Implantation of the Whistle-blower Channel and protection of reporters

ENTRY INTO FORCE OF LAW 2/2023, PASSED ON 20 FEBRUARY, TO GOVERN THE PROTECTION OF PEOPLE WHO REPORT ON REGULATORY BREACHES AND THE FIGHT AGAINST CORRUPTION
 
With the arrival of Law 2/2023, passed on 20 February, hereby transposing into Spanish Law  the Directive (EU) 2019/1937 of the European Parliament and Council, dated 23 October 2019 relating to the protection of persons who report on breaches of Union Law, also referred to as the Whistleblowing Directive, and which has had its coming into force delayed by more than a year.
 
The aim of this legal rule is dual, firstly, to protect physical persons vis-à-vis reprisals, who in an employment or professional setting detect serious or very serious criminal or administrative breaches. Alongside this, it aims to bolster a culture of information within organisations for the prevention and detection of threats against the public interest.

Below, a response is given to the main issues that may arise from this Law:

• When does the Law come into force and how long will be given to implant the internal information system?
• Who is obliged to provide an internal information system in the private sector?
• What type of information may be disclosed via this channel?
• Who does this Law protect and who can report?
• Who will be entrusted with the implantation of the internal information system?
• Which figure is the “information system controller”?
• How is the internal information system applied to company groups?
• Which principles must be upheld in the company’s internal information system?
• Can the running of the whistle-blower channel be outsourced by the company?
• Can the internal information system be shared between companies?
• What forms the minimum content of the information management procedure?
• What publication and registry regime is applicable to the companies’ whistle-blower channels?
• Protection for the whistle-blower: What does the prohibition of reprisals entail?
• What are considered incidents of reprisals?
• What type of support measures are established?
• What sanctioning system will be in place if I am in breach as a company?

All of the responses can be found in the following expanded document: