Spain: Definitive approval for the Spanish Whistleblower Law

On 21 February, Spain's Official State Journal, the BOE, published Law 2/2023, of 20 February, on the protection of persons who report regulatory breaches and to combat corruption, which will enter into effect on 13 March. The Whistleblower Law, (i) transposes into Spanish legislation Directive (EU) 2019/1937 of the European Parliament and of the Council of 23 October 2019 on the protection of persons who report breaches of Union law (the Directive); and (ii) protects reporting persons, establishing minimum provisions that reporting channels must comply with.
Following the amendments made by the Spanish Senate, the most significant aspects of the new Whistleblower Law are set out below.

Persons protected by the Law and the measures established to protect whistleblowers

The aim of the new Law is to protect persons who, in a professional or work-related context, detect serious or very serious criminal or administrative offences and who report them by means of the mechanisms provided for in the Law.

It therefore defines the persons who will be protected from potential retaliation, as well as the measures aimed at ensuring that protection.

Specifically, it affords protection to all persons who have a professional or work-related relationship with public or private-sector entities. It also protects persons (i) whose professional relationship has come to an end, (ii) volunteers, (iii) trainees, (iv) who take part in selection processes and (v) who assist whistleblowers, such as undertakings owned by the whistleblower, among others.

In order to afford protection to the persons covered by the new Law, and without prejudice to the provisions applicable to internal reporting channels, a series of measures are put in place aimed at protecting persons who report breaches. Some of the most significant are as follows:

• Actions that may be deemed as being a retaliation (including, for example, denial of a licence or a permit) adopted within two years following conclusion of the investigation¹ is null and void.
• Special protection is given to the persons to which the reported events refer. The persons concerned are entitled to (i) the presumption of innocence; (ii) the right to defence; (iii) access their file; and (iv) the matter being kept confidential.
• Reporting persons will have the support of the Independent Whistleblower Protection Authority (Autoridad Independiente de Protección del Informante) – which is described in the "New external reporting channel: the Independent Whistleblower Protection Authority" section of this ebulletin.

Putting in place internal reporting channels

The new Law establishes internal reporting systems as the preferred channels for reporting conduct or omissions that could constitute criminal or administrative offences.

In the context of private undertakings, the Law establishes an obligation for companies that have 50 or more workers to set up an internal reporting channel.² Irrespective of the number of workers, reporting channels must also be put in place and managed by undertakings falling within the scope of Union acts in the areas of financial services, products or markets, prevention of money laundering and terrorist financing, transport safety and protection of the environment.

Although most undertakings with foreign influence had already implemented internal reporting channels, entities subject to the Whistleblower Law must implement an internal reporting system within three months of it entering into effect, with the exceptions identified in its Second Transitional Provision.³ Failure to comply with the obligation to implement an internal reporting system, on the terms established by the Law, will constitute a very serious breach, which in the case of undertakings carries a fine ranging from €600,001 and €1,000,000.

Finally, the new Law also establishes the position of the "Reporting System Officer", an individual (a company officer in the case of private-sector undertakings) who is responsible for the management of the internal reporting system. Among the amendments made by the Senate to the Bill, it broadened the scope of the individuals who could act as Reporting System Officer, establishing that where entities or bodies already had in place a compliance officer or ethics officer, that person could be appointed Reporting System Officer, provided that they comply with the requirements established by the Law. In other words, existing compliance officers or ethics officers may be appointed as Reporting System Officers.

Requirements of internal reporting channels

Internal reporting channels must (i) allow the reporting of breaches, whether in writing or orally; (ii) be secure and ensure the confidentiality of the file; (iii) have a policy or strategy that sets out the general principles of the system, and which must be published by the entity or body; (iv) have a procedure for managing the information received; and (v) establish guarantees to protect reporting persons. In this regard, the system must allow for anonymous reporting and subsequent processing.

The Whistleblower Law also includes a procedure for processing communications and establishes that internal reporting systems may be managed by third parties – those third parties must provide suitable guarantees regarding independence, confidentiality, data protection and reporting secrecy, and outsourcing the management of the system does not release the Reporting System Officer from liability.

New external reporting channel: the Independent Whistleblower Protection Authority

A new external reporting channel is established, the Independent Whistleblower Protection Authority (Autoridad Independiente de Protección del Informante, or A.P.I.), the aim of which is to properly gather together the various functions and duties given by the Directive to the competent authorities in each member State.

In essence, by setting up the new body, a public authority will now be able to receive information on the reported conduct and, if appropriate, investigate it in collaboration with the Public Prosecutor's Office.

The A.P.I. is also able to impose penalties for breaches of the provisions of the Whistleblower Law. Following the amendments included by the Senate, the A.P.I. now has jurisdiction over breaches committed within the context of the state public sector as well as over breaches committed within the private sector nationwide (provided that a corresponding regional regulation has not attributed competences in this respect to a body within that respective region).

Decisions issued by the A.P.I. are not open to appeal, whether administrative or before the courts; it would nevertheless be possible to challenge the decision that brings an end to the infringement procedure, if ultimately opened.

Other modifications

Other amendments of note brought in by the Whistleblower Law are as follows: (i) the Spanish government – in collaboration with the autonomous regions – has an obligation to approve an Anti-corruption Strategy, which at least includes an assessment of the compliance of the objectives established in the Law, as well as measures to mitigate any deficiencies detected; and (ii) modifications to some of the functions held by public bodies with investigation competencies.

Note 1: Reporting by workers' representatives enjoys special protection, although they are subject to legal obligations of secrecy and not to disclose privileged information (article 38).

Note 2: Companies that have more than 50 workers but less than 250 are able to share measures and resources for the management of information received, provided that it is clear that separate channels exist for each company.

Note 3: In the case of private-sector companies with less than 249 workers and municipalities with less than 10,000 inhabitants, the deadline for implementation is 1 December 2023.