By Alexander Benalal and Ana
María Rodriguez
The Spanish Data Protection Agency (hereinafter SDPA) has just
published its position regarding the implementation of
whistleblowing schemes in companies. Although the paper released is
the response to a specific consultation made by a pharmaceutical
company (identification undisclosed) for its particular case and
not a formal guideline, it reflects the SDPA position regarding the
implementation of whistleblowing schemes in multinational companies
and therefore should be taken as a reference.
Basically, the aforementioned opinion states that:
- Reporting schemes are lawful provided that the processings
implied by them relate to the parties to a contract (for instance
any company and its employees) and are necessary for the
maintenance or performance thereof. Please note that, apart from
identifying the wrongdoings, the reporting scheme must necessarily
rely on wrongdoings which could actually affect the
