Introduction On 20 February 2023, Law 2/2023 on the protection of persons reporting on regulatory and anti-corruption infringements was adopted, transposing Directive 2019/1937 on the protection of persons reporting breaches of Union law. Its purpose is to fill certain gaps in the legal framework for the security and protection of whistleblowers within the organizations where they provide their services and, as a consequence, to detect irregularities or illegalities in order to inform the authorities. Undoubtedly, the aforementioned law aims to facilitate transparency and combat corruption and the commission of other crimes within public entities or private corporations. In order to achieve these objectives, Law 2/2023 takes advantage of the successful proactive measures of clear European influence that have been applied for the management of European funds in contexts such as the detection of fraud, corruption, conflicts of interest and double financing that have been developed so far (for example, State Order HFP/1030/2021, which configures the management system of the Recovery, Transformation and Resilience Plan). This is a novelty in Spain whose regulatory anchoring occurred with some delay although it currently represents the culmination of the process of transposition of Directive 2019/1937 into the Spanish legal system. Thus, as is evident in the preamble of the Law, it is added to the previous and more advanced experiences of some autonomies such as the Valencian Community that, by virtue of Law 11/2016, of November 28, created the Agency for the Prevention and Fight against Fraud and Corruption (Valencian Anti-Fraud Agency) which has been at the forefront in Spain in terms of the empowerment of the “information culture”. To this end, the new state law is based on the premise that citizen collaboration is an essential factor for the effectiveness of the Law and that it is manifested not only with the subjection of all public powers and citizens to the Spanish Constitution and the rest of the legal system (article 9.1 of the Spanish Constitution), but also with the collective commitment to the proper functioning of public and private institutions. This, without prejudice to the fact that it is projected on the duty of workers – and that could be extended, even, to elected public officials – to inform or alert about certain categories of irregularities of which they have knowledge in the context of their employment or professional relationship in order to prevent and detect fraudulent and corrupt practices that, Indeed, they threaten the public interest. Generic obligations of Law 2/2023 As for Title II of this law (arts. 4 et seq.), it establishes the obligation for both companies and the public sector to have a complete internal information system composed of both the usual communication channel – commonly known as an ethical or complaints channel – and the process of management and monitoring of the information received. Precisely, it is more than evident that this system should be used preferentially to channel information although the informant can choose the internal or external channel, depending on the circumstances and risks of retaliation that he can consider. Likewise, the entities must designate a person responsible for the internal information system (articles 5 and 8) who may be a person or a collegiate body and whose appointment, dismissal or dismissal will depend on the administrative or governing body of the entity. The management of the system may be internal or external to the entity (art. 12). In the event that management is outsourced, the guarantees provided for by law must be respected and the responsibility, in any case, will also fall on the person responsible for the system that has been appointed in the entity (articles 6 and 8). The communication channel that is part of the system must allow communications to be made in writing or verbally, or both, by electronic means or even in person (arts. 5 and 7). Communications through the channel will be confidential (art. 5.2º b) and must also allow anonymous communications to be presented or processed subsequently (art. 7.3º). Likewise, the information management procedure will respond to the minimum content and principles provided for in article 9 of this law. In relation to Title III (arts. 16 et seq.), the external information channel is regulated, so that the informant may choose to inform the Independent Authority for the Protection of the Informant (hereinafter, AIPI) or the competent authorities or autonomous bodies, either directly or prior communication through the corresponding internal channel. Moreover, as a last resort, the reporting person may make a public disclosure of the infringement of which he has become aware, after having made the communication first through internal and external channels, or directly, through external channels – provided that appropriate measures have not been taken in this regard within the prescribed period and understands that there is a situation of imminent danger to the public interest, among others–. For its part, Law 2/2023 also establishes a precise sanctioning regime, which contemplates high amounts of fines both for the infringing entity, public or private, and for the responsible internal bodies. Thus, according to the provisions of article 65, they start from 1,001 to 300,000 euros in the case of natural persons and between 100,000 and one million euros if those who commit an infringement are legal persons, intervals that vary depending on their severity. In any case, in the case of very serious cases, provision is also made for (a) public reprimand; (b) a ban on obtaining subsidies or other tax benefits for a maximum period of four years and; (c) a ban on contracting with the public sector for a maximum period of three years. In short, although the sanctioning regime will encourage companies to adapt as soon as possible to the novelties provided for in this law, it leaves them in a complicated situation, since they must comply with their legal obligations in record time under penalty of high penalties that may compromise their viability. However, under Article 61 of that Law, the national sanctioning body is vested in AIPI, which has…
