The BOE nº44 of 21 February 2023 publishes the Act 2/2023, of 20 February, regulating the protection of persons who report regulatory infringements and the fight against corruption, which transposes Directive (EU) 2019/1937 of the European Parliament and of the Council of 23 October 2019 into Spanish law.
The law aims to provide adequate protection against retaliation against “whistleblowers” who report acts or omissions (i) that may constitute a serious or very serious criminal or administrative offence under national law, or (ii) that may constitute breaches of European Union, financial, tax and competition law.
The law calls “whistleblower” any person who, working in the private or public sector, becomes aware of infringements committed in an employment or professional context.
The law obliges private entities with more than fifty (50) employees, financial entities (regardless of the number of employees), and socio-political associations to have an Internal Information System (SII). In the case of the public sector, all public sector entities are obliged to have an IIS. In addition, the law creates the Independent Authority for the Protection of Whistleblowers (AAI), which will also be able to receive complaints and information.
The SII must, in general terms, allow information on infringements to be provided in a secure manner, so as to guarantee the confidentiality of the identity of the informant and of any third party mentioned in the communication, and of the actions carried out in the management and processing of the same, as well as data protection, preventing access by unauthorised personnel. It should be noted that the SII allows the submission of anonymous reports (art. 7.3 and art. 17), although in any case, all reports will be recorded on a durable medium.
The management body of each obliged entity, whether private or public, will be responsible for the implementation of the SII, after consultation with the employees; it will also be responsible for the appointment of the “System Manager”, and for his or her dismissal or removal. In the case of the private sector, the person in charge of the system will be a manager of the entity, who will exercise this position exclusively, or if this is not possible due to the size of the company, trying to avoid conflicts of interest.
Title VII of the law provides for a system of measures to protect whistleblowers against reprisals that may occur during the two (2) year period following the whistleblowing, which may be extended. Whistleblowers may also receive support, assistance, information and advice.
For this purpose, Article 38 of the law provides that persons who communicate information about violations or who make a public disclosure of violations shall not be deemed to have violated any restriction on disclosure of information, and therefore shall not incur liability for such communication or public disclosure, provided that they had reasonable grounds to believe that the communication or disclosure was necessary to disclose a violation. However, the law adds that “this measure shall not affect criminal liability”, so that the informant could, where appropriate, be charged with an offence of disclosure of secrets (Articles 197 to 201 of the Criminal Code).
There is also a “clemency regime“, as whistleblowers who have participated in the infringements may be exempted from or attenuated the corresponding sanction.
Title IX of the law contains the system of penalties for non-compliance with its provisions, with the AAI or equivalent regional bodies having the power to impose penalties. The penalties may amount to up to 300,000.00 Euros in the case of natural persons and 1,000,000.00 Euros in the case of legal persons; as well as other additional measures for a period of four (4) years, and the impossibility of obtaining subsidies or contracting with the public sector for a period of three (3) years.
The protection provided for in the law shall not apply to information affecting classified information, nor to the obligations resulting from the protection of the professional secrecy of the medical and legal professions, the duty of confidentiality of the Security Forces and Corps in the scope of their actions, as well as the secrecy of judicial deliberations.