Article
viadenuncia
The new produce for managing informations and communications: Law 2/2023
The new Law 2/2023, regulating the protection of persons who report regulatory infringements and the fight against corruption, has established the need to approve an information management procedure through the administrative or governing body of each entity obliged to have an internal information system.
The ten basic points that constitute the minimum content and the essential principles that must govern the information management procedure are as follows:
Identify the internal information channels associated with the internal information system. Therefore, it will be necessary to identify whether the system is intended to receive communications related to the prevention of money laundering, matters of EU Directive 2019/1937, Next Generation Fund, harassment, public procurement and/or compliance.
Provide information on the external information channels of the competent regional, state or European authorities (Anti-Fraud Offices, OLAF, etc.).
Provision should be made for an acknowledgement of receipt to be sent to the informant within seven calendar days of receipt of the communication. . Exceptions are made in cases that may jeopardise the confidentiality of the communication.
Establishment of a maximum period of three months to respond to the investigative actions. In cases of particular complexity, the time limit may be extended to a maximum of three additional months.
Provide for the possibility of maintaining communication with the informant, especially in those cases in which it is necessary to request additional information from him/her.
Provision for the rights of the person concerned to be informed of the actions and omissions attributed to him/her and to be heard at all times. This communication shall take place at the appropriate time and in the appropriate manner, avoiding frustrating the proper conduct of the investigation.
Establishment of the guarantee of confidentiality when the communication is sent through systems other than those established. In this regard, personnel not responsible for its processing should be warned of the responsibility involved in not immediately sending the communication received to the person responsible for the system.
Provision should be made for respect for the presumption of innocence and the honour of the persons concerned.
Provision for the respect of the provisions on the protection of personal data.
Provision for immediate referral to the Public Prosecutor’s Office of the facts in respect of which there are indications of a criminal offence. Where the facts affect the financial interests of the European
Union, the immediate referral will be to the European Public Prosecutor’s Office. Given that the deadline for adapting to the new Law expires three months after its entry into force, the deadline for adapting the internal information systems and, therefore, their management and processing procedures, is 13 June 2023.