Whistleblowing or the law to protect those who report corruption and other offences

The Official State Gazette has published the new Act 2/2023, regulating the protection of people who report serious regulatory irregularities. The text comes from the Whistleblowing Directive (EU 2019/1937) of the European Parliament and of the Council of 23 October 2019. The law gives companies three months to adapt. However, this is extended to 1 December 2023 for companies with fewer than 250 workers.

The purpose of the law is to protect people against possible reprisals when, in work contexts, they detect serious or very serious criminal or administrative offences and report them through the mechanisms provided. The law thus protects people against acts or omissions that may infringe European Union Law. When they affect the financial interests of the Union or affect the internal market. The law also deals with criminal or administrative offences that involve economic harm to the Public Treasury and Social Security.

The protection extends to all those who have professional or work ties with public and private sector organisations. It also protects people who provide assistance to those reporting offences and people close to them who may suffer reprisals.

The internal reporting system is regulated and covers both the channel for receiving the information, as well as the person responsible for the system and the procedure. This channel must be established as the preferred way to channel information. However, whistleblowers can choose to use the internal or external channel, based on the circumstances and the risks of reprisals they consider they face. Anonymous reporting is allowed and the whistleblower is protected, except in cases in which a national regulation requires their identity to be disclosed or it is requested in the context of court proceedings.

The public sector organisations required to have an internal reporting system are Public Administrations and their dependent bodies or entities, independent administrative authorities, universities, public sector companies and foundations, as well as public law corporations, and constitutional bodies, or those of constitutional relevance, included in the statutes of autonomy.

An external channel is also planned for reporting offences and to guarantee independence and autonomy in the receipt and processing of information. It will be implemented by the Independent Authority for the Protection of Whistleblowers, which is responsible for receiving and processing the information. The procedure for receiving communications may be anonymous or with the whistleblower’s identity concealed. The details of the admission procedure and investigation by the Independent Authority for the Protection of Whistleblowers, culminating with the issuance of a report, are set out. The authority’s decision cannot be appealed. The law also sets out the whistleblower’s rights and safeguards and the possible implementation of external reporting channels by autonomous communities.

The Independent Authority for the Protection of Whistleblowers is an independent administrative authority. It fulfils various legal functions such as managing the external reporting channel, putting protection in place for whistleblowers within the scope of its powers, providing mandatory information during the initial stages of formulating general provisions that affect the scope of its powers and functions, carrying out penalty procedures and imposing penalties, and promoting and encouraging a reporting culture.