The purpose of the regulation is to protect anyone who reports corruption, fraud or violations of EU or national law by establishing protected communication channels and prohibiting any retaliation against whistleblowers.
In this regard, the regulation imposes an obligation which has drawn a lot of attention: implement an internal reporting channel. The obligation applies to companies and public bodies with 50 or more employees and to municipalities with 10,000 or more inhabitants.
This reporting channel must allow for written (including paper and electronic formats), verbal and face-to-face communication via in-person meetings (to be recorded, with prior notice to the whistleblower), guaranteeing the confidentiality of the report and the anonymity of the informant.
Under the new law, companies that fail to set up reporting channels face fines between EUR 1,001 and EUR 300,000 in the case of natural persons and between EUR 10,001 and EUR 1,000,000 in the case of legal persons.
Penalties may also be imposed on persons who file false reports and companies or channels that disclose reports, as all reports must be anonymous.
Companies with more than 249 employees have to set up the reporting channel by 13 June 2023, for smaller companies, with between 50 and 249 employees, the implementation deadline is 1 December 2023.
It is also worth mentioning that there will be an external reporting channel managed by the newly created Independent Authority for the Protection of Informants (Autoridad Independiente de Protección del Informante) complementary and independent to the internal company channel.
In our opinion, the new law, although necessary, is very ambitious, and being a late transposition of the European Directive, it leaves issues unresolved.
The aim is to provide anonymity to the whistleblower and to avoid retaliation throughout the internal procedure, but when the complaint is eventually brought before the courts, it will be necessary for the whistleblower to disclose his or her identity.
Furthermore, although reporting channels have been implemented and operational for some time now in compliance management of corporate criminal liability, the reporting of criminal acts is, in fact, uncommon. It is possible, hence, that despite implementing this new reporting channel, nothing will change — not only in terms of business, even more so at the public level.
We will see how the law is implemented and whether it really serves a purpose, or whether it turns out to be just another rule to keep things the same. What is certain is that this reporting channel will have to be implemented sooner rather than later in order to avoid penalties.