With the name internal information system we could refer to a multitude of information systems, but in Spain, in the field of the draft law regulating the protection of people who report regulatory infractions and the fight against corruption, we refer to the tools that are implemented to facilitate the direct communication of violations to organizations.
Commonly called the complaint channel or the ethical channel, the legislator has renamed these systems with the name of “internal information system”. In order to eliminate the word with a negative character of complaint, it has been decided by this name: “internal information system”. In our opinion it is too general, but surely soon we will accept it as a substitute for the complaint channel.
Thus, the internal information system will be the channel provided by companies and the public administration as the first level of management of alerts or communications. This system will be managed internally by the members of the organization or the management may be outsourced to a third party. The internal information system must be implemented in all companies with 50 or more employees and in the different agencies of the public administration. Although, at the moment it is a preliminary bill, it is supposed to be approved during the second quarter of 2022. The preliminary draft mentions the dates on which it will be mandatory to implement the system in the different organizations. Specifically, 3 months from the entry into force of the law for companies with more than 250 employees and until 1/1/2023 for those with between 50 and 250 employees. The dates are very tight, for example in Portugal they have given 6 months for the implementation of the systems in the companies. It is possible that the dates will be modified when the law is published, since if they do not go quickly the initial dates will not be met.
Unlike the European Directive (EU) 2019/1937 that transposes this law, the name of the internal systems is different from the external ones. The internal ones, those that affect the complaints of the organization itself, are the ones that will be managed by the “internal information system” regardless of whether its management is internal or outsourced to a third party. On the other hand, external systems, those that must be provided by a public entity and that will serve to cover alerts that are not correctly managed by internal information systems, are called external communications channels and not external information systems.
We will be attentive to the publication of the law, to see if the names are maintained, as everything seems to indicate, or if there is a last-minute change to make a less general nomenclature.
