In our last edition, we reported on Italy and Netherlands, and now is the turn of Spain in transposing the European Directive, just a few days after the European Commission had decided to take Spain, among other countries, to the CJEU for failing to transpose it. 

The main scope of the law is to protect from retaliation persons who, in an employment or professional context, detect severe or grave criminal or administrative offences and report them, fostering a reporting culture to detect and prevent threats to the public interest. It sets out the obligation to establish internal and external systems for reporting infringements in private and public organisations and detailed data protection obligations.

The law extends the scope of application, also covering severe and grave criminal and administrative offences under Spanish law and protects an extensive range of, including those working in the public or private sector, shareholders, investors, volunteers, and trainees, as well as whistleblowers after any work-based relationship has ended.

Companies with 50 or more employees and other regulated entities must establish an internal reporting channel to enable the disclosure of information, ensuring the protection of whistleblowers and any named third parties. Employers must also appoint a whistleblowing officer.

The law prohibits and declares null and void any conduct that can be qualified as retaliation taken within two years of the completion of investigations.

It also creates external public whistleblowing channels supervised by the Autoridad Independiente de Protección del Informante (“AAI”) or the relevant regional authority.

It also provides for a detailed system of penalties for actions or omissions that limits the rights and guarantees introduced in this law, as well as the disclosure of breaches of the legal system in the knowledge that they are false.

The sanctioning procedure includes fines of up to €300,000 for natural persons and up to €1 million for legal persons.

Finally, the law contains detailed provisions on the processing of personal data of whistleblowers and other persons involved in the disclosure, retention, and subsequent investigation.

Employers must implement the internal reporting system by 13 June 2023 (for employers with less than 249 employees by 1 December 2023).

Here you can find an updated map from Ius Laboris of the implementation of the EU whistleblowing directive across Europe.