Is my company required to implement a whistleblowing channel?

On February 16, 2023, the Spanish Congress passed Law 2/2023 regulating the protection of persons who report regulatory breaches and combating corruption, which transposes Directive 2019/1937 of the European Union. The Law requires companies and entities to set up a whistleblowing channel, or internal reporting channel, so that employees, or any third party working with them, can make reports anonymously. It also enables them to inform the company of conduct that departs from ethical standards or is allegedly unlawful

.

The purpose of this law is to protect persons who, in a work or professional context, detect acts or omissions that may constitute criminal offenses or serious or very serious administrative infringements and report them through the mechanisms it regulates.

What is a whistleblowing channel?

An internal whistleblowing channel, or reporting channel, is an alert system. It notifies the unit responsible for regulatory compliance of alleged malpractice in the management of a company or organization. The aim is to identify such alleged malpractice that may pose a risk to the organization so that it can be combated. Through this channel, whistleblowers transmit information via a secure system that must prevent leaks that could damage the company’s reputation.

The priority of these channels is to protect the persons who make reports, particularly those who work in the organization or have ties to it. The tool must allow the report to be made on a completely confidential basis and, where applicable, anonymously, if the informant (whistleblower) so wishes.

Some of the situations that could be reported through this channel are:

• Possible conduct and behavior considered unlawful in the performance of work,

• Alleged use of company resources for profit,

• Situations of discrimination or sexual abuse,

• Corrupt practices, theft, fraud, etc.

New obligations

The Directive imposes an obligation on Member States, requiring the creation of reporting channels, both internal and third-party to the organization, that guarantee confidentiality.

To this end, 3 levels are established:

• A whistleblowing channel within the entity itself, at the internal level.

• If this channel does not perform its function adequately, the next level would be the channel of the competent authorities.

• If the authorities do not act, or imminent dangers are foreseen, the rules provide for the use of the media.

Public institutions and private companies with more than 50 employees or €10 million in revenue will be required to comply with these new rules.

EU Member States may require entities with fewer than 50 workers to establish such channels if risks exist.

The Directive provides for the protection of persons who report irregularities in the areas of public procurement, financial services, money laundering, or terrorist financing.

It also covers transport safety, environmental protection, food safety, public health, animal health, consumer protection, data protection, and tax regulations.

The Law on the protection of persons who report regulatory breaches and combating corruption entered into force on March 13.

Companies required to create whistleblowing channels will have to do so within 3 to 9 months, depending on the size of their workforce.

Who must have a whistleblowing channel?

The new Law requires all companies with more than 50 people in their workforce and public sector entities to implement confidential and secure whistleblowing channels.

The companies required to create these whistleblowing channels are:

• Individuals or legal entities with businesses employing 50 or more people.

• Financial sector companies or legal entities that, although not domiciled in Spain, carry out activities through branches or agents without a permanent domicile.

• Political parties, trade unions, employers’ associations, or foundations created by them that receive public funds.

• Groups of companies.

What is the deadline for creating effective whistleblowing channels?

There are two different deadlines for creating whistleblowing channels:

• Companies with more than 249 people in their workforce: 3 months (deadline: June 13, 2023).

• Companies with between 50 and 249 employees: 9 months (deadline: December 1, 2023).

• Municipalities with fewer than 10,000 inhabitants: 9 months (deadline: December 1, 2023).

How does it work?

Whistleblowing channels must be fully confidential and must never disclose the whistleblower’s identity. The report may be made in writing, through an online platform, or verbally.

Once a worker reports a situation, they must receive an acknowledgment of receipt of their report within 7 days.

It will be mandatory to designate a contact person to maintain communication with the whistleblower and follow up on the status of the report.

A response must be provided within a reasonable period, which may not exceed 3 months from the acknowledgment of receipt.

Naturally, the General Data Protection Regulation must be complied with.

All information must be kept in a register of reports for as long as deemed necessary.

Fines and penalties

The Member States of the European Union consider it essential to establish criminal, civil, or administrative penalties to ensure that no retaliation is taken against whistleblowers.

In fact, the Law provides for penalties of up to €1 million for companies.

Fines may range:

• From €1,001 to €300,000 for individuals.

• From €10,001 to €1,000,000 for legal entities.

Likewise, penalties will be imposed on persons who file false reports and on companies that disclose such reports.