Spain approves bill to strengthen whistleblower protection


People who report breaches of EU and national law must have secure reporting channels, with sanctions to deter retaliation against them.

The new rules aim to establish a high level of protection for people who report breaches of EU and national law, to provide secure reporting channels within an organization and to public authorities, and to impose proportionate and dissuasive penalties. to anyone who encourages retaliation, or retaliates, against whistleblowers.


The new law, which transposes Directive (EU) 2019/1937 of the European Parliament and of the Council of 23 October 2019 on the protection of persons who report breaches of Union (EU) law, also known as “donors of alert”, sets out in its explanatory memorandum numerous examples of civil actions warning of the existence of irregular practices and corruption. These whistleblowing actions have led to investigations leading to corresponding criminal convictions for the behavior complained of. However, there have sometimes been painful consequences for those who have reported corrupt practices and other offences: whistleblowers have notably been pressured by accused persons, isolated by colleagues or been unfairly dismissed.

Accordingly, the draft law, which regulates protective measures for anyone reporting law or anti-corruption offences, aims to defend whistleblowers and sets minimum rules for reporting channels that whistleblowers can use.

Prohibition of retaliation and protective measures

The new law prohibits and declares void behaviors that could be qualified as reprisals adopted within two years following the completion of the investigations. The law provides examples, without limitation, of several unjustifiable behaviors towards whistleblowers that are considered retaliation: breach of contract, intimidation, adverse treatment, reputational damage, and cancellation of leave.

As a protection against reprisals, the law leaves ineffective the clauses or contractual provisions which prevent or aim to limit the right or the capacity to inform, such as the clauses of confidentiality or the conditions reflecting express renunciations. In addition, whistleblowers will be exonerated from any liability for obtaining relevant information and the burden of proof is reversed in any proceedings a whistleblower may initiate to claim damages.

The protective measures target both the whistleblowers and any person targeted in the events reported in the communication.

These people retain all the rights of legal protection and defence, access to their file, confidentiality (including as to their identity), the presumption of innocence, or even financial assistance or psychological support: the same rights from which whistleblowers benefit.

Finally, the advantages and effectiveness demonstrated by leniency policies in certain sectoral regions have led to the inclusion of specific regulations for these policies, in which particular conditions are required for their proper application.

Internal reporting systems

Internal information systems must meet specific requirements, such as (among others) their unrestricted use, guarantees of confidentiality, good monitoring practices, investigation and protection of whistleblowers.

Under the directive, private sector entities with more than 50 workers will have to set up an internal reporting system. Regardless of the number of workers, all political parties, trade unions and professional organizations, as well as all the foundations dependent on them, which receive public funds for their financing, must have an internal declaration system.

In the public sector, the law has fully implemented the obligation to establish internal reporting channels. Therefore, public administrations, whether territorial or institutional, as well as independent authorities or other bodies that manage social security services, universities, public companies, foundations and legal persons under public law, must this system in place.

External reporting channel

The new law recognizes that one of the main factors deterring potential whistleblowers is a lack of confidence in the effectiveness of communications.

To this end, the law regulates the External Reporting Channel, an external communication channel managed by the corresponding Independent Whistleblower Protection Authority and governed by the principles of independence and autonomy when receiving and processing of any information on infringements. This authority has the independence and freedom to guarantee the exhaustiveness, integrity and confidentiality of the information, to prohibit access to it by personnel and to allow its long-term storage.


The regulations, in addition to prohibiting retaliation, provide a detailed system of sanctions for all acts or omissions that limit the rights and guarantees set out in this law, mainly those aimed at hindering, preventing, frustrating or slowing down information. Likewise, the new regulations will also penalize any communication or disclosure of breaches of the legal order, knowing that these are false.

This sanction procedure provides for fines of up to €300,000 for natural persons and up to €1,000,000 for legal persons.

Commentary by Osborne Clarke

Culture is an essential part of any compliance program, as is having a tool to disclose non-compliance activities, i.e. a reporting channel.

With the new regulations, organizations need to convince their members that using a reporting channel to uncover violations of the law does not make the person reporting a “whistleblower” but rather someone who upholds the legality who contributes to creating a society which does not tolerate corruption, and which, in the future, will be better protected against any possible sanction.


Comments are closed.