The New Paradigm of Corporate Integrity: The Impact of Law 2/2023 on Labour Relations

The entry into force of Law 2/2023 of 20 February, regulating the protection of persons reporting regulatory breaches and combating corruption, which transposes Directive (EU) 2019/1937 (known as the Whistleblowing Directive), has marked a turning point in human resources management in Spain. What might initially appear to be a purely administrative compliance requirement has turned out to be a regulation with a cross-cutting impact on employment law, affecting everything from recruitment processes to the termination of contracts.

The convergence of Law 2/2023 of 20 February and the imminent draft bill amending Law 31/1995 of 8 November on the Prevention of Occupational Risks, the Consolidated Text of the Workers’ Statute, approved by Royal Legislative Decree 2/2015 of 23 October, and the Regulation on Prevention Services, approved by Royal Decree 39/1997 of 17 January, outlines a new paradigm in which transparency, mental health and proactive integrity cease to be corporate options and become legal imperatives.

1. The subjective scope: Who does the law actually protect?

One of the most disruptive aspects, as noted by specialist legal literature (Fernández Ramos, 2023), is the move beyond the traditional concept of a ‘worker’. Protection against reprisals is not limited to the current workforce but, according to Article 3 of Law 2/2023, extends to:

• Public sector employees and employees in private employment.
• Self-employed workers, shareholders and directors.
• Candidates in recruitment processes: Protection applies even if the information was obtained during pre-contractual negotiations.
• Former employees: Workers whose employment relationship has already ended.
• The whistleblower’s circle: Protection is extended to trade union representatives, facilitators, colleagues and family members who may suffer indirect reprisals.

This broad scope obliges companies to exercise extreme caution in their organisational decisions, as the circle of people who can invoke the protection of the law is extraordinarily wide.

The aim is to shield workers and put an end to the culture of silence. Law 2/2023 of 20 February is not merely a regulatory compliance measure; it is a legal shield for workers. Its primary objective, according to Article 1, is to provide adequate protection against retaliation for those who detect serious labour, criminal or administrative infringements in a workplace context.

2. The Internal Reporting System: The mandatory channel

The Act requires all companies with 50 or more employees to implement an Internal Reporting System. According to Articles 5 and 7 of Act 2/2023, this system must:

• Guarantee the confidentiality of the whistleblower’s identity and that of any third party mentioned.
• Allow for anonymous communications.
• Have a person responsible for the System, who must act independently and autonomously.
• Be integrated into an integrity policy that is duly publicised within the organisation.

Failure to comply with this obligation to have an internal system in place is classified as a very serious offence, with fines of up to one million euros for legal entities, in accordance with Article 65 of Law 2/2023.

Article 5 stipulates that this system must be secure and managed in such a way as to prevent access by unauthorised personnel. As highlighted by recent case law in National High Court Judgment 1647/2025, confidentiality is the cornerstone of the system. The regulation requires that the whistleblower be the ‘first to know’ of the irregularity so that the company can rectify it internally before it reaches external channels or authorities.

3. The prohibition of retaliation and automatic nullity

The core of the legislation in the workplace is found in Article 36, which expressly prohibits any act constituting retaliation. The law not only prohibits dismissal, but also:

• Suspension of employment, demotion or denial of promotion.
• Substantial changes to working conditions.
• Unjustified negative performance appraisals.
• Damage to reputation or harassment.

Immediate legal consequence: Administrative acts or business decisions constituting retaliation shall be null and void. This means that, in the event of a dismissal classified as retaliation for whistleblowing, the company will be ordered to reinstate the employee immediately with back pay and, likely, to pay compensation for damages.

4. The reversal of the burden of proof: A procedural challenge

Article 38.4 of Law 2/2023 introduces a procedural rule of enormous significance: once the whistleblower has reasonably demonstrated that they have made a protected report and have suffered harm, it will be presumed that such harm was caused in retaliation.

It will be incumbent upon the company to prove that the measure taken (for example, a dismissal for objective reasons or a disciplinary sanction) was based on duly justified grounds and was entirely unrelated to the report. This ‘presumption of retaliation’ obliges companies to document, in an exhaustive and objective manner, any decision affecting an employee who has made use of the reporting channels.

5. ‘New Prevention’: Mental Health and Psychosocial Risks

Whilst Law 2/2023 protects the worker’s ‘voice’, the Draft Bill amending Law 31/1995 (LPRL), Royal Legislative Decree 2/2015 and the Regulation on Prevention Services (RSP) protects their mental well-being in a digitalised environment.

• Inclusion of Psychosocial Risks and Climate Change:
  One of the most disruptive changes is the amendment to Article 16 of the LPRL. Companies will be required to include psychosocial factors and those associated with climate change in their risk assessments. It is no longer sufficient to assess physical risks; stress, burnout and the impact of work organisation are now coming to the fore.
• Physical and Mental Health Monitoring:
  The new wording of Article 22 of the LPRL reinforces the right to health monitoring, specifying that this must cover both physical and mental health. This ties in with the need for early detection of work-related conditions, such as psychological harassment, the seriousness of which has been emphasised by courts such as the High Court of Justice of the Basque Country in its Judgment 1093/2016, which links harassment to the termination of the contract with compensation under Article 50 of the Workers’ Statute.

6. Algorithms, AI and the New Definition of Harassment

The Draft Bill introduces a necessary update to Article 4 of the LPRL, defining workplace violence and harassment in a comprehensive manner. For the first time, it expressly includes harassment carried out through:

• Information and communication technologies.
• The use of algorithms or artificial intelligence systems.

This amendment obliges companies to audit their automated decision-making systems to ensure they do not create hostile or discriminatory environments, thereby guaranteeing the right to moral integrity recognised in the amended Article 4.2 of the Workers’ Statute.

7. Gender and Age Perspectives: Diverse Management

The amendment to Article 1.1 bis of the Prevention Services Regulations requires the integration of gender and age perspectives into all phases of preventive management.

• Gender: Biological differences (anthropometry, hormonal cycles) and social inequalities that result in unequal exposure to risks must be taken into account.
• Age: The assessment must be adapted to the ageing of the working population, adjusting roles to changing capabilities.

Furthermore, protection for maternity and breastfeeding is strengthened, with an updated list of prohibited agents and conditions in the new Annex VII of the RSP.

8. Legal and Penal Consequences and Recommendations for the Company

Failure to comply with these obligations entails not only reputational risks but also significant financial penalties.

• Law 2/2023: Article 65 establishes fines of up to €1,000,000 for legal entities in the event of very serious infringements, such as breaches of confidentiality or the taking of retaliatory action.
• LISOS: The Draft Bill amends the Law on Offences and Penalties in the Social Order (Ley sobre Infracciones y Sanciones en el Orden Social) to classify any discriminatory conduct in employment as an offence. Furthermore, it introduces a 40% reduction in financial penalties for early payment, except where the breach has caused an accident at work or an occupational disease, thereby reinforcing the deterrent nature of the legislation.

The impact of this regulatory package requires immediate action on three fronts:

1. Review of Ethics Channels: Ensure compliance with the requirements of Law 2/2023 and that the System Manager acts independently.
2. Updating the Risk Assessment: Integrate psychosocial risks and the gender perspective in a substantive manner, not merely as a formality.
3. Disconnection and AI Protocols: Establish clear rules on the use of digital devices and human oversight of algorithms to prevent situations of digital harassment.
4. A culture of non-discrimination on grounds of age and technology, which complements the protection against violations of fundamental rights already provided by labour legislation within the framework of employment relations.

The era of transparency is here to stay. Those companies that see these regulations as an opportunity to improve their working environment and organisational resilience will not only avoid penalties but will also position themselves as leaders in the 21st-century labour market.

 

******

More information:

Lupicinio International Law Firm
C/ Villanueva 29
28001 Madrid
P: +34 91 436 00 90