The protection of persons who report breaches of law in the Spanish Act 2/2023: strengths and weaknesses in the implementation of the EU Whistleblowing Directive

The protection of persons who report breaches of law in the Spanish Act 2/2023: strengths and weaknesses in the implementation of the EU Whistleblowing Directive La protezione delle persone che segnalano violazioni del diritto nella Legge Spagnola 2/2023: punti di forza e debolezza nel recepimento della Direttiva Whistleblowing Victoria Rodríguez-Rico Roldán Permanent Lecturer of Labour and Social Security Law University of Granada ABSTRACT: This paper deals with one of the main legislative novelties introduced in Spain in 2023. The Act 2/2023, regulating the protection of persons who report breaches of law and the fight against corruption, is of great importance, not only because it promotes the consolidation of the culture of integrity in organisations, but also because it establishes for the first time in our legal system the obligation to establish reporting channels and, at the same time, guarantees a legal status for the protection of whistleblowers. As this is a subject of unquestionable impact in the labour sphere, the following pages propose an assessment of the Spanish transposition of the EU Directive 2019/1937, in order to identify the convergences and divergences between the Spanish and European standards. As will be seen, while attempting to respond to many of the questions raised by the Whistleblowing Directive, the Act 2/2023 poses interpretative and application problems which will be highlighted in this paper in order to propose solutions and enhance the effectiveness of the Spanish legal framework. KEYWORDS: Whistleblowing - reporting channel – public disclosure - retaliation SUMMARY: 1. Introduction: Are we facing a new or a not-so-new issue in Spain? Pre-print – Rodríguez-Rico Roldán, V., “The protection of persons who report breaches of law in the Spanish Act 2/2023: strengths and weaknesses in the implementation of the EU Whistleblowing Directive”, Variazioni su Temi di Diritto del Lavoro, n. 3, 2024, pp. 770-805. ISSN 2499-4650. 2. Late as usual…The Spanish transposition from the formal point of view 3. The scope of application of the Act 2/2023 3.1. Personal scope: the work-related or professional context 3.2. Material scope: breaches of EU law and national law 4. The establishment of reporting channels 4.1. Internal reporting channels 4.1.1. Configuration and scope in the private and the public sector 4.1.2. Responsibility for the implementation and management of the internal channels 4.2. External reporting channels: The Independent Authority for the protection of the reporting persons 5. The public disclosure 6. The protection of persons who report breaches of law 6.1. The prohibition of retaliation 6.2. The measures of support and protection against retaliation 7. The sanctioning legal regime 8. Conclusions 1. Introduction: Are we facing a new or a not-so-new issue in Spain? Act 2/2023, of 20 February, regulating the protection of persons who report breaches of law and the fight against corruption, aims to provide adequate protection against retaliation that may be suffered by individuals who report any of the actions or omissions identified in the rule itself, through the procedures provided for therein. The aim is to strengthen the integrity infrastructures of organisations and the promotion of the information culture as a mechanism for preventing and detecting threats to the public interest. It has been proven that the investigation of infractions necessarily requires the promotion of whistleblowing, which also requires the guarantee of the absence of retaliation. Not surprisingly, the fear of possible harmful consequences for the whistleblower explains why 81% of those consulted in the Special Eurobarometer on corruption, according to data referring to 20221, were not open to reporting acts of corruption of which they had become aware. In general, and in contrast to other legal systems, in Spain the figure of the whistleblower and his or her protection lacked a consolidated legal basis. There was therefore no comprehensive regulation of reporting channels in private entities and public administrations or some kind of statute of legal protection for the person who used them2. In any case, it is true that, since Organic Law 1/2015 modified the Criminal Code, the implementation of reporting channels has become more widespread. It should be recalled that, five years after the 2010 reform which introduced criminal liability for legal persons, the modification of art. 31 bis included, among the conditions for exemption from such liability, that the management body must have adopted and effectively implemented, prior to the commission of the crime, organisational and management models that include the surveillance and control measures suitable for preventing crimes of the same nature or for significantly reducing the risk of their commission. The requirements to be met by such organisation and management models included precisely the imposition of the obligation !!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!! 1 https://data.europa.eu/data/datasets/s2247_92_4_502_eng?locale=en 2 Looking back, some frustrated attempts stand out, such as when in September 2016, a comprehensive Proposition of Law on the fight against corruption and protection of whistleblowers was presented for processing in the Congress of Deputies, which would have been a real regulatory milestone in this area. to report breaches to the body responsible for overseeing the operation and observance of the prevention model, as well as the establishment of a disciplinary system that adequately sanctions non-compliance with the measures established by the model. This made criminal compliance systems highly relevant. However, given that this was not an imposition in itself, but rather a recognition of the guarantees in terms of exemption from criminal liability, not all companies opted to implement these channels. Moreover, it had an important limitation, since, in accordance with Art. 31 quinquies, the provisions on criminal liability do not apply to public administrations. From a sectoral perspective, the creation of various instruments for reporting has been successively imposed. The Organic Act 3/2007, of 22 March, for the effective equality of women and men established the obligation of companies to establish specific procedures for the prevention of sexual harassment and harassment on grounds of sex and to channel the complaints or claims that may be made by those who have been subjected to it (Art. 48). This same rule amended the Royal Legistative Decree 5/2000 on offences and penalties in the Social Order and included as a very serious offence the decision of the employer to treat workers unfavourably as a reaction to a complaint made within the company or to an administrative or judicial action aimed at demanding compliance with the principle of equal treatment and non-discrimination. Equally noteworthy, in relation to the control obligations of the Next Generation EU Funds, is the Order HFP/1030/2021, of 29 September, which configures the management system of the Recovery Plan, Transformation and Resilience Plan. It expressly refers to the establishment by the decision-making and implementing entities of adequate and clear mechanisms for reporting possible suspicions of fraud by those who have detected them, in accordance with Regulation (EU) 2021/241 of the European Parliament and of the Council of 12 February 2021 establishing the Recovery and Resilience Facility. Article 22 of the Regulation obliges Member States, in their capacity as beneficiaries or borrowers of funds under the Facility, to take all appropriate measures to protect the financial interests of the Union and to ensure that the use of funds in connection with actions financed by the Facility complies with applicable Union and national law, in particular as regards the prevention, detection and correction of fraud, corruption and conflicts of interest. For its part, Organic Act 10/2022, of 6 September, on the comprehensive guarantee of sexual freedom, expressly referred to the obligation of companies to establish specific procedures for the prevention of crimes and other conduct against sexual freedom and moral integrity at work and to channel the complaints or claims that may be made by those who have been victims of such conduct, including specifically those suffered in the digital environment (art. 12.1). More recently, Act 4/2023, of 28 February, for the real and effective equality of trans persons and for the guarantee of the rights of LGTBI persons, dedicates a specific article to the equal treatment and opportunities of LGTBI persons in the workplace. Specifically, the rule urges public administrations to encourage, through the social partners, as well as through collective bargaining, the inclusion in collective agreements of clauses promoting the prevention, elimination and correction of all forms of discrimination against LGTBI persons, as well as procedures to channel complaints (art. 14.e). Abandoning the sectoral approach, the Organic Act 3/2018, of 5 December, on the Protection of Personal Data and Guarantee of Digital Rights can be considered the first precedent for the current reporting system. In particular, Art. 24 expressly recognised the lawfulness of the creation and maintenance of information systems through which a private law entity could be informed, even anonymously, of the commission within it or in the actions of third parties contracting with it, of conduct that could be contrary to the general or sectoral regulations that may be applicable. Institutionally, and in the absence of a state authority, regional anti-corruption agencies have proliferated to date, which have functioned as what the current legal framework calls external channels. Catalonia was the first autonomous community to set up an anti-fraud office. It was followed by others, such as the Agency for the Prevention and Fight against Fraud and Corruption of the Valencian Community, the Office for the Prevention and Fight against Corruption of the Balearic Islands, the Andalusian Anti-Fraud and Corruption Office, and the Office of Good Practices and Anti-Corruption of the Autonomous Community of Navarre. In other cases, it was decided to dispense with the creation of an entity with this specific competence and to include it among the tasks of bodies already created. This was the case of the Audit Council in Galicia and the Audit Office of the Canary Islands. The problem is that the regulation provided in the different Autonomous Communities is equally diverse because, although in general all of them guarantee the confidentiality of whistleblowers, they do not share anonymity as a common feature of the systems implemented. Equally divergent is the concept of whistleblower, as some of these entities only admit reports from public employees, while others extend the right to any person, whether or not they are public administration staff. Therefore, when Act 2/2023 came into force, we were facing a very diverse scenario. At the same time, there were entities that had (which does not mean that they were necessarily used) channels for reporting infringements detected within the framework of an employment relationship, which required a mere adaptation to the postulates set out in that legal text, for example to broaden the list of reportable breaches of law, as well as others for which a completely new obligation was required, starting of course with a farreaching cultural change. Thus, in many cases, it has gone from being something voluntary to a legal duty in private and public entities. This is despite the fact that there is no small amount of concern about transparency in Spain3. 2. Late as usual…The Spanish transposition from the formal point of view Although the transposition deadline for the Directive was 17 December 2021, as usual, Spain implemented it with considerable delay and it was on 20 February 2023 when Act 2/2023 regulating the protection of persons who report breaches of law and the fight against corruption was finally approved. However, this delay was not exceptional in the comparative sphere, as many countries were late in complying with the obligation set out in the European legal act4. In January 2022, the European Commission sent letter of formal notice to Spain, among other Member States, for not fully transposing and informing the Commission of the transposition measures before the deadline5. Just over a month later, on 4 March 2022, the Spanish Council of Ministers approved the Preliminary Draft Act. The rule finally !!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!! 3 Spain ranks 14th out of the 27 EU Member States, according to the Corruption Perceptions Index 2023. See https://transparencia.org.es/wp-content/uploads/Report_CPI2023_English.pdf 4 In January 2022, 24 Member States had not transposed the EU Directive. In July 2022, the implementation of the European standard was pending in 15 Member States: Bulgaria, Czech Republic, Estonia, Finland, France, Germany, Greece, Hungary, Ireland, Italy, Luxembourg, The Netherlands, Poland, Slovakia and Spain. See https://ec.europa.eu/commission/presscorner/detail/EN/inf_22_3768 5 In July of the same year, the European Commission issued a reasoned opinion accepting the commitment to ensure the implementation of the EU Whistleblowing Directive.! came into force on 13 March 2023, although it postponed the full effectiveness of some articles because it set subsequent dates for the creation or adaptation of internal and external reporting channels, in three months and six months respectively from the entry into force of the Act. Thus, the maximum deadline for setting up internal channels was 13 June 2023, although this deadline was extended to 1 December 2023 for smaller entities, specifically for legal-private entities with fewer than 250 employees and municipalities with fewer than 10.000 inhabitants. This timeframe is too short, as the obligation under discussion is not fulfilled by merely establishing a reporting channel, but requires a qualified person in charge, staff and support material, a detailed procedure and an appropriate policy or strategy6. For its part, the deadline for the implementation of external channels was 13 September 2023. 3. The scope of application of the Act 2/2023 3.1. Personal scope: the work-related or professional context The personal scope of the Act 2/2023, as in the case of the European Directive, is clearly connected to labour relations. Namely, the Spanish Act proclaims its application to reporting persons working in the private or public sector who acquired information on breaches in a “work-related or professional context” (art. 3). The Act 2/2023, as EU Whistleblowing does, uses a broad criterion in the delimitation of the personal scope of application. In particular, the European legislator states that protection should be granted to the broadest possible range of categories of persons, who, irrespective of whether they are Union citizens or third-country nationals, by virtue of their work-related activities, irrespective of the nature of those activities and of whether they are paid or not, have privileged access to information on breaches that it would be in the public interest to report and who may suffer retaliation if they report them (Recital 37). Therefore, it is clear the intention to extend the application of the framework beyond the typical forms of work, and this is also the proposal of the Spanish transposition. The truth is that, as will be seen immediately, it cannot be said that Art. 3 of the Act 2/2023 undertakes a notable extension of the personal scope of application provided for in the Directive, but it does introduce a series of variations in the adaptation to the Spanish legal system. It should be noted at the outset that the cases included exceed in several cases the concept that fits the definition of paid employment in art. 1.1 of the Workers’ Statute and, in this sense, the reference to the “work-related or professional context”, as a note common to the informants, stands out. Specifically, it includes persons with the status of workers or public employees, self-employed persons, shareholders, participants and persons belonging to the administrative, management or supervisory body of an undertaking, including non-executive members, volunteers, workers in training periods, regardless of whether or not they receive remuneration, and any person working for or under the supervision and directions of contractors, subcontractors and suppliers. As the EU Directive does, the Spanish Act extends the protection in terms of time, which is not limited to the duration of the employment relationship. Thus, it also applies to persons who report or publicly disclose information on breaches acquired in a workbased relationship which has since ended as well as those reporting persons whose !!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!! 6!C. SÁEZ LARA, El sistema interno de denuncia: una nueva obligación de las empresas, in Trabajo y Derecho, 111, 2024.! work-based relationship is yet to begin in cases where information on breaches has been acquired during the recruitment process or other pre-contractual negotiations. Protection measures against retaliation also apply to those who, without being reporting persons in the strict sense of the word, are in some way connected and, by virtue of that connection, may also suffer retaliation. The Act 2/2023 refers to the employees’ representatives in the exercise of their functions of advising and supporting the reporting person, which is a novelty as the reference in Recital 41 of the Directive was not also included in art. 47, as well as to persons who, in the framework of the organisation in which the reporting person provides services, assist the whistleblower in the process (what the Directive calls facilitators), persons who are connected with the reporting persons and who could suffer retaliation, such as colleagues or relatives of the reporting persons (without the rule clarifying to what degree of kinship this condition is linked). This is the only case in which the personal scope of application of the Act 2/2023 goes beyond the work-related context, probably in order to pursue discrimination by association cases. Finally, whistleblower protection measures provided for in the Spanish Act will also apply to legal persons that the reporting persons work for or are otherwise connected with in a work-related context, or (and this is a novelty in the Act 2/2023), have a significant shareholding in. For these purposes, it is understood that a holding in the capital or voting rights corresponding to shares or holdings is significant when, due to its proportion, it allows the person who holds it to have the capacity to influence the legal person in which the holding is held. 3.2. Material scope: breaches of EU law and national law Making use of the power provided for in Article 2.2 of the EU Directive, the Spanish Act opts to extend the application to other areas that do not fall within the material scope of the European rule. Thus, unlike the European rule, which uses the subject matter as a criterion for classifying breaches, the Act 2/2023 makes an initial distinction according to the law infringed, distinguishing between breaches of EU law and breaches of national law (art. 2). Firstly, the Spanish Act establishes mechanisms for the protection of natural persons who report any acts or omissions that may constitute breaches of European Union law provided that they fall within the scope of the European Union acts set out in the Annex to the EU Whistleblowing Directive, irrespective of their classification in the domestic legal system; affect the financial interests of the European Union as referred to in Art. 325 of the Treaty on the Functioning of the European Union (TFEU); or affect the internal market, as referred to in Art. 26.2 TFEU, including infringements of EU competition rules and aid granted by States, as well as breaches relating to the internal market in connection to acts infringing corporate tax rules or practices aimed at obtaining a tax advantage that distorts the object or purpose of corporate tax law. Secondly, and this is a novelty with respect to the text of the European standard (2.1), the Act 2/2023 decides to extend protection to informants of acts or omissions that may !!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!! 7 The mention of the employee’s representatives has been deemed unnecessary since, if they are workers representatives, they are also employees of the company. R. GÓMEZ GORDILLO, Aspectos laborales de la ley de protección de personas informantes, in Temas Laborales, 168, 2023, p. 267. constitute a serious or very serious criminal or administrative offence8. As indicated in the Preamble to the law, the legislator considered it necessary to extend the material scope of the Directive to infringements of national law, but limited to criminal offences and serious or very serious administrative offences, in order to allow both internal and external reporting channels to concentrate their enquiry or investigation on the breaches that are considered to have the greatest impact on society as a whole. The final text of the article that we are assessing deleted the reference that the Draft Bill had made to “any breaches of the rest of the legal system provided that, in any case, they directly affect or undermine the general interest, and do not have specific regulation”. The final text therefore discarded the generic reference to the effect on the general interest as a criterion for delimiting the material scope and opted for the stricter criterion of the specific classification of the breach in the legal system. As we have seen, this does not coincide with the scope corresponding to the breaches of EU law9. It should be recalled that the Directive, in its preamble, states that “effective detection and prevention of serious harm to the public interest requires that the notion of breach also includes abusive practices, as defined by the case law of the Court, namely acts or omissions which do not appear to be unlawful in formal terms but defeat the object or the purpose of the law” (Recital 42). For the purposes of clarification, the rule includes also a reference to criminal offences and serious or very serious administrative offences involving financial losses for the Treasury and for the Social Security system. It is perhaps a reiteration intended to emphasize the importance of protecting persons who report breaches affecting public funds. It can be argued, in this sense, that the unnecessary nature of this prevision derives, in addition to the redundant nature already mentioned, from the risk of confusion in the sense of interpreting the rule as only providing protection if the information on such breaches also affects public funds10. The Act 2/2023, thus, adopts a broad material approach, since protection is granted whatever the subject matter of the reported breach, so that there are no limitations as to the material sectors of the Spanish legal system. On the other hand, the type of offence is limited, which must be criminal or administrative (excluding in the latter case those considered minor), so that those which do not enjoy such status, such as non-compliance with the internal policies or codes of ethics that organisations have been implementing in recent years11, disciplinary offences of the worker, which are confined to the purely contractual sphere, would be outside the protection provided by the Act, unless they could be redirected to any of the conducts classified as criminal or administrative offences. The question arises, given the omission of any reference in this respect, of possible whistleblowing systems in companies that do not refer to serious or very serious criminal or administrative offences, such as, for example, reporting channels in relation to the !!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!! 8 It should be recalled that the Preamble of the Directive already provided for this extension by stating that “Member States could decide to extend the application of national provisions to other areas with a view to ensuring that there is a comprehensive and coherent whistleblower protection framework at national level” (Recital 5). 9 It is also inconsistent with the art. 1.2 of the Act 2/2023, which considers information as a mechanism to prevent and detect threats to the public interest. 10 R. GÓMEZ GORDILLO, Aspectos laborales de la ley de protección de personas informantes, cit., p. 269. The author rules out that this subparagraph can be interpreted in terms of exclusion of other criminal and administrative offences that do not involve public funds. 11!J. VIGURI CORDERO, Los retos de la protección de las personas informantes en España tras la aprobación de la Ley 2/2023: un derecho en vías de consolidación, in Revista Española de la Transparencia, 17, 2023, p. 295.! company's code of ethics or in application of its social responsibility. It has been considered that nothing would prevent their implementation, but the Spanish transposition does not oblige them to do so, which means that, from the perspective of these rules, they are voluntary in nature, without prejudice to their obligatory nature if so determined by a collective bargaining mandate12. In any case, the Act 2/2023 introduces a caveat regarding the provisions that may exist in labour law in this area, stating that the protection of workers who report breaches of labour law in matters of health and safety at work shall be without prejudice to that established in their specific regulations. There are different interpretations of this provision. At first sight, it seems to constitute a minimum of necessary law which must respect in any case the protection provided under the transposition rule, and which remains subsidiary, without being able to diminish the latter in any way. Another option is that the law has sought to emphasise the importance of reporting health and safety infringements and, at the same time, to clarify that its regulation does not affect the validity of the Act 31/1995 on the prevention of occupational risks, so that the measures provided for therein, such as, for example, the stoppage of production activity in the event of imminent risk (art. 21) remain fully effective. Another interpretation considers this clause as the result of an insistence on making it clear that it is possible to use the reporting channels concerning any regulatory area, regardless of its projection on public finances, as it is indicating that workers can report breaches of occupational risk prevention regulations, a matter that is partly connected with the fraud of public resources13. 4. The establishment of reporting channels The Spanish Act considers that the internal reporting channel is the preferential channel for reporting the actions or omissions described above (art. 4.1)14. It may well be considered that proximity to the origin of the breach may ensure greater guarantees of the effectiveness of the information, since timely knowledge and speed in clarifying the facts may prevent greater harmful consequences from arising from the possible infringement15. However, and following the Directive, the Spanish Act makes this preference conditional on the fact that breach can be addressed effectively internally and the reporting person considers that there is no risk of retaliation. This requirement seems to cover the questions raised by the preferential recourse to the internal reporting channel, especially because of the fear that those responsible for the infringement might themselves be responsible for the reporting channel and could therefore promote its concealment. Therefore, although the law articulates a whole series of measures to protect against retaliation, it does not rule out the possibility that fear of retaliation may often lead informants to dispense with the internal reporting channel and go directly to the external one. The preamble of the !!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!! 12 J. F. LOUSADA AROCHENA and R. P. RON LATAS, La Ley 2/2023, de 20 de febrero, y la protección laboral frente a las represalias por la denuncia de irregularidades en la empresa, in Revista de Derecho Social, 103, 2023, p. 71. 13 R. GÓMEZ GORDILLO, Aspectos laborales de la ley de protección de personas informantes, cit., p. 270. 14 Similarly, the European Directive states that “Member States shall encourage reporting through internal reporting channels before reporting through external reporting channels” (art. 7.2). 15 According to the Directive, “reporting persons normally feel more at ease reporting internally, unless they have reasons to report externally” while at the same time “internal reporting is also the best way to get information to the persons who can contribute to the early and effective resolution of risks to the public interest” (Recital 33). Act, after stating that the internal reporting channel should be used as the preferred one’, adds that, once this preference has been declared, the whistleblower may choose the channel to use, internal or external, depending on the circumstances and the risks of retaliation that he or she considers. Therefore, what is a general rule ends up becoming an exception, given the wide range of cases that open up in which specific circumstances would make recourse to another channel more advisable. According to the Directive, the reporting person should be able to choose the most appropriate reporting channel depending on the individual circumstances of the case (Recital 33). As it has been noted, it is a merely enunciative priority, since no motivational requirement has been established for going directly to the external channel; therefore, the decision to use one channel or the other is based solely on the assessment made by the reporting person16. Likewise, the relative nature of this preference of the internal reporting channel seems to be confirmed when, while regulating access to the external reporting channel, the Act 2/2023 indicates that information may be provided directly or after prior reporting through the corresponding internal channel (art. 16.1)17, conforming to the European Directive (art. 10). In this case, it is particularly striking that it does not make direct recourse to the external channel subject to any requirement, which could lead one to believe that there is no duty to communicate the information, in the first place, through the internal reporting channel18. If this interpretation is followed, it could be understood that the law merely expresses a preference, but does not establish a binding obligation. In any case, given the conflict that seems to arise between art. 4.1, which does make direct access to the external reporting channel conditional on the effectiveness of the internal addressment of the breach and the informant’s consideration of the absence of risk of retaliation, and the aforementioned art. 16.1, which does not introduce any requirement, it seems that a systematic interpretation leads us to understand that some kind of demonstration of the conditions included in the first rule is required, since, otherwise, the provision would be irrelevant19. !!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!! 16!C. SÁEZ LARA, El sistema interno de denuncia: una nueva obligación de las empresas, cit., 2024.! 17 The rule will do the same in the area of public disclosure where it makes protection for whistleblowers who have used public disclosure conditional on the communication having been made first through internal and external channels, or directly through external channels (art. 28.1.a). 18 M. L. PÉREZ GUERRERO, Canales de información en la empresa e infracciones laborales: la determinación del ámbito material de la ley de protección de las personas informantes, in Temas Laborales, 170, 2023, p. 77. 19 S. DEL REY GUANTER, La relación entre las vías de comunicación de las infracciones en la Ley 2/2023 de protección del informante desde la perspectiva de la persona trabajadora y su empleadora, in IUSLabor, 2, 2023, p. 18. Weighing positive and negative aspects, and taking into account the margin of freedom granted by the Directive in this respect34, the Spanish legislator has opted to allow anonymous reporting. This type of provision is not entirely new, insofar as Organic Act 3/2018, of 5 December, on the Protection of Personal Data and the guarantee of digital rights, already contemplated the creation and maintenance of reporting systems through which a private law entity could be informed, even anonymously, of the commission, within the entity or in the actions of third parties contracting with it, of acts that could be contrary to the general or sectoral regulations applicable to it. It is particularly noteworthy that the Act 2/2023 stipulates that the decisions adopted by the AAI cannot be appealed in administrative or contentious-administrative proceedings, except for those that put an end to the sanctioning procedure that may be initiated as a result of the investigations carried out. This regulation, which renounces the right to effective judicial protection, runs counter to the terms of the Directive, which insist on the need to guarantee the right to appeal35. We can think of, for example, an unfounded rejection or an erroneous consideration that the reported breach is excluded from the material scope of protection. There is no reason to justify why the corresponding contentious-administrative appeal should be prevented, as the decision of the AAI is an administrative act which, without such an appeal, would be beyond review36. 5. The public disclosure In terms very similar to those used by the European Directive, the Spanish transposition defines public disclosure as the making of information on actions or omissions available in the public domain, under the terms provided for therein. Without any determination of the responsible party or procedure, what distinguishes this third alternative from the previous reporting channels is the instrument used for the communication of the information on breaches and the recipient of the information, insofar as it refers briefly to “making it available in the public domain”. In contrast to the internal and external reporting channels, this requirement does not only refer to actual communication, but also includes those cases in which information is made accessible to a potential audience. Therefore, the key in this case is not so much the success of the disclosure but the easy accessibility of the information being communicated. Particularly noteworthy is the breadth with which public disclosure is regulated. The Act 2/2023 does not limit the means of communication through which such disclosure is made, nor does it make any reference to the extent or scope of knowledge of third parties, !!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!! 34 “Without prejudice to existing obligations to provide for anonymous reporting by virtue of Union law, this Directive does not affect the power of Member States to decide whether legal entities in the private or public sector and competent authorities are required to accept and follow up on anonymous reports of breaches” (art. 6.2). Likewise, art. 9.1.e) establishes that “diligent follow-up, where provided for in national law, as regards anonymous reporting”. 35 “Member States shall take the necessary measures to ensure that remedies and full compensation are provided for damage suffered by persons referred to in Article 4 in accordance with national law” (art. 21.8). In this sense, “Member States shall ensure that the rights and remedies provided for under this Directive cannot be waived or limited by any agreement, policy, form or condition of employment, including a pre-dispute arbitration agreement” (art. 24). 36 J. A. TARDÍO PATO, La protección del informante en la Ley Española 2/2023, de transposición de la directiva 2019/1937, cit. so that it has been understood that information posted on a notice board or on an employee's personal blog could be classified as public disclosure37. The protection of persons making use of a public disclosure requires that one of the following two conditions be met: the person first reported internally and externally, or directly externally, but no appropriate action was taken in response to the report within the timeframe referred to; or where the informant has reasonable grounds to believe that either the breach may constitute an imminent or manifest danger to the public interest, in particular where there is an emergency situation, or there is a risk of irreversible harm, including a danger to the physical integrity of a person; or, in the case of external reporting, there is a risk of retaliation or there is a low prospect of the breach being effectively addressed, due to the particular circumstances of the case, such as those where evidence may be concealed or destroyed or where an authority may be in collusion with the perpetrator of the breach or involved in the breach. In any case, the aforementioned conditions for the protection of the whistleblower provided for in the Act shall not apply when the person has directly disclosed information to the press in accordance with the exercise of the freedom of expression and information recognized in the Spanish Constitution. This is an important clarification because it considerably broadens the margin of protection that this freedom enjoys as a fundamental right. As in the internal and external reporting channels, the Act 2/2023 guarantees the right of a person who makes a public disclosure not to have his or her identity revealed to third parties (art. 33). In this sense, internal and external reporting channels and those receiving public disclosures shall not obtain data that allow the identification of the reporting person and must have adequate technical and organisational measures in place to preserve the identity and guarantee the confidentiality of the data corresponding to the persons concerned and to any third party mentioned in the information provided. 6. The protection of persons who report breaches of law 6.1. The prohibition of retaliation The art. 36 of the Act 2/2023 transposes the art. 19 of the EU Directive and regulates the prohibition of retaliation, which it defines, based on the concept used in the art. 5 of the European rule38, as any acts or omissions which are prohibited by law, or which, directly or indirectly, involve unfavourable treatment that places the persons who suffer them at a particular disadvantage with respect to another in the employment or professional context, solely because of their status as informants, or because they have made a public disclosure. Taking a broad view, the Spanish Act extends the prohibition not only to acts constituting retaliation in themselves, but also to threats and attempts of retaliation. The question arises as to whether the protection against retaliation applies to persons who already have the status of whistleblowers because they have actually reported breaches !!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!! 37 S. DEL REY GUANTER, La relación entre las vías de comunicación de las infracciones en la Ley 2/2023, cit., p. 14. 38 However, it is more complete in the Preamble, because it states that reporting persons should be protected against any form of retaliation, whether direct or indirect, taken, encouraged or tolerated by their employer or customer or recipient of services and by persons working for or acting on behalf of the latter, including colleagues and managers in the same organisation or in other organisations with which the reporting person is in contact in the context of his or her workrelated activities (Recital 87). of law or whether it also extends to preparatory acts, i.e. when it is known that someone is preparing to make the communication. The first interpretation has been defended, given that the precept prohibits retaliations, with the broad character already seen, against persons who submit a communication in accordance with the legal provisions39. In order to illustrate the retaliation that are subject to such a prohibition, the Act sets out an exemplary list in which, therefore, without being exhaustive, specific conducts are listed that fit the aforementioned definition: a) Suspension of the employment contract, dismissal or termination of the employment or statutory relationship, including the non-renewal or early termination of a temporary employment contract once the probationary period has passed, or early termination or cancellation of contracts for goods or services, imposition of any disciplinary measure, demotion or denial of promotion and any other substantial modification of working conditions and the failure to convert a temporary employment contract into an indefinite one, where the employee had legitimate expectations that he/she would be offered an indefinite job; unless these measures were carried out in the regular exercise of managerial authority under the relevant labour or public employee statute legislation, due to circumstances, facts or proven breaches, unrelated to the submission of the communication. b) Harm, including to the person’s reputation, particularly in social media, or financial loss, including loss of business and loss of income. c) A negative performance assessment or employment reference. d) Blacklisting on the basis of a sector or industry-wide informal or formal agreement, which may entail that the person will not, in the future, find employment in the sector or industry. e) Cancellation of a licence or permit. f) Withholding of training. g) Discrimination, disadvantageous or unfair treatment. It is worth highlighting the richness of the exemplification undertaken by the act since, as the Directive postulates, the effective protection of reporting persons as a means of enhancing the enforcement of law requires a broad definition of retaliation, encompassing any act or omission occurring in a work-related context and which causes them detriment (Recital 44). It is true that, as in any numerus apertus list, there are always cases that are missing, such as dismissal during the probationary period40, but it is difficult to think of any type of conduct that cannot be understood as falling in one way or another under point g), which seems to act as a catch-all for these purposes. The reference to a time limit to which the act refers, almost obliquely, in the art. 36.4 introduces greater problems. Indeed, the provision states that any person whose rights have been harmed as a result of its communication or disclosure after the two-year period has elapsed may request protection from the competent authority which, exceptionally and with justification, may extend the period of protection, after hearing the persons or bodies that could be affected. The fact is that there is no reference whatsoever to this time limit in the rest of the articles of the act. One has to dig into the Preamble to find a sparse allusion to the nullity of those conducts that may be qualified as retaliations and are adopted within two years after the investigations have been completed. This time limit poses problems as it could lead to the interpretation that, after this period of time, the !!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!! 39 S. DEL REY GUANTER, Las medidas de protección contra las represalias a la persona informante de infracciones en la Ley 2/2023 y su proyección sobre la relación laboral y funcionarial, in Trabajo y Derecho, 107, 2023. 40 R. GÓMEZ GORDILLO, Aspectos laborales de la ley de protección de personas informantes, cit., p. 274. victim of retaliations would be excluded from any protection. In this sense, some have understood that the two-year time limit, unless extended, would only apply to support or sanction measures based on the act. Thus, it could not prevent a judicial declaration of nullity with respect to the retaliatory measure, as it would entail an impairment of the constitutional freedoms of expression and information and the right to effective judicial protection41. Other authors understand that during this period there is full protection of the whistleblower, so that the presumption (a rebuttable presumption) that any unfavourable treatment of a reporting person constitutes retaliation will develop its full effects unless a solid justification is shown that such unfavourable treatment is due to causes totally unrelated to the information or disclosure made by the whistleblower. Once this period has elapsed, it does not mean that a retaliation adopted after it is lawful, since the passing of this two-year period or its extension will only imply that this presumption will not apply and that it will be up to the informant to establish further evidence or proof that the unfavourable treatment is determined by that condition42. It is striking that at no point does Spanish law require the informant to have acted in good faith as a condition for the protection afforded therein. In any case, there seems to be no problem in considering that the legal text should be interpreted in the light of this principle, especially if we bear in mind that the Preamble itself includes a clear reference to it43, that article 35.1.a) establishes as a condition of protection that the informant has reasonable grounds to believe that the information referred to is truthful at the time of communication or disclosure, and that the act itself classifies as a very serious offence reporting or publicly disclosing information knowing it to be false (art. 63.1.f). 6.2. The measures of support and protection against retaliation Persons who report or disclose offenses falling within the material scope of application of the act, through the procedures outlined in it, are entitled to access a series of support measures specified in the Act. Although the legal text is silent on the matter, there does not seem to be any impediment to understanding that such measures are compatible with those which are specific to the labour or civil service sphere, such as trade union assistance or assistance to representative unitary bodies44. Focusing on the support measures expressly included in Act 2/2023, these are the following: a) Comprehensive and independent information and advice, which is easily accessible to the public and free of charge, on procedures and remedies available, on protection against retaliation, and on the rights of the person concerned. b) Effective assistance from competent authorities before any relevant authority involved in their protection against retaliation, including, where provided for under national law, certification of the fact that they qualify for protection under this Directive. !!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!! 41 J. F. LOUSADA AROCHENA and R. P. RON LATAS, La Ley 2/2023, de 20 de febrero, y la protección laboral frente a las represalias por la denuncia de irregularidades en la empresa, cit., p. 86. 42 S. DEL REY GUANTER, Las medidas de protección contra las represalias a la persona informante, cit. 43 “Good faith, an honest awareness that serious harmful events have occurred or are likely to occur, is a prerequisite for whistleblower protection. This good faith is the expression of his or her civic behaviour”. 44 S. DEL REY GUANTER, Las medidas de protección contra las represalias a la persona informante, cit. c) Legal aid in criminal proceedings and in cross-border civil proceedings in accordance with Community law. d) Financial and psychological support, on an exceptional basis, if so decided by the AAI following an assessment of the circumstances arising from the submission of the communication. Comparing the European and Spanish regulations, it is easy to see how the art. 37 of the latter, which regulates such support measures, transposes the art. 20 of the Directive practically verbatim. It only introduces some variation when it refrains from referring also in letter c) to “in accordance with national law, legal assistance in other proceedings and legal advice or any other type of legal assistance”, or when it specifies that all these measures are understood “independently of the assistance that may correspond under Act 1/1996, of 10 January, on free legal aid, for representation and defence in legal proceedings arising from the presentation of the communication or public disclosure”. The act conditions the right to protection of persons who report or disclose offences determined therein to the concurrence of different circumstances. Firstly, the communication or disclosure must have been made in accordance with the requirements set out in this act, including those relating to the subjective and objective scope of application and the procedural requirements themselves. Secondly, informants are required to have reasonable grounds to believe that the information referred to is truthful at the time of communication or disclosure, even if they do not provide conclusive evidence. The act does not demand specialized knowledge from the person disclosing the information to conclusively determine its accuracy. Rather, it requires them to have sufficient indications, in good faith, to reasonably assume its truthfulness. As Spanish Constitutional Court has stated45, the veracity of information is not synonymous with the objective and incontestable truth of the facts, but reflects the necessary diligence in the search for the truth or, if preferred, the special diligence in order to properly check the sources of the information. It should be pointed out that this is not the first time that the Act alludes to the criterion of the truthfulness of the information, as art. 18 of the Act establishes as a cause of inadmissibility of communications in the external channel those in which the facts related lack any verisimilitude. Many of these conditions respond to the understandable aim of preventing workers from using information systems for the sole purpose of shielding their employment relationship from potential company actions or simply to harm their colleagues46. In addition to the aforementioned inclusive criteria, the act also establishes certain cases of exclusion from protection. Specifically, reference is made to those persons who communicate or disclose: a) Information contained in communications that have been inadmissible by any internal information channel or for any of the reasons provided for in Article 18.2.a). b) Information linked to complaints about interpersonal conflicts or affecting only the informant and the persons to whom the communication or disclosure refers. This is a controversial case, as it is possible that the interpersonal nature of the conflict does not exclude its classification as a crime or serious or very serious administrative offence, which, it should be remembered, is the criterion used by the act to delimit the material scope of application. It is therefore understood that it has been argued that the qualifier of interpersonal does not refer to the subjective scope of the dispute, but to the nature of the dispute, and therefore the rule includes those conflicts of a personal and socially !!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!! 45 Constitutional Court Judgement 212/2000, 21 September 2000. 46 A. DE LA PUEBLA PINILLA, Ley 2/2023, de Protección de los informantes. Problemas aplicativos desde una perspectiva laboral, in Labos, 4, 2023, p. 44.! private nature that do not involve an infringing commission or omission per se, but a situation of divergence of opinions or characters in the relationship between two or several people47. Otherwise, information on crimes of sexual harassment and offences against moral integrity, which are the ultimate expression of what can be understood as interpersonal conflicts, would be left unprotected48. c) Information that is already fully available to the public (although availability does not always imply general knowledge or, in other words, accessibility is not the same as effective access) or that is mere hearsay (which is connected with the ground for inadmissibility established in the external channel and refers to manifest lack of foundation (art. 18.2.a.3). d) Information referring to actions or omissions that do not fall within the material scope of application of the act. It is clear that the above criteria will require a considerable effort of assessing the information on the part of the person who is to make the communication, with the added difficulty that we are immersed in an endless number of vague legal concepts. It will be difficult, for example, to draw the line between the notion of mere rumours and the cases, which are admitted in the rule, in which the informant has reasonable grounds to believe that the information referred to is true at the time of communication or disclosure, even if he does not provide conclusive proof. This complexity, coupled with the casuistic analysis required by the assessment of the circumstances included in some of the above requirements (for example, the assessment of information as “fully available to the public”), may end up discouraging individuals from reporting information, which contradicts the intent of the Directive being transposed by the regulation and which, in fact, does not mandate such evidence for validating provided information. In order to ensure that reporting persons are protected against possible retaliations, in line with the provisions of the Directive (art. 21), the art. 38 of the Act 2/2023 includes a series of measures. Firstly, persons who communicate information on actions or omissions falling within the material scope of the act or who make a public disclosure will not be considered to be in breach of any restriction on disclosure of information. In this regard, they will not incur liability of any kind in connection with such communication or public disclosure, provided that they had reasonable grounds to believe that the communication or public disclosure of such information was necessary to disclose an act or omission under Act 2/2023. As a novelty, the Act introduces a final subparagraph to this first measure, stating that it shall not affect criminal liability. This provision, as has been noted49, should be understood as referring to criminal liabilities other than those arising from the communication of the information or public disclosure itself. The above measure extends to the communication of information made by the workers' representatives, even if they are subject to legal obligations of secrecy or of not disclosing reserved information. All this is without prejudice to the specific rules of protection applicable under labour law, in a clear reference to the guarantees that Spanish law grants to the legal or trade union representation of workers. !!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!! 47 S. DEL REY GUANTER, Las medidas de protección contra las represalias a la persona informante, cit. 48 V. CAMPOS SÁENZ DE SANTA MARÍA AND H. CHEDAD AHMED, Implicaciones, y posibles incógnitas, tras la entrada en vigor de la Ley de Protección al Informante, in Revista Aranzadi de Derecho y Proceso Penal, 70, 2023.! 49 J. F. LOUSADA AROCHENA and R. P. RON LATAS, La Ley 2/2023, de 20 de febrero, y la protección laboral frente a las represalias por la denuncia de irregularidades en la empresa, cit., pp. 87 and 88. Secondly, reporting persons will not incur liability in respect of the acquisition of or access to information that is publicly communicated or disclosed, provided that such acquisition or access does not constitute a criminal offence. Like the Directive, the Spanish Act takes care to qualify that any other possible liability of informants arising from acts or omissions that are not related to the communication or public disclosure or that are not necessary to disclose an infringement under the Act will be enforceable under the applicable law. Furthermore, and in what is another direct transposition of the European standard, in proceedings before a court or other authority concerning detriment suffered by whistleblowers, once the reporting person has reasonably demonstrated that he or she has made a public report or disclosure and has suffered harm, the harm will be presumed to have occurred in retaliation for making a public report or disclosure. In such cases, it is for the person who has taken the detrimental action to prove that the detrimental action was based on duly justified reasons not linked to the communication or public disclosure. This is not exceptional in the field of labour litigation, since proceedings related to discrimination and any other case of violation of fundamental rights are characterised by the fact that it is up to the defendant to provide an objective and reasonable justification, sufficiently proven, of the measures adopted and their proportionality (art. 96 Act 36/2011, of 10 October, regulating the social jurisdiction). Although it is not expressly stated in the rule, it seems to be possible to deduce from the text that the damage must have been certain, and mere suspicions are not sufficient. Likewise, it can be understood that, if it is not possible to demonstrate that the measure is due to reasons unrelated to the information, it will be null and void and will give rise to the corresponding liability, and the corresponding compensation for damages may be awarded to the injured party, as provided for in art. 36.5 of the Act. Finally, in legal proceedings, including those relating to defamation, copyright infringement, breach of secrecy, infringement of data protection rules, disclosure of trade secrets, or claims for compensation based on labour or statutory law, informants shall not incur liability of any kind as a result of communications or public disclosures protected by the Act. Such persons shall be entitled to plead in their defence in such legal proceedings that they have communicated or made a public disclosure, provided that they had reasonable grounds to believe that the communication or public disclosure was necessary to bring to light an infringement. There are two shortcomings in the Spanish regulation with respect to the literal wording of the article 21 of the Directive. On the one hand, it omits any reference to the provision contained in the fourth paragraph of that provision, which states that the persons included in the personal scope of application of the rule shall have access to corrective measures against retaliation, as appropriate, including provisional measures pending the resolution of the judicial proceedings, in accordance with national law. The transposition rule probably takes into account the operative nature of the procedural rules on precautionary measures and considers this point unnecessary. On the other hand, the Act 2/2023 has also failed to follow the mandate contained in the European act, which urges Member States to adopt the necessary measures to ensure that remedies and full compensation for damages are provided. This mandate, which should be interpreted broadly, as demonstrated by the rule itself50, does not appear in the Spanish law, probably because there is no reason to doubt the applicability of the specific rules on the matter. !!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!! 50 The appropriate remedy in each case should be determined by the kind of retaliation suffered, and the damage caused in such cases should be compensated in full in accordance with national law. The appropriate remedy could take the form of actions for reinstatement, for instance, in the event of dismissal, transfer or demotion, or of withholding of training or promotion, or for 7. The sanctioning legal regime The exercise of the sanctioning powers provided for in the Act 2/2023 corresponds to the Independent Authority for the Protection of the reporting person and to the respective competent bodies of the Autonomous Communities. In any case, the latter shall be exclusively competent in respect of infringements committed in the sphere of the autonomous and local public sector in the territory of the corresponding Autonomous Community, although the autonomous community regulations may provide that these bodies shall be competent in respect of infringements committed in the sphere of the private sector when they affect only their territorial sphere. The legal definition of the conduct constituting offences could be improved, to say the least, as the sections that include very serious and serious offences tend to include the same conducts, although in the latter case with the qualification “not considered a very serious offence”. This is followed in the next section, which, dedicated to the description of minor offences, ends with a closing clause in which it grants this status to “any breach of the obligations set out in this law that is not classified as a very serious or serious offence”. Clearly, this unfortunate catalogue violates the principle of prior definition, generates great legal uncertainty and jeopardises the very effectiveness of the system51. Offences included in the Spanish Act can be committed by both natural and legal persons. More specifically, offences can be committed by the employer (for example, adopting any kind of retaliation), the reporting person (for example, reporting or publicly disclosing information knowing it to be false) or the person responsible for the reporting channel (for example, violating the guarantees of confidentiality and anonymity). If natural persons are responsible for the offences, the commission of the offences set out in the regulation entails the imposition of fines ranging from 1.001to 10.000 euros for minor offences, from 10.001 to 30.000 euros for serious offences and from 30.001 to 300.000 euros for very serious offences. If they are legal persons, the fines amount to up to 100.000 euros for minor offences, between 100.001 and 600.000 euros for serious offences and from 600.001 to 1.000.000 euros for very serious offences. In the case of very serious offences, the AAI may also agree on certain additional measures, such as public reprimand, prohibition from obtaining subsidies or other tax benefits for a maximum period of four years, as well as prohibition from contracting with the public sector for a maximum period of three years in accordance with the provisions of Law 9/2017, of 8 November, on Public Sector Contracts. Likewise, sanctions for very serious infringements of an amount equal to or greater than 600.001 euros imposed on legal entities may be published in the Official State Gazette, following the finality of the resolution in administrative proceedings. This rule specifies the minimum information that must be included in such publication, including details on the type and nature of the infringement, and, when applicable, the identity of the persons responsible, in accordance with data protection regulations. The transposition of the sanctioning regime has been more problematic than could have been predicted at first. This is due to the legislative technique used. Specifically, the !!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!! restoration of a cancelled permit, licence or contract; compensation for actual and future financial losses, for example for lost past wages, but also for future loss of income, costs linked to a change of occupation; and compensation for other economic damage, such as legal expenses and costs of medical treatment, and for intangible damage such as pain and suffering (Recital 94). 51 R. GÓMEZ GORDILLO, Aspectos laborales de la ley de protección de personas informantes, cit., p. 276. legislator did not incorporate the regulation on this matter into what would have been its natural home, the Royal Legistative Decree 5/2000 on offences and penalties in the Social Order. Rather than choosing this course of action and making the necessary adaptations, it prefers to utilize the same law intended to transpose the Community Directive. This situation would not pose a significant issue if it were not for the fact that, in some instances, both legislative texts feature very similar classifications of offenses, yet these offenses are often subject to fines of considerably varying amounts. Thus, for example, the Act 2/2023 establishes a fine of 30.001 to 300.000 euros (if the person responsible is a natural person) and 600.001 to 1.000.000 euros (in the case of legal persons) for the adoption of any retaliation derived from the communication against reporting persons or other persons included in the scope of protection of the Act (arts. 63.1.b and 65.1.a and b). However, in the Royal Legistative Decree 5/2000 on offences and penalties in the Social Order, unilateral company decisions involving direct or indirect unfavourable discrimination and those involving unfavourable treatment of workers as a reaction to a complaint made within the company are classified as very serious offences, with penalties ranging from 7.501 euros to a fine of 225.018 euros (arts. 8.12 and 40.1.c). It is not difficult to imagine conducts that could fit in one legal text and in the other, with the fines foreseen in the Act 2/2023 being higher. The same is true in cases of “refusal of training”, which is one of the forms of retaliation prohibited by the Act 2/2023 (art. 36.3.f.) and, therefore, if carried out, would fit the description of the very serious infringement already mentioned. If we place ourselves within the scope of the Royal Legistative Decree 5/2000 on offences and penalties in the Social Order, it should be noted that this Act defines conducts that would fit the aforementioned description as serious or very serious offences, in the area of labour relations (art. 7.10) and employment (arts. 15.6 and 16.1.f), as well as serious offences in the area of occupational risk prevention (arts. 12.8 and 12). The principle of non bis in idem prevents the accumulation of penalties provided for in one legal text and another, and it is therefore necessary to resolve these possible cases of concurrence by determining the application of only one of the rules. This would also have effects from the point of view of the authority, since in the case of the Royal Legistative Decree 5/2000 on offences and penalties in the Social Order, it is the Labour and Social Security Inspectorate which is competent to instruct the sanctioning procedure, while the Act 2/2023 designates the AAI as the body responsible for exercising the sanctioning power for the offences set out therein, without prejudice to the exercise of the sanctioning power by the competent bodies of the Autonomous Communities where appropriate (arts. 52 and 61). In application of the criterion of speciality, the Royal Legistative Decree 5/2000 on offences and penalties in the Social Order would be the regulatory text to be applied and, therefore, the Labour and Social Security Inspectorate would be the competent body to carry out the procedure to impose penalties for labour infringements52. In any case, it should be borne in mind that, for this type of case in which it is not clear which rule should be applied and, therefore, which authority is competent, the Act 2/2023 refers to different cases of referral of proceedings. Significantly, the art. 23 seems to be thinking of these cases when it states precisely the transfer of the communication by other authorities to the AAI, so that any authority that receives a communication and does not have the competence to investigate the facts reported as being one of the offences provided for in the Act, shall refer it to the AAI, within ten days following the day on !!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!! 52 M. L. PÉREZ GUERRERO, Canales de información en la empresa e infracciones laborales, cit., p. 81. which it was received, and must communicate the referral to the reporting person within that period. The Spanish Act is clearer when it recognises the compatibility between the administrative sanctions that it establishes and the disciplinary sanctions that may be applicable. Specifically, art. 67 of the Act leaves no room for doubt when it states that the exercise of the sanctioning power provided for in this rule is autonomous and may concur with the disciplinary regime of civil servants or workers that may be applicable in each case. 8. Conclusions Until the entry into force of the Act 2/2023, Spain had lacked a national legislation that provided a comprehensive regulation of the legal regime for the protection of those persons who had decided to report breaches of law. Nor was there a specific legal framework expressly prohibiting retaliation and articulating protection measures, without prejudice to the reference already contained in article 17.1 of the Workers’ Statute and the operability of the so-called guarantee of indemnity, which is much narrower in scope as it is limited to protection against retaliation due to administrative or judicial actions. The Spanish implementation of the Whistleblowing Directive has made up for all these shortcomings, while it has also introduced the obligation to set up reporting channels in certain undertakings, which has also been a novelty in many of them. If we compare the European and Spanish legislations, it can generally be considered that Spain has undertaken a minimum transposition. And only on certain issues has it opted to improve on the minimum standard of European protection. In particular, the offences that fall within the material scope of the Directive are extended, in the national context, to all areas of the legal system, although the types of offences are limited, which are reduced to criminal offences and serious or very serious administrative offences. It is true that the rule gains in legal certainty, making use of the criterion of legal definition of the offence, but it does so at the cost of reducing the scope of application, restricting protection to cases in which the commission of an offence classified as a criminal or serious or very serious administrative offence is reported. This, in turn, presupposes specialised knowledge of the list of punishable offences, which logically does not necessarily characterise the persons who report information, with the added risk of ending up discouraging them from doing it. Therefore, conducts contrary to the general interest that is not classified as punishable offences, such as reprehensible conducts, acts or omissions that do not appear unlawful from a formal point of view, but which distort the object or purpose of the law and which nevertheless fall outside the scope of the law, are excluded from the material scope of the Act 2/2023. This exclusion is risky because it is well known that, in the area of corruption, there is a tendency to seek any legislative silence in order to alter objective and impartial action through nepotism, for example. The question becomes even more complex if one takes into account that this type of irregularity can be included in the field of breaches of EU law, since the law does not extend the criterion of legal definition to these cases as well. Be that as it may, it is still too early to draw any conclusions, and any attempt to do so would be hasty. Especially when Spain was not only late in transposing the European Directive, but also in applying the provisions of the legal text. For example, the implementation of channels has yet to be completed in certain entities and the creation of the AAI is still pending. The latter is even more burdensome for those undertakings that, due to their size, are not obliged to set up internal channels and, therefore, their employees