Spain becomes the 18th Member State to approve a new law on the protection of whistleblowers

Spain approved a new whistleblower law only one day after being referred to the Court of Justice. Law 2/2023 on the protection of persons who report breaches of the law and on combating corruption was published on 21 February and entered into force on 13 March 2023. 

With the approval of Law 2/2023, Spain became the 18^th Member State to implement the Whistleblowing Directive. 

Legislative process of the whistleblower law in Spain 

As with most Member States, Spain did not meet the initial deadline and the first draft Bill for transposing the EU Whistleblower Directive was not published until 13 September 2022. Spain was included in the infringement procedures initiated by the European Commission in 2022, and in February 2023 Spain was referred to the European Court of Justice for failure to transpose and notify national measures for transposing the Directive.

Only one day later, on 16th February, the Spanish Senate approved new legislation on the protection of whistleblowers. The law aims to provide suitable protection for persons reporting acts or omissions that may amount to any of the infringements contained in the law. This includes both infringements of Union Law as well as serious or severe criminal or administrative infringements.

In this article, we’ll have a closer look at the details and most important aspects of the Spanish whistleblower law together with Maria Bobóc, Territory Manager at Whistlelink.

For more information, please also read our article written by Whistlelink Partner Ecija: Legislative process of the Spanish Whistleblowing law.

Spanish whistleblower law: Scope of application

Obliged entities must have an internal reporting channel in place, as well as management and protection systems for preventing retaliation against informants.

This includes for the private sector:

• Legal entities with 50 or more employees.
• Certain legal persons in the financial sector or with obligations relating to the prevention of money laundering or terrorist financing, or transport and environmental security.
• Political parties, trade unions, business organisations, and foundations dependent on them, provided that receive or manage public funds.

The law allows companies in the private sector with between 50 to 249 employees to share internal reporting channels as well as resources for receiving and processing complaints. In addition, groups may have a common reporting system and appoint a single person to be responsible.

For the public sector, the law has extended the obligation to have internal reporting channels to its full extent. All public entities must set up a secure reporting system regardless of the number of employees.

Deadlines: 

The deadline for implementing internal reporting channels is three months from the date the Spanish whistleblower law came into force. In other words, private companies employing 250 or more employees have until 13 June to become compliant. Companies with 50 to 249 employees have until 1 December 2023. 

Sanctions:

For obliged companies, the law sets out an infringements and penalty system with three categories – minor, serious and very serious.

• A breach of the obligation to have an internal reporting system is a serious infringement, with fines ranging between €300,000to €1,000,000 for legal entities.  
• The very serious bracket can result in a public reprimand or a ban on tax benefits for a period of up to four years, or a ban on public sector contracting for up to three years.
• The sanctioning procedure will also consider fines of up to €300,000 for individuals who aim to hinder disclosure or prevent investigation.

Communication or public disclosure of information, knowing it to be false, will also be punishable by law. Fines imposed in the Spanish law are the highest in Europe.

Anonymous reporting:

Anonymous reports are allowed, and the whistleblowing system must contain the necessary mechanisms to make this possible. 

Other details about the whistleblower law in Spain:

A response to the reporting person about the investigation process must be provided within three months, although this period of time may be extended for a further three months if the complaint is complex.

An Independent Authority for the Protection of Informants, depending on the Ministry of Justice endowed with sanctioning power, will be created to manage an external reporting channel.   

You can visit our page about National whistleblower laws in the EU to learn more.

Would you like to discuss a safe and secure whistleblowing solution for your organisation? Please book a free demo!