In two weeks, on Monday, March 13, a new law will enter into force that obliges the 1.93 million companies with more than 50 employees in the country -according to INE data- to have a complaints channel and, above all, to manage all the communications they receive through this channel, which in many cases will mean an increase in costs and responsibilities.
This is established by Law 2/2023, although it gives a three-month adaptation period for large companies -compliance will not be monitored until June 13- and six months for medium-sized companies that have between 50 and 249 workers or the that are located in municipalities with less than 10,000 inhabitants -that can implement it between now and December 1-.
Having a complaints channel not only implies that companies set up a web page or an email box so that their workers or people related to the company (for example, suppliers) can inform management of practices that could constitute a crime. (usually cases of harassment -labour or sexual- or corruption), but it implies assigning personnel -with the cost that it entails- or subcontracting to another company to be in charge of processing all the information received through that channel and taking the relevant measures.
In the case of smaller companies, given the lack of powerful human resources teams or compliance units, the labor lawyers consulted by this newspaper admit that -when there have been complaints to date- they usually resort to them to manage these cases.
"Sometimes, even though companies have a department or person dedicated to Human Resources, they are not trained to investigate this type of complaint. The point is that it is not worth having a channel, you have to manage it and the deadlines are short -in some agreements It is established that the investigation must be completed in ten days-, so they outsource it and we have to summon the workers involved, usually in a hotel, we talk to them and carry out the investigation", says a lawyer from one of the most important law firms in the country.
If companies do not comply with this mandate, they can also face high sanctions, which according to the norm can reach one million euros if they are considered "very" serious. "There is a lot of uncertainty about how they will be interpreted in practice many of the provisions of the Law, which has also gone beyond what the European Directive established in many cases and has established very high sanctions", points out Margarita Fernández, a partner in Labor at Baker McKenzie, who detects many gaps in the wording of the rule.
"How do I comply with the restrictions on access to personal data in practice?", he asks, for example, since "the law is very restrictive and exhaustive and creates practical operational problems by restricting access to departments normally involved in the management of the complaints". "How are the liability regime and sanctions going to be applied in practice, especially to the members of the board of directors and those responsible for the complaints channel?", he questions, without finding an answer in the law.
From the Hogan Lovells law firm, they emphasize that the norm obliges the company to send the information of the complaint to the Public Prosecutor "immediately when the facts could be constitutively a crime" and, in case of not doing so, the company faces very high penalties. "Until now, the criminal procedure law prevailed, which establishes an obligation to report facts that may constitute a crime of which you are a witness, whether you are a natural person or a company. But the fine provided for by that law when breaches that obligation is regulated in pesetas and is 250 pesetas, so how solid was that obligation if that usually depends on the consequences that derive from its breach?", they ironically.
In the event that the company was involved in the denounced act, it also had the right not to incriminate itself, with which "we must now see how they combine the obligations that existed until now - sanctions of 250 pesetas and the right not to denounce the company - with the high sanctions and infractions of the new law", they add.
Smaller companies will be the most affected by the new law, as denounced by their employer, Cepyme. "Guaranteeing security is essential, what is necessary is trying to ensure that the obligations that derive from it do not seriously hinder the productivity of the company. Smaller companies, even if we are talking about 50 workers, are assuming many new loads bureaucratic in recent years and also tend to be exactly the same as those that must be assumed by the Administration or multinational companies, but the resources between them are enormously different", they underline.
"Most of the SMEs are already familiar in general with the complaint channels due to sectoral regulations such as the Harassment Prevention Law or the penal code. But, this law affects them and worries them because it opens the possibility of making complaints for 'any infringement of the administrative or criminal legal system', so they will have to implement a more global channel and with more formal requirements that, logically, will have an impact on the costs and internal procedures that they perceive as too demanding, especially with regard to the management of complaints , especially in the initial phase where conflicts of interest may arise; with the appointment of managers and teams to investigate; the processing of data and compliance with deadlines", explains Rocío Gil Robles, criminal law partner at CECA Magán.
According to the criteria of The Trust Project
