Complaint boxes: What, Who, When, Where and Why

1. Anti-fraud complaint mailboxes: basic concepts We are facing a new legal obligation. Directive 1937/2019 of the European Parliament and of the Council, of October 23, 2019, regarding the protection of people who report violations of Union Law, establishes the need to promote internal and external reporting channels: “ Member States shall promote communication through internal complaint channels before communication through external complaint channels.” (article 7.2). The rule establishes a preference for internal reporting channels over external ones, “Member States shall promote communication through internal reporting channels (…), provided that the infraction can be dealt with effectively internally and provided that the complainant consider that there is no risk of retaliation.” (article 7.2). This need to promote the implementation of internal complaint channels is complemented by the need to articulate the appropriate complaint and follow-up procedures, after consulting the social partners and in accordance with them when established by national law. However, the complainant may go directly to the external channel if, after the internal complaint, the appropriate measures are not taken; if it is presumed that the complaint to his superiors will not produce effects; or when there is imminent or manifest danger to the public interest.For its part, the Draft Law transposing Directive 2019/1937 (hereinafter, APL), refers to internal information systems, opting for this less forceful terminology, almost a euphemism, and providing that these internal information systems information are the preferential channel to report on the actions or omissions provided for in article 2, in short, on infringements of Union Law provided for in the Directive (article 4 APL). The administration or government body of each entity or body will be responsible for the implementation of the internal information system, after consultation with the legal representation of the workers (art. 5 APL). The management of internal information systems may be carried out within the entity itself or by going to an external third party. (art. 6 APL). In addition, all internal information channels will be integrated into the internal information system. The Preliminary Draft also refers to the anonymization or confidentiality of the informant (understood as “complainant”). Thus, it establishes that the internal information channels must allow the presentation and subsequent processing of anonymous communications (art. 7.3 APL). For its part, the procedure for managing internal communications (understood as “complaints”) is the one established in art. 8 APL, to which we refer. In any case, it will be necessary to follow the evolution of the text already in the phases of the Bill, reports and processing in parliament. What does seem clear is that the vast majority of public and private entities must have them: “Member States shall ensure that legal entities in the private and public sectors establish channels and procedures for internal reporting and follow-up (…)” (art. 8.1 Directive). According to the Directive itself, the establishment of a complaints channel or mailbox is mandatory for legal entities in the private sector with more than 50 workers. Member States may require it from entities with less than 50 workers, but this decision is left to national regulatory development. At the moment, the aforementioned draft law generally regulates the obligation only for private legal entities with 50 or more workers. The same does not happen in the public sector, where reporting channels will be mandatory. In this case, the Directive once again establishes the possibility for Member States to exempt municipalities with fewer than 10,000 inhabitants or with fewer than 50 workers, as well as other legal entities in the public sector with fewer than 50 workers. But here the preliminary bill does not exempt any public sector entity from the obligation, and given that the difficulties of small municipalities can be solved with the sharing of resources and, above all, with the action of support and assistance of Provincial Councils, Cabildos and Councils, it is more than likely that the obligation will remain.   2. The complaints mailbox of the Valencian Anti-Fraud Agency: a model to reproduce How to articulate the aforementioned obligation to create and maintain a mailbox for complaints in our public sector entities? Our particular proposal is the model of the Valencian Antifraud Agency. Our complaints mailbox, in this case internal and, as an anti-fraud office, also external in the sense explained above, has been in operation since 2018. It is based on the Globaleaks platform and was originally adapted to the current technology and legislation by Xnet, this form could be used and replicated in different institutions and organizations in Spain quickly, agilely and without cost. The tool can be downloaded from the website of its creator https://www.globaleaks.org/ where you can access its main features and which we would like to group into four groups: 1.At the user level: simple management from a web interface, translated into more than 60 languages, fully configurable and customizable with the corporate colors and logos of the different administrations. It also allows its adaptation to the casuistry of each project, allowing anonymous reporting, creation of advanced questionnaires, private conversations and exchange of information and statistical reports. 2.On a technical level: long-term maintenance guaranteed by the developer (LTS), fully autonomous application (no need for web servers or other applications), built using light navigation technologies, integrated backup system, configuration automated access through the TOR private network and prepared to be integrated with other web pages and intranets. 3.At a legal level: it complies with the standards of ISO 37002:2021 (Management systems for reporting irregularities) as well as with Community Directive 2019/1937 on the protection of whistleblowers of corruption. It complies with the European GDPR data protection regulation allowing data retention policies to be configured, in the same way it guarantees the custody of the complainant’s identity (if provided) by protecting access to complaints as well as by the absence of registration of the IP addresses of those who make these communications. 4.At the security level: it guarantees access through HTTPS protocols and the TOR network. It is continuously exposed to different pentesting tests to guarantee and improve its…

Circumvention of the guiding principles applicable to the processes of selection and provision of public employees

Anonymous Reporting Deniers

For the deniers of anonymous reporting, it does not matter what is reported, however serious it may be. It matters who denounces, because knowing who the complainant  has been, the facts are covered.  They want to know who is reporting because in this way the complainant is pressured, discredited and re-apprehended, or accused of falsehood.  The message is: find a  lawyer to defend you, you will find out.  This is what we comment on too many occasions in the Valencian Anti-Fraud Agency. The whistleblower is denounced for breaking the law of silence, for safeguarding the interest of all, for defending ourselves against fraud, irregularities and  corruption. The deniers reject the anonymous complaint, although  it is provided for in the special legislation and is applied by the jurisprudence that expresses the evolution in the application of the laws adapting the right to the demands and social realities. The Tributaria Agency  and the Labour and Social Security Inspectorate, to give two examples, recognize anonymous reporting in Spain, as this is, for obvious reasons, very useful. The tax law does not specify who can file a tax complaint with the Administration, so the complaint can be anonymous;  that is, the complainant may not disclose his or her identity. The fact that the identity of the complainant is not recorded does not represent any obstacle to taking into account the complaint and examining the documentation provided and, if appropriate, initiating the corresponding verification and investigation actions by the competent authorities. The Labor and Social Security Inspectorate has a complaints box, to which to go to notify all behaviors that imply job insecurity in employment and to inform any unfair situation that a worker may suffer, offering the possibility of communicating from anonymity the situations of labor abuse and non-compliance. The National Commission on Markets and Competition (CNMC)  also has its own complaints box, which allows anonymity, in order to detect and, where appropriate, prosecute and sanction infringements of competition law. With regard to the prevention of money laundering, the obliged subjects (financial and credit institutions, insurers, investment services and reciprocal guarantee companies, among others) must establish an internal complaints channel so that employees, agents or managers can communicate, even anonymously, any relevant information about possible infringements. in this field. Since 2015, the Ministry of the Interior itself has set up an anonymous complaints box for terrorism cases. Similarly, in terms of data protection,  anonymous complaints are allowed, which contributes to better protection of whistleblowers and facilitates the reporting of more cases.  This is a good opportunity for companies  to address their problems internally before they move abroad. For its part, the Criminal Chamber of the Supreme Court, in an important judgment whose rapporteur was Judge Vicente Magro, Judgment No. 35/2020 of February 6, 2020, validates an anonymous complaint as the origin of an internal investigation in a company to  uncover a fraud, referring to Directive (EU) 2019/1937 and the channels of complaint,  to which it qualifies as highly effective in the start of the notitia criminis, because they promote- says the sentence, the due police investigation and the discovery of illicit or criminal practices. It adds that an anonymous complaint does not preclude a criminal investigation, but requires only a reinforced analysis for its taking into account, which weighs the coherence and plausibility of the data.  This Judgment includes a doctrine that is a continuation of others, also issued by the Criminal Chamber of the Supreme Court, such as Judgment No. 54/2019 of February 6, 2019 and Judgment No.  318/2013 of 11 April. Directive (EU) 2019/1937 of the European Parliament and of the Council of 23 October 2019 on the protection of persons reporting breaches of Union law, commonly referred to as the Whistleblower Directive, warns, in its first lines, that persons working for or in contact with a public or private organisation in the context of their work activities,  they are often the first to be aware of threats or harm to the public interest that arise in that context. When reporting breaches, such persons act as whistleblowers and therefore play a key role in uncovering and preventing irregularities and protecting the well-being of society. However, potential whistleblowers often give up reporting their concerns or suspicions for fear of retaliation. In this environment, there is a growing need to recognize the importance of providing effective protection to whistleblowers. This Directive entered into force in Spain on December 17, 2019 and its deadline for transposition into Spanish law expired on December 17, 2021, with the European Commission reprimanding Spain for that reason. Both the aforementioned Directive and the United Nations Convention against Corruption, both directly applicable throughout Spain, that since December 17, 2021 and this since its ratification by the Congress of Deputies according to publication in the BOE of July 19, 2006, make anonymous reporting possible. In development of this United Nations Convention and in anticipation of the aforementioned Directive, the Valencian Anti-Fraud Agency is created by law approved in the Valencian Parliament on November 28, 2016, as an independent public institution with functions of prevention and promotion of integrity and public ethics, investigation of complaints, protection of whistleblowers and sanctioning capacity. The Anti-Fraud Agency, in accordance with its regulatory law and its implementing regulations, which is available in the Code for the Fight against Fraud and Corruption that publishes and periodically updates the BOE, admits complaints and communications made by any person, both nominal and anonymous, in the latter case with full guarantees through the electronic complaints mailbox of  its website. This complaints channel also operates  as a virtual office for public employees who inform the Agency of irregularities that it is aware of or to which it has had access. It is a secure and confidential telematic channel, which allows intercommunication, because for each communication that is made, an alphanumeric code is automatically assigned through which the complainant, anonymous or not, can access the system and interact with the official staff of the Agency, which also has the status of…