The Internal Information System shall collect reports submitted by members of the university community or third parties relating to:

• a) Actions or omissions that may constitute infringements of European Union Law under the terms established in Law 2/2023, regulating the protection of persons who report regulatory infringements and the fight against corruption, and in Directive (EU) 2019/1937, regarding:

  i. Public procurement
  ii. Financial services, products, and markets, and prevention of money laundering and terrorist financing
  iii. Product safety and compliance
  iv. Transport safety
  v. Environmental protection
  vi. Radiation protection and nuclear safety
  vii. Food and feed safety, animal health, and animal welfare
  viii. Public health
  ix. Consumer protection
  x. Protection of privacy and personal data, and security of network and information systems

• b) Actions or omissions that may constitute a criminal offense or a serious or very serious administrative offense. In any case, this shall include all criminal or serious/very serious administrative offenses that involve financial loss to the USC.

The internal system shall not apply to:

• a) Obligations resulting from the professional secrecy of medical and legal professionals, the duty of confidentiality of FDA personnel, or cases involving the processing of classified/restricted information.

• b) Information regarding infringements in the processing of procurement procedures that contain classified information, are declared secret or restricted, or those whose execution must be accompanied by special security measures in accordance with current legislation.

To be admitted, the information must fall within the scope of application of these Regulations. In the event of admission for processing, an acknowledgment of receipt shall be sent to the reporting person within seven business days, unless doing so jeopardizes the confidentiality of the communication.

The information may be inadmissible for processing, within a period not exceeding ten business days, in the following cases:

a) When the reported facts lack all plausibility.

b) When the reported facts do not constitute an infringement of the legal system included within the scope of application of these Regulations.

c) When the communication manifestly lacks grounds or there are reasonable indications that it was obtained through the commission of a crime. In the latter case, in addition to non-admission, a detailed report of the facts deemed to constitute a crime shall be forwarded to the Public Prosecutor's Office (Ministerio Fiscal).

d) When the communication does not contain new and significant information regarding infringements compared to a previous communication for which the corresponding procedures have already concluded.

There are two channels for reporting actions or omissions that constitute infringements of Union Law:

a) Written channel

b) Verbal channel

Once the information has been submitted, it shall be entered into the information management system and assigned an identification code. This system shall be maintained in a secure, restricted-access database, which will record the following data:

a) Date of receipt

b) Identification code

c) Actions taken

d) Measures adopted

e) Closing date

Upon receipt of the information, an acknowledgment of receipt shall be issued within a period not exceeding seven business days, unless the reporting person expressly waives the receipt of communications regarding the investigation or the report is anonymous. The investigation phase (instrución) shall include all actions aimed at verifying the plausibility of the reported facts.

Once all actions are completed, the system manager, with any necessary support, shall issue a report containing at least:

a) A statement of the reported facts.

b) The actions carried out to verify the plausibility of the facts.

c) The conclusions reached during the investigation and an assessment of the proceedings and the evidence supporting them.

Once the report is issued, one of the following decisions shall be adopted:

a) Filing of the case, which shall be notified to the reporting person and, where applicable, to the affected person.

b) Referral to the Public Prosecutor's Office if the facts could potentially constitute a criminal offense.

c) Adoption of an agreement to initiate disciplinary proceedings. These decisions may be accompanied by the adoption of any corresponding corrective measures.

Internal Information System Form

FURTHER INFORMATION Regulation establishing the Internal Information System:
http://hdl.handle.net/10347/30661

Law 2/2023, of February 20, regulating the protection of persons who report regulatory infringements and the fight against corruption:
Disposición 4513 del BOE núm. 44 de 2023

Directive (EU) 2019/1937 of the European Parliament and of the Council, of 23 October 2019, on the protection of persons who report breaches of Union law.
https://www.boe.es/doue/2019/305/L00017-00056.pdf