Companies commit to implementing a complaints channel with the advent of the Whistleblowing Directive

On March 13, 2023, the Law 2/202320 February, regulating the protection of people reporting violations of rules and the fight against corruption. It responds to the transposition of Directive 2019/1937 of the European Parliament and of the Council of 23 October 2019 on the protection of persons who report breaches of Central legislation, known as “whistleblower instructions,

The spirit of the “Whistleblowing Directive” is to protect whistleblowers (people who work for, or are in contact with, a public or private organization in the context of their work activities) so that they can report violations of the union, without fear of retaliation. Report law is likely to be in this context. It established a two-year period for member states to transpose it, and urged them to incorporate, in addition to central laws, violations of each state’s law that may occur in the labor context.

In Spain, the transposition law has been in effect with 2/2023, a regulation that has been widely criticized, among other things, for being two years late, and for coming into force without being implemented. Independent Informant Protection Authority (hereinafter the Authority), the body in charge of approval work, management of external communication channels and interpretation of the legal text, among others. But we want to recognize the merit of being the first law, which begins to put into practice in Spain compliance concepts that were previously only enunciated in “soft law”, Through the requirements of various standards, such as UNE 19601 (Criminal Compliance) and ISO 37301 (Management Requirements of Compliance Systems). The new law complements these requirements and aligns them with the good practices established in ISO 37002 (Complaint Channel Management System), making them a legal obligation.

Before considering the obligations this law imposes on companies, we would like to highlight the importance of officializing the implementation of an ethical channel as part of a system of regulatory compliance and zero tolerance that many organizations have been working on for years. are working for the corruption within them.

The benefits for any organization of having an effective compliance culture, which includes all of its members, are enormous. This has been achieved, not only in order to reduce the risk of the Commission, within it, being accused of any criminal offense or serious or very serious administrative infringement, with its associated economic and other sanctions, but also, above all, of reputation Very difficult to avoid damage, recoverable.

This compliance is only achieved through the establishment of a series of internal policies, regularly reviewed and updated, that guide the organization’s actions, ongoing training for employees and the unit’s management. With an example of impeccable performance, “tone from above,

In addition to compliance with the implementation of the internal information system (hereinafter the system), the application of the new law constitutes an excellent opportunity for obligated entities, laying the foundation for achieving compliance culture,

The terminology used by the law, “internal information channel”, “informer”, “communication”, also seems to us very precise, as it invites positivity and sees the establishment of the channel as a means to improve integrity and good practices. perceived as a challenge. Within organizations, rectifying and repairing what is not in line. We will look below at the most relevant implications of Law 2/2023 for companies, and we give some pointers on how to comply.

The first thing a company has to do is determine whether it is bound. are considered bound subject To implement the system, all entities that form the public sector, and private sector entities employing 50 or more workers, as well as those that do not reach 50 workers, are within the scope of Community law. These come in terms of financial services, products and markets, prevention of money laundering and terrorist financing (note foundations, associations, lawyers, agencies, etc.), transportation security, and environmental protection. and, in addition, political parties, unions, employers’ associations and foundations created by them, as long as they receive or manage public funds.

time limit The implementation period ends on June 13, 2023, except for entities with fewer than 250 employees and municipalities with fewer than 10,000 residents, which run until December 1, 2023.

If being a bound subject, The system is not implemented in the conditions required by lawThis is considered a very serious violation, and a penalty is expected. up to 1,000,000 Euro Penalties for legal persons.

Add to this that the law allows groups of companies to share the same system, and it also allows companies with between 50 and 250 employees to share said resources.

To implement the system, a series of steps must be followed which we will detail below.

The governing body of each bound entity is responsible for the implementation of the internal system and must approve information management processAlso decide whether Management will be done in a systematic way internal in unit, or going outsource to an outside third party expert. In addition, you must appoint system ManagerInternal, who may be an individual, or a collegiate body, director of the entity, but may be independent of the governing body.

This Process will involve the implementation of internal channelExpansion of Policy of canal, Etiquette of channel management, building a record book Regarding the communication received and the investigation carried out, Communications A program of ethics for channel implementation staff representatives, communications for channel implementation staff, communications for channel implementation business partners, and Training employees so that they know how to use the channel. Also, if the company has Web PageChannel ads should appear on the home page in a separate and easily identifiable section.

Companies that already have any type of channel must adapt it to the new standard, and if they have multiple types of channels, they must To integrate In one such as those who implement it for the first time, they should make it attractive to receive communication through it, and thus prevent informers from going to the external channel of authority, which we mentioned earlier, Once formed, lose the possibility of conveying information. Resolve claims internally.

When setting up channels, you must definitely delimit scopeHow the facts are likely to be communicated through who the two can communicate.

Are communication object, in accordance with the law: 1. acts or omissions that may constitute a breach of EU law; 2. Acts or omissions which may constitute an offence; 3. Actions that may constitute a serious or very serious administrative offense; 4. Violation of labor law in matters of safety and health at work. Furthermore, to establish a culture of compliance in the organization, all violations of each company’s rules or internal policies (gift policies, safeguards, etc.) must also be reported, as well as established in their applicable codes. conduct and collective agreements.

In form of that can present communication, the law informs about the following groups: 1. People who have the status of public servants or workers for others; 2. Self-employment; 3. shareholders, participants and members of administrative, management or supervisory bodies; 4. Contractors, Subcontractors and Suppliers. 4. Volunteer; 5. Companion; 6. Those working in the training period, as well as those whose employment relationship has not yet begun. We understand that customers should also be included within the professional relationship that links them with the entity, as potential viewers or affected by the breach indicated.

Furthermore, the channel that is implemented must allow the possibility of presenting a communication anonymousgive a guarantee confidentiality Informant Identification and Prevention the revenge Against this, give the possibility of presenting oral, written or face-to-face communication, and guarantee transparency, forcing the bound parties to provide clear and accessible instructions on the operation of the canal, as we mentioned earlier.

All communications must be recorded, transcribed or documented, and, in all cases, the informant may indicate a secure location for the information or may decline to receive any communications, and shall, by signing, a transcription of the message shall be empowered to confirm Once the information is submitted, it will be registered in the enabled information management system, and a identification codefor your follow up. Once the communication is registered, a period of 5 days will be enabled to reject, or initiate an investigation, estimating a period of 3 months to complete the tasks and inform the Indicator of the result, A period that may be extended by a further 3 months for communications that present logistical complexity.

Both the confidentiality of the informant and the right to information must be respected during the process. presumption of innocence of the person examined, who have to be summoned at the right time so that the investigation is not jeopardized. Similarly, a rigorous system of sanctions including dismissal should be established for those who report with disharmony,

An excellent treatment of personal data collected and processed will be required, obliging informants to comply with the duty of information, respecting protection periods established by law, and limiting those who can access them, fundamentally, System manager, data protection representative, when there is one, and external manager, when management of the channel is outsourced. In addition, if in the course of the investigation it is discovered that facts may constitute an offense indicatively, the information shall be immediately sent to the Public Prosecutor’s Office.

Due to the complexity of the process and in order to encourage whistleblowers to use the system, we strongly recommend that companies that do not have a compliance department, outsourcing Served for a particular company.