Spain: The internal whistleblowing channel and its impact on labor relations (II)

The internal whistleblowing channel in companies is, in principle, preferential to external channels and public disclosure, which means that, from the point of view of labor relations, the focus of interest should be mainly on this channel. It is true that this preferential nature is relative and, in practice, will be left to the discretion of the whistleblower. The European directive that regulates it requires States to promote " reporting through internal reporting channels before reporting through external reporting channels" (Article 7.2), but only if the offence can be dealt with effectively internally (and who decides whether the offence (or rather the complaint) can be dealt with effectively internally, whether the complainant has to make any enquiries, whether he can simply consider that the conditions for doing so do not exist?) and provided that the complainant considers that there is no risk of reprisals. This provision is reproduced in Article 4.1 of our law, so that the preference for the internal channel, with no control of the whistleblower's assessment of the risk of reprisals, is more theoretical than real. This is the point of Article 28 of the law, which requires, in order to resort to public disclosure, that the communication must first have been made "through internal and external channels, or directly through external channels". The wording is certainly not fortunate and the use of the copulative conjunction "and" does not seem appropriate. But what is relevant is that direct recourse to external channels is allowed, without any indication of preference for internal channels. Moreover, direct recourse to public disclosure is possible if the whistleblower has "reasonable grounds to believe" that the offence may constitute an imminent or manifest danger to the public interest, or if there is an emergency situation, risk of irreversible damage, risk of retaliation or risk of concealment or destruction of evidence.

I have spoken of an internal channel, although the heading of Title II of the law is "internal information system", even though Article 7 speaks of "internal channel". With a regulation that is certainly confusing, it is not very clear whether what is being regulated is a system within which different information channels can coexist. Article 7.1 states that all internal channels shall be integrated into the internal information system, and Article 5.2.b states that the internal system shall integrate the various internal information channels. Can there be different channels for compliance with the law or are these channels intended for other complaints? On the other hand, Article 7.2 speaks of the internal channel, in the singular, and regulates it as if it were the channel foreseen for information or complaints, so there is no difference between the system and the internal channel.

The issue is further complicated by the fact that the management of the internal system can be outsourced (Articles 6 and 12 of the law). However, it is made clear that, "for these purposes" (of entrusting management to an external third party), "the receipt of information is considered to be management of the system" (Article 6.1). External management thus seems to be limited to the receipt of information, although Article 12 speaks of the "management and processing of communications". In any case, it seems that it is the responsibility of the companies, even if the management is outsourced and also covers the processing of complaints (as expressly stated in the European directive for cases of "joint" management), to maintain confidentiality, respond to the complainant and deal with the offence reported (Article 8.6 of the directive).

The law imposes the existence, even in cases of outsourcing (Article 6.3), of a "person responsible for the internal information system", who must in principle be a natural person (Article 8.1), although a collegiate body may be chosen, in which case it must delegate to one of its members the powers to manage the system and process information files (Article 8.2). As can be seen, legal rigor is conspicuous by its absence: Article 8(2) provides for the possibility of opting for a collegiate management body, whereas the option is not provided for at all in Article 8(1), which only refers to the designation of the natural person responsible for management. This lack of rigor is maintained in the regulation of the figure of the person responsible for the system: Article 8.5 speaks of the "person responsible for the system, a natural person or the entity to whom the collegiate body has delegated its functions", when the delegation must be to a member of the collegiate body (therefore a natural person), not to an "entity". In any case, the person responsible or delegated must be a "manager of the entity", who will exercise his or her position independently of the administrative or governing body of the entity. It is not required that they have exclusive dedication, but the second part of the same section 5 of Article 8 seems to suggest otherwise, since "when the nature or dimension of the entity's activities do not justify or permit the existence of a manager responsible for the system, it will be possible for the ordinary performance of the functions of the post or position with those of the person responsible for the system, trying in all cases to avoid possible situations of conflict of interest". This seems to be an ambiguous and convoluted way of saying that the person in charge must be a full-time manager and, when this is not possible, it may be an employee who is not necessarily a manager, who may combine the responsibility for the system with the performance of his or her work. With the added doubt as to when it will be possible to resort to this second solution, and who, and with what criteria, will be able to assess the impossibility of it being a manager (or the justification for it not being a manager).

The law allows for the submission and subsequent processing of anonymous reports through internal channels (Article 7(3)), although this is not required by the directive, which recognizes the power of Member States to decide whether or not to require private or public sector entities and competent authorities to accept and follow up on anonymous reports of infringements (Article 6(2)). This admission of anonymous reports may be highly problematic given the extension, by Spanish law, of the material scope of the directive. The admission, in the complaints channel, of complaints of criminal offences and, above all, of serious and very serious administrative offences, may give rise to situations in which the anonymity of the complainant goes against the rights of defense of possible third parties affected by the complaint, which may exist, provided that they are not interpersonal conflicts or conflicts that exclusively affect the complainant and the accused, who are excluded from the protection of the law (Article 35.2.b). The guarantee of anonymity, on the other hand, is hardly compatible with the consistent system of whistleblower protection provided for in the law.

With regard to the system of infringements and penalties, it should be borne in mind that what are typified are infringements of the whistleblower protection law and penalties are provided for them. These are not applicable to possible administrative or criminal offences reported, which will have their own legal regime. Even so, there are problematic cases, such as that of Article 63.1 b of the law in relation to reprisals derived from whistleblowing. In the labor sphere, the guarantee of indemnity and the prohibition of reprisals already exist, and, in my opinion, the more specific labor sanctioning system should prevail in all those cases in which not only compliance (or non-compliance) with the provisions of the law is at stake. This is another drawback of the Spanish legislator's extension of the material scope of application of the directive.