Information alert: Is there an obligation to implement a com-plaints channel by 17 December 2021?

The European Union Directive 2019/1937 of the European Parliament and of the Council of 23 October 2019 on the protection of reporting persons who report breaches of Union law (the "Directive"), which is known as the Whistleblower Directive, provides in its Article 26 that Member States, including Spain, shall enact such laws, regulations and administrative provisions as they deem necessary, by 17 December 2021 at the latest, to enable companies with more than 250 employees to comply with the Directive, including Spain, shall bring into force the laws, regulations and administrative provisions they deem necessary by 17 December 2021 at the latest, to enable companies with more than 250 employees to comply with the Directive, and by 17 December 2023 for companies with more than 50 employees.

The Directive says that it is necessary to have the complaints channel in place, and we say that it is not mandatory. Let us explain, directives do not have direct effect for member states, i.e. they are not directly applicable. Directives only become binding on member states when they transpose the legislation into national law, unlike EU regulations, which become binding and have direct effect throughout the EU from the date of their entry into force.

This Directive provides that it is for each Member State to define how to establish such complaint channels, while respecting the minimum requirements imposed by the Directive.

To date, Spain has not yet transposed the Directive into national law, so companies with more than 250 employees are not yet legally obliged to establish an internal whistleblowing channel. However, it would be advisable for companies with more than 250 employees to consider setting up an internal whistleblowing channel.

At the end of 2020, the Ministry of Justice launched a public consultation on the transposition of the Directive, giving until the end of January of this year to receive all kinds of allegations. According to the website of the aforementioned Ministry, the latest news on the matter is from last June, referring to the meeting of the Working Group set up within the Ministry of Justice to address the transposition of the Directive. Considering the time needed to process a law in our country (on average around five months between the approval of the draft law by the Council of Ministers, sending it to Congress, the period for amendments, appointing the Commission, debate, presentation, deliberation, the Senate stage and return to Congress), we do not believe that Spain will reach the transposition stage on time.

Looking at the situation in our neighbouring countries, it cannot be said that we are doing too badly in this respect, when it comes to the transposition of the Directive:

• Germany.  The bill was submitted to the German Parliament in December 2021, having been rejected in April 2021. Given the recent elections, after Merkel's departure, it does not look like our German friends will make it in time either. There is a strong debate on whether the German regulation should go beyond the minimum required by the Directive.
• Austria. Transposition pending.
• Italy. On 8 May this year, the Italian Parliament passed the Law of 22 April 2021 delegating the government to transpose the Directive.
• France. The draft law was submitted to the French Parliament on 21 July 2021.
• Netherlands. Since 2016 both its Civil Code and a law called 'the House for Whistleblowers Act' regulate whistleblowing channels. In July 2020, a law was published bringing together the domestic legislation with the Directive. The adoption of such a new bundling law is still in the pipeline.
• Belgium. The first draft law was rejected. To avoid a new rejection, the second draft law was submitted on 30 April 2021 and is currently being processed.
• Poland. The bill was submitted to the Polish Parliament on 18 October 2021. The Centre for Government Legislation indicates that Polish companies are not sufficiently prepared to implement the requirements of the Directive and considers the deadline too demanding.
• Czech Republic. The draft law was submitted to Parliament on 1 February 2021 and is currently being processed.

Two countries have already transposed the Directive:

• Denmark. Denmark adopted on 24 June 2021, transposing the Directive, the Whistleblower Protection Act (Lov om beskyttelse af whistleblowere).
• Sweden. Adopted on 29 September 2021, transposing the Directive, the Whistleblower Directive Implementation Act ("genomförande av vis-selblåsardirektivet").

Two conclusions can be drawn from this analysis: one, that at the present time, a few weeks before the deadline for transposition of the Directive, only two member states out of twenty-seven have transposed it; and two, that transposition of the Directive is not being an easy task for the governments of the member states, as they are encountering considerable opposition from different groups.

Be that as it may, if we want to make progress with the implementation of such a channel in our organisations, we must bear in mind that it must include the following fundamental principles:

1. Confidentiality of the identity of the whistleblower: reporting procedures and follow-ups on reports should be carried out by means that ensure that the identity of the whistleblower/reporting person and of any third parties involved in the reported non-compliance is kept secret, preventing access by unauthorised members of the company. Anonymous whistleblowing and subsequent anonymous dialogue are essential for people to dare to report breaches.
2. Confirmation of receipt: The whistleblower should receive an acknowledgement of receipt of his or her report within seven days.
3. Contact person: an impartial person or a competent department should be designated to manage the whistleblowing channel. The designated person should maintain communication with the whistleblower in case further information about the reported facts is needed.
4. Follow-up: the complaint should be followed up diligently by the contact person. The complainant should be informed, within a reasonable period of time (in no case more than three months from the acknowledgement of receipt), about the follow-up of the complaint. It should be ensured that the reporting channel allows for a fully anonymous dialogue between the complainant and the contact person.
5. Communication and Reporting: Procedures for reporting and follow-up of reports shall include clear and accessible information on how to report to competent authorities and, where appropriate, to official institutions or bodies.
6. Compliance with the General Data Protection Regulation: all processing of personal data shall comply with the GDPR.
7. Recording of Reports: every organisation must keep records of all reports received, for as long as necessary, respecting confidentiality requirements.

In conclusion, whether by 17 December of this year or a little later, at RocaJunyent we recommend that all companies with a workforce of more than 50 employees start to organise their whistleblowing channels, or ethical channels, or reporting channels, or whistleblower channels, which are some of the names that are often used.

This implementation of the whistleblowing channel may be a good first step towards the appropriate deployment of compliance in the company, something which, as the Magistrate of the Second Chamber of the Supreme Court, Vicente Magro Servet, has been reiterating, every company, regardless of its size, must have its own regulatory compliance model.