Introduction
On 20 February 2023, Law 2/2023 on the protection of persons reporting on regulatory and anti-corruption infringements was adopted, transposing Directive 2019/1937 on the protection of persons reporting breaches of Union law. Its purpose is to fill certain gaps in the legal framework for the security and protection of whistleblowers within the organizations where they provide their services and, as a consequence, to detect irregularities or illegalities in order to inform the authorities. Undoubtedly, the aforementioned law aims to facilitate transparency and combat corruption and the commission of other crimes within public entities or private corporations.
In order to achieve these objectives, Law 2/2023 takes advantage of the successful proactive measures of clear European influence that have been applied for the management of European funds in contexts such as the detection of fraud, corruption, conflicts of interest and double financing that have been developed so far (for example, State Order HFP/1030/2021, which configures the management system of the Recovery, Transformation and Resilience Plan).
This is a novelty in Spain whose regulatory anchoring occurred with some delay although it currently represents the culmination of the process of transposition of Directive 2019/1937 into the Spanish legal system. Thus, as is evident in the preamble of the Law, it is added to the previous and more advanced experiences of some autonomies such as the Valencian Community that, by virtue of Law 11/2016, of November 28, created the Agency for the Prevention and Fight against Fraud and Corruption (Valencian Anti-Fraud Agency) which has been at the forefront in Spain in terms of the empowerment of the “information culture”.
To this end, the new state law is based on the premise that citizen collaboration is an essential factor for the effectiveness of the Law and that it is manifested not only with the subjection of all public powers and citizens to the Spanish Constitution and the rest of the legal system (article 9.1 of the Spanish Constitution), but also with the collective commitment to the proper functioning of public and private institutions. This, without prejudice to the fact that it is projected on the duty of workers – and that could be extended, even, to elected public officials – to inform or alert about certain categories of irregularities of which they have knowledge in the context of their employment or professional relationship in order to prevent and detect fraudulent and corrupt practices that, Indeed, they threaten the public interest.
Generic obligations of Law 2/2023
As for Title II of this law (arts. 4 et seq.), it establishes the obligation for both companies and the public sector to have a complete internal information system composed of both the usual communication channel – commonly known as an ethical or complaints channel – and the process of management and monitoring of the information received. Precisely, it is more than evident that this system should be used preferentially to channel information although the informant can choose the internal or external channel, depending on the circumstances and risks of retaliation that he can consider.
Likewise, the entities must designate a person responsible for the internal information system (articles 5 and 8) who may be a person or a collegiate body and whose appointment, dismissal or dismissal will depend on the administrative or governing body of the entity. The management of the system may be internal or external to the entity (art. 12). In the event that management is outsourced, the guarantees provided for by law must be respected and the responsibility, in any case, will also fall on the person responsible for the system that has been appointed in the entity (articles 6 and 8). The communication channel that is part of the system must allow communications to be made in writing or verbally, or both, by electronic means or even in person (arts. 5 and 7). Communications through the channel will be confidential (art. 5.2º b) and must also allow anonymous communications to be presented or processed subsequently (art. 7.3º). Likewise, the information management procedure will respond to the minimum content and principles provided for in article 9 of this law.
In relation to Title III (arts. 16 et seq.), the external information channel is regulated, so that the informant may choose to inform the Independent Authority for the Protection of the Informant (hereinafter, AIPI) or the competent authorities or autonomous bodies, either directly or prior communication through the corresponding internal channel. Moreover, as a last resort, the reporting person may make a public disclosure of the infringement of which he has become aware, after having made the communication first through internal and external channels, or directly, through external channels – provided that appropriate measures have not been taken in this regard within the prescribed period and understands that there is a situation of imminent danger to the public interest, among others–.
For its part, Law 2/2023 also establishes a precise sanctioning regime, which contemplates high amounts of fines both for the infringing entity, public or private, and for the responsible internal bodies. Thus, according to the provisions of article 65, they start from 1,001 to 300,000 euros in the case of natural persons and between 100,000 and one million euros if those who commit an infringement are legal persons, intervals that vary depending on their severity. In any case, in the case of very serious cases, provision is also made for (a) public reprimand; (b) a ban on obtaining subsidies or other tax benefits for a maximum period of four years and; (c) a ban on contracting with the public sector for a maximum period of three years. In short, although the sanctioning regime will encourage companies to adapt as soon as possible to the novelties provided for in this law, it leaves them in a complicated situation, since they must comply with their legal obligations in record time under penalty of high penalties that may compromise their viability.
However, under Article 61 of that Law, the national sanctioning body is vested in AIPI, which has not yet been established. Although, in the case of the autonomous communities, Catalonia has been the first autonomous community to confer such competence to its Anti-Fraud Office. It is thus the first independent authority to assume full powers for the protection of reporting persons, both in terms of the provision of external channels and in the imminent use of the sanctioning power.
The material and personal scope of Law 2/2023: some structural deficits
The material scope (Art. 2 of the Law) focuses on the protection of persons who, in a work or professional environment, identify both infringements of EU regulations and any serious or very serious criminal or administrative infringement of our legal system and report them through internal and external information channels.
However, what could happen to other common practices such as non-compliance with internal policies and ethical codes of organizations or other behaviors linked to abuse of power?
Certainly, such an absence could deprive the guarantees predefined by the European Directive of protection and could exclude from protection relevant and everyday conduct such as wage dumping or employment discrimination. Some practices that, legislations of our environment do contemplate, as is the case of French legislation, by virtue of the application of the current Law no. 2022-401 (known as “Loi Waserman”).
As if that were not enough, it should be noted that this scope of protection does not exclude the application of the rules relating to criminal procedure, including investigative measures. A provision that departs from the French Law no. 2022-401 that grants immunity – including criminal and civil liability – to the reporting person and that could have a dangerous deterrent effect among potential informants.
With regard to the personal sphere (art. 3 of Law 2/2023), it has a manifestly more restrictive scope with respect to the material since, although it protects the reporting subjects regardless of the information channel used, it leaves to their fate the organizations that assist or carry out support or research activities together with the reporting person, these include reporting persons protection associations or non-governmental organizations (NGOs), among others. Therefore, this Law has a more restrictive scope than the Valencian law that, in its article 14, considers a complainant to be “any natural or legal person who communicates facts that may give rise to the demand for legal responsibilities” or the French law, whose definition of “facilitators” also accommodates a wide range of natural and legal persons (including in both cases, NGOs).
—-
For an exhaustive analysis of Law 2/2023 of February 20, regulating the protection of people who report on regulatory infractions and the fight against corruption, we refer to the following study: VIGURI CORDERO, “The challenges of the protection of whistleblowers in Spain after the approval of Law 2/2023: a right in the process of consolidation”, Revista Española de la Transparencia, no. 17, 2023. Available in: https://doi.org/10.51915/ret.313
Jorge Viguri Cordero
Permanent Labor Professor of Constitutional Law. Universitat Jaume I
