Spanish Parliament starts the procedure for approving the Whistleblower Protection Bill

The Spanish Government has approved a Bill to regulate the protection of people who report breaches of regulations and in the fight against corruption. The new law (i) transposes Directive (EU) 2019/1937 of the European Parliament and of the Council of 23 October 2019 on the protection of persons who report breaches of Union law into Spanish legislation (ii) protects whistleblowers, establishing de minimis provisions for reporting channels. This Bill, which was published in the Official Journal of Spanish Parliament (Boletín Oficial de las Cortes Generales) on 23 September 2022 and will enter into effect 20 days after it has been published in the Spanish Official State Journal after the parliamentary process has been completed.

Among other things, the Bill includes a number of provisions that will affect the protection of whistleblowers who report criminal offences or administrative infringements in an employment or professional context. These are set out below.

People protected by the Bill and measures for protecting whistleblowers

Implementation of internal reporting channels

Requirements of the internal reporting system

New body: External system for reporting to the Independent Whistleblower Protection Authority

People protected by the Bill and measures for protecting whistleblowers

The aim of the Bill is to protect people who detect serious or very serious criminal offences or administrative infringements in an employment or professional context and who report them using the mechanisms established in the Bill.

Title I of the Bill, in relation to Title VII, establishes the people that would be afforded protection against potential retaliation as well as the measures that would be adopted to ensure that protection.

Specifically, it protects anyone who has professional or employment links with private or public sector entities. Likewise, protection would extend to (i) people who have ended their professional relationship, (ii) volunteers, (iii) trainees or people on work-experience, (iv) people who take part in recruitment processes and (v) people who assist whistleblowers, such as any entities that they may own, among others.

In order to protect the people to whom this Law extends, the Bill sets out a series of measures aimed at the people who report breaches. These include:
• Any conduct that may be considered retaliatory in nature (in accordance with article 36) adopted within two (2) years following the conclusion of the investigation conducted will be null and void.¹
• Special protection is afforded to the people to whom the facts relate. In this regard, the affected people will be entitled to (i) presumption of innocence, (ii) the right to defence, (iii) access to the file on the terms provided for by law, and (iv) confidentiality.
• Whistleblowers will have the support of the Independent Whistleblower Protection Authority (Autoridad Independiente de Protección del Informante, or A.A.I.) – which we explain in section 4 below: New body: External system for reporting to the Independent Whistleblower Protection Authority – in order to ensure the effectiveness of the protective measures established by the Bill.
• The rules established for the internal reporting channels have also considerably enhanced the protection afforded to whistleblowers – among other aspects, whistleblowers' confidentiality and anonymity are now guaranteed

Implementation of internal reporting channels

Title II of the Bill regulates internal reporting channels as the preferred route for reporting on the actions and inactions set forth in the Bill. The law therefore introduces, in a private sector context, the obligation for enterprises with 50 or more workers to set up an internal reporting channel.² Furthermore, irrespective of the number of workers that they have, undertakings must also put in place and manage reporting channels if they fall within the scope of application of EU provisions regarding financial services, products and markets, anti-money laundering and terrorist financing, transportation safety and protection of the environment.

Although most international enterprises already have an internal reporting channel in place, the above undertakings to which the provisions apply must implement an internal reporting channel within three (3) months from the date on which the Law enters into effect, with the exceptions indicated in the Second Transitional Provision.³ Breach of the obligation to have an internal reporting system, on the terms established in the Bill, will constitute a very serious breach for which undertakings would face fines ranging from €600,001 to €1,000,000.

The rules established for the internal reporting channels have also considerably enhanced the protection afforded to whistleblowers – among other aspects, whistleblowers' confidentiality and anonymity are now guaranteed.

Finally, the Bill also introduces the position of the Reporting Officer (Responsable del Sistema), a natural person (an executive or officer in the case of private-sector enterprises) who is responsible for managing the internal reporting procedure.

Requirements of the internal reporting system

The internal reporting system must (i) allow the reporting of breaches, whether orally or in writing; (ii) be secure and guarantee the confidentiality of the file; (iii) have a policy or strategy in place setting out the general principles of the system, which must be properly published at the level of the entity or body concerned; (iv) have a procedure in place to manage the information received; and (v) establish guarantees to protect whistleblowers. In this regard, the system must make it possible to send and subsequently manage anonymous communications.

The Bill also sets out the procedure for managing communications and establishes that the internal reporting system may be managed by an external third party; however, adequate guarantees must in any event be provided to ensure the independence, confidentiality, data protection and secrecy of the communications. Furthermore, the party responsible for the system will not be exempt from liability.

New body: External system for reporting to the Independent Whistleblower Protection Authority

Title III and Title VIII of the Bill create a new body, the A.A.I., which is an "independent administrative authority" set up to channel in a satisfactory manner the set of functions that the European Directive allocates to the competent authorities in each member State.

Essentially, establishing the A.A.I. – which is an external body but is also complementary to the internal channels analysed in the preceding section – puts in place a public authority that may be informed of the reported incident and would, if appropriate, conduct an investigation in collaboration with the Public Prosecutor's Office.

The A.A.I. may also impose sanctions for breach of the provisions of the new Law.

The decisions rendered by the A.A.I. are not open to appeal of any kind, whether administrative or in court, without prejudice to the possibility of challenging the decision that brings an end to the infringement proceedings that may ultimately by brought.

________________________________________

Note 1: Special protection is extended to information sent by the workers' representatives, although they are subject to secrecy obligations and undertakings not to disclose reserved information (article 38 of the Bill).
Note 2: Enterprises that have more than 50 workers but less than 250 may share resources for managing the information they receive – however each enterprise must have its own clearly defined reporting channel.
Note 3: As an exception, in the case of private sector enterprises with less than 249 workers and municipalities with less than 10,000 inhabitants, the deadline for implementation will be 1 December 2023.