With more than a year’s delay, Spain is adapting to the Whistleblowing Directive and incorporating it into our domestic legislation through Law 2/2023, of 20 February, regulating the protection of persons who report regulatory infringements and the fight against corruption.
The aim of the law is to protect people who, in an employment or professional context, detect serious or very serious criminal or administrative offences and wish to report them by offering the mechanisms regulated therein.
Obligations of the Whistleblowing Directive:
The law determines that establishing a whistleblowing channel will be mandatory for:
- All companies with 50 or more employees.
- Political parties, trade unions, business organisations and foundations created by them, whenever they receive or manage public funds.
- Companies operating in the financial sector.
This regulation also affects the Public Sector, and they must have such a channel:
- Public Administrations.
- Public Bodies and Entities.
- Independent Administrative Authorities and Social Security
- Management Entities and Common Services.
- Public Law Corporations.
- Public sector foundations.
- Public Universities.
How long do organisations have to adapt to the new regulations on the complaints channel?
The Law comes into force 20 days after its publication in the Official State Gazette, i.e. today, 13 March. Private companies with 50 to 249 employees and municipalities with less than 10,000 inhabitants have an extended period to adapt until 1 December 2023.
What is the sanctioning regime of the Whistleblowing Directive?
The regulation establishes different sanctions that can be applied to both natural and legal persons, which can reach up to 300,000 euros and one million euros respectively in the most serious degree of severity.
Infringements of varying degrees are contemplated, ranging from not having a complaints channel, hindering its operation or management, violating the anonymity of the channel or retaliating against anyone who has made a complaint through it.
It is important to remember that the regulation is of a European nature and the law that has transferred it to the Spanish legal system is the Corruption Whistleblower Protection Act.
Minor offences:
- Incomplete or deliberately late submission of information by the System Manager to the competent authority.
- Failure to comply with the obligation to collaborate with the investigation of complaints.
- Any non-compliance not classified as a very serious or serious infringement.
Serious infringements:
- Actions that limit the rights and guarantees provided for in the law, as well as any attempt or action that hinders or attempts to hinder complaints and their follow-up, which are not considered very serious.
- Breach of the guarantees of confidentiality and anonymity provided by law in minor or serious complaints.
- Failure to adopt measures to guarantee the confidentiality and secrecy of complaints.
- The commission of a third minor infringement, after having been sanctioned for two minor infringements in the previous two years.
Very serious infringements:
- Any action that limits the rights and guarantees provided for in the law, as well as any attempt or action that hinders or attempts to hinder complaints and their follow-up. Also complaints based on knowingly false information.
- Retaliation against whistleblowers.
- Breach of the guarantees of confidentiality and anonymity provided for by law. As well as any attempt to reveal the identity of the anonymous whistleblower.
- Breach of the duty to maintain secrecy on any aspect related to the whistleblowing.
- A third serious infringement, when you have already been sanctioned by a final decision for two serious infringements in the previous two years.
- Communicating or publicly disclosing information knowing it to be false, in complaints in which the whistleblower is identified.
Requirements for the whistleblowing channel
Due to the high level of security required for the information received and the obligation to investigate all reports, various providers have already started to emerge that allow outsourcing part of the management of the whistleblowing channel. Whether in-house or outsourced, the legal requirements must always be complied with:
- Measures to ensure the identity and confidentiality of the whistleblower, the reported and witnesses.
- Capacity to store information securely and for the time necessary to carry out further investigations.
- Means: should allow for written and verbal complaints.
- Follow-up and investigation of complaints should be carried out by an autonomous and impartial person in charge.
- Acknowledgement of receipt of the complaint within 7 days of receipt.
- Access limited to authorised personnel.
Guarantees to be given to complainants:
- Information and advice on procedures and remedies available to them.
- Protection against possible retaliation.
- Financial assistance and other support measures in the framework of possible legal proceedings arising from the complaint.
- The directive requires groups of companies to have a common general policy for all their companies with a single internal whistleblowing channel for the whole group.
This new measure goes hand in hand with data protection and its implementation can be complex for medium-sized companies that are affected but do not have the resources and structure of large corporations. Our team can help you adapt to the Whistleblowing Directive effectively.
Photo by Towfiqu barbhuiya on Unsplash
