Spain approves draft law to strengthen protection for whistleblowers

The new rules aim to establish a high level of protection for persons who report breaches of EU and national law, to offer secure reporting channels within an organisation and to public authorities, and to impose proportional and dissuasive sanctions on anyone promoting retaliation, or retaliating, against whistleblowers.

Background

The new law, which transposes Directive (UE) 2019/1937 of the European Parliament and of the Council, of 23 October 2019, on the protection of persons who report breaches of Union Law (EU), also known as "whistleblowers", sets out in its Explanatory Memorandum many examples of civil actions warning of the existence of irregular and corrupt practices. These whistleblowing actions have enabled investigations ending with corresponding criminal sentences for the reported behaviours. However, there have sometimes also been painful consequences for those who have reported corrupt practices and other offences: including whistleblowers being pressured by the accused parties, isolated by colleagues, or unfairly dismissed.

As a result, the draft law, which regulates protection measures for anyone reporting law infringements or anticorruption violations, aims to defend whistleblowers and set out the minimum rules for the reporting channels that whistleblowers can use.

Prohibition on retaliation and protection measures

The new law forbids and declares null any behaviours that could be classified as retaliatory that are adopted within two years of completion of the inquiries. The law gives examples, without limitation, of several unjustifiable behaviours towards whistleblowers that are considered retaliatory: termination of contracts, intimidation, unfavourable treatment, reputational damage and cancellation of leave.

As protection against retaliatory action, the law leaves without effect any contractual clauses or provisions that prevent or aim to limit the right or capacity to inform, such as confidentiality clauses or conditions that reflect express waivers. In addition, whistleblowers will be exempt from any liability for having obtained relevant information and the burden of proof is reversed in any procedure that a whistleblower may initiate to claim any damages.

The protection measures are aimed both at whistleblowers and at anyone referred to in the events reported in the communication.

These individuals retain all rights of judicial protection and defence, access to their file, confidentiality (including as to their identity), the presumption of innocence, or even financial assistance or psychological support: the same rights that whistleblowers enjoy.

Finally, the advantages and efficiency that leniency policies have shown in some sectorial regions have led to including a specific regulation of these policies, in which particular conditions are required for their proper application.

Internal reporting systems

Internal information systems must meet specific requirements, such as (among other things) their unrestricted use, confidentiality guarantees, good follow-up practices, investigation, and protection for whistleblowers.

Under the Directive, entities in the private sector with more than 50 workers will have to establish an internal reporting system. Regardless of the number of workers, all political parties, trade unions, and business organisations, as well as any foundations that depend on them, that receive public funds for their financing, must have an internal reporting system.

In the public sector, the law has applied to its full extent the obligation of establishing internal reporting channels. Therefore, public administrations, whether territorial or institutional, as well as independent authorities or other bodies that manage social security services, universities, public companies, foundations, and public law corporations, must set up this system.

External reporting channel

The new law acknowledges that one of the main factors discouraging potential whistleblowers is the lack of trust in the effectiveness of the communications. 

To that end, the law regulates the external reporting channel, an external communication channel managed by the corresponding Independent Authority for the Protection of Whistleblowers and governed by the principles of independence and autonomy when receiving and processing any information on infringements. This authority has the independence and freedom to guarantee the information's comprehensiveness, integrity, and confidentiality, prevent personnel from accessing it and enable its durable storage.

Penalties

The regulations, in addition to prohibiting reprisals, consider a detailed penalty system for any acts or omissions that limit the rights and guarantees set out in this law, mainly any directed at obstructing, preventing, frustrating, or slowing down the information. Likewise, the new regulations will also penalise any communication or disclosure of infringements of the legal system, knowing that these are false.

This sanctioning procedure considers fines of up to 300,000€ for natural persons and up to 1,000,000€ for legal persons.

Osborne Clarke comment

Culture is an essential element of any compliance programme, as is having a tool to disclose non-compliance activities, that is, a reporting channel. 

With the new regulations, organisations must convince their members that using a reporting channel to reveal breaches in the law does not make the person reporting an "informant" but rather someone who defends the legality that contributes to creating a society that does not tolerate corruption, and who, in future, will be better protected against any likely punishment.