Does your company have over 50 workers? According to the European Union, you must implement a Whistleblowing Channel

On April 16, 2019, the European Parliament voted and approved the proposal for a Directive of the European Parliament and of the Council on the protection of persons who report breaches of Union law, known as the Whistleblowing Directive (i.e., anyone that blows the whistle, in other words, the person reporting). In the USA, the protection of whistleblowers is an essential element in the fight against corruption, the disclosure of cartels and the investigation of business irregularities, including giving economic awards to to anyone revealing information that would be difficult to ascertain without inside information.

The European Directive, now approved, includes this practice for protecting European regulations (including to detect irregularities affecting food security, public health and consumer protection) and establishes the need and obligation to implement internal channels and procedures for reporting and processing complaints. This obligation will apply to both public entities and private sector companies with over 50 workers.

For the effective implementation of the internal reporting channels, the directive establishes (i) that these be negotiated with the workers’ legal representatives and when this is stipulated by national law, and (ii) the scope and content of the procedures for reporting and processing complaints. See below:

1. The whistleblowing channels must allow for complaints to be made verbally and in writing, as well as by telephone or other voice messaging systems, and also in person if so requested by the complainant.
2. Receipt of the complaint must be acknowledged within a maximum of seven days.
3. Appointment of an impartial person or service able to process complaints; this could be the same person or service that receives complaints and that keeps communication with the complainant, and if necessary, this person or service will also be responsible for requesting additional information and giving a response.
4. Diligent processing of all complaints including anonymous ones.
5. The complainant must receive a response regarding the complaint’s handling in a maximum of three months, starting on the date the complaint is acknowledged and, if there is no acknowledgment receipt, within seven days from the date on which the complaint is filed.

Remember that Spain had already started to regulate these channels through  Spanish Act 3/2018, of December 5, on Data Protection and Guarantee of Digital Rights (“LOPDGDD”). For the first time, article 24 LOPDGDD confirmed the possibility for private companies to create and maintain whistleblowing channels (whistleblowing, see post on entry into force of LOPDGDD here) through which workers and external third parties could report, including anonymously, the commission in the company, or through the actions of third parties in contracts with the company, of acts or behavior that could be contrary to the general or sectoral regulations applicable.

Based on the above, and despite the directive having a two-year transposition period from its publication in the Official Journal of the European Union, the compliance plans already recommend having these channels, which are of vital importance for a successful internal investigation. Therefore, it is highly recommendable for companies to take advantage of this opportunity to implement secure channels that meet the guidelines established in the new European regulation.

Autores: Lara Vivas y Álvaro Fernández