In our latest update on how the EU Whistleblowing Directive is being implemented across Europe, we focus on recent developments in Spain.

Whistleblowers in Spain currently have very little legislative protection, with existing provisions limited to certain types of complaint (e.g. money laundering) and certain sectors (e.g. financial institutions).  To comply with the much broader requirements of the Directive, Spain has recently issued a new draft law that seeks to protect those who raise allegations about breaches of EU law (as defined in the Directive), as well as other acts or omissions that breach Spanish law and “affect the general interest” (a precaution to limit the scope for use of the law to pursue personal agendas in individual disputes).  As you would expect, given the minimum requirements are set out in the Directive, most of the new obligations in Spain are similar to those we have already outlined for Germany and France. There are, however, a few important differences for employers to note.  

Key points for businesses operating in Spain are:  

• In the private sector, employers with 50 or more employees will be required to establish internal reporting channels to allow whistleblowers to raise their concerns. All entities in the public sector will be required to do the same, irrespective of how many people they employ.  Such systems must: (i) have a member of management or the governing body of the entity responsible for them; (ii) be established in a secure manner that guarantees confidentiality; (iii) allow concerns to be raised either verbally or in writing; and (iv) be independent and clearly differentiated from other internal reporting systems. The draft law allows for those systems to be managed internally or externally, e.g. by an external third party. Furthermore, companies with between 50 and 249 employees will be able to share internal reporting channels and resources for managing complaints. Group companies will be able to establish either a common reporting channel for the group or separate ones for individual group companies.  

• Whistleblowers will also be able to raise their concerns externally via a newly created body, the  Independent Authority for Whistleblower Protection (AIPI).  Within 10 days of receipt of a complaint, the AIPI must determine whether it is admissible or not, i.e. whether the facts lack plausibility or do not constitute an infringement even if true, the communication lacks obvious evidential grounds or it is determined that the information could have been obtained illegally. It must then issue a report that includes at least a statement of the facts, the code of the communication, date of registration, clarification of whether the communication is urgent, actions taken and conclusions reached, and then either (i) close the file; (ii) refer the matter to the Public Prosecutor’s Office or the European Public Prosecutor’s Office in the case of criminal facts affecting the financial interests of the EU; (iii) transfer the matter to the relevant competent authority; or (iv) initiate a procedure for issuing a sanction. There is no right to appeal against the findings in the report.  

• As whistleblowers will have the right to remain anonymous, both internal and external reporting systems must have measures in place to ensure confidentiality. The informant’s identity can only be communicated to the Judicial Authority, the Public Prosecutor’s Office or the relevant administrative authority within the context of a criminal investigation.

• In line with the Directive, the draft law extends protection to a wide range of individuals who obtain the information in a work or professional context, including employees, the self-employed, shareholders, individuals working for and under the supervision and direction of contractors, subcontractors and suppliers, volunteers, etc.  It also extends to individuals who have assisted the whistleblower within the organisation or who are related to them, and may suffer reprisals on that basis, e.g. co-workers or family members.   

• As you would expect, employers must not retaliate against whistleblowers, e.g. instigate disciplinary action against them, subject them to detriment or other less favorable treatment, make any threats, etc., because they have made a protected disclosure. In addition, whistleblowers must have access to free and accessible state-provided information and advice on available procedures and remedies, effective assistance to protect them against retaliation and financial and psychological support on an exceptional basis.

• In terms of sanctions, the AIPI and the relevant competent authorities will have the power to issue sanctions for breaches of this new law. Individuals will be subject to fines ranging from €10,000 for minor infringements up to €300,000 for very serious infringements. Fines for employers range from €100,000 for minor infringements up to 1,000,000 euros for very serious breaches. For very serious infringements, the AIPI may also issue a public reprimand, a ban on obtaining state subsidies or other tax benefits for up to four years, and a ban on contracting with the public sector for the same period. Note that these are for failure to comply with the structural obligations under the new law (creation of systems, confidentiality, access to information and support, etc.) and are on top of any compensation which may be awarded to individuals who are subject to denial of rights or retaliation by their employer.

Next steps

The proposed new law is currently still in draft form without a clear implementation date as yet. Affected companies will have three months from entry into force of the new law to establish the relevant internal reporting channels – or six months within which to adapt any existing reporting channels. Companies with between 50 and 249 employees will have until 1 January 2023 to comply, but this may clearly slip if implementation is much further delayed.  

As in other European countries we have been discussing, affected employers (meaning those with operations in Spain, not just those incorporated or with their HQ in that country) should now be reviewing any existing internal reporting channels or establishing new internal ones to ensure they satisfy the requirements outlined above. If you would like to discuss the implications of the new implementing legislation in Spain, please speak to Ignacio Regojo, Juan Nasarre, or your usual contact in our Spanish Labour & Employment team.