November 17, 2022
Following the introduction of criminal liability of legal persons in the Spanish Criminal Code, together with the boom in the implementation of Compliance Systems in private companies (in order to generate confidence in the markets and raise corporate reputation), the need arose to establish certain communication/whistleblowing channels through which improper or criminal conduct committed within these companies could be reported.
However, in practice there were certain aspects that could affect the normal functioning of these communication/whistleblowing channels, to the point of rendering them inefficient. Furthermore, the regulation of whistleblower protection was fragmented in the diverse legal systems of the different European Union Member States.
In this context, Directive (EU) 2019/1937 of the European Parliament and of the Council of 23 October 2019 was enacted, which aims to impose “common minimum standards providing for a high level of protection” for all persons who report acts or suspicions of corruption or fraud or infringements of European Union law, whether in public or private entities, taking into account that most reports are made by company personnel or persons close to the company.
The Directive sets out the following key objectives:
- establish internal and/or external whistleblowing channels;
- impartially follow up on reports;
- implement a real and effective whistleblower protection system;
- prohibit any retaliation against whistleblowers;
- promote measures to support and protect against reprisals;
- respect confidentiality and the proper processing and recording of personal data;
- do not restrict the possibility to report on the basis of contractual obligations;
- establish a regime of effective, proportionate and dissuasive sanctions; and
- implement protection measures also for the persons reported (rights of judicial protection and defence, access to the case file, confidentiality, identity secrecy and presumption of innocence).
Subsequently, the UNE-ISO 37002:2021 standard on Whistleblowing Management Systems was published in October 2021, whose clear and exemplary guidelines and recommendations can be developed, to a greater or lesser extent, depending on the specific characteristics of each company (size, activity, business model, etc.), in order to achieve the highest international quality standards.
By virtue of this, it can be said that whistleblowing channels can be internal or external, verbal, written or digital, as well as open, confidential or anonymous.
The most common methods for receiving communications/reports may include personal conversations, telephone lines, online or digital reports, mobile applications, email, post or internal mailbox.
For partial or full outsourcing of the management of whistleblowing channels, a specialised provider should be appointed to ensure impartiality of treatment. Even so, companies should ensure that they assign responsibility and authority over the outsourced functions to someone within the company.
However, although many obstacles have now been overcome in the implementation of whistleblowing channels, there are still some controversies that generate debate, among which we can exemplify the following:
- how to deal with a whistleblower who deliberately makes false allegations;
- complications to investigate and protect the whistleblower and to guarantee the right of defence of the accused in the case of anonymous reports;
- acknowledgement of the whistleblower; and
- mandatory reporting.
Finally, it should be noted that, since Directive (EU) 2019/1937 is mandatory for Member States to transpose, they must adopt the necessary internal laws, regulations and administrative provisions to order the implementation of whistleblowing channels. However, to date, only 16 of the 27 Member States have transposed the rule, despite having expired the deadline of 17 December 2021.
Spain is among the 11 Member States with pending transposition. Recently, on 13 September 2022, the Draft Law regulating the protection of persons who report regulatory infringements and the fight against corruption was submitted to the Spanish Parliament. If approved, its most innovative contributions will be:
- whistleblower protection extends to all persons linked to public or private entities, even if their relationship has ended, as well as to persons close to the whistleblower, and to legal persons owned by the whistleblower;
- the regulation of an internal information system, which covers the channel for receiving information, the person responsible for the system and the procedure;
- the admission of anonymous communications; and
- the creation of an external channel managed by the Independent Whistleblower Protection Authority (“Autoridad Independiente de Protección del Informante” or “A.A.I.”, in Spanish), as a complementary means to the internal communication/whistleblowing channel, with guarantees of independence and autonomy to adopt whistleblower protection measures, process procedures and impose sanctions, and draw up recommendations and criteria for proper compliance with the law.
Finally, the Draft establishes that, in general, administrations, bodies, companies and other entities obliged to have an internal information system must implement it within a maximum period of three months from its entry into force (considering the current state of the Draft, the amendments and deliberation phase, final approval by Parliament, sanction and promulgation by the King, and publication in the Official State Gazette are pending, which could take approximately five months). As an exception to the above, private companies with less than 249 workers and municipalities with less than 10,000 inhabitants will have a longer implementation period, which will be established in the current law.
The information contained in this note should not in itself be considered as specific advice on the matter under discussion, but only as a first approach to the subject matter, and it is therefore advisable that the recipients of this note obtain professional advice on their specific case before taking specific measures or actions.