The Spanish Whistleblower Protection Law
What is the current status of the Spanish Whistleblower Protection Law?
Like all other members of the European union, Spain is required to transpose the EU Whistleblower Protection Directive into national law, which will become the Spanish Whistleblower Protection Law. The EU Directive obliges businesses with more than 50 employees to have a reporting channel for a broad spectrum of potential whistleblowers, and forbids reprisals against whistleblowers.
The deadline for this transposition was 17th December 2021, which Spain did not meet, although various legislative alternatives have been proposed and at least one proposal for a Spanish Whistleblower Protection law has been rejected by Congress.
In Spain there is currently no national law that specifically regulates whistleblowing. However some regional laws exist in the autonomous regions and a number of sectors are subject to certain provisions related to internal reporting channels and procedures.
Spain currently has no whistleblower protection in its national laws, though some regions and sectors are subject to provisions. Legislative alternatives are currently being proposed to comply with the EU Whistleblower Protection Directive.
What to do while awaiting the Spanish Whistleblower Protection Law
There is good news for companies with operations in Spain who would prefer to start preparations for compliance now rather than wait for the Spanish law. The EU Directive sets a number of minimum standards that will apply in all member states and to all organisations with more than 50 employees. We recommend that you investigate these minimum requirements (see below) already now, and identify solutions that can help you fulfil them.
- A secure channel for receiving whistleblower reports must be put in place.
- Acknowledgment of the receipt of the report must be provided to the whistleblower within seven days.
- An impartial person or department must be appointed to follow up on the reports.
- Records must be kept of every report received, in compliance with confidentiality requirements.
- There must be diligent follow-up of the report by the designated person or department.
- Feedback about the report follow-up must be given to the whistleblower within three months.
- All processing of personal data must be done in accordance with the GDPR.