the concept of limited waiver of privilege exist as a concept in your jurisdiction? What is its scope?

The concept of a limited waiver of privilege is not regulated. However, that should not preclude one’s ability to waive privilege only with respect to certain aspects or documents.

43If privilege has been waived on a limited basis in another country, can privilege be maintained in your own country?

Maintaining confidentiality is regarded as an absolute obligation for lawyers in Romania. Therefore, even if privilege has been waived in another country, the lawyer must maintain the privilege in Romania, except when a client waives privilege specifically in relation to the lawyer or the information becomes public.

44Do common interest privileges exist as concepts in your country? What are the requirements and scope?

The concept of common interest privilege does not exist in Romania.

45Can privilege be claimed over the assistance given by third parties to lawyers?

Legal privilege can be claimed on any documents or information created, exchanged or disclosed during the professional services rendered by a lawyer, provided the client has retained the lawyer through a written agreement registered in the lawyer’s registry of contracts.

This privilege will extend to lawyers’ associates, employees, subcontractors, other lawyers who co-operate with the lawyer and any individual who is helping the lawyers in carrying out their jobs. However, lawyers must inform these persons of their obligation to respect the privilege. If other parties, such as accountants or experts, have been consulted but not retained by a lawyer, privilege will not apply.

Witness interviews

46Does your country permit the interviewing of witnesses as part of an internal investigation?

Companies may gather information by interviewing witnesses during internal investigations, but there is no legal obligation on a potential witness to testify in internal investigations. However, in practice, employees are bound to co-operate and testify in accordance with the internal code of conduct of the company, and this may be considered a facet of the broader obligation of loyalty to the employer that employees have under the law.

47Can a company claim attorney–client privilege over internal witness interviews or attorney reports?

If a lawyer conducts interviews to provide legal advice on a matter, the records or a report of the interviews may be privileged. However, as discussed in questions 42 and 43, this privilege may be waived in some circumstances. Best practice would see lawyers recording interview notes as their ‘impression’ of an interview, rather than as a verbatim transcription.

48When conducting a witness interview of an employee in your country, what legal or ethical requirements or guidance must be adhered to? Are there different requirements when interviewing third parties?

Romanian labour law does not specify how an interview of employees or third parties should be conducted. Employers should strive for fairness and transparency when conducting interviews, treat interviewees appropriately and avoid leading questions. Further, employees generally must assist in all aspects of an internal investigation, including interviews, if this obligation is included in the company’s code of conduct or under the more general obligation of loyalty to employers. Confidentiality and respect for private life should also be ensured, so that information obtained in relation to other individuals is not distributed except on a need-to-know basis and is subject to appropriate confidentiality safeguards.

49How is an internal interview typically conducted in your country? Are documents put to the witness? May or must employees in your country have their own legal representation at the interview?

There are no prescribed methods for conducting a witness interview. Companies either retain external counsel or conduct the interviews with their internal compliance teams. If external counsel is retained to conduct an interview, it is customary for the lawyer to inform employees that he or she does not represent them. Nevertheless, an employee has a right to legal representation during the interview. Also, it is customary in a witness interview to show documents to the employee if it is necessary to refresh the employee’s memory.

Reporting to the authorities

50Are there circumstances under which reporting misconduct to law enforcement authorities is mandatory in your country?

A variety of circumstances trigger mandatory reporting obligations. In practice, however, law enforcement authorities are primarily concerned with investigating crimes and the enforcement of reporting breaches are usually ancillary.

One of the more problematic mandatory reporting obligations comes from corruption legislation, which requires certain categories of individuals to report indications or knowledge of potential corruption, even when these may be the sole result of a purely vexatious or unsubstantiated claim. While the intent of the legislature was to maximise reporting of suspected corruption and ensure that the reporting obligation was triggered without the need to investigate the merits of the suspicion, the mandatory reporting obligation opens the door to potential investigations by law enforcement authorities in purely speculative or bad-faith cases.

51In what circumstances might you advise a company to self-report to law enforcement even if it has no legal obligation to do so? In what circumstances would that advice to self-report extend to countries beyond your country?

This issue is currently the subject of public debate in Romania. The advice given to companies varies depending on the matter and requires careful assessment of a company’s duties as well as the risks and benefits of self-reporting. One considerable benefit is that the relevant authorities in Romania may agree to non-criminal penalties or other benefits for self-reporting companies.

For certain criminal offences (such as giving a bribe and acquiring influence), a person (physical or legal) who reports his or her participation in a criminal offence will receive leniency under criminal law, if the self-reporting is carried out before law enforcement authorities become aware (by any other means) of the offence.

52What are the practical steps you need to take to self-report to law enforcement in your country?

Companies should thoroughly investigate the issue and the surrounding circumstances to be reported to ensure that they are fully aware of all the issues that may arise during a law enforcement investigation. Next, the company should assess the benefits and potential setbacks of self-reporting, including whether the self-reporting entails impunity, or acts only as a mitigating factor or counts towards a lesser penalty; the timing and content of self-reporting and its effects on the organisation’s ability to conduct its business; a potential reputational backlash; or the risk of opening up the organisation to additional scrutiny. This assessment needs to be conducted carefully, with an external legal consultant who specialises in crisis and reputation management. If the company decides that self-reporting is the most appropriate action, it should prepare a communication plan and ensure it is ready to co-operate with authorities and provide any requested support.

Responding to the authorities

53In practice, how does a company in your country respond to a notice or subpoena from a law enforcement authority? Is it possible to enter into dialogue with the authorities to address their concerns before or even after charges are brought? How?

Companies should seek external counsel’s advice regarding compliance with a document production request or a subpoena. External counsel should engage in dialogue with the law enforcement authority regarding the scope of the subpoena and communicate the intent of the company to fully co-operate. Dialogue with the authority is possible and advisable; authorities may view it as a demonstration of the willingness to co-operate and an act of good faith. If the company fails to comply with requests within an established deadline, the prosecutor may obtain a warrant to search the premises.

54Are ongoing authority investigations subject to challenge before the courts?

A company can file requests for quashing a prosecutor’s measures and orders. Such requests are reviewed and decided by the relevant chief prosecutor. In practice, challenges are filed before the relevant chief prosecutor; however, prosecutors are reluctant to uphold such challenges, unless there is a clear indication that the company’s legitimate interests are harmed.

55In the event that authorities in your country and one or more other countries issue separate notices or subpoenas regarding the same facts or allegations, how should the company approach this?

Companies should seek legal advice on legal requirements under both countries’ jurisdictions and their legal counsel should provide advice that details the appropriate strategy that the company should use to respond to the subpoenas, and advise whether it is most appropriate to respond to notices or subpoenas separately or together.

56If a notice or subpoena from the authorities in your country seeks production of material relating to a particular matter that crosses borders, must the company search for, and produce material, in other countries to satisfy the request? What are the difficulties in that regard?

If the material is in the company’s possession, the company should comply with the request for production. Companies will also be expected to comply with requests to produce material that is legally required to be held by the company, even if the company does not possess that material. If the material requested should be in the company’s possession under Romanian law but is in another country, the company should search in that country. If the material is not (and should not be) in the company’s possession, the company is not bound to make additional enquiries (although, if it is feasible, making additional enquiries may be a sign of active co-operation with the investigation).

57Does law enforcement in your country routinely share information or investigative materials with law enforcement in other countries? What framework is in place in your country for co-operation with foreign authorities?

Romanian law enforcement authorities frequently co-operate with foreign law enforcement.

The Criminal Procedure Code and Law No. 302/2004 regulate Romania’s co-operation procedures on extradition, European arrest warrants, the transfer of criminal proceedings and sentenced persons, and the execution of judgments. These laws and the 2000 EU Convention on Mutual Assistance in Criminal Matters between the Member States of the European Union regulate Romania’s obligations in providing and receiving mutual legal assistance, including the search, seizure and confiscation of assets.

Additionally, Romania has signed more than 25 bilateral treaties with other countries, including France, Italy and the United States, which enable it to provide and receive assistance in criminal matters.

58Do law enforcement authorities in your country have any confidentiality obligations in relation to information received during an investigation or onward disclosure and use of that information by third parties?

The law enforcement authority is itself under a duty of confidentiality with respect to material it has accessed as a result of a request for production or a search warrant. Criminal procedure rules specifically require a strict level of confidentiality with respect to all information discovered during such procedures. Moreover, (1) the unlawful disclosure of information that is not public by a person who had access to that information as part of his or her work-related duties and (2) the use of information that is not public or granting an unauthorised person access to such information, if perpetrated with the purpose of obtaining money or other undue benefits, constitute criminal offences sanctioned by imprisonment.

59How would you advise a company that has received a request from a law enforcement authority in your country seeking documents from another country, where production would violate the laws of that other country?

In these circumstances, companies should seek an exception and inform the relevant law enforcement authority that they cannot reasonably comply with the request without violating the laws of another country. Further, as the company receiving the request would not typically own the documents in another country, the company should direct the law enforcement authorities to the foreign entity holding the documents.

60Does your country have secrecy or blocking statutes? What related issues arise from compliance with a notice or subpoena?

Generally, a company’s data is not protected under Romanian data protection statutes and, as a result, the obligation to comply with a notice or subpoena is not blocked by data protection statutes unless it involves the personal data of employees or clients (and even in those cases, restrictions on consent to disclose would most likely be overridden by other legitimate grounds). The GDPR, implemented in May 2018, has the same effect.

61What are the risks in voluntary production versus compelled production of material to authorities in your country? Is this material discoverable by third parties? Is there any confidentiality attached to productions to law enforcement in your country?

Compliance with a request for production of material is mandatory under the law – to do other­wise would be to act in breach of the law. Unless there are legitimate grounds to argue that a request violates specific rights or legitimate interests of the company (in which case the company is able to file a complaint against the order), the request should be complied with.

Furthermore, if the request is not complied with, a warrant may be issued to search the company premises to obtain the requested material.

Prosecution and penalties

62What types of penalties may companies or their directors, officers or employees face for misconduct in your country?

The main criminal penalty applicable to legal entities is a fine, ranging from 3,000 to 3 million Romanian lei. The penalty can be increased by a third (up to a maximum of 3 million lei) if the company perpetrated the crime with the purpose of obtaining financial gain.

Other penalties include:

• dissolution;
• suspension of the legal entity’s activity for between three months and three years;
• prohibition of the legal entity’s participation in public procurement procedures for between one and three years;
• shutting down the legal entity’s offices for between three months and three years;
• placing the legal entity under judicial supervision; and
• publication of the sanctioning decision.

For individuals, the main penalties are imprisonment and fines.

Individual employees, directors and the companies they serve can be prosecuted together. Criminal liability of the company does not exclude criminal liability of the individuals perpetrating the offence.

63Where there is a risk of a corporate’s suspension, debarment or other restrictions on continuing business in your country, what options or restrictions apply to a corporate wanting to settle in another country?

As a general rule, a company’s decision to settle in another country should be driven by pure business reasons and should therefore not be subject to any restrictions other than those regarding the lawful termination of the local entity.

However, if a company under investigation in Romania tries to move its business to another country, the prosecutor may request a judge to take a preventive measure if there is reasonable suspicion that the company perpetrated a crime and its actions are impeding the criminal investigation. In such cases, the judge has discretion to order one or more of the following measures:

• interdiction to initiate or, as the case may be, the suspension of the company’s dissolution or liquidation procedure;
• interdiction to initiate or, as the case may be, the suspension of the company’s merger, division or share capital reduction, started prior or during the criminal investigation phase;
• interdiction to perform certain commercial transactions that would lead to the reduction of the company’s assets or that would cause the company to become insolvent;
• interdiction to conclude certain legal documents; or
• interdiction to perform activities such as those that led to the perpetration of the crime.

64What do the authorities in your country take into account when fixing penalties?

The gravity of the offence and the threat posed by the convicted individual or company determine the severity and type of penalty. The following criteria are used to assess the gravity and threat:

• the circumstances and manner of the commission of the offence, and the means that were used;
• the threat to the protected social interest;
• the nature and seriousness of the outcome produced by the offence or other consequences of the offence;
• the reason for committing the offence and the intended goal;
• the nature and frequency of offences in the indicted person’s criminal history;
• the indicted person’s conduct after committing the offence and during the trial; and
• the indicted person’s level of education, age, health, family and social situation.

Where the law provides for alternative penalties, the court may also use these criteria to assess which penalties are most appropriate.

When determining the value of a corporate fine, in addition to the above criteria, courts will consider a company’s financial status and any benefit derived by the company as a result of the crime. The value of corporate fines has increased and have culminated at the beginning of 2019 with the biggest fine ever applied to a company in Romania. The leading television and internet provider in Romania was convicted of money laundering and fined 1.25 million Romanian lei; in addition, €3.1 million and 655,124 lei was seized.

Resolution and settlements short of trial

65Are non-prosecution agreements or deferred prosecution agreements available in your jurisdiction for corporations?

Romanian legislation does not provide for non-prosecution agreements or deferred prosecution agreements for corporations or individuals.

66Does your jurisdiction provide for reporting restrictions or anonymity for corporates that have entered into non-prosecution agreements or deferred prosecution agreements until the conclusion of criminal proceedings in relation to connected individuals to ensure fairness in those proceedings?

Romanian legislation does not provide for non-prosecution agreements or deferred prosecution agreements for corporations or individuals.

67Prior to any settlement with a law enforcement authority in your country, what considerations should companies be aware of?

Companies must cautiously weigh the benefits and risks of proceeding under such a settlement. Some of the factors that should be considered are:

• the strength of the prosecution case and defence case, and the likely outcome;
• the sanction that is likely to be imposed in the event of a conviction;
• the object of the settlement and an assessment of whether the settlement is comprehensively defined;
• the effect the settlement may have on any aspect of the company’s future activities and operations;
• ensuring the settlement is consistent with the company’s internal regulations; and
• consideration of any benefits derived, such as the potential for a guilty plea to act as a mitigating factor in sentencing.

68To what extent do law enforcement authorities in your country use external corporate compliance monitors as an enforcement tool?

Romanian legislation does not provide for external corporate compliance monitors.

69Are parallel private actions allowed? May private plaintiffs gain access to the authorities’ files?

Parallel civil actions are allowed; however, in practice, they are often suspended until the conclusion of the criminal proceedings, because findings of fact in criminal courts may influence civil courts.

Parties to civil matters do not have access to authorities’ or criminal investigation files unless they also hold a capacity in the criminal file (i.e, injured civil party); that is because investigations must maintain confidentiality and are not made public.

Publicity and reputational issues

70Outline the law in your country surrounding publicity of criminal cases at the investigatory stage and once a case is before a court.

The procedure and information obtained during criminal investigations is not public. Moreover, during the course of a criminal investigation, the prosecutor may restrict access to the case file if access could prevent a proper criminal investigation. Once official charges are brought against a person, access can be restricted for a maximum of 10 days.

Once a case is before a court, the criminal investigation and subsequent information becomes public (although the court may, in limited circumstances, judge the file in chambers, without public access). This does not mean that the entire file is generally accessible to the public, and requests may be made on the basis of Romanian regulations on freedom of access to information.

71What steps do you take to manage corporate communications in your country? Is it common for companies to use a public relations firm to manage a corporate crisis in your country?

The appointment of a public relations advice team is crucial to develop and follow a well-planned strategy. Relevant stakeholders, experts and legal consultants should work together to prepare public statements and to avoid damaging the company’s reputation.

72How is publicity managed when there are ongoing related proceedings?

Strategic considerations are required to successfully manage public communication in cases of ongoing proceedings. During the court proceeding phase, media access to information about the activity of the court and prosecutors’ offices is determined by judicial authorities. It is useful for companies to have an organised plan for dealing with media queries and communications relating to the proceedings.

Duty to the market

73Is disclosure to the market in circumstances where a settlement has been agreed but not yet made public mandatory?

Disclosure by the company to the market is not mandatory and the decision must be made depending on the facts of the individual case, and by weighing up the factors discussed in question 33.

However, all decisions in criminal matters (including court-approved settlements) become public and are published on a court database. This publication is limited to basic information, such as names, the offence committed and the sanction imposed. As mentioned in question 62, a company may be required – once convicted of an offence – to ensure publication in national media of the full court decision, at the company’s own expense.

Anticipated developments

74Do you expect to see any key regulatory or legislative changes emerge in the next year or so designed to address corporate misconduct?

Some changes have been announced in relation to the Criminal Code that may affect legal entities. One of these targets the reduction of the statute of limitations for corruption crimes from eight to six years. The aim of these changes is to sanction the slow manner in which criminal investigations have been performed in Romania in recent years.

Another change that may affect legal entities relates to tax evasion crimes. The proposed change provides that, if a perpetrator repays the damage caused to the state budget (plus 20 per cent, interest and delay penalties), the criminal tax evasion charges will be dropped.

It is unclear if and when these changes may occur. The Constitutional Court of Romania decided that they are unconstitutional and Parliament now has to modify them and restart the procedure.

Footnotes