Start of main content

Directive of the European Parliament and of the Council on the protection of persons reporting infringements of Union law

| Publications | Employment Law and Social Security

Concerning the Directive of the European Parliament and of the Council on the protection of persons reporting infringements of Union law of 26th November 2019

I.- Purpose:

To provide real and effective protection to complainants and third parties who may be affected by the communication of complaints, preventing possible reprisals that may occur as a result of such actions. For this reason, the reinforcement in protection will be carried out not only in the complaints that are communicated in the strictest confidentiality, but also in those that are made publicly or through external channels.

II.- Appicability:

Public sector entities, as well as large and medium-sized companies, are obliged to comply with the regulations, understanding as such those with fifty or more employees. However, the Directive stipulates that companies with between 50 and 249 employees may share the resources for the reception and processing of complaints and their subsequent investigation. Small businesses will therefore be excluded from the obligation to implement such complaint channels.

However, by way of exception, it is established that, irrespective of the size of the institution, if they operate in the area of financial services, or if they are considered particularly vulnerable to money laundering or terrorist financing, they must fall within the scope of this Directive.

III.- Nature and articulation of complaint mechanisms:

Once the scope of application of the rules of merit has been defined, the requirement contained therein must be specified, by virtue of which the mechanisms through which complaints are instrumentalised must guarantee knowledge of the information in the shortest possible time, and through those that are closest to the source of the problem.

The Directive distinguishes between internal and external channels of complaint.

A.- Internal complaints and their processing: the third provision of the Directive defines internal complaint as the "communication orally or in writing of information about infringements within a legal entity in the private or public sector".

i.- In relation to negotiation and the form of the reporting channels.

Regarding the negotiation of the channels, as well as the processing of them, a wide margin is established for transposition by the Member States; considering, however, the possibility of requiring prior consultation and/or negotiation with the social partners.

About the type of channels, it will be up to the entities to decide which procedures are most appropriate, always respecting the strictest confidentiality and protection of both the complaints and the identity of the complainant and the third parties mentioned in the complaint. Indicating, by way of example, the use of electronic mail, physical mailboxes, online platforms, voice messaging systems, or in person when the complainant so requests.

The complainant must also receive an acknowledgement of receipt within seven days of receiving the complaint.

Similarly, the company must designate an independent and impartial person or department to receive and process the complaints, diligently following up on them. However, the Explanatory Memorandum indicates that in smaller entities it may be a person in charge - among others, the Director of Human Resources, Legal Services or a member of the Board of Directors - who passes the complaint onto those in charge of the company.

ii.- Regarding the process duration.

The Directive announces that it must be substantiated within a "reasonable time", meaning that the complaint must be resolved promptly and thus avoid unnecessary disclosure of information, with the possible consequences that this might entail.

Consequently, it proposes a maximum duration of three months from the acknowledgement of receipt of the complaint, but, if there were no acknowledgement of receipt, the "dies a quo" would begin seven days after the presentation of the same, to communicate to the complainant the measures that are going to be carried out.

Consequently, provisional measures should not be ignored in order not to continue with the infringements, or even to prevent those destined to possible reprisals while the procedure is being studied.

iii.- On the information to be made available to workers on the procedure.

Information on complaints procedures should be easily understandable and available in sufficiently visible places - e.g. the corporate website. In addition, for preventive purposes, it is suggested that training courses and activities related to ethics and integrity should be offered.

B.- External complaints and processing of complaints: the third precept defines external reporting as "the oral or written communication of information on infringements to the competent authorities". In other words, complainants may report infringements of Union law through external complaint channels, either by first communicating through internal channels, or directly through an external complaint.

i.- Entities competent to deal with external complaints.

Member States will be responsible for designating the authorities competent to deal with external complaints, which must have secure channels independent of the channels used for the provision of internal services, and again, always respecting the confidentiality of the complainant. The competent authorities will also be required to keep a register of all complaints, always complying with confidentiality requirements.

ii.- About the methods of the complaint channels.

The Directive provides that complaints may be dealt with in writing, in electronic or paper form; by telephone; or in a face-to-face meeting at the complainant's request.

As in the case of internal procedures, the external authorities must appoint specific staff, whose functions are as follows: receiving and processing complaints; providing information to those interested in starting the complaint channels; and keeping the complainant informed during and after the proceedings.

iii.- In reference to the duration of the process.

The "reasonable period" granted by the Directive in these cases is, as in the internal channels, three months, but with the extension to six months in cases where the nature and complexity of the matter so require, and its extension must be duly justified.

Acknowledgement of receipt is also required, unless the complainant expressly requests otherwise, or the authority considers that acknowledgement of receipt could undermine the protection of the identity of the complainant.

IV.- On the relationship between the Directive and Organic Law 3/2018 of 5 December on the Protection of Personal Data and Guarantee of Digital Rights:

Although the Directive proscribes the collection of personal data that are not necessary for the specific complaint, its content must necessarily be in line with what is disciplined by Article 24 of the recent Spanish legislation on data protection - especially as regards the dichotomy between confidentiality and anonymity, which is particularly problematic in the transposition of this Directive.

It is also stated in the Community legislation that if data are accidentally collected that exceed the strict scope of the complaint, they must be deleted "without undue delay".

V.- Applicability of the measures:

The Directive will enter into force on the twentieth day after its publication, allowing two years for Member States to transpose it, fixing Article 26, to be transposed by 17 December 2021 at the latest. However, for private entities with 50 to 249 employees, the transposition period will be four years, i.e. until 17 December 2023.

You can read the full sentence for more information.

For more information please contact:

Alfredo Aspra

José Antonio Sanfulgencio

You can download the complete document in the following link

End of main content