Whistleblowing channel: mandatory for all companies with over 50 employees and for public sector entities

The context

According to experts, the best way to detect irregular behaviour in companies is to have reliable mechanisms that allow their employees and third parties with whom they have work-related activities to report such behaviour. This is the best way to detect undesirable behaviour that might otherwise go unnoticed by the usual supervisory and control mechanisms. 

The benefits for companies are clear: early and comprehensive identification of such misconduct allows companies to act in time to avoid serious legal, financial, and reputational consequences.

But beyond the interests of companies, the fight against corruption is a priority in Europe, as is the need to demand high standards of compliance and ethical behaviour from European public and private entities.

In this context, the so-called “whistleblowing channels” are a key instrument to ensure that those who are aware of irregular or illegal actions within a public or private entity can bring them to its attention.

Law 2/2023, of 20 February, which regulates the protection of persons who report breaches of the law and the fight against corruption, and which transposes European Directive (EU) 2019/1937 into Spanish law, has just been published in the Official State Gazette. Both rules regulate the aforementioned whistleblowing channels in detail, but it should be noted that the explicit purpose of the regulation (as expressed in the first article of the Spanish law) is to provide adequate protection against retaliation that may be suffered by individuals who report any of the alleged infringements or irregular actions or omissions.

The preamble of the Law recognises the whistleblower as an important instrument in the fight against illegality and corruption: “It is important to raise awareness in society that those who break the law must be prosecuted, and that non-compliance must not be tolerated or silenced“.

Company whistleblowing channels

Companies with over 50 employees must have an internal reporting system to allow for the submission of complaints (“Whistleblowing Channel”).

Companies with 250 or more employees have until 13 June 2023 to comply with the new law. For all other companies, the deadline is 1st December 2023.

Reportable conducts

The Whistleblowing Channel should allow for the submission of information on any matter that could constitute a serious or very serious criminal or administrative offence.

In the field of medicines and medical devices, serious or very serious administrative offences are defined in Articles 111 et seq. of the Law on Guarantees and Rational Use of Medicines and Medical Devices.

Examples of serious offences include:

• Modification, without prior authorisation or notification, of any of the conditions for the authorisation of the medicinal product.

• Supplying, purchasing, or selling medicinal products to entities not authorised to carry out such activities.

• Failure to adapt the prices of medicinal products to those set by the administration.

• Offering, directly or indirectly, inducements, bonuses, unlawful rebates, premiums, or gifts to healthcare professionals (or their relatives and household members) in connection with the prescribing, dispensing and administration of medicinal products.

Some examples of very serious offences are:

• Selling medicines at home or via the Internet or other telematic or indirect means, contravening the specific provisions of the law.

• Promoting, informing, or advertising unauthorised medicinal products or without such activities being in accordance with the provisions of the law.

• Offering premiums, gifts, prizes, contests, competitions, bonuses, rebates, discounts or similar as a method of promoting or selling a medicinal product to the public.

• Manufacturing, marketing, prescribing or dispensing products that are presented as medicinal products without being legally recognised as such.

• Stopping the supply of a medicinal product if this affects public health interests.

• Distributing outside the national territory medicinal products for which there are problems of shortage affecting patient care in Spain.

• Failing to comply with the obligation to supply the market adequately and continuously in order to meet the statutory requirements for the provision of medicines to the NHS and to ensure that pharmacies and pharmacy services are supplied with medicines having the lowest price in homogeneous groups.

Situations such as interpersonal conflicts, or information that is already in the public domain cannot be reported.

Protection for whistleblowers

Not only employees of a company, but also former employees, trainees or apprentices, shareholders, members of management ,the Board or supervisory bodies as well as any person working for or under the supervision of contractors, subcontractors and suppliers can be whistleblowers (as the law calls them) protected by the law.

Persons involved in recruitment processes may also be whistleblowers.

The Whistleblowing Channel must be confidential, and secure, ensuring “affordability of use”, and effective protection of whistleblowers from retaliation. Reports must not be accessible to unauthorised personnel, and reports may be made anonymously, verbally or in writing.

Any form of retaliation against the whistleblower (e.g., dismissal, transfer, change of job or location, demotion or denial of promotion, reduction in salary or change in working hours, denial of training, negative performance reviews, coercion and, in general, situations of unfavourable treatment) is prohibited.

Strict compliance with legislation on the protection of personal data must be ensured.

Leniency Programmes

Whistleblowers who have been actively involved in an administrative offence may be exempted from the sanction that may be imposed on him or her, if the administrative body deciding on the offence so decides. All this is subject to the following conditions:

• The complaint being lodged before the administrative procedure is initiated.

• Other persons involved in the offence must be identified.

• The offending conduct must have ceased.

• Full cooperation, provision of relevant evidence and data, and no destruction or concealment of information.

• The attributable damage must have been repaired.

This leniency benefit does not apply to breaches of competition law, which are governed by specific rules. In fact, the current law introduces an amendment to Spanish Law on Defence of Competition, defining the conditions that must be met when reporting possible infringements through the external communication channel of the Spanish Competition Authority (CNMC). These rules also apply to information received by regional competition authorities. They are essentially as follows:

• Any natural person may report through the CNMC’s external channel any act or omission that may constitute an infringement of competition rules.

• The reporting of infringements is not considered a complaint within the meaning of the law, nor is it considered a request for exemption or reduction of fines under the specific leniency program of CNMC.

• The complaint may be made anonymously. If not, the identity of the whisteblower will be protected.

• Persons using this external channel are entitled to support and protection measures.

• Communications will be recorded securely and with restricted access.

• Information received will be acknowledged within 7 calendar days.

• Referrals will be made to other government agencies if the information relates to conduct that breaches other areas of regulation.

Impact on public procurement

Companies that are sanctioned for committing a very serious offence of this law may be sanctioned with the prohibition of contracting with the public administration.

The very serious offences that may give rise to this severe sanction are essentially the following:

• Any action that effectively limits the rights and guarantees of the whistleblower, or any attempt to obstruct communication, or to slow down or hinder the investigation.

• Any form of retaliation.

• Breach of guarantees of confidentiality and anonymity.

• Breach of confidentiality.

• Provision of information knowing it to be false.

• Failure to comply with the obligation to have an internal information.

Management of the system

The whistleblowing channel must be independent of the internal reporting systems of other entities or bodies. The implementation of the whistleblowing system cannot be avoided, for example, arguing that a self-regulatory system with conflict resolution mechanisms is already in place.

The management of the Whistleblowing Channel may be provided by a third party, provided that it offers adequate guarantees with regard to independence, confidentiality, data protection and confidentiality of communications.

In any case, entrusting management to a third party does not exempt the company from the obligation to have an internal natural person in charge of the system. It is expected that the Compliance Officerwill perform this function.

The whistleblowing procedure

The law regulates in detail the procedure for the management of the information received, with maximum time limits for the initial response, the decision on whether or not to accept the complaint for processing and, where applicable, the resolution of the complaint.

Whistleblowers, on the other hand, should be provided with clear and accessible information on external reporting channels of the competent authorities.

In this case, the information received will give rise to an investigation on the alleged irregular facts. The remedy that should be put in place once the infringement has been verified remains outside the scope of the investigation. In any case, the information must be forwarded to the Public Prosecutor’s Office if the facts investigated could constitute a criminal offence.

Whistleblowing channels in the public sector

Public sector entities are also required to have an internal information system (we basically refer to the General State Administration, regional and local administrations, universities, foundations, and public sector companies).

The Law does not contain a detailed description of the cases that can be reported through these channels, nor does it set out a specific procedure for resolving them.

In any case, on the basis of this law, any person will be able to report on the conduct of the administration that they consider irregular, under the same conditions and guarantees that apply to the use of private channels. Undoubtedly, this regulation opens a new way for the citizens to control and monitor the activities of the administration.

Our value proposition

The new law represents a qualitative leap in the prevention of irregular behaviour and establishes a strict and demanding system of obligations.

At Faus Moliner, we have over 25 years’ experience advising companies operating in the pharmaceutical and life sciences sectors. Our knowledge of the dynamics of the sector and a team with solid and proven experience in pharmaceutical compliancematters, as well as knowledge of the practices and regulations of the sector place us in a uniquely privileged position to manage whistleblowing channels. We are ready to offer a comprehensive external whistleblowing channel management service that allows to comply with the new law and with the standards of excellence that characterise the sector, reinforcing the guarantees of independence and confidentiality, while ensuring an assessment of each situation based on a solid knowledge of the social, legal and economic context in which pharmaceutical and health sciences companies operate