View the PDF

When is it mandatory for a company to have a Whistleblowing Channel?

On 17 December 2021, Directive (EU) 2019/1937 of the European Parliament and of the Council of 23 October 2019 on the protection of persons who report breaches of Union law, also known as the Whistleblowing Directive, came into force in all Member States.

This directive lays down common minimum standards for the protection of persons reporting breaches of European Union law (public procurement, environmental protection, public health, etc.) in companies, and obliges all entities (private or public) with 50 to 249 employees to establish a Whistleblowing Channel. However, by 2021 the obligation of having a reporting channel only applies to companies with more than 250 employees and, as of 2023, to those with more than 50 employees.

Reporting channels shall ensure the confidentiality of the identity of every reporting person and third persons referred to in the report, acknowledgement of receipt of the report to the reporting person within 7 days of that receipt, and designation of an impartial person or department competent for following-up on the report, among others.

Whereas the Directive officially entered into force on 17 December 2019, Member States had been allowed a period of 2 years for its transposition into the national law. However, Spain has not yet developed any regulations in this regard, with the consequent legal uncertainty that this entails.

Nevertheless, the fact that a Member State does not adapt or transpose a European Directive into its national legislation does not mean it cannot be enforced.

In this case, it must be considered the principle of direct effect of the European Union law, as established by the European Court of Justice in the Van Gend en Loos judgment on 5 February 1963. In this judgement it was stated that European Union law not only generates obligations for Member States, but also rights for individuals. This means that any individual can invoke rights derived from European Union law, even if it has not been transposed.

It should be noted that one of the basic aspects of a Criminal Compliance System is the implementation of the Whistleblowing Channel. In this sense, article 31 bis.5.4 of the Spanish Criminal Code establishes that “it will impose the obligation to report possible risks and non-compliance to the body in charge of monitoring the functioning and observance of the prevention model”. Hence, every company having a Criminal Compliance System should already have a Whistleblowing Channel, and therefore already be in compliance with this directive.