Background
National whistleblower protection laws varied considerably in scope across the European Union and the EU Whistleblowing Directive has sought to bring the confusing patchwork legal situation to a single and comprehensive standard across all member states.
Spain was among the long list of member states that failed to transpose the EU Whistleblowing Directive by the original 17 December 2021 deadline. Previously, Spain did not have a national whistleblowing law and protection was considered limited. Local legislation passed in autonomous regions’ parliaments covered certain aspects of whistleblower protection while some sectors did have their own limited provisions to shield people reporting wrongdoing.
The path towards a comprehensive new national law and implementation of the Directive was slow with the Ministry of Justice only approving draft legislation on 13 September 2022. While broadly welcomed, the draft was criticised and a number of amendments were suggested.
The draft made headway in parliament in December 2022 while the European Commission launched infringement proceedings against Spain for the protracted transposition in mid-February 2023. The Senate approved the new law shortly afterwards, and Spain became the 18th EU member state to adopt the EU Whistleblowing Directive.
The scope of the new whistleblowing law in Spain
Under the new whistleblowing law in Spain, all companies with more than 50 employees are obliged to establish internal reporting channels. As already mentioned, companies with more than 250 employees had to implement this measure by the middle of June 2023 while smaller organisations were given an extended deadline near the end of the year.
Several sensitive sectors have to establish reporting channels irrespective of staff numbers and they include certain legal positions within finance, entities with an obligation to prevent money laundering or terrorist financing, transport and environmental security, trade unions and all political parties.
The legislation protects individuals reporting breaches of EU law as well as serious criminal and administrative offenses under Spanish law. As well as shielding employees, it extends protection to volunteers, trainees, individuals in the hiring phase, individuals assisting the whistleblower and personal contacts of the whistleblower who may suffer retaliation.
Whistleblowing channels: the specifics
A major point of contention regarding the EU Whistleblowing Directive concerns group-wide sharing of whistleblowing systems, particularly among large companies. The latter stipulation is absent from both the Directive and the new Spanish law. However, Spain’s legislation does allow private sector entities with between 50 and 249 workers to share internal reporting channels as well as the resources to process them.
The internal reporting channel must allow for complaints to be made verbally or in writing while receipt of the communication must be acknowledged within seven days. Anonymous reporting is allowed and the whistleblowing system must contain the necessary mechanisms to make this possible. The management or governing body of an organisation must also appoint a person or body to take charge of the whistleblowing system.
A response about the investigation process must be provided after three months, though this can be extended for a further three-month period if the complaint is complex. Personal data collected during proceedings can be stored for a maximum of three months unless further action is required, whereby it can be stored for a longer period.
Protection against retaliation
- Under the law, acts constituting retaliation against whistleblowers and third parties are prohibited. The legislation sets out a number of different acts that can be considered reprisals:
- Discrimination and unfavourable/unfair treatment
- Blacklisting
- Negative evaluation/feedback/references
- Economic damage or loss
- Suspension of contract/dismissal
- Denial or cancellation of licenses/permits
The law does not take into account reports linked to complaints about interpersonal conflicts as well as information that is already known or in the public realm. It also neglects information considered hearsay which cannot be considered credible.
Infringements and penalties
- If the whistleblower has participated in the commission of the offence, they may be considered exempt from sanction if they have ceased committing the offense, cooperated with the investigation, provided truthful information or made a reparation for any damage caused. If these requirements are not met in full, the relevant authority may impose sanctions on the whistleblower.
- For organisations, infringements fall into three categories – minor, serious and very serious. Financial penalties range from €1,000 to €300,000 for offences committed by natural persons and they climb as high as €1 million for legal persons. The very serious bracket can result in a public reprimand or a ban on tax benefits for period of up to four years. A ban on public sector contracting can also be imposed for a maximum period of three years. Penalties of between €600,001 and €1,000,000 may also be published in the Official State Gazette.
Conclusion
After a period of stagnation, late 2022 saw a number of EU member states drive their transposition processes forward and new laws were enacted in Belgium, Bulgaria, Finland, Greece and the Netherlands. Spain is a welcome addition to the club of countries with new whistleblowing laws in place. Madrid’s comprehensive new national legislation brings an end to a fragmented, ineffective and outdated regional protection framework while ushering in a new era of certainty for Spanish whistleblowers.
Whistleblowing Laws in the European Union
A glance at the implementation of the EU Whistleblowing Directive in EU Member States
