Obliged companies and bodies must comply with this obligation within the three months following its entry into force (i.e., by 13 June 2023), with the exception of municipalities with less than 10,000 inhabitants and legal entities with 249 employees or less, which have until 1 December 2023 to implement the internal whistleblowing channel. In case the company or body already has one of these mechanisms in place, it shall adapt it to the requirements of the Law by 13 September 2023, i.e. within the six months following its entry into force.
As can be deduced from the previous paragraph, this obligation applies to both the private and the public sector. In this article, we will focus on the main impacts of the Law on the public procurement and, in particular, on the contractors and subcontractors operating in the public sector.
To begin with the subjective scope of application of the obligation to have an internal whistleblowing channel. The Law provides that "all public sector entities" are obliged to have an internal whistleblowing channel. In line with the definition provided by the same, the subjective scope in the public sector of the Law is largely equivalent to the public sector as defined in Law 9/2017, of 8 November, on Public Procurement.
Regarding the material scope of application of the Law, direct and indirect references to "public procurement" can be identified. In this regard, the text of the norm provides that, through the established whistleblowing channel, it will be possible to report (i) any EU law infringement affecting the financial interests of the Union, the internal market, or irregularities with respect to Union law in certain sectors, among which "public procurement" is included; as well as (ii) any act or omission that may constitute a serious or very serious criminal or administrative offence. The Law specifies that this includes all serious or very serious criminal or administrative offences that cause financial loss to the Social Security and the Tax Authorities.
Notwithstanding to the above, the main impact for those companies contracting with the Spanish public sector is in the personal scope of the Law, i.e., the individuals who will get protection under the Law as whistleblowers. Article 3 of the norm states that it applies to whistleblowers working in the "private" or "public" sector who have obtained information about violations in an employment or professional context, which includes, among others, "any person working for or under the supervision and direction of contractors, subcontractors and suppliers". In other words, employees of any contractor, subcontractor or supplier will be able to report breaches committed by these companies through the internal channel of the public sector entity to which they are providing the service, supply or work. In fact, not only that, they may also report it through the external channel created by the Law, that is, to the Independent Authority for the Protection of Whistleblowers ("A.A.I."), which may also carry out the relevant investigations and, if it deems it necessary, refer the proceedings to the competent authority to process an eventual criminal/sanctioning procedure.
Therefore the Law provides that, any company holding a public contract runs the risk that any of its employees (or those of its subcontractors) may use the whistleblowing channel to bring certain infringements to the attention of the public sector entity (or the A.A.I.). In this regard, it should be remembered that the infringements to be reported do not necessarily have to be within the framework of public procurement regulations, but rather, through this channel, employees may report any type of serious or very serious criminal or administrative infringement on any matter (unless there is already an appropriate channel for this purpose).
Because of the above, with the entry into force of the Law, companies operating in the public sector face a higher risk, as their eventual infringements can be more easily exposed to the relevant public sector entity (or the A.A.I.). This, in the field of public procurement, translates into a higher risk of penalties being imposed, of the contract being terminated for culpable breach or of prohibitions on contracting with the public sector being applied, affecting not only a specific contract, but the company's activity as a whole.
It is worth noting, in line with this last point, that regardless of any complaint, failure to comply with the Law itself, in addition to the imposition of the corresponding financial penalties, which can reach up to EUR 1 million, may lead to the application of a ban on contracting with the public sector for a maximum period of three years.
Given this situation, the question is: how can companies operating in the public sector prepare themselves to minimize this new risk? The first step to minimize the risk described above would be to have an effective and reliable internal whistleblowing channel so that employees choose to use the company's own whistleblowing channel rather than the one of the public sector entity. This will enable companies to detect any possible irregularities at an early stage and to take appropriate actions.
Therefore, the need to have a good compliance program is particularly important, and companies must ensure that they have correctly implemented the corresponding due diligence procedures to ensure that they do not commit any infringement within the framework of their activity and that, if they do, they have the necessary mechanisms in place to adopt the necessary actions to correct the situation and minimize its impact.
The Spanish version of this article is available here.
