Series
Blogs
Spain – EU Whistleblowing Directive implemented
Spain – EU Whistleblowing Directive implemented
16 March 2023
Series
Blogs
16 March 2023
The Spanish Act 2/2023 on the protection of persons who report regulatory breaches and anti-corruption measures (the “Act”) was published just a few days after the European Commission had decided to take Spain, among other countries, to the CJEU for failing to transpose the EU Whistleblowing Directive 2019/1937 (the “Directive”).
The Act aims to protect whistleblowers and sets out the obligation to establish internal and external systems for reporting infringements in private and public organisations. It also sets forth detailed data protection obligations.
The purpose of the Act is to protect whistleblowers from retaliation and thereby foster a reporting culture to detect and prevent threats to the public interest. The Act also requires companies to have internal systems for handling disclosures. It applies to reports of acts or omissions that:
A very broad range of individuals are protected including those working in the public or private sector, shareholders, investors, volunteers and trainees. It also applies to whistleblowers after any work-based relationship has ended.
Companies with 50 or more employees and other regulated entities (such as public sector institutions) must establish an internal reporting channel. That should enable the disclosure of information, in writing and/or verbally, and ensure that the identities of whistleblowers and any named third parties are protected. The entity must also appoint a whistleblowing officer.
Reports must be investigated within three months, extendable for an additional three months. The entity must allow the person to which the report relates to be heard, and inform the Spanish public prosecutor's office where the alleged situation may constitute a crime.
The Act creates external public whistleblowing channels supervised by the Autoridad Independiente de Protección del Informante (the “AAI”), or by the relevant regional authority.
Any individual may inform the AAI of an infringement set out in the Act, whether in the public or private sector, directly or after making a report through an internal channel. If accepted for processing, the AAI will then investigate to check the veracity of the report and ultimately issue a decision. These proceedings cannot take longer than three months. Decisions by the AAI will not be appealable.
Finally, any person making a public disclosure will also be protected where:
The potential conflict between data protection and whistleblowing laws is longstanding, dating all the way back to the Article 29 Working Party’s Opinion 1/2006 on the application of EU data protection rules to internal whistleblowing schemes (WP117). However, those conflicts are now largely resolved given the Act implements EU law and has been designed to comply with the GDPR.
In particular, the Act contains detailed provisions on the processing of personal data of whistleblowers and other persons involved in the disclosure, retention and subsequent investigation. It repeals the previous rule contained in the Spanish Data Protection Act 3/2018 (Ley Orgánica 3/2018, de 5 de diciembre, de Protección de Datos Personales y garantía de los derechos digitales).
The key data protection requirements in the Act are as follows:
Companies must implement the internal reporting system within three months after the law comes into force, i.e. by 13 June 2023. For companies with less than 249 employees, this time limit has been extended to 1 December 2023. Companies should also review and update their data protection practices relating to whistleblowing, including their privacy notices, procedures for handling data subject rights, data deletion procedures and security requirements.