Law 2/2023: Whistleblower Protection

Law 2/2023: Whistleblower Protection

Adoption of Law 2/2023 on the protection of whistleblowers and objectives

Law 2/2023, which transposes Directive (EU) 2019/1937 of the European Parliament and of the Council of 23 October 2019 on the protection of persons who report breaches of Union law, known as the Whistleblower Directive, was passed in Spain on February 16, 2023,more than a year late. The law aims to provide adequate protection against retaliation for individuals who report violations or non-compliance by companies of European and Spanish regulations, and to promote a culture of information or communication as a mechanism to prevent and detect threats to the public interest. The law came into force on March 13, 2023, but gives a period of 3 months for organizations with 250 or more employees to adapt and until December 1, 2023 for companies with between 50 and 250 employees.

Companies with more than 250 employees must have an internal whistleblowing system in place no later than three months after the law comes into force, i.e. June 13, 2023. However, companies with fewer than 250 employees have until December 1, 2023 to comply. The law protects persons who report acts or omissions that may constitute aninfringement of European Union law or a serious criminal or administrative offense in Spain.

Personal scope of Law 2/2023 and entities obliged to implement an internal reporting system

The personal scope of application of the law extends to whistleblowers working in the private or public sector who have obtained information about infringements in an employment or professional context. The protection also extends to all those who have professional or employment ties with entities in the public and private sector, those who have terminated their professional relationship, volunteers, trainees or apprentices in training and persons participating in selection processes. In addition, the protection of the law extends to persons who provide assistance to whistleblowers, persons in their environment who may suffer retaliation and legal entities owned by the whistleblower.

The entities that must implement an internal reporting system are the following: private sector individuals or entities with 50 or more employees, private sector entities that fall within the scope of specific EU regulations on financial services, products and markets, prevention of money laundering or terrorist financing, transport security and environmental protection, and political parties, trade unions, employers' organizations and foundations created by them, to the extent that they receive or manage public funds.


Our recommendation to comply with Law 2/2023

From FukuroLegal we recommend theimplementation of a complaint channel such as Hintbox, as it allows you to comply with the requirements easily and quickly and thus avoid possible sanctions.

If you have any questions about the law or need advice on how to process reports received in a whistleblowersystem, we will be happy to help you.