Law 2/2023 (BOE 21-2-23), which transposes Dir (EU) 2019/1937 (whistleblowers), establishes the obligation of companies with more than 50 employees and all public entities to establish an internal information system through which employees can report violations of the legal system within the framework of a professional relationship. It also establishes protection measures for those who make use of this system, both informants and those affected.
Reporting irregularities
Law 2/2023 transposes Directive (EU) 2019/1937 of the European Parliament and of the Council into Spanish law in order to protect citizens who report violations of the legal system in the context of a professional relationship.
To this end, entities and organizations are required to have an internal information system through which employees can report anonymously, if necessary, actions or omissions that may constitute an infringement of EU law or a serious or very serious criminal or administrative infringement of Spanish law. The following entities are obliged to have the Internal Reporting System:
- Private companies with 50 or more employees. Those with less than 250 employees may share means and resources for the management of the information they receive.
- Private companies in the areas of financial services, products and markets, prevention of money laundering or terrorist financing, transportation security and environmental protection.
- Political parties, trade unions, business organizations and their foundations whenever they receive or manage public funds.
- All the entities that make up the public sector. Municipalities with less than 10,000 inhabitants may share the internal information system among themselves or with any other public administrations located within the Autonomous Community. Likewise, the entities with their own legal personality linked to or dependent on bodies of the territorial Administrations, and which have less than 50 employees, may share the internal information system with the Administration to which they are attached. The system must be implemented within a period ending on 13-6-2023. However, the deadline is extended to 1-12-2023 for private companies with less than 250 workers and municipalities with less than 10,000 inhabitants.The responsibility for the implementation of the system lies with the administration or governing body of the obliged entity or body, after consultation with the workers’ representatives. In any case, the internal information system must, among other requirements,
be independent and guarantee the confidentiality of the identity of the informant and third parties involved. It is composed of two elements:
– Internal reporting channel: must allow for communications to be submitted in writing (by mail or electronic means), verbally (by telephone or voice messaging) or both, or through a face-to-face meeting within a maximum of 7 days. Verbal communications must be documented, at the informant’s option, by recording or complete transcription. They should also allow for the submission and subsequent processing of anonymous communications.
– Responsible for the internal information system appointedby the administrative or governing body of the entity or organization, which, in the private sector, will be a manager of the entity. He/she must perform his/her duties independently and autonomously and may not receive instructions of any kind.
The management of the system -reception of information- may be carried out either by the entity itself or by an external third party, provided that independence, confidentiality, data protection and secrecy of communications are respected.
The maximum time limit for responding to the investigation proceedings may not exceed 3 months from the receipt of the communication, which may be extended by a further 3 months in the case of particular complexity. When the facts are suspected of constituting a crime, the information must be sent immediately to the Public Prosecutor’s Office or to the European Public Prosecutor’s Office if the facts affect the financial interests of the EU.
All those obliged to have an internal information channel must have a logbook, which is not public, of the information received and the internal investigations to which they have given rise.
Independent Whistleblower Protection Authority
Information on actions and omissions may also be submitted through the external information channel of the newly created Independent Whistleblower Protection Authority, either directly or after communication through the internal channel. The Authority will respond within a maximum period of 3 months with one of the following actions: closing the file; referring it to the Public Prosecutor’s Office; transferring it to the competent authority or initiating disciplinary proceedings.
In addition, its functions include the adoption of whistleblower protection measures and the processing of disciplinary proceedings. The acts of the Independent Authority for Whistleblower Protection terminate administrative proceedings and may only be appealed before the contentious-administrative jurisdiction.
Protective measures
The Law grants protection against reprisals that may be suffered by whistleblowers. The protection measures are applied by the Independent Authority for the protection of whistleblowers or the competent bodies of the Autonomous Communities to the following groups:
- public employees or employees working for others, even if the information was obtained within the framework of a relationship that has already ended;
- the self-employed;
- shareholders, participants and persons belonging to the administrative, management or supervisory body of a company, including non-executive members;
- any person working for or under the supervision and direction of contractors, subcontractors and suppliers;
- volunteers, interns, trainees, whether or not they are paid;
- persons whose employment relationship has not yet begun, when the information has been obtained during the selection or pre-contractual negotiation process;
- legal representatives of the employees, those who assist the whistleblower within the organization, as well as natural persons who are related to the whistleblower such as co-workers or relatives of the whistleblower, and related legal persons.This protection is maintained for 2 years following the disclosure of the information.Exceptionally and justifiably, the competent authority may extend this protection period.As a consequence of these measures, acts intended to prevent or hinder the submission of communications and disclosures, constitute null and void. Exceptionally and in a justified manner, the competent authority may extend this period of protection.As a consequence of these measures, acts that are intended to prevent or hinder the submission of communications and disclosures, constitute retaliation or cause discrimination are null and void as a matter of law. It includes the adoption of corrective measures and, where appropriate, the payment of the corresponding compensation for damages to the injured party, as well as the adoption of support measures for whistleblowers such as: assistance from the competent authorities, legal assistance in cross-border criminal or civil proceedings and, exceptionally, financial and psychological support. In addition, the right to free legal assistance is recognized for those who report regulatory and anti-corruption violations to the Independent Whistleblower Protection Authority and have resources of less than 4 times the IPREM.contractual clauses or provisions that prevent or seek to limit the right or ability to report (confidentiality clauses or provisions reflecting express waivers) are rendered null and void . This measure does not affect criminal liabilities, but it does extend to the communication of information made by the representatives of the workers, even if they are subject to legal obligations of secrecy or of not disclosing reserved information.Penalty regimeAsystem of infringements is established to guarantee the rights contained in this Law, which are classified as minor, serious and very serious, and may be sanctioned with fines that
range from 1,000 € to 300,000 € if committed by individuals or up to 1,000,000 € if committed by legal entities. Additionally, in the case of very serious infringements, a public reprimand may be issued; a ban on obtaining subsidies or other tax benefits for a maximum period of 4 years or a ban on contracting with the public sector for a maximum period of 3 years. In addition, penalties of an amount equal to or greater than €600,001 may be published in the BOE.
The statute of limitations for very serious infringements is 3 years, 2 years for serious infringements and 6 months for minor infringements. The statute of limitations for penalties is three years for very serious infringements, two years for serious infringements and one year for minor infringements.