Defense Against Internal Channel Complaints (Law 2/2023)

The Spanish Whistleblower Protection Law 2/2023 has transformed the panorama of internal investigations in Spain. Companies with 50 or more employees are obliged to have an operational internal complaints channel, with reinforced guarantees for the whistleblower. But the channel also generates a new defensive front: that of the reported director or employee, who may see their reputation, career and freedom compromised before any judicial proceeding even exists.

Legal Framework of the Whistleblower Channel

Law 2/2023 transposes EU Directive 2019/1937 and obliges companies and public bodies with 50 or more employees to maintain an operational internal information channel, overseen by an Independent Whistleblower Protection Authority. The law protects the whistleblower against retaliation, but it is not a one-way street: it also imposes processing obligations on the company and grants the reported person a set of guarantees. Understanding this dual structure is the starting point of any defence, because a channel operated negligently or in bad faith breaches the very law that created it.

Rights of the Reported Person

European and Spanish regulations require the reported person to have: (a) information about the subject of the complaint and their status as investigated within a reasonable period, (b) legal assistance if the internal interview may be used in a criminal or disciplinary process, (c) right against self-incrimination, (d) access to documentation affecting them, and (e) reasoned resolution within a reasonable period —maximum 3 months extendable to 6—.

Confidentiality and Its Limits

The whistleblower's identity is confidential and, as a rule, can only be revealed by criminal judicial order; the reported person therefore has no right to know who reported them. That confidentiality is not, however, unlimited: the reported person must be informed of the content of the complaint and the facts imputed within a reasonable period in order to defend themselves, and an anonymous complaint on its own is insufficient to ground a procedurally valid dismissal —the company must establish the facts with its own evidence. Data-protection rules and the principle of proportionality govern what may be accessed and disclosed throughout.

Defense Against Malicious Complaints

The channel may become an instrument of retaliation or internal conflict: complaints between confronted partners, resentful ex-employees, conflicts over management succession. The defense must identify early the improper motivation and articulate the response on two planes: (1) defensive, showing the inconsistency of the complaint and the chain of facts motivating it; (2) offensive, evaluating counter-complaint for false accusation (Art. 456 CP), slander (Art. 205 CP) or fraudulent use of the channel with labor consequences.

Counter-Complaint and Criminal Actions

Where the channel has been used fraudulently, the reported person can move from defence to attack. A false accusation (Art. 456 CP) carries six months to two years' imprisonment and a fine; slander (Art. 205 CP) applies where an offence is imputed knowingly or with reckless disregard for the truth; and, where the complaint forms part of a sustained campaign, harassment (Art. 173.1 CP) and labour actions may also come into play. Timing is strategic: the counter-complaint is usually best articulated after the internal investigation is dismissed, since that dismissal operates as powerful evidence of the falsity of the original accusation. A civil claim for the reputational and professional damage caused completes the response.