Whistleblowing Channel

Background

EU Directive 2019/1937 on Whistleblowing stated in article 26 that all EU-countries should incorporate it to their legislation at the latest the 17^th of December of 2021, but there is granted a moratorium of two years for private legal entities with 50 to 249 employees, not for companies with more than 250 employees or public organizations.

Regardless of the number of employees, it is compulsory to have an internal information system for all political parties, unions, business organizations, as well as foundations that manage public funds.

That means, that private companies with less than 50 employees are not obliged to have such whistleblowing channel unless any other Spanish legislation or the collective bargaining requires it.

In Spain the Criminal Act, article 31 bis, states that a legal person is responsible for the crimes committed in the name or on behalf of it, by its legal representatives or by those acting individually or as member of governing body, that are authorized to take decisions on its behalf or have the power to organize and control the company.

The organization is also considered responsible if, although it has not directly carried out the criminal acts, has seriously filed to comply with its duties of supervision, surveillance and control of its activity considering the specific circumstances of each case.

As a legal entity can be held criminally liable for breach of its duties of surveillance and control of its own activity, it is necessary to apply compliance policies and whistleblowing channels, since with these tools, it would be possible for a legal person to demonstrate its willingness to maintain a code of ethics within its organization, although that the control measures do not exonerate automatically from its responsibility.

EU Directive 2019/1937 Regulation

This regulation establishes common minimum standards that should apply to ensure effective protection of whistleblowers and directly obliges States to implement concrete measures to protect whistleblowers such as the establishment of communication channels and mechanisms for the harmonisation of EU States’ legislations, and in order to achieve effective protection for persons reporting breaches.

This regulation refers exclusively to complains concerning infringements in certain areas (can be expandable by the legislation of the Members States) as:

• Public procurement
• Financial services
• Product, food and transport safety
• Environmental protection
• Animal health
• Nuclear safety
• Public health
• Consumer protection
• Privacy and data protection
• Competition
• Internal market or financial interest of the Union

Informants:
Workers and public employees, freelancers’ employees, shareholders, members of the Board of Directors, managers, voluntary employees and trainees and related persons, independent if the previous employee relationship has not begun or has finished.

Information channels:
Can be internal (priority) or external. Municipality with less than 10,000 inhabitants or less than 50 employees are not obliged.

Protection measures for the informant:
Must be followed the legislation regarding data protection and the preservation of the identity of the informant and the investigated persons.

It is compulsory the duty of confidentiality and the prohibition of reprisals.

Sanctions:
The EU-States shall establish the sanctions to them who try to block complaints, apply reprisals, do not observe the duty of confidentiality or protection of the identity of the whistleblowers.

Spanish Law 2/2023 for whistleblowing channels

The Spanish Law for whistleblowing channels called “reguladora de la protección de las personas que informen sobre infracciones normativas y de lucha contra la corrupción” (Law on the protection of persons reporting on regulatory and anti-corruption offences) extends several matters of the EU Directive.

Who is obliged?

The Spanish Law 2/2023 (art. 10) extends the areas where it is compulsory to have a whistleblowing channel:

• Persons or private entities with 50 or more employees.
• Private entities having activity in EU-countries (regardless the number of employees) related to
  • Services, Products of Financial markets
  • Laundering of money prevention
  • Transport security
  • Environmental protection
• Political parties, trade unions, business organizations and foundations if they receive or manage public funds.
• Public Authorities

Information channels:
Information channels can be internal or external (Spanish State Attorney’s Office recommends the external ones).

In case of groups of companies, parent company can draft up a common general policy for whistleblowing channels and protection for the denouncer and may have a single internal information system and responsible for the entire group or one independent for each society.

It is compulsory to inform specifically of the existence of a whistleblowing channel for the company or for the group, not only to employees (making courses, informative sessions, etc.) but also to providers or third parties. If the company has a website this information must be included on the home page, in a separate and easily identifiable section.

The governing body of the company is responsible for the implementation. It will be necessary to appoint a responsible for the whistleblowing channel, who must have all independence, so there offers guarantees regarding the respect for the informing principles of the procedure, confidentiality, data protection, protection of the denouncer and no retaliation.

It is necessary to have a register book for the received information and the investigations carried out, that must be confidential and non-public (unless judicial authorities require to see the content). Personal data must be deleted when the case is finished and cannot be kept more than 10 years.

In addition, shared information systems can be organized between companies with staff of 50 to 249 employees.

The complaint can be anonymous.

If the complaint is verbal, it must be advised that the conversation can be registered.

A detailed list of processes to be followed are regulated.

If companies have information channels, those will be kept but they must be adapted to the new Spanish legislation during a period of three months.

Protection measures for the informant:
Same measures than EU-Directive, adding two years of guarantee before the prohibition of reprisals.

Autoridad Independiente de Protección del Informante (Independent Whistleblower Protection Authority)

It is an administrative public authority depending on the Justice Ministry that will act as external information channel for private organizations assisting them and establishing sanctions.

Sanctions

Spanish Law 2/2023 for whistleblowing channels distinguish between very serious, serious, and mild infringements, making a list of actions in each group (art. 63).

Very serious infringements will prescribe after 3 years, serious infringements after 2 years and mild infringements after 1 year.

The amounts of the sanctions are:

• Fiscal persons:
  • Very Serious infringements: from 30.001 to 300.000 €
  • Serious infringements: from 10.001 to 30.000 €
  • Mild infringements: from 1.001 to 10.000€
• Legal persons:
  • Very Serious infringements: from 600.001 to 1.000.000 €
  • Serious infringements: from 100.001 to 600.000 €
  • Mild infringements: up to 100.000 €

When is it compulsory in Spain?

3 months for all legal person (until de 12^th of June of 2023), but for companies between 50 and 249 employees until the 1^st of December of 2023.

Recommendation

Zafo Law can take care of the entire implementation process of the whistleblowing channel, as well as the adaptation of it to the Spanish legislations in case of having one as group of companies.

Zafo Law can also help with the management, evaluation and follow-up (in collaboration with the Compliance Body of the company) of the complaints received in the whistleblowing channel, as well as offer our legal assistance and inform about corrective measures to be adopted.

In addition, we would like to emphasize that an external whistleblowing channel will maintain greater independence and objectivity when handling complaints, and employees will feel more comfortable with an external channel.