Whistleblowing – deadline on 17 December 2023

You have probably already been informed in detail about this matter by your labour consultant; to be on the safe side, here is some further information from our side:

Objective of the new legislation:

With Legislative Decree No. 24/2023, Italy too has transposed the EU’s so-called Whistleblower Directive into Italian law. The purpose of the law is to ensure that employees who pass on anonymous reports of breaches of the law within the company do not face any disadvantages. By way of explanation: where employees become aware of legal infringements in the course of their professional activity, they not infrequently find themselves in an (internal) conflict: may or must the infringement be reported, or do the duties of loyalty as an employee take precedence? For fear of negative repercussions, possible legal infringements are then not brought to light. This „whistleblower protection law“ is intended to counteract this: anyone who reports infringements should not have to fear professional consequences, such as exclusion from a promotion or even dismissal.

Protected whistleblowers:

The group of persons protected by the whistleblowing provisions and able to report irregularities via the reporting system is very broadly defined and includes, among others:

• salaried employees of the company,
• self-employed professionals and freelancers who work for the company,
• interns and voluntary workers,
• shareholders as well as members of administrative and supervisory bodies,
• other persons who become aware of infringements in the course of their cooperation with the company and
• partners of the whistleblower as well as his or her relatives (up to the 4th degree).

Setting up a reporting system:

The establishment and management of this reporting system as well as the handling of the reports received must comply with the time limits and methods laid down by law. These obligations include, among other things:

1) setting up a suitable reporting system which is managed by sufficiently trained staff (the reporting system may be managed internally or externally)

2) timely handling of incoming reports: the whistleblower must be sent an acknowledgement of receipt within 7 days of receipt of the report and an initial response on the progress of the procedure within 3 months.

Companies concerned:

• All companies with at least 250 employees have already been required to provide suitable internal reporting channels since 15 July 2023;
• Companies which in the past year employed an average of at least 50 employees must provide secure and anonymous reporting channels for whistleblowers by 17 December 2023;
• Irrespective of the number of employees, companies operating in sensitive sectors are likewise obliged to set up a system for reporting infringements by 17 December 2023. Sensitive sectors within this meaning are:
• companies in the fields of financial services, financial products and financial markets;
• companies which are particularly vulnerable to money laundering and terrorist financing, and
• companies which are subject to specific provisions in the fields of transport safety and environmental protection.
• Also subject to the new obligations, again irrespective of the size of the business, are companies which already apply the organisational model under Legislative Decree No. 231/2001 (they should, however, essentially have introduced the system already).

Incidentally: with regard to the calculation of the headcount for the above purposes, the anti-corruption authority ANAC, which is responsible for monitoring compliance with the whistleblowing provisions, established by resolution of 12 July 2023 that the figure shown in the Chamber of Commerce extract as at 31.12. of the respective previous year is decisive.

Protection mechanisms for whistleblowers:

For the persons falling within the scope of Legislative Decree No. 24/2023 there applies, in addition to confidentiality as to the identity of the whistleblower, an absolute prohibition of retaliation (against them, and even of the mere threat thereof). If action is taken against the whistleblower (e.g. by means of court proceedings), there is a mandatory presumption that this constitutes retaliation. This presumption can indeed be rebutted, but the party who initiated such proceedings must furnish specific evidence to the contrary, which is usually extremely difficult.

Subject matter of the protected reports:

The subject matter of the protected reports may in general be administrative offences, offences in the field of accounting as well as commercial and criminal offences, further infringements within the framework of the organisational model under Legislative Decree No. 231/2001 and then, above all, infringements in the field of public procurement law and of safety in the transport sector as well as acts to the detriment of the European Union or of the internal market.

Necessary measures:

In order to ensure that reported infringements are properly handled within the meaning of the regulations outlined, companies must:

• set up internal communication channels for the reports (e.g. e-mail, a dedicated telephone number, etc.);
• appoint an employee or a department to be responsible for the management of these specially created communication channels, and train these appointed employees;
• alternatively, the management of the communication channels may be assigned to an external party who has specially trained staff;
• introduce a specific procedure governing the various stages and the responsibilities of the persons involved; and
• inform the entire staff of the company about those infringements which can be reported, raise awareness of the topic and provide training.

Incidentally, labour consultants as a rule offer digital platforms for setting up such reporting channels.

Important: the choice of the reporting route is no longer at the whistleblower’s discretion, since the internal reporting channel must be used as a matter of priority. A report via the external reporting channel (A.N.A.C) may only be made if one of the following grounds applies:

• The internal report was not followed up.
• An internal report entails an increased risk of retaliatory measures.
• There are grounds to believe that the infringement constitutes an immediate or manifest danger to the public interest.

Recommendation: for the reasons outlined, setting up such an internal reporting channel is also in the immediate interest of the company itself.

One final note: it is likely that in future the establishment of these reporting channels will also be required for participation in certain public tendering procedures as well as for claiming grants and subsidies.

Administrative penalties: anyone who is obliged to set up the reporting channel and fails to do so faces penalties of between 10.000 and 50.000 euro.