Spain’s new Whistleblower Protection Authority: What you need to know

Spain has taken a significant step in protecting whistleblowers with the creation of the Autoridad Independiente de Protección al Informante (A.A.I.), an independent authority created under Law 2/2023. This new Whistleblower Protection agency offers a secure, anonymous external reporting channel to complement internal reporting systems in both public and private sectors. The A.A.I. aims to protect individuals who report regulatory violations, fraud, and ethical breaches, ensuring that whistleblowers are safeguarded from retaliation.

Purpose and mandate of the A.A.I.

In line with the EU Whistleblowing Directive, which encourages member states to establish frameworks for whistleblower protection, the A.A.I. was established under the Ministry of Justice but operates independently of government control. It is tasked with handling complaints from both the public and private sectors, and key responsibilities include:

• Providing a secure, external reporting channel for whistleblowers who feel unsafe using internal channels.
• Protecting whistleblowers from retaliation, including maintaining their anonymity throughout the process.
• Investigating complaints related to regulatory breaches, fraud, and corruption.
• Imposing penalties on organisations that retaliate against whistleblowers or fail to maintain secure reporting systems.
  
  

Under the new law, Spanish organisations with more than 50 employees, as well as all public entities, must implement secure reporting channels. Failure to comply may lead to fines of up to €1 million, emphasising the importance of creating safe environments for reporting unethical behaviour.

Key structures of the Whistleblower Protection Authority in Spain

The A.A.I. is structured to ensure impartial management and effective oversight. It comprises several bodies:

1. The Presidency: Leads the A.A.I. and ensures the smooth functioning of its departments.
   
   
2. Advisory Commission for the Protection of Informants: A consultative body composed of experts from institutions such as the Spanish Prosecutor’s Office and the Bank of Spain.
   
   
3. Informant Protection Department: Manages the external communications channel and implements protection measures for whistleblowers.
   
   
4. Monitoring and Sanctioning Department: Oversees investigations and issues guidelines and recommendations to improve compliance practices.
   
   
5. General Management: Handles internal functions such as human resources and information systems.

Ensuring protection and accountability

The A.A.I. provides an additional channel for Spanish citizens to report misconduct. Once a report is received, the authority will assess the complaint, carry out necessary investigations and, if deemed credible, refer it to the Public Prosecutor’s Office or other relevant authority. Whistleblowers are granted anonymity, and any retaliation against them is subject to penalties.

Organisations that fail to establish or maintain secure reporting systems face severe consequences, including potential fines up to €1 million. For transparency and accountability, organisations must communicate the appointed owners of the reporting channel to the A.A.I. Any changes to these designated individuals must be reported within ten working days to the A.A.I. or regional authorities, with a clear explanation of the reasons for any dismissals.

Furthermore, the A.A.I. extends its support to whistleblowers by offering legal, psychological, and even financial assistance, reinforcing Spain’s commitment to safeguarding individuals who expose wrongdoing.

Coordinated regional integration for whistleblower protection

To ensure consistent whistleblower protection across Spain, regional authorities may set up their own independent whistleblower protection bodies or partner with the central A.A.I. This coordinated approach ensures that protection mechanisms are uniform across the country. The A.A.I. also serves as an advisory body, offering guidance both to the government and the private sector on best practices for whistleblowing.

Additionally, the A.A.I. is required to publish an annual report by March each year, summarising activities from the previous year. This report will cover the number and types of reports submitted, investigations and outcomes, pending cases, and general actions taken, including resource estimates and financial claims from legal proceedings. The report will be publicly accessible to enhance transparency in Spain’s whistleblowing system.

Moving forward: Ensuring compliance and ethical governance

With the new Whistleblower Protection Authority now operational in Spain, it is crucial for companies to promptly implement secure internal reporting channels. Failing to do so could lead to costly consequences, including reputational damage and fines of up to €1 million.

The establishment of the A.A.I. highlights the importance of having robust systems in place to protect whistleblowers and create a safe environment for reporting unethical activities. Spanish organisations must act quickly to comply with the requirements set by the new authority, not only to avoid penalties but also to support Spain’s broader commitment to ethical governance and anti-corruption efforts.