Just this week, the new Law 2/2023 of 20 February, which regulates the protection of whistleblowers and the fight against corruption, came into force. Known as the Whistleblower Protection Act, this new law transposes the so-called Whistleblower Directive and obliges, among others, all companies with more than 50 employees to have an internal system that allows employees to report breaches of the law in the professional sphere.
These may be criminal offences or serious or very serious administrative offences, the latter including, in any case, those involving financial loss to the Treasury and to the Social Security.
Índice
Structure of the Whistleblower information system
The management body or governing body of each entity shall be responsible for the implementation of the internal information system, after consultation with the legal representation of the employees.
The information system shall ensure impartiality, respect for data, privacy and confidentiality of communications. It shall consist of two elements:
- The internal reporting channel itself, which should facilitate the submission of information by post, electronically, by telephone or even in person. Oral communications should be recorded by the whistleblower through a full recording or transcript. The system should ensure the confidentiality and privacy of the identity of the whistleblower and allow reports to be sent and processed anonymously. A private archive shall be kept of data received and internal studies conducted.
- The person responsible for the internal information system, who may be an individual or a collegial body. It is authorised by the board or management panel but performs its tasks independently and autonomously.
The principles governing the internal information system should be public. Management can be internal or external to the company.
Deadlines for action
Within seven calendar days the internal reporting system administrator shall acknowledge receipt of the communication to the reporter.
The response to the investigation proceedings may not take more than 3 months from receipt. Only in cases of particular complexity may it be extended for a further 3 months. If the facts prove to be criminal offences, the information must be sent immediately to the Public Prosecutor’s Office or the European Public Prosecutor’s Office.
Whistleblower protection measures
The fundamental objective of the Whistleblower Protection Act is to safeguard whistleblowers against retaliation. It therefore grants them protection for a minimum of 24 months.
Retaliation is defined as any act or omission involving unfavourable treatment that results in a disadvantage in the employment context solely because of their status as whistleblowers. Such acts or omissions shall be completely invalid and, where appropriate, may result in the payment of compensation.
Support measures for whistleblowers, free public advice on available procedures and remedies, legal aid in cross-border criminal and civil proceedings or even financial assistance and psychological support are also envisaged.
Fines of up to one million euros
Infringements are punishable by fines of between €1,000 and €300,000 for natural persons and up to €1,000,000 for legal persons.
What is the deadline for implementing Whistleblower in the company?
Companies with 250 or more employees must implement the system by 13 June. Companies with up to 250 employees have an additional margin until 1 December.
External reporting channels
The whistleblower may also choose to use the external reporting channel of the newly established Independent Whistleblower Protection Authority. The Authority will have to respond within three months: close the case, send it to the Public Prosecutor’s Office, transfer it to the appropriate authority or initiate sanction proceedings.
Ultimately, after disclosure through internal and external channels and the expiry of the deadlines without appropriate action, the whistleblower may make a public disclosure of the breach if it poses an imminent danger to the public interest.