Dejan Jasnic · Co-founder & Compliance Lead, Trusty · 20+ years anti-fraud & compliance · ACFE Swiss Chapter Board
In October 2019, the Whistleblowing Directive was officially drafted, marking a milestone in the labor field by establishing new obligations for the implementation of internal whistleblowing channels in companies. The main objective of this regulation is to ensure that any employee has a tool that facilitates the disclosure of possible infractions or irregularities within the company, while ensuring that the confidentiality of the whistleblower is protected.
Although this directive establishes general guidelines for the entire European Union, each country has had to develop it specifically, adapting it to the particular needs of its business fabric.
The Whistleblowing Directive in Spanish law: Law 2/2023
Thus, in Spain this directive has its transposition in Law 2/2023, of February 20, 2023, regulating the protection of persons who report regulatory infringements and the fight against corruption, drafted in the BOE of February 21, 2023 and in force since March of the same year, although with particularities depending on the size of the company.
Who is protected by Law 2/2023 in Spain?
Law 2/2023 protects any person who, in an employment or professional context, has obtained information about suspected wrongdoing, whether in the public or private sector. Specifically, the protection extends to the following whistleblowers:
- Workers and self-employed persons.
- Shareholders, participants, members of the administrative, management or supervisory body of a company.
- Personnel of contractors, subcontractors and suppliers.
- Volunteers, interns and workers in training periods, with or without remuneration.
- In addition to whistleblowers, the law also protects:
- Individuals assisting the reporting person within the organization.
- Natural persons related to the informant who may suffer retaliation, such as coworkers or family members.
- Legal persons for whom the informant works, with whom he/she has any type of work relationship or in which he/she has a significant shareholding.
Which companies are affected by Law 2/2023?
To companies with 50 or more employees, which will have the obligation to implement an information system, simultaneously ensuring the protection of informants (which may include not only employees).
As drafted in the BOE, companies had a period of 3 months to adapt from the entry into force of the law, with two deadlines depending on the size of the workforce:
- Companies with more than 249 workers had to be adapted as of June 13, 2023.
- Companies with between 50 and 249 workers had to be adapted as of December 1, 2023.
In other words, all companies must already be complying with all the precepts of the European directive and the national standard.
What are the main novelties introduced by the law with respect to the directive?
This law develops the provisions of the directive and incorporates some new features.
- The Whistleblowing Directive broadens the scope of protected communications (breaches of European Union law; specific matters listed in Annex I of the Whistleblowing Directive; matters affecting the financial interests of the Union and the internal market; serious or very serious administrative offenses; or criminal offenses) and obliges public and private entities with 50 or more employees to implement internal whistleblowing channels.
- In addition, it requires the effective processing and integration of all channels into a single internal system, respecting minimum guarantees and rights, and allowing anonymous complaints.
- It establishes the creation of an Independent Whistleblower Protection Authority and legitimizes public disclosure of violations in certain cases.
- It also requires the management body to designate a person responsible for the internal system and offers protection measures, including financial support to the whistleblower.
What are the main obligations of companies under this law?
Companies should inform and publicize the use of the internal channel and the main principles of its management procedure. If the company has a website, the channel should be visible on the home page, in a separate and easily identifiable section.
What violations can be reported under this law?
Spanish law goes beyond the Whistleblowing Directive and, in addition to the infringements of EU law mentioned in the Directive, allows the reporting of any serious or very serious criminal or administrative infringement of the Spanish legal system, especially those causing economic damage to the Treasury and Social Security.
The information or communication must be made in good faith and honestly, based on reasonable grounds as to the truthfulness of the possible infringement, and must be within the scope of protection of the Law.
However, Law 2/2023 expressly excludes from its scope of application the cases regulated by specific regulations, the obligations of protection of professional secrecy and classified information.
What is the maximum time limit for the investigation of the complaint?
The company must confirm receipt of the information or communication to the whistleblower within 7 days of receipt.
The investigation of the complaints received should not exceed 3 months, although this period may be extended to 6 months in exceptionally complex cases.
Through which channels can violations be reported?
There is no single channel of information, but rather communications about infractions or irregularities may be channeled through various means:
- The company’s internal channel.
- The external channel, i.e. the Independent Whistleblower Protection Authority (IPA).
– Public disclosure on web platforms, social networks, media, etc., when internal or external channels have not worked properly, there is an imminent threat to the public interest, or there is a risk of retaliation or lack of effective treatment.
Who is responsible for setting up this system within the company?
The company’s management body is responsible for implementing the system, after consultation with the legal representation of the employees.
The system must include a person in charge appointed by the management body, who shall be an officer of the company and act independently. This function may be performed by the compliance officer or compliance officer.
What is the sanctioning regime and what are the penalties foreseen?
The sanctioning regime established by the Law is specific and contemplates fines for individuals or legal entities that commit typified infractions, with the Independent Authority having the power to impose these sanctions.
Serious infringements include failure to implement the information system or retaliation against whistleblowers, with significant fines of up to 300,000 euros for natural persons, and fines of up to 1,000,000 euros for legal persons (with a minimum fine of 30,001 euros for natural persons and 600,001 euros for legal persons). Fines for very serious infringements exceeding €600,001 imposed on legal entities could be disclosed in the Official State Gazette after the administrative resolution becomes final.
Likewise, accessory sanctions such as reprimands, prohibition to obtain subsidies or tax benefits with a limit of up to 4 years, and prohibition to contract with the public sector for up to 3 years may be applied.
The absence of the information system may also affect the criminal liability of legal entities according to Article 31 bis of the Criminal Code. In addition, non-compliance with these regulations could result in administrative sanctions in terms of data protection.
Comply with Law 2/2023: Trusty’s whistleblowing platform is designed to meet EU Whistleblowing Directive requirements, including Spain’s Law 2/2023. It supports anonymous reporting, case management, and full audit trails. See pricing and plans.
Frequently asked questions
Anyone who obtains information about suspected wrongdoing in an employment or professional context: workers and self-employed persons, shareholders and board members, staff of contractors, subcontractors and suppliers, volunteers, interns and trainees, plus people assisting the reporter, related persons who could suffer retaliation and the legal persons they work for.
Companies with 50 or more employees. Those with more than 249 workers by 13 June 2023, those with 50 to 249 workers by 1 December 2023.
Receipt must be confirmed within 7 days, and the investigation should not exceed 3 months, extendable to 6 months in exceptionally complex cases.
For serious infringements such as failing to implement the system or retaliating, fines of up to 300,000 euros for natural persons and up to 1,000,000 euros for legal persons, with accessory sanctions such as a ban on subsidies or tax benefits for up to 4 years and on public contracts for up to 3 years.
FROM 49 EUR PER MONTH
Trusty Whistleblowing: a reporting channel compliant with the EU Whistleblower Directive, live in minutes with no IT project. From 49 EUR per month, 7-day free trial.