View the PDF
In Article nº 8/20 we already mentioned the great relevance of the European Directive 2019/1937 on the protection of persons who report through the Whistleblowing Channels and the first court decisions have not been long in coming.
Supreme Court ruling 35/2020, of 6 February, deals with the anonymous report received by the person responsible for Human Resources, in which the commission of a fraud offence within the company was warned.
The resolution stresses the importance of said Directive and states that «Whistleblowing Channels should allow people to report in writing and to do so by mail, through a physical mailbox for collecting reports or through an online platform, either on the intranet or the internet, or to report verbally, by hotline or through another voice mail system, or both (…). Internal report procedures should enable private legal entities to receive and investigate reports from employees of the entity and its subsidiaries (hereinafter referred to as the group), but also, to the extent possible, from any of the agents and suppliers of the group and from any person accessing the information through their work activities related to the entity and the group”.
Article 24.1 of Organic Law 3/2018, of 5 December, on the Protection of Personal Data and the Guarantee of Digital Rights already established that it is lawful «to create and maintain information systems through which a private law entity can be made aware, even anonymously, of the commission within it or in the actions of third parties who contract with it, of acts or behaviours that may be contrary to the general or sectorial regulations applicable to it».
However, until the end of 2018, when the aforementioned Data Protection Act came into force, the filing of anonymous reports through internal Whistleblowing Channels was not allowed.
This was the position adopted by the Spanish Data Protection Agency (AEPD) in its legal report 128/2007, on the understanding that «procedures should be established to guarantee the confidential treatment of reports submitted through whistleblowing systems, so as to avoid the existence of anonymous reports, thus guaranteeing the accuracy and integrity of the information contained in such systems«.
Therefore, the implementation of the Whistleblowing Channel is a fundamental part of the Criminal Compliance Program, since those who intend (or plan) to carry out irregularities will know that from their most direct environment an anonymous report can be done that will determine the opening of an investigation.
In the case covered by the ruling, it is concluded that the anonymous report is entirely lawful and can be produced as evidence in court proceedings. Likewise, it is sufficient cause to initiate an internal investigation within the company for the purpose of clarifying the facts and identifying those responsible.
Therefore, companies must comply with the obligation to allow the filing of anonymous reports through the Whistleblowing Channels, as well as be aware of the new features included in the aforementioned European Directive, among which are noteworthy the obligation to implement Whistleblowing Channels in private companies with 50 or more employees.