Publications

Law 2/2023 of February 20, 2023, on the protection of persons who report breaches of the law and on combating corruption was published in the Official State Gazette on February 21, 2023. It transposes Directive (EU) 2019/1937 of the European Parliament and of the Council of 23 October 2019, known as the Whistleblowing Directive.

The law is targeted at providing suitable protection for anyone who reports acts or omissions that may amount to any of the infringements contained in the law (infringements of EU law, serious or very serious criminal or administrative infringements, among others).

To achieve its aim, the law requires certain entities to have in place an internal information channel (reporting channel), as well as a management and protection system for whistleblowers, preventing retaliation against them.

1. Who are classed as obliged entities?

Those required to have an internal information system as described in the law include legal entities in the private sector that have 50 or more hired workers.

The obligations are also targeted at political parties, labor unions, business organizations and the foundations created by any of them, where they receive or manage public funds.

2. When does it start to apply?

The deadline for having internal information systems in place is, namely three months from the date the law comes into force, which will occur twenty days after its publication in the Official State Gazette.

As an exception, that period is extended until December 1, 2023 for legal entities in the private sector with 249 or fewer workers.

3. Who is protected?

The law protects whistleblowers working in the private sector who have obtained information on infringements in a workplace or professional context, among other informants.

It applies broadly to cases where the whistleblower has obtained information disclosed (i) in the context of an employment relationship that has ended, as well as (ii) in the selection or precontractual negotiation process.

Protection measures are also set out for workers' statutory representatives in the performance of their functions relating to advising and supporting the whistleblower.

4. Prohibition of retaliation

Any acts amounting to retaliation against persons submitting a report falling under the law are prohibited.

For the purposes of the law, examples of retaliation include adopted decisions that take the form of: (i) suspension of the employment contract, (ii) dismissal or termination of the employment relationship (including failure to renew or early termination of an employment contract after the trial period has ended), (iii) imposition of any type of disciplinary measure, (iv) demotion or withholding of promotion, (v) substantial modification to working conditions and (vi) failure to convert a temporary employment contract into a permanent one, where the worker had legitimate expectations that they would be offered permanent employment, among others.

5. Penalties

The law sets out an infringements and penalties system for obliged companies, a system that treats a breach of the obligation to have in place an internal information system where required to do so as a very serious infringement, for which a penalty is imposed consisting of fines ranging between €600,001 and €1,000,000, for legal entities.