In brief
Spanish Official State Gazette published Law 2/2023 on 20 February 2023 (Ley Reguladora de la Protección de las Personas que Informen sobre Infracciones Normativas y de Lucha contra la Corrupción), which transposes the EU Whistleblower Directive (Directive (EU) 2019/1937 of the European Parliament and of the Council of 23 October 2019 on the protection of persons who report breaches of European Union law) into Spanish law (Ley Reguladora de la Protección de las Personas que Informen Sobre Infracciones Normativas y de Lucha Contra la Corrupción) (“Law“). The full text of the Law is available here.
The main compliance obligations imposed by the Law on entities with more than 50 employees are the following:
- Have a reporting System that complies with legal requirements (e.g., that accepts anonymous reports and acknowledges receipt within seven calendar days) and is approved by the entity’s management or governing body
- Making the whistleblowing channel available not only to employees, but also to shareholders, board members, suppliers, intermediaries, etc.
- The channel should be able to report, in addition to the possible infringements of European Union law provided for in the Directive, any “serious” or “very serious” administrative offenses and infringements as those terms are understood under Spanish law.
- Appoint a first-level manager as the person in charge of the reporting system, who must perform his or her functions independently and autonomously from the rest of the organization’s bodies
- Process the information received and respond to it within three months, which may be extended for a further three months in particularly complex matters
- Guarantee confidentiality, apply the presumption of innocence, minimize risk of defamation, and prohibit retaliation
- Forward the information to the Public Prosecutor’s Office “immediately” when the facts could be indicative of a crime. In the event that the facts affect the financial interests of the European Union, the referral must be made to the European Public Prosecutor’s Office
- Comply with a number of specific data protection obligations
Click here to access the full alert.
For further information and to discuss what this development might mean for you, please get in touch with your usual Baker McKenzie contact.
