On February 21, the long-awaited Whistleblower Protection Act (Law 2/2023 of February 20, regulating the protection of individuals who report regulatory violations and combat corruption) was published in the Official State Gazette (BOE).
This law transposes Directive 2019/1937 of October 23, 2019, on the protection against retaliation of persons who report violations of Union law, also known as the Whistleblowing Directive.
The law incorporates two objectives of the Directive itself: to protect whistleblowers and to establish minimum standards for reporting channels.
What is the scope of the law?
The law protects individuals who report violations of European Union law and serious or very serious criminal or administrative offenses under our legal system.
Therefore, the law focuses on investigations into violations that are considered to have the greatest impact on society as a whole.
What exclusions are provided for in the law?
The law shall not apply to information relating to classified information. Nor shall it affect the obligations arising from the protection of professional secrecy for medical and legal professionals, the duty of confidentiality of law enforcement agencies in the course of their duties, or the confidentiality of judicial deliberations.
Nor shall the law apply to information concerning violations in the conduct of procurement procedures that contains classified information or that has been designated as secret or confidential, or to those whose implementation must be accompanied by special security measures or where required to protect interests essential to national security.
Who are the protected individuals?
Protection extends to all individuals who have professional or employment ties to entities in both the public and private sectors, including those whose professional relationship has ended, as well as volunteers, interns, trainees, and even individuals currently in the hiring process.
Protection is expressly extended to individuals who may provide assistance to whistleblowers, to those in their circle, and to legal entities owned by the whistleblower.
Internal Information System?
The Internal Reporting System is considered the preferred channel for reporting information, since prompt and effective action within the organization itself could prevent the harmful consequences of the actions under investigation.
The internal reporting system must always consist of a channel, a person responsible for the system, and a specific procedure.
The channel must meet the requirements for accessibility, confidentiality, proper monitoring procedures, investigation, and protection of the whistleblower.
The administrative or governing body of each obligated entity or agency shall be responsible for implementing the internal information system and shall act as the controller of personal data.
The administrative or governing body must designate the person responsible for managing the system. The appointment must be reported to the Independent Whistleblower Protection Authority (A.A.I.).
The person responsible for the system must perform his or her duties independently and autonomously from the entity’s or agency’s other bodies; he or she may not receive instructions of any kind in the performance of those duties and must have all the necessary personnel and material resources to carry them out.
Channel management may be carried out within the organization itself or through an external third party, provided that independence, confidentiality, data protection, and the secrecy of communications are guaranteed.
Internal channels must allow for communication in writing (mail, electronic means) or verbally (telephone, voice messaging) or a combination of both. In-person meetings are also permitted at the request of the whistleblower.
Are anonymous complaints allowed?
The law permits the filing and processing of anonymous complaints, subject to the provisions of any national law, or when requested in the context of legal proceedings, or when it is argued that the court needs to know the complainant’s identity to ensure the right to a defense.
Which entities are required to have information systems in place?
All private-sector individuals or legal entities with more than 50 employees are required to have an information system in place.
Likewise, regardless of their number, political parties, labor unions, business organizations, and the foundations affiliated with them are required to comply, provided they receive public funds for their financing.
Regardless of their size, all public institutions and agencies must have an information system.
Private-sector legal entities with between 50 and 249 employees may share among themselves the Internal Information System and the resources allocated to the management and processing of communications, if they expressly so decide.
Is there any external communication system?
The law provides for the creation of an external reporting channel to complement the internal one, which would be administered by the Independent Whistleblower Protection Authority (A.A.I.), an independent administrative authority yet to be established.
This channel must be independent and autonomous.
Any individual may use this channel, either directly or after first filing a complaint through the internal communication channel.
The A.A.I. may accept the complaint for processing, reject it with a statement of reasons, immediately notify the Public Prosecutor’s Office if the conduct could constitute a crime, or refer it to another competent authority or agency.
The time limit for investigating the matter and responding to the whistleblower may not exceed three months from the date the report is entered into the registry. Whatever the decision, it will be communicated to the whistleblower, unless the whistleblower has waived this right or the report was submitted anonymously.
Decisions issued by the A.A.I. do not provide for any appeal, whether administrative or judicial, without prejudice to any administrative or contentious-administrative appeal that may be filed against any decision that concludes the disciplinary proceeding that may be initiated in connection with the facts described.
Rights and Protections Against Retaliation?
Whistleblowers who use internal and external channels will be covered by a specific protection program against retaliation.
Any conduct that could be classified as retaliation and that occurs within two years after the conclusion of the investigations is prohibited and shall be deemed null and void.
The following could be considered retaliation: suspension of the employment contract, dismissal, or termination of the employment or statutory relationship; nonrenewal or early termination of the employment contract; imposition of disciplinary measures; demotion; denial of promotions; etc.
Penalties?
The law provides for penalties in both the public and private sectors in the event of violations, which include, as very serious violations, violations of confidentiality and anonymity guarantees; actions intended to reveal the whistleblower’s identity; breaches of the duty of confidentiality regarding the information; publicly communicating or disclosing information while knowing it to be false; and failure to comply with the obligation to have an internal reporting system in place, among others.
Fines for legal entities can amount to a maximum of 1,000,000 euros for very serious violations.
When does the law take effect, and what is the deadline for its implementation?
The law will take effect 20 days after its publication. The deadline for establishing internal reporting systems is three months from the law’s effective date.
As an exception, for private-sector legal entities with 249 employees or fewer, as well as municipalities with fewer than 10,000 residents, the deadline will be extended to December 1, 2023.
Tránsito Ruiz, Associate at ELZABURU.