Organic Law 5/2010: Companies Enter the Criminal Code

Organic Law 5/2010, of June 22 (BOE-A-2010-9953), amending Organic Law 10/1995, of November 23, on the Criminal Code (CP), marked a turning point in Spanish criminal law. Its headline change was to introduce, for the first time, the criminal liability of legal persons, breaking with the traditional principle societas delinquere non potest ("corporations cannot commit crimes"). But the reform went much further: it created the autonomous offense of human trafficking, criminalized workplace and real estate harassment, modernized computer crimes and reinforced the protection of intellectual and industrial property. As a firm dedicated exclusively to criminal law, we explain what changed, why, and what it means today for an investigated company, a director or a victim. You can place this statute within the wider set of legislative changes on our criminal law reforms page.

What the reform changed and why

Until 2010, only natural persons bore criminal liability in Spain. Companies sat outside the Criminal Code: at most they faced so-called accessory consequences (such as closure or dissolution), but they were not subjects of the crime. That model had fallen behind the reality of economic crime, where much of the harm is generated within and through corporate structures, and behind the requirements of the European Union and the international commitments assumed by Spain.

Organic Law 5/2010 responded to that pressure with a fundamental shift: the legal person can now be the author of a crime and answer with its own penalties. The aim was not to replace the liability of natural persons, but to add a distinct liability for the company when the offense is committed for its benefit and from within it. Alongside this central axis, the legislator used the reform to close gaps across very different areas: human dignity (trafficking and harassment), cybercrime, and intellectual and industrial property.

Article 31 bis CP: the criminal liability of legal persons

The new article 31 bis CP is the heart of the reform. It established that legal persons can be criminally liable for certain offenses committed, in their name or on their behalf and for their benefit, through two main channels: on the one hand, offenses committed by their legal representatives and directors (those with decision-making power); on the other, those committed by persons subject to their authority where the offense was made possible by a failure to exercise due control over them.

The practical consequences are far-reaching:

• The company has its own catalogue of penalties. It does not go to prison, obviously, but it can be sentenced to a fine, to suspension of activities, to closure of premises, to disqualification from obtaining subsidies or contracting with the public sector and, in the most serious cases, to dissolution.
• Cumulative liability. The liability of the legal person is compatible with that of the natural persons who actually committed the offense; they do not exclude one another.
• Not for every offense. Corporate criminal liability only applies to offenses where the law expressly provides for it (for example, certain economic offenses, crimes against the public treasury, corruption, money laundering, computer crimes or offenses against workers' rights, among others).

This provision is the direct origin of what we now call criminal compliance: the need for companies to put in place crime-prevention programs. It is worth clarifying that the regime of article 31 bis CP was later developed and refined by subsequent reforms, which spelled out the requirements of organization and management models; but the starting point — that a company can commit a crime — is born with Organic Law 5/2010.

Human trafficking and harassment: arts. 177 bis and 173 CP

The reform significantly reinforced the protection of human dignity on two fronts:

• Autonomous offense of human trafficking (art. 177 bis CP). Until then, trafficking was blurred together with the illegal smuggling of persons. Organic Law 5/2010 created a distinct, independent offense punishing the recruitment, transport, harboring or receipt of persons, using violence, intimidation, deception or abuse of a situation of vulnerability, for purposes such as labor or sexual exploitation, organ removal or slavery. Separating trafficking (an attack on the dignity and freedom of the person) from illegal immigration (an attack on the control of migration flows) is one of the most important technical advances of the law.
• Workplace harassment (mobbing) and real estate harassment (art. 173 CP). The reform added two specific forms to the offense against moral integrity in article 173 CP. Workplace harassment punishes anyone who, within an employment or civil-service relationship and abusing a position of superiority, repeatedly carries out hostile or humiliating acts amounting to serious harassment of the victim. Real estate harassment punishes anyone who, in order to force the lawful occupant of a dwelling to leave it, imposes conduct that seriously harasses their normal way of life (for example, cutting off utilities, noise or threats to drive out the tenant).

An important clarification to avoid confusion: the stalking offense in article 172 ter CP does NOT come from this reform; it was introduced years later, in 2015. Organic Law 5/2010 did, however, open the door to the criminal protection of harassment at work and in housing.

Computer crimes and intellectual property: arts. 197, 264 and 270 CP

The law modernized the criminal response to technology-related crime and piracy:

• Discovery and disclosure of secrets (art. 197 CP). The protection of privacy and data against unlawful access and seizure was reinforced, in line with the growing digitization of personal information.
• Computer damage (art. 264 CP). Damage to data, programs or computer systems was specifically criminalized (deletion, alteration, suppression or rendering useless of another's data, and the sabotage of systems), responding to phenomena such as attacks on IT infrastructure. It is also one of the provisions where corporate criminal liability applies.
• Intellectual and industrial property (art. 270 CP and related provisions). The reform adjusted the protection of copyright and industrial property against unauthorized exploitation, refocusing the criminal response on conduct carried out for profit.

The practical reach is clear: a company that operates with IT systems, personal data or protected content takes on not only civil or administrative risks, but may also be dragged into criminal proceedings — even as an investigated legal person — if such conduct is committed from within its organization.

Supervised release as a new measure

Organic Law 5/2010 also introduced supervised release as a non-custodial security measure, initially designed for certain serious offenses (particularly sexual and terrorism offenses). It subjects the person, once the prison sentence has been served, to a set of obligations and controls for a period of time (for example, appearances, prohibitions on approaching certain persons or places, or participation in programs). Its purpose is preventive: to reduce the risk of reoffending once freedom is regained. It is a significant piece because it broadens the catalogue of responses available to the criminal justice system beyond the traditional sentence.

What it means today for the company, the director or the victim

For a company, the most important consequence is that it can be charged as such. When an investigation is opened into an offense committed from within its structure, the company can appear as an investigated party with its own defense, separate from that of its directors. The key question in the proceedings is no longer only who committed the act, but whether the company had effective prevention and control mechanisms in place.

For a director or administrator, the reform means that their conduct can give rise to their own criminal liability and, in addition, drag the company in with it. The line between a legitimate business decision and criminal conduct calls for careful criminal advice, especially in economic, tax or computer-related matters.

For a victim — of trafficking, of workplace or real estate harassment, or of a computer crime — the law offers specific offenses that allow a complaint to be framed with greater technical precision, clearly identifying the applicable offense and, where relevant, the legal person that may be liable.

Lines of defense

Building on this reform, these are the main lines of defense we work with:

• Proving an effective organization and management model. This is the central line of defense for the legal person. Showing that the company had a suitable crime-prevention program, with control functions genuinely assigned, and that the offense was committed by fraudulently circumventing those controls, can decisively exclude or mitigate its liability.
• Separating the liability of the company from that of natural persons. The defense of the company and that of the director do not always coincide; from the outset it is important to delimit who is liable and why, preventing the company from bearing individual conduct unrelated to its organization.
• Challenging the benefit and the attribution to the organization. Disputing that the offense was actually committed for the company's benefit or from within its structure, as opposed to isolated acts that do not engage the legal person.
• Pinning down the classification in trafficking and harassment. Under art. 177 bis CP, delimiting trafficking from other offenses; under art. 173 CP, requiring the elements of workplace or real estate harassment (repetition, seriousness, abuse of superiority) as against conflicts that do not reach criminal relevance.
• Temporal application of criminal law. For acts predating the reform, requiring the application of the criminal rule most favorable to the defendant, comparing the successive regimes.

What to do if this reform affects you

If your company has received a summons, if you are a director or officer of an investigated company, or if you are a victim of trafficking, of workplace or real estate harassment or of a computer crime, the decisive thing is to act in the early stages: review the charge, organize the documentation of the prevention programs and design the strategy before the first statement. You can read more context in our criminal law reforms section, consult the articles in the annotated Criminal Code, or learn how we approach criminal defense. You will find more analysis of legislative developments on the firm's blog.