Guide to Whistleblowing

Contributing Editors

In this new age of accountability, organisations around the globe are having to navigate a patchwork of new laws designed to protect those who expose corporate misconduct. IEL’s Guide to Whistleblowing examines what constitutes a protective disclosure, the scope of regulations across 18 countries, and the steps businesses must take to ensure compliance with them.

Learn more about the response taken in specific countries or build your own report to compare approaches taken around the world.

Choose countries

 

Choose questions

Choose the questions you would like answering, or choose all for the full picture.

01. Which body of rules govern the status of whistleblowers?

01. Which body of rules govern the status of whistleblowers?

Flag / Icon

Spain

  • at Cuatrecasas
  • at Cuatrecasas
  • at Cuatrecasas

First, we must clarify that the Directive has not been transposed into the Spanish legal system yet. However, on 4 March 2022, the Council of Ministers approved a preliminary draft law transposing the Directive (the Draft). The Draft must be approved by the Spanish Cortes Generales (legislature) to become law.

This chapter will be based on the current content of the Draft.

Apart from the above, there are no other legal and regulatory obligations on employers for whistleblowing (except in certain sectors).

The most important Spanish regulations that up to now have had an impact on whistleblowing are:

  1. Section 24 of Law 3/2018, on Data Protection and the guarantee of Digital Rights authorises the creation of information systems for internal complaints regarding actions that could be unlawful and regulates some requirements that need to be met by these channels.

The content of this section has been included in the Draft and also extended.

  1. Section 31 bis of the Criminal Code states that legal entities can be exempt from liability for crimes committed by its legal representatives or persons authorised to take decisions in the name of the company (among others) if the legal entity has implemented, before the criminal offence took place, organisational and management models that include appropriate surveillance and control measures to prevent offences or reduce the risk of them occurring.
  2. Section 48.1 of Law 3/2007 on effective equality between women and men states that companies must establish workplace conditions that prevent sexual harassment. Consequently, they are required to establish procedures destined to prevent this conduct and study complaints made by victims.
  3. Section 26 bis of Law 10/2010 on the prevention of money laundering and terrorist financing establishes that entities or individuals to whom this law applies[1] must implement internal procedures that allow employees, directors, and other agents to communicate (even anonymously) relevant information regarding money laundering and terrorist financing in their company.

Additionally, entities and individuals who fall under the law’s scope must protect employees, directors or agents who report information from retaliatory, discriminatory, or unfair measures, thus establishing a soft-law mechanism.

 

[1]Section 2 of Law 10/2010 states that concerned individuals will be: credit entities; insurance companies authorized to offer life insurance or investment related insurance; investment companies; entities managing pension plans; entities managing risk-capital and risk-capital entities whose risk-capital is not managed by another entity;  mutual agreement companies; individuals who are involved in money exchanging activities; postal services regarding certain services; property developers and individuals who professionally participate in operations with a certain value; accountants, tax consultants and individuals who perform similar activities; notaries and similar public servants; lawyers; casinos; art or antiquities sellers and collectors; among others.

Last updated on 29/07/2022

02. Which companies must implement a whistleblowing procedure?

02. Which companies must implement a whistleblowing procedure?

Flag / Icon

Spain

  • at Cuatrecasas
  • at Cuatrecasas
  • at Cuatrecasas

According to section 10 of the Draft, in the private sector, natural and legal persons with 50 or more workers must establish internal information systems.

Moreover, irrespective of the number of employees, legal entities falling within the scope of European Union law regarding financial services, products and financial markets, the prevention of money laundering or terrorist financing, transport safety and environmental protection, referred to in parts I.B and II of the Annex to the Directive, will be governed by their specific regulation. In these cases, the Draft will only apply to matters not covered by said specific regulations.

Political parties, trade unions, employers' organisations and foundations created by them, insofar as they receive or manage public funds, may also implement whistleblowing procedures.

Private-sector entities that do not need to establish internal information systems but decide to do so anyway must also respect the content of the Draft.

According to section 13 of the Draft, all public-sector entities must establish internal reporting channels.

Last updated on 29/07/2022

03. Is it possible to set up a whistleblowing procedure at a Group level, covering all subsidiaries?

03. Is it possible to set up a whistleblowing procedure at a Group level, covering all subsidiaries?

Flag / Icon

Spain

  • at Cuatrecasas
  • at Cuatrecasas
  • at Cuatrecasas

According to section 11 of the Draft, Group companies as defined in section 42 of the Spanish Code of Commerce (basically, when a company has or may have, directly or indirectly, control of another company or companies), the parent company may adopt a general policy for an internal reporting system and whistleblower protection and should also ensure its application in all entities of the Group, without prejudice to the autonomy and independence of each of the companies to establish its own corporate governance system or to introduce modifications or adaptations as may be necessary to comply with applicable regulations in each case.

The Responsible for the system and an internal information system could be unique for the Group companies or there could be one for each of the companies in the group, under the terms established above.

Last updated on 29/07/2022

04. Is there a specific sanction if whistleblowing procedures are absent within the Company?

04. Is there a specific sanction if whistleblowing procedures are absent within the Company?

Flag / Icon

Spain

  • at Cuatrecasas
  • at Cuatrecasas
  • at Cuatrecasas

No. There is no specific sanction in the Draft if whistleblowing procedures are not implemented within the company. However, section 63.3.(c) establishes that “Any failure to comply with the obligations provided for in this law that is not classified as a very serious or serious infringement” will be considered a minor infringement.

Considering that the absence of a whistleblowing procedure is not expressly listed as a very serious or serious infringement, it could be argued it would qualify as a minor infringement.

According to section 65, for a minor infraction, the sanction is a fine of up to 10,000 EUR if the perpetrator is a natural person, and 100,000 EUR if it is a legal entity.

Last updated on 29/07/2022

05. Are the employee representative bodies involved in the implementation of this system? 

05. Are the employee representative bodies involved in the implementation of this system? 

Flag / Icon

Spain

  • at Cuatrecasas
  • at Cuatrecasas
  • at Cuatrecasas

Yes. Section 5 of the Draft states that the management body or governing body of each entity or body that must establish “internal information systems” will be responsible for their implementation, after consultation with the employees´ legal representatives.

Moreover, collective-bargaining agreements may also establish certain obligations in this regard.

Last updated on 29/07/2022

06. What are the publicity measures of the whistleblowing procedure within the company?

06. What are the publicity measures of the whistleblowing procedure within the company?

Flag / Icon

Spain

  • at Cuatrecasas
  • at Cuatrecasas
  • at Cuatrecasas

Section 25 of the Draft states that the company should provide appropriate information, in a clear and accessible way, on the use of internal reporting channels (or information systems, following the name given in the Draft), as well as on the essential principles of the procedure to be followed. If the company has a website, said information should be reflected on the homepage, in a separate and easily identifiable section.

Moreover, competent public authorities are also subject to publicity measures regarding whistleblowing procedures, including: conditions to be eligible for the protection reflected in the Draft; contact information regarding external channels; management procedures;  confidentiality; remedies and procedures for protection against retaliation; and the availability of confidential advice.

Last updated on 29/07/2022

07. Should employers manage the reporting channel itself or can it be outsourced?

07. Should employers manage the reporting channel itself or can it be outsourced?

Flag / Icon

Spain

  • at Cuatrecasas
  • at Cuatrecasas
  • at Cuatrecasas

Yes, the management of internal reporting channels can be outsourced as established in section 6 of the Draft. However, a third party managing the reporting channel must provide adequate guarantees of respect for independence, confidentiality, data protection and secrecy. This third party would be considered a “data processor”, whereas the person or persons appointed by the company as “responsible for the system” will still be responsible for the reporting channel, even when it is outsourced.

Management of an internal information system by a third party should not undermine the guarantees and requirements established for this system in the Draft.

Last updated on 29/07/2022

09. What precautions should be taken when setting up a whistleblowing procedure?

09. What precautions should be taken when setting up a whistleblowing procedure?

Flag / Icon

Spain

  • at Cuatrecasas
  • at Cuatrecasas
  • at Cuatrecasas

Some requirements must be met in the implementation of whistleblowing procedures: easy-to-follow guidelines, confidentiality, and good practice for monitoring, investigation and whistleblower protection.

These precautions are bolstered by sections 18 and 20 of the Constitution. These sections consolidate the rights to privacy, information and freedom of speech that influence Law 3/2018 on Data Protection and the guarantee of Digital Rights, and the Draft.

Last updated on 29/07/2022

10. What types of breaches/violations are subject to whistleblowing?

10. What types of breaches/violations are subject to whistleblowing?

Flag / Icon

Spain

  • at Cuatrecasas
  • at Cuatrecasas
  • at Cuatrecasas

Section 2 of the Draft establishes that “this law protects the natural persons who report, through any of the procedures provided for therein”:

  • Any action or omission in breach of European Union law as defined in the Annex to the Directive, regardless of the categorisation they receive under national law, and provided that they affect the financial interests of the Union as referred to in section 325 TFEU or have an impact on the internal market as referred to in section 26 (2) of the TFEU.

    This scope corresponds with that of the Directive.
  • Any action or omission that may constitute a serious or very serious criminal or administrative offence or any violation of the rest of the legal system, provided that it directly affects or undermines the public interest and does not have a specific regulation. In any case, the public interest is deemed affected when the action or omission involves economic loss for the Treasury.

    This is an expanded scope introduced by the Draft.

    Section 2 also refers to particular cases where the protection of the Law transposing the Directive will apply (for example, in reports regarding infractions of occupational hazards regulations, even if there is a specific regulation) or not (classified information, among others).
Last updated on 29/07/2022

11. Are there special whistleblowing procedures applicable to specific economic sectors or professional areas?

11. Are there special whistleblowing procedures applicable to specific economic sectors or professional areas?

Flag / Icon

Spain

  • at Cuatrecasas
  • at Cuatrecasas
  • at Cuatrecasas

Yes, for example in the finance sector (anti-money laundering) and antitrust.

Last updated on 29/07/2022

13. Who can be a whistleblower?

13. Who can be a whistleblower?

Flag / Icon

Spain

  • at Cuatrecasas
  • at Cuatrecasas
  • at Cuatrecasas

The definition given by the Draft is very similar to the one in section 4 of the Directive, namely:

  • civil servants and workers;
  • self-employed;
  • shareholders and persons belonging to the administrative, management or supervisory body of an undertaking, including non-executive members; and
  • any persons working under the supervision and direction of contractors, subcontractors and suppliers.

The Law will also apply to persons when they report or publicly disclose information on breaches obtained in a work-based relationship that has since ended, volunteers, trainees (regardless of whether they are paid or not) and persons whose employment relationship is yet to begin in cases where information on breaches has been obtained during the recruitment process or other pre-contractual negotiations.

Last updated on 29/07/2022

14. Are there requirements to fulfil to be considered as a whistleblower?

14. Are there requirements to fulfil to be considered as a whistleblower?

Flag / Icon

Spain

  • at Cuatrecasas
  • at Cuatrecasas
  • at Cuatrecasas

This is described in questions 12 and 13.

Last updated on 29/07/2022

15. Are anonymous alerts admissible?

15. Are anonymous alerts admissible?

Flag / Icon

Spain

  • at Cuatrecasas
  • at Cuatrecasas
  • at Cuatrecasas

Under the Draft, anonymous alerts are authorised. Precisely, section 7.3 establishes that “internal channels should allow the submission and processing of anonymous reports”. Moreover, as per external channels, section 17 also reflects that “communication can be carried out anonymously”.

Last updated on 29/07/2022

16. Does the whistleblower have to be a direct witness of the violation that they are whistleblowing on?

16. Does the whistleblower have to be a direct witness of the violation that they are whistleblowing on?

Flag / Icon

Spain

  • at Cuatrecasas
  • at Cuatrecasas
  • at Cuatrecasas

The Draft does not establish any obligation in this regard, so it does not seem necessary that the whistleblower must be a direct witness of the violation. However, reporting persons should have reasonable grounds to believe that the matters reported are true, a situation that is more likely to happen when the reporting person is a direct witness.

Last updated on 29/07/2022

17. What are the terms and conditions of the whistleblowing procedure?

17. What are the terms and conditions of the whistleblowing procedure?

Flag / Icon

Spain

  • at Cuatrecasas
  • at Cuatrecasas
  • at Cuatrecasas

The Draft establishes two ways of reporting: internal and external reporting.

Regarding internal report channels, communications should be written or verbal or both. Section 7.2 regulates different ways of reporting the information (post, email or any other accepted electronic means, phone or voice message, in person, among others).

Section 8 of the Draft regulates the procedure to manage information. First, the procedure may be approved by those responsible for the system and in charge of its diligent handling. Then, the agreed procedure will establish the necessary provisions for the internal information system to comply with the Law enacting the Directive. In particular, it will cover the following at a minimum:

  • an identifiable internal information system;
  • receipt of acknowledgement must be submitted within seven days to the reporting person (if identified), unless it compromises confidentiality;
  • potential contact with the whistleblower if it is deemed necessary to obtain further information.
  • additionally, the potential offender is entitled to be informed about the accusations against him or her. Such communication will take place at the time and in a manner as is deemed appropriate to ensure a proper investigation;
  • the investigated individual has a right to the presumption of innocence, a right to be heard and for their honour to be respected;
  • investigations should last no longer than three months from the date of receipt of the information. This can be extended by three additional months if the matter is particularly complex;
  • section 8.2 also indicates that clear and easily accessible information on external channels or European entities should be included; and
  • confidentiality and personal data must be respected. 

Regarding external report channels, an independent authority for the protection of whistleblowers will be established. Whistleblowers are allowed to choose that path directly or after having used internal information systems. The type (written, verbal) and means to send the report are the same as the ones for internal systems.

Once the communication has been made, it will be registered in the communications management system and an identification code will be assigned to it. The communications management system will be contained in a secure database with access restricted to the staff of the authority for the protection of whistleblowers.

A receipt of acknowledgement should be given within five business days of receiving the information (unless the reporting person is anonymous or has waived receipt of communications relating to the investigation).  

When the information is registered, it is subject to a preliminary analysis (maximum of 10 business days) by the state-level or regional-level independent authority – to see whether the report falls into the scope of the law enacting the Directive or could be considered a criminal offence. This will result in:

  • admission – to be communicated to the whistleblower, if any, within five business days; or
  • rejection – when the facts reported lack plausibility or do not fall under the scope of the Directive or, even falling under the said scope, do not affect the public interest. The rejection should be communicated to the reporter, if any, within five business days;
  • it can be admitted to the entity or body considered competent to process it or it affects the interests of the Treasury. When the facts may indicate a criminal offence, it will be referred to the Public Prosecutor's Office.

If it is admitted, investigations ensue. The investigated individual will be notified, and a succinct explanation of why he or she is being investigated will be provided. The whistleblower will have a right to make allegations in a written form, but a hearing can be arranged if there are certain risks, such as tampering with, concealing, or destroying evidence.

These inquiries will conclude in a report by the Independent Authority for the Protection of the Whistleblower or corresponding local Authority, which will close the case, begin a disciplinary procedure or transfer the case to another authority.

In any case, investigations should last no longer than three months from the date of receipt of the information.

Last updated on 29/07/2022

18. Is there a hierarchy between the different reporting channels?

18. Is there a hierarchy between the different reporting channels?

Flag / Icon

Spain

  • at Cuatrecasas
  • at Cuatrecasas
  • at Cuatrecasas

The Draft clearly states that internal reporting channels are preferred (section 4.1 of the Draft), and that external reporting channels are complementary. However, the whistleblower is entitled to choose freely between both options.

Last updated on 29/07/2022

19. Should the employer inform external authorities about the whistleblowing? If so, in what circumstances?

19. Should the employer inform external authorities about the whistleblowing? If so, in what circumstances?

Flag / Icon

Spain

  • at Cuatrecasas
  • at Cuatrecasas
  • at Cuatrecasas

The Draft does not establish specific situations in which employers need to inform external authorities about the whistleblowing. However, if the reported act or omission could be considered a criminal offence, the employer should inform the public prosecutor. If the reported act or omission could be considered an administrative infraction, the competent authority should also be informed.

Last updated on 29/07/2022

20. Can the whistleblower be sanctioned if the facts, once verified, are not confirmed or are not constitutive of an infringement?

20. Can the whistleblower be sanctioned if the facts, once verified, are not confirmed or are not constitutive of an infringement?

Flag / Icon

Spain

  • at Cuatrecasas
  • at Cuatrecasas
  • at Cuatrecasas

The Draft does not explicitly pardon those who have reported information that has not been confirmed or that simply does not constitute an infraction. However, the Draft does seem to ensure that those who reported information in good faith will not be punished.

On the contrary, those who knowingly reveal false information might be sanctioned, according to section 63 of the Draft.

Last updated on 29/07/2022

21. What are the sanctions if there is obstruction of the whistleblower?

21. What are the sanctions if there is obstruction of the whistleblower?

Flag / Icon

Spain

  • at Cuatrecasas
  • at Cuatrecasas
  • at Cuatrecasas

Sanctionable conduct is regulated in section 63 of the Draft. Obstruction of the whistleblower may be punished, depending on the circumstances, as a minor, serious or very serious infraction.

According to section 65 of the Draft, for a minor infraction, the sanction will be a fine of up to 10,000 EUR if the perpetrator is a natural person. If the perpetrator is a legal entity, this increases to 100,000 EUR.

For serious infractions, the sanction will be a fine ranging from 5,001 to 30,000 EUR if the perpetrator is a natural person. If the perpetrator is a legal entity, this increases to between 100,001 and 600,000 EUR.

For very serious infractions, the sanction is a fine ranging from 30,001 to 300,000 euros for a natural person. If the perpetrator is a legal entity, this increases to between 600,001 to 1,000,000 EUR. Very serious infractions might also result in other sanctions at the discretion of the Independent Authority for the Protection of Whistleblowers.

Last updated on 29/07/2022

22. What procedure must the whistleblower follow to receive protection?

22. What procedure must the whistleblower follow to receive protection?

Flag / Icon

Spain

  • at Cuatrecasas
  • at Cuatrecasas
  • at Cuatrecasas

If the whistleblower believes that he or she has been retaliated against, he or she should inform the corresponding Independent Authority for Whistleblower Protection – or the equivalent body in the corresponding autonomous community. This is the Authority responsible for the adoption of protection measures and for imposing sanctions under Title IX of the Draft when infractions fall under the public sector scope and in the private sector when the reported infringement affects more than one autonomous community.

Moreover, the whistleblower, if appropriate, can also inform the company (internal disciplinary powers) or even file a claim against its employer before the Labour Courts (because dismissal or other measures implemented by the company as retaliation for having reported unlawful practices will be declared null and void). As stated in section 38 of the Draft, in employment proceedings before a court, once the whistleblower has reasonably demonstrated that he or she has communicated or made a public disclosure under the Law transposing the Directive and that he or she has suffered prejudice, it will be presumed that the prejudice occurred in retaliation for that disclosure. In such cases, the person who has taken the detrimental action will need to prove that such action was based on duly justified reasons not linked to the communication or public disclosure.

Last updated on 29/07/2022

23. What is the scope of the protection? 

23. What is the scope of the protection? 

Flag / Icon

Spain

  • at Cuatrecasas
  • at Cuatrecasas
  • at Cuatrecasas

The scope of protection is regulated in sections 35 and 36 of the Draft. Specifically, to be eligible for protection, an individual must report an action or omission that falls under section 2 of the Draft (content already mentioned), provided:

  • they have reasonable grounds to believe the information is true, even if they do not provide conclusive evidence, and that said information falls within the scope of application of the Draft; and
  • they have obtained that information according to the conditions contained in the Draft.

In certain cases, protection must be denied when, for example, the information provided is not relevant, is mere rumour or is already available to the public. 

As per the protection granted by the Draft, any act constituting retaliation or threat or attempt of retaliation against whistleblowers is forbidden. The acts, threats or attempts considered retaliatory will be declared null and void.

The Draft defines retaliation as any acts or omissions prohibited by law, or that directly or indirectly result in disadvantageous treatment compared to another person in the employment or professional context, solely because of their status as whistleblowers, or because they have made a public disclosure, and provided that such acts or omissions occur during the investigation procedure or two years after the completion of the investigation procedure or from the date on which the public disclosure took place. An exception will be made where such an act or omission can be justified by a legitimate aim and the means of achieving that aim are necessary and appropriate.

By way of example, the following events can be considered retaliation:

  • suspension, lay-off, dismissal or equivalent measures (eg, early termination of a temporary employment contract once the probationary period has expired), or early termination or cancellation of contracts for goods or services, the imposition of disciplinary measures, a demotion or withholding of promotion and any other substantial modification of working conditions unless these measures were carried out within the regular exercise of management power;
  • damage, including damage to reputation, financial loss, coercion, intimidation, harassment or ostracism;
  • a negative performance assessment or employment reference;
  • blacklisting or dissemination of information in a particular sectoral area that hinders or prevents access to employment or the contracting of works or services; and
  • cancellation of a licence or permit;

Apart from whistleblowers, the protection will also extend to:

  • legal representatives when they are advising and supporting the whistleblower;
  • natural persons who, within the organisation in which the whistleblower provides services, assist him or her in the process;
  • natural persons who are related to the whistleblower and who may suffer retaliation, such as co-workers or relatives of the whistleblower; and
  • legal entities for whom he or she works or with whom he or she has any other type of relationship in an employment context or in which he or she has a significant shareholding.
Last updated on 29/07/2022

24. What are the support measures attached to the status of whistleblower?

24. What are the support measures attached to the status of whistleblower?

Flag / Icon

Spain

  • at Cuatrecasas
  • at Cuatrecasas
  • at Cuatrecasas

Whistleblowers will be granted certain support measures, according to section 37 of the Draft. For instance, first, they will be informed and advised for free on procedures and resources put in place to ensure their protection against retaliation. Second, they will benefit from assistance regarding protection against retaliation. Third, they will enjoy monetary and psychological assistance in exceptional cases if the Independent Authority for the Protection of Whistleblowers deems it adequate.

All of them, irrespective of the free legal aid foreseen under Law 1/1996.

Last updated on 29/07/2022

25. What are the risks for the whistleblower if there is abusive reporting or non-compliance with the procedure?

25. What are the risks for the whistleblower if there is abusive reporting or non-compliance with the procedure?

Flag / Icon

Spain

  • at Cuatrecasas
  • at Cuatrecasas
  • at Cuatrecasas

For abusive reporting, whistleblowers may be sanctioned according to sections 64 and 65 of the Draft. Moreover, depending on the content of the report, he or she could be committing a criminal offence.

It is also worth saying that, according to section 63 paragraph 3, non-compliance with the obligation to collaborate with the investigation is considered a minor infringement.

Finally, in certain cases, non-compliance with the procedure could lead to the investigation coming to an end.

Last updated on 29/07/2022