- Purpose: Creation of a reporting channel that will protect individuals who report (i) actions/omissions in breach of EU law, (ii) actions/omissions which constitute a serious/very serious criminal/administrative offences/breach and (iii) any other breach of the legislation, if directly affects/undermines the general interest.
o ¿Which individuals? It includes (i) civil servants, (ii) employees (also volunteers, trainees, people in the recruitment process, indiviuals who are not longer employed by the company…), (iii) self-employed, (iv) individuals/legal entities related to the whistleblower (coworkers, relatives, legal representation of workers…), (v) shareholders, participants or members of the company management (including non-executive members), (vi) those who work for contractors/subcontractors/suppliers, and (vii) individuals with whom the whistlwblower has any other type of relationship in an employment context. Those who inform about (i) classified information, (ii) information covered by the duty of confidentiality of doctors/attorneys/law enforcement, and (iii) information affecting the secrecy of judicial deliberations, are not protected by this Act.
- ¿What do companies have to do?
o Companies with 50 or more employees must implement a reporting channel (internal system). This also applies to political parties, trade unions, business organizations, foundations and companies that do not have 50 or more employees, but they belong to the financial market sector.
- ¿What does this internal system consist of (reporting channel)?
o The company management has to appoint a person responsible for the internal system (it can be a person outside the company). It has to be a manager or the compliance officer (if it is a group of companies, there can be one manager for the entire group, but it will be mandatory to have one general policy applicable to all companies of the group, without prejudice to possible amendments at each company of the group). The appointment of the person in charge must be communicated to the competent independent administrative authority (the so-called “AIPI”).
o If legal representation of workers exists in the company, it will be necessary to previously initiate a consultation proceeding with this legal representation in order to be able to implement the reporting channel.
o The system must ensure confidentiality and data protection and provide the possibility of informing, verbally/in writing (or both; email, voice note, telephone, etc.), and of reporting in person, at a meeting, if the whistleblower requests so. The report can be anonymous
o An acknowledgement of receipt of the complaint must be sent to the whistleblower within 7 calendar days. All communications will be answered within 3 months, extendable to 3 additional months in very complex cases.
o Companies between 50-249 employees can share the reporting channel among themselves.
o If the company has a website, it must include on it the information on the use of the reporting channel. All employees must be informed on how to use this reporting channel.
- Public disclosure: possibility to publicly inform/disclose about the complaint and still remain protected by this law when (i) the internal or external reporting channel has been previously used and there has been no result and when (ii) it could be harmful for the general/public interest or when (iii) there is a risk of irreversible damages, retaliation, evidence tampering, etc. These requirements will not be necessary to be protected if the person hasdisclosed the information to the press.
- Prohibition of retaliation: (for 2 years, extendable if deemed necessary by the competent authority). What retaliation? Suspension of the employment contract, dismissal/termination of the employment relationship, disciplinary measures, substantial modification of the working conditions, failure to convert a temporary contract into a contract of an indefinite duration, denial of promotions, reputational damage, issuing negative references regarding your performance, denial of training or discrimination. If any of these measures are applied and the employee contests them, the company will have the burden of proof and it will have to prove that the measure in question is not related to the whistleblower’s complaint.
- Infringements and penalties (they might concur with other applicable disciplinary regimes (e.g., labor):
o Very serious infringements: retaliation, breach of confidentiality/anonymity, not having an internal reporting system, disclosing false information, etc.
o Serious infringements: failure to adopt measures to ensure confidentiality/secrecy of information, repeated misconduct, etc.
o Minor infringements: failure to cooperate in the investigation of communications, submitting incomplete information to AIPI, etc.
o Fines: individuals: between €1,001 and €300,000; legal entities (companies): between €100,000 and €1,000,000 + accessory penalties (in the case of very serious infringements), e.g., public reprimand, prohibition from obtaining subsidies/tax benefits for 4 years, or prohibition on contracting with the public sector for 3 years.
- Deadline: The internal system (reporting channel) must be implemented by 06/13/23, except for private sector companies with less or 249 employees, which must have it implemented by 12/1/23 at the latest. The external AIPI channel must be implemented by 13/09/23.
