Entry into force of Law 2/2023, of February 20, regulating the protection of individuals who report legal violations and the fight against corruption.

On February 20, Law 2/2023, of February 20, regulating the protection of individuals who report legal violations and the fight against corruption, was approved.

This Law, which came into force on March 13, transposes the so-called “Whistleblowing Directive,” Directive (EU) 2019/1937, of the European Parliament and of the Council, of October 23, 2019, which aims to protect individuals who report violations of Union law and establishes easily accessible channels of information, ensuring confidentiality and prohibiting possible retaliation against whistleblowers.

The purpose of this Law is to provide adequate protection against retaliation for individuals who report violations or non-compliance. Likewise, it aims to strengthen the culture of information, the integrity infrastructures of organizations, and communication as a mechanism to prevent and detect threats to the public interest.

The law protects, therefore, the individual whistleblowers who work in the private or public sector and who have obtained information about infringements in a work or professional context and who report, through the mechanisms provided for in the Law, in relation to:

a) Actions or omissions that may constitute infringements of European Union law provided that:

1º. They fall within the scope of application of Union acts related in the Annex of Directive (EU) 2019/1937.

2º. They affect the financial interests of the European Union.

3º. They affect the internal market.

b) Actions or omissions that may constitute serious or very serious criminal or administrative infringements.

The channel established by Law 2/2023 to report these actions or omissions is the Internal Reporting System. The management body or governing body of each entity or organization obliged by this Law will be responsible for the implementation of the Internal Reporting System.

Entities obliged to have an Internal Reporting System are:

1º. Entities that are part of the public sector (General State Administration, regional and local administrations, public bodies or entities dependent on a public administration, independent administrative authorities, Bank of Spain, Social Security, Universities, corporations and foundations of the public sector, companies majority owned by the aforementioned entities, etc.).

2º. Entities in the private sector:

a.) Natural or legal persons in the private sector with 50 or more employees.

b.) Legal persons in the private sector falling within the scope of Union acts in the field of services, products and financial markets, prevention of money laundering or terrorism financing, transport security and environmental protection referred to in parts I.B and II of the annex to Directive (EU) 2019/1937 of the European Parliament and of the Council of 23 October 2019, must have an Internal Reporting System regulated by their specific regulations regardless of the number of workers they have. In these cases, this law will apply to what is not regulated by their specific regulations.

Legal entities that, despite not having their registered office in national territory, carry out activities in Spain through branches or agents or by providing services without a permanent establishment shall be considered included in the preceding paragraph.

c.) Political parties, trade unions, business organizations, and foundations created by them, provided that they receive or manage public funds.

As entities obliged to comply with this Law 2/2023, of February 20, we inform you of the sanctions resulting from non-compliance:

a) If individuals are responsible for the infringements, they will be fined up to €300,000.

b) If legal entities are responsible, they will be fined up to €1,000,000.

Additionally, the following may be imposed:

a) Public reprimand.

b) Prohibition from obtaining subsidies or other tax benefits for a maximum period of four years.

c) Prohibition from contracting with the public sector for a maximum period of three years.

The established deadline for the implementation of the Internal Reporting System, in the case of administrations, organizations, companies, and other entities required to have an Internal Reporting System, is a maximum of three months from the entry into force of this law.

Exceptionally, in the case of private sector legal entities with 249 or fewer employees, as well as municipalities with fewer than ten thousand inhabitants, the deadline provided in the preceding paragraph will be extended until December 1, 2023.

To obtain more information about the technical requirements and other specifics that the Internal Reporting System must comply with, you can contact Hcms.