On February 21, the long-awaited Whistleblower Protection Law was published in the BOE (Law 2/2023 of February 20 regulating the protection of people who report regulatory infractions and the fight against corruption).
This law transposes Directive 2019/1937 of October 23, 2019, relating to the protection against retaliation of persons who report infringements of Union Law, also known as Whistleblowing Directive.
The Law includes two objectives of the Directive itself: protecting informants and establishing minimum standards for information channels.
What is the scope of application of the law?
The law protects natural persons who report violations of Union Law and serious and very serious criminal or administrative violations of our legal system.
Therefore, the law focuses on investigative activities on violations that are considered to have the greatest impact on society as a whole.
What exclusions exist in the law?
The law will not apply to information that affects classified information. Nor will it affect the obligations resulting from the protection of the professional secrecy of medical and legal professionals, the duty of confidentiality of the Security Forces and Corps in the scope of their actions, as well as the secrecy of judicial deliberations. .
Nor will the law apply to information relating to violations in the processing of contracting procedures that contain classified information or that have been declared secret or reserved, or those whose execution must be accompanied by special security measures or in which the law requires it. protection of interests essential to the security of the State.
Who are the protected people?
Protection extends to all people who have professional or employment ties with entities in both the public and private sectors, including those who have ended their professional relationship, or those who are volunteers, interns or workers in training, or even those people who are in the selection process.
An express extension of protection is made to people who can provide assistance to informants, people around them, and legal entities owned by the informant.
Internal information system?
The Internal Information System is considered preferential for channeling information since diligent and effective action within the organization itself could paralyze the harmful consequences of the actions investigated.
The internal information system must always consist of a channel, a person responsible for the system and a specific procedure.
The Channel must meet the requirements of affordable use, guarantee of confidentiality, correct monitoring practice, investigation and protection of the informant.
The administrative body or governing body of each obligated entity or body will be responsible for the implementation of the internal information system and will be responsible for the processing of personal data.
The administrative or governing body must designate the person responsible for managing the system. The appointment must be notified to the Independent Whistleblower Protection Authority (AAI).
The person responsible for the system must carry out his or her functions independently and autonomously with respect to the rest of the bodies of the entity or organization, may not receive instructions of any kind in their exercise and must have all the personal and material means necessary to carry them out. .
The management of the channel can be carried out within the entity itself or through an external third party, but as long as respect for independence, confidentiality, data protection and the secrecy of communications is guaranteed.
Internal channels must allow communications to be carried out in writing (postal mail, electronic media) or verbally (telephone, voice messaging) or jointly. Face-to-face meetings are also allowed at the request of the informant.
Is an anonymous complaint allowed?
The law allows the presentation and processing of anonymous complaints with the exception of what is provided for in a national standard, or when requested within the framework of a judicial process or when it is argued that the court needs to know the identity of the complainant to guarantee the right of defense.
What entities are required to have information systems?
All natural or legal persons in the private sector with more than 50 employees are required to have an information system.
Likewise, regardless of their number, political parties, unions, business organizations and the foundations that depend on them are obliged, as long as they receive public funds for their financing.
Regardless of their size, all public institutions and organizations must have an information system.
Legal entities in the private sector that have between 50 and 249 employees may share among themselves the Internal Information System and the resources intended for the management and processing of communications, if they expressly decide to do so.
Will there be any external communication system?
The law provides for the creation of an external information channel as complementary to the internal one and whose management would correspond to the Independent Authority for the Protection of Informants (AAI), which is an independent administrative authority pending creation.
This channel must be provided with independence and autonomy.
All natural persons can use this channel, either directly or after the prior complaint made in the internal communication channel.
The AAI may accept the complaint for processing, reject it for reasons, immediately notify the Public Prosecutor's Office if the conduct could constitute a crime or refer it to another competent Authority or Organization.
The period for investigating the actions and for responding to the informant cannot be more than three months from the entry of the information into the registry. Whatever the decision, it will be communicated to the informant, unless he or she has waived it or when the communication is anonymous.
The decisions issued by the AAI do not provide for any appeal, neither administrative nor jurisdictional, without prejudice to the administrative or contentious-administrative appeal that could be filed against the eventual resolution that puts an end to the sanctioning procedure that could be initiated on the occasion of the events reported.
Rights and guarantees against retaliation?
Informants who use internal and external channels will have a specific protection regime against retaliation.
Conduct that can be classified as retaliation and is adopted within two years following the completion of the investigations is prohibited and will be declared null and void.
The suspension of the employment contract, dismissal or termination of the employment or statutory relationship, non-renewal or early termination of the employment contract, imposition of disciplinary measures, demotion, denial of promotions, etc. could be considered retaliation.
Sanctions?
The law provides for sanctions in both the public and private sectors in the case of infractions, which include, as very serious infractions, the violation of the guarantees of confidentiality and anonymity or actions aimed at revealing the identity of the informant, violating the duty of secrecy related to information, communicating or publicly revealing information knowing that it is false or failure to comply with the obligation to have an internal information system, among others.
Fines for legal entities can amount to a maximum of 1.000.000 euros for very serious infractions.
When does the Law come into force and the maximum period for its application?
The Law will enter into force 20 days after its publication. And the maximum period for the establishment of internal information systems is three months from the entry into force of the law.
As an exception, in the case of private sector legal entities with 249 or fewer workers, as well as municipalities with less than ten thousand inhabitants, the deadline will be extended until December 1, 2023.
Ruiz Transit, Associate at ELZABURU.
