Albert Rodríguez, a partner in RocaJunyent's Employment Law Department, is a member of the Editorial Board of the yearbook “2024 Labour Practice for Lawyers”. In it, several members of the team have written the RocaJunyent block, which comprises chapter 20, with the following headings:

-‘Illegal assignment of workers in an automated environment ’ - María José Sánchez, Pere Vidal.

-Nullity of the requirement to remain in the company at the time of payment of the bonus earned by a worker who voluntarily leaves ‘ - Rosa Rodríguez, Clara Croizat-Viallet, Rubén Salas.

Link to the publication (available in Spanish)

Following the annulment by the CJEU, the SC had to decide who was entitled to request a refund of the tax unduly paid as it was contrary to EU law.

This decision was eagerly awaited because the aforementioned regional section of the IEH was in force from 2013 to 2018 and, depending on the decision, could lead to very significant refunds for the State, as had happened a few years earlier with the ‘céntimo sanitario’ (the predecessor of this regional rate of the IEH).

The IEH, unlike VAT, is a single-phase tax, which means that it is only levied once. VAT, on the other hand, is passed on through all the links in the production chain. The IEH is levied only when the oil leaves the tax warehouse and is purchased by the distributor. The rest of the chain until it reaches the final consumer is not legally charged this tax. Although the cost of this tax may be included for them, this is only from an economic point of view, but not from a legal-taxation point of view.

The SC has established that only those who are legally obliged to bear the tax can apply for a refund of the unduly paid amount. Those who suffered only an economic impact are not entitled to claim a refund. This is very relevant because it means that those who purchased diesel at a petrol station (e.g. hauliers or final consumers), although they bore the cost of the tax economically, cannot claim a refund of the tax annulled by the CJEU.

Access to the complete informative note

Alberto Novoa, partner of the Labour Law Department of RocaJunyent, has collaborated in the book ‘Labour Law explained through LinkedIn publications’, in which its author, Francisco Trujillo Pons, Professor of Labour Law and Social Security at the Universitat Jaume I (Castellón, Spain), analyses how the professional network LinkedIn can be used as an effective platform for teaching and disseminating the eclectic and changing field of Labour Law. 

Link to publication (available in Spanish)

The Guide is updated to include all recommendations for action, internal regulations to be approved and processes to be implemented in relation to the obligations of the audit committees (ACs) in the area of supervision of non-financial information and sustainability, and the involvement of the verifier of sustainability information. 

This has been done taking into account the provisions of Directive (EU) 2022/2464 on sustainability reporting by companies (CSRD), which is already in force, and the draft bill regulating the corporate reporting framework on environmental, social and governance issues.

In general, the functions of the CA in terms of dialogue, dialogue, supervision, guarantee of independence, regular meetings, control of remuneration, etc. that applied in relation to the external auditor are extended in equivalent terms to the verifier of sustainability information.

Other additional functions are also included, such as reporting on related-party transactions of listed companies.

Access to the full informative note

Apart from the debatable nature of the aforementioned prohibition decision - which gave rise to a sanctioning proceeding against Illumina, for having executed the operation without having been notified and authorised to the EC (an infringement known as "gun jumping") - the case has been particularly controversial because the aforementioned operation did not pass the notification threshold of the European merger control system, nor did it do so in any EU Member State. In other words, Illumina was under no obligation to notify the acquisition of Grail, prior to its implementation, either to the European Commission or to any national competition authority. 

What happened then? We look at it in brief in this article.

Access to the complete informative note

What does the RIA consider Artificial Intelligence Systems to be?

The RIA is designed to oversee and regulate the deployment of Artificial Intelligence ("AI"), with a particular focus on mitigating the risks associated with its development and use.

The Regulation defines AI Systems as machine-based systems that are designed to operate with varying levels of autonomy and can exhibit adaptive capabilities after deployment, and which, for explicit or implicit objectives, infer from the input information they receive how to generate output results, such as predictions, content, recommendations or decisions, which may influence physical or virtual environments.

What roles does RIA identify?

RIA identifies the following roles in the lifecycle of IA systems and models:

1. Provider: a natural or legal person, public authority or body that develops an AI system or model and brings it to the market or puts it into service under its own name or brand, either free or paid.
    
2. Deployer: A natural or legal person or public authority that uses an AI system under its own authority, except where the use is of a personal and non-professional nature.
    
3. Importer: A natural or legal person located in the European Union who places on the market an AI system bearing the name or trademark of an entity established outside the EU.
    
4. Distributor: Natural or legal person in the supply chain, other than the supplier or importer, who places an AI system on the market in the European Union.
    
5. Authorised representative: A natural or legal person in the European Union who, under a written mandate from a supplier, undertakes the obligations and procedures set out in the regulation on behalf of the supplier.
    
6. Product manufacturer: Manufacturer as defined in the harmonised legislation listed in Annex I of the RIA.
    
7. What is the scope of application?
    

To which IA systems does the RIA not apply?

1. Military and national security purposes: AI systems used exclusively for military, defence or national security purposes.
    
2. International cooperation: AI systems used by public authorities of third countries or international organisations in the framework of international cooperation agreements with the EU or its Member States, provided that the protection of fundamental rights and freedoms is ensured.
    
3. Scientific research and development: AI systems and models developed and used exclusively for scientific research and development.
    
4. Pre-commercial testing and development: Research, testing or development activities of AI systems or models prior to their introduction on the market or putting into service (except testing under real conditions).
    
5. Personal non-professional use: AI systems used by individuals in purely personal and non-professional activities.
    
6. Free and open source licences: Some AI systems released under free and open source licences, except those that are prohibited or high-risk.
    

How are AI Systems categorised?
AI Systems are categorised according to the risk they pose to people's fundamental rights, with Unacceptable Risk, High Risk, Limited Risk and Minimal Risk Systems.

Access to the full informative note

1. Introduction

Information is a major asset for GRUPO ROCAJUNYENT, as it is essential for the provision of the services it offers to third parties. For their part, information and communication technologies (ICT) have become essential for organisations, as they contribute very effectively to the processing of this information. However, the improvements that ICTs bring to information processing are accompanied by new risks. For this reason, it is necessary to introduce specific measures to protect both information and the services that depend on it.

Information security aims to protect information and services by reducing the risks to which they are subject to an acceptable level. This document establishes the Information Security Policy of GRUPO ROCAJUNYENT to ensure that all professionals in its service, both directly and indirectly, know, manage and support information security.

The aim is to achieve the strategic alignment of information security management with international standards and existing legislative regulations in this area.
 

2. Mission and objectives of the information security policy

GRUPO ROCAJUNYENT has established an alignment with the management of information security as established in the regulatory framework of the ISO 27001 market standard, recognising information and the systems that support it as strategic assets.

One of the fundamental objectives of the implementation of this Information Security Policy is to establish the bases on which both internal employees and third parties can access the services offered by GRUPO ROCAJUNYENT in a secure and trustworthy environment.

The Information Security Policy defines the global framework for the management of information security, protecting all information assets and guaranteeing the continuity in the operation of the systems. The aim is to minimise the risks arising from a possible security breach and to ensure compliance with the objectives of the ROCAJUNYENT GROUP in the event of a hypothetical information security incident.

To this end, the following general information security objectives have been established:

1. To contribute through security management to the fulfilment of the mission and objectives established by ROCAJUNYENT GROUP.
    
2. To have the necessary control measures in place to guarantee compliance with the legal requirements applicable as a result of the activity carried out, especially with regard to the protection of personal data and the provision of services through electronic or telematic means.
    
3. To ensure the accessibility, confidentiality, integrity, availability, authenticity and traceability of the information.
    
4. To ensure the continuous provision of services, both preventively and reactively in the event of security incidents.
    
5. To protect the information assets of GRUPO ROCAJUNYENT and the technology that supports them against any threat, intentional or accidental, internal or external, in order to ensure their confidentiality, integrity and availability.

This Information Security Policy ensures the ROCAJUNYENT GROUP's continuous and clear commitment to the dissemination and consolidation of the culture of security.
 

3. Scope

This Information Security Policy shall apply to all ROCAJUNYENT GROUP information. For these purposes, the ROCAJUNYENT GROUP is understood as follows.

• C/ Aribau,198 1ª Planta (Barcelona).
   
• C/ José Abascal, 56 6th Floor (Madrid).
   
• C/ Gran Vía Jaume I, 37 5th Floor (Girona).
   

Extending the scope of the information systems provided by ROCAJUNYENT to the following organisations:
 

SIGE BUSINESS SERVICES, S.L.P.U ("SIGE ’) with offices in the same locations.
 

4. Regulatory framework

The ROCAJUNYENT GROUP is defined as all the organisations described above.

This Policy is not limited to personal data and is independent of whether the processing is manual or automated.

The legislation on information security, which should serve as a reference, is continuously updated and is reflected in the ‘Annex: Applicable legislation’.
 

5. Review of the policy

In relation to any revisions that may be made to the wording of the text constituting the information security policy, two types of activities shall be distinguished:
 

1. Periodic systematic reviews: these shall be carried out at least once a year, or when incidents or changes are detected in the legal framework that may call into question the validity of said Policy. The review of the Information Security Policy must guarantee that it is in line with the strategy, mission and vision of the ROCAJUNYENT GROUP in matters of information security and that it ensures compliance with the established control objectives.
    
2. Unplanned reviews: these reviews must be carried out in response to any security event or incident that could lead to a significant increase in the current level of risk or have caused an impact on the security of GRUPO ROCAJUNYENT's information.
    

6. Internal organisation of security

Information security corresponds, with the functions indicated for each of them in this section, to the following bodies: ROCAJUNYENT GROUP's Information Security Committee, Information Managers, Service Managers, Security Managers and, where appropriate, Delegated Security Managers.
 

6.1. Information Security and Data Protection Committee.

The Information Security and Data Protection Committee is the body that centralises the management of information security in the organisation.

When justified by the complexity, the physical separation of its elements or the number of users of the information in electronic support, or of the systems that handle it, delegated Security Committees may be created, functionally dependent on the main Information Security and Data Protection Committee, which shall be responsible within their scope for the actions delegated to them.

The Information Security and Data Protection Committee is responsible for ensuring that the ISMS is implemented and maintained in accordance with this Policy and for ensuring that all necessary resources are available.

The Information Security and Data Protection Committee shall define what information related to information security is and will be communicated to which stakeholders (both internal and external), by whom and when.
 

6.2. Security Officer

The person who will determine the decisions to satisfy the security requirements for information and service security. He/she shall have the following functions:

1. Operational coordination of the ISMS, as well as reporting on its performance.
    
2. Conduct or promote periodic audits to verify compliance with information security obligations.
    
3. To monitor and control the security status of the information systems.
    
4. Propose to the Information Security and Data Protection Committee the security standards and security procedures.6.3.
    

When justified by the complexity, the physical separation of its elements or the number of users of the information in electronic format, or of the systems that handle it, ‘delegated security officers’ may be designated, functionally dependent on the main officer, who shall be responsible in their area for the actions delegated to them.

The person/s in charge of implementing the security measures designated by the Information Security Officer.

The person/s in charge of monitoring the information systems and the follow-up of the measures implemented.
 

6.4. Manager

Senior management should review the ISMS at least once a year or whenever there is a significant modification; and should prepare minutes of such meetings. The objective of management reviews is to establish the suitability, adequacy and effectiveness of the ISMS.
 

6.5. Data Protection Officer

The person in charge of developing the policies related to data protection, as well as participating in the committee to provide his or her vision regarding security incidents and their impact on personal data.
 

6.6. Other areas

Protecting the integrity, availability and confidentiality of assets is the responsibility of the owner of each asset.

All security incidents or weaknesses must be reported to the security officer.

The human resources department is responsible for adopting and implementing the Training and Awareness Plan, which applies to all persons who have a role in information security management.
 

7. Conflict resolution

In the event of conflict between the different persons responsible for the organisational structure of the Information Security Policy, this will be resolved by the Management of GRUPO ROCAJUNYENT, and the most stringent requirements derived from the protection of personal data will prevail.
 

8. Classification of information

ROCAJUNYENT GROUP will classify and inventory the information assets by virtue of their nature. The level of protection and the measures to be applied will be based on the result of this classification.
 

9. Personal data

When a system affected by ISO 27001 handles data of a personal nature, the provisions of European Regulation 679/2016 on data protection and Organic Law 3/2018, of 5 December, on the Protection of Personal Data and its implementing regulations shall apply, without prejudice to the requirements established in the regulatory framework of ISO 27001 in the field of e-Government. All information systems shall comply with the security levels required by personal data protection regulations.
 

10. Risk management

All systems subject to this Policy shall be subject to risk analysis and risk management, assessing the assets, threats and vulnerabilities to which they are exposed and proposing appropriate countermeasures to mitigate the risks. While continuous monitoring of changes made to systems is required, this analysis shall be repeated:

1. at least once a year (by formal review and approval).
    
2. when the information handled changes
    
3. when the services provided change
    
4. when a major security incident occurs
    
5. when serious vulnerabilities are reported
    

11. Development tool

For the harmonisation of risk analysis, a baseline assessment will be established for the different types of information handled and the different services provided.
An information security policy framework structured at different levels is established so that the objectives set out in this document are specifically developed. The information security policy will structure its regulatory framework at the following levels:

1. The present Information Security Policy, which establishes the global protection requirements and criteria.
    
2. The security standards that define what is to be protected and the desired security requirements. The set of all security standards must cover the protection of all the organisation's information systems environments. They establish a set of expectations and requirements that must be met in order to satisfy and fulfil each of the security objectives set out in the policy. They are proposed by the Security Manager and approved by the Information Security Committee.
    
3. The security procedures that describe in concrete terms how to protect what is defined in the rules and the people or groups responsible for the implementation, maintenance and monitoring of their level of compliance. These are documents that specify how to carry out the usual tasks, who should do each task and how to identify and report anomalous behaviour.
    

12. Obligations of professionals

Their approval will depend on their scope of application, which may be in a specific area or in a specific information system.
In addition, guidelines with recommendations and good practices may be established.
As far as possible, all this documentation will be managed in accordance with the current procedure for the Control of documents and records in ROCAJUNYENT GROUP, which will aim to establish the criteria for the control of documentation and security records used in the Information Security Management System and which extends to all the documentation that supports compliance with ISO 27001.

All professionals with responsibility for the use, operation or administration of information and communications technology systems are obliged to know and comply with this Information Security Policy and the derived security regulations, regardless of the type of legal relationship that links them to ROCAJUNYENT GROUP.

All persons will receive training in the safe use of the systems to the extent that they need it to carry out their work.

The Information Security Policy will be accessible to all professionals who provide their services in the bodies and entities referred to in the point relating to ‘Scope’.

In order to foster a ‘Culture of Security’, the Information Security Committee shall promote an ongoing awareness programme to train all professionals. Failure to comply with the Information Security Policy and its implementing regulations shall give rise to the establishment of preventive and corrective measures aimed at safeguarding and protecting the networks and information systems, without prejudice to the corresponding disciplinary liability.
 

13. Relations with third parties

When ROCAJUNYENT GROUP provides services or transfers information to third parties, it will inform them of this Information Security Policy and the rules and instructions derived from it.

Likewise, when ROCAJUNYENT GROUP uses the services of third parties or cedes information to third parties, they will likewise be informed of this Information Security Policy and of the security regulations and instructions relating to such services or information. Third parties shall be subject to the obligations and security measures established in said regulations and instructions, and may develop their own operating procedures to comply with them. Specific incident detection and resolution procedures shall be established.

It shall be ensured that the personnel of third parties are adequately aware of information security matters, at least to the same level as that established in this Information Security Policy.

Specifically, third parties shall ensure compliance with the information security policy based on auditable standards that allow verification of compliance with these policies. Likewise, it will be guaranteed by means of an audit or certificate of destruction/deletion that the third party cancels and deletes the data belonging to GRUPO ROCAJUNYENT at the end of the contract.
When any aspect of the Information Security Policy cannot be satisfied by a third party, a report will be required from the Information Security Manager specifying the risks incurred and how they are to be dealt with. Approval of this report by the Manager will be required before proceeding further.
 

Approved by:
Information Security and Data Protection Committee.

David Vegara, Chairman of the Advisory Board of RocaJunyent, invites us to read his Economic Note. In it, he analyses how politics, with its volatility and unpredictability, is perceived as separate from the economy, which continues to grow and generate employment. He highlights recent political events in Europe, including elections in France and the UK, and the implications of the rise of populism.

He notes that in Europe and other parts of the world, social discontent has fuelled support for populist solutions, which promise simple remedies to complex problems. In contrast, the Spanish economy shows a positive performance with GDP growth above that of the eurozone and improvements in the labour market, the financial situation of the private sector, and diversification of tourism. However, it warns of structural weaknesses, such as low productivity and lack of business investment, which could affect long-term growth.

As for the eurozone, Vegara mentions that a gradual recovery in growth is anticipated, although interest rates will probably not fall significantly in the short term due to persistent inflationary pressures in the services sector.

Access to the full Economic Note.

Jaime Tarrero and Carlos Vivar, Partner and Senior Associate respectively in M&A and Corporate - Capital Markets, have contributed to the second edition of the Legal 500's "The Legal 500: Capital Markets Comparative Guide", which contains Spain-specific Q&As providing an overview of the capital markets laws and regulations applicable in Spain.

You can consult the chapter in the following link.