Whistleblower protection and reporting channels in Italy

The EU Whistleblowing Directive 2019/1937 was transposed in Italy by Legislative Decree No. 24 of 10 March 2023 (hereinafter referred to as the WB Decree), which entered into force on 30 March 2023.¹

The main purpose of the WB Decree is to regulate, on the basis of the provisions of the EU Directive, the protection of so-called whistleblowers, i.e. persons who report breaches of national or European Union law affecting the public interest or the integrity of public administration or of a private entity, of which they have become aware in a work-related context in a public or private entity.

The deadline to comply with the provisions of the WB Decree depends on the size of the entity as follows:

• 15 July 2023 for private entities with 250 or more workers in the last year, as well as for public entities, and
• 17 December 2023 for private entities with an average of 50 to 249 workers in the last year.

Until these dates, the pre-existing domestic legislation will continue to apply.

Yes, Legislative Decree No. 24 of 10 March 2023 requires legal entities in the private sector to establish and operate an internal whistleblowing system in compliance with certain requirements.

In the private sector, the WB Decree applies to:

• companies that have adopted an organisation, management and control model (compliance programme) pursuant to Legislative Decree 231/2001 (hereinafter referred to as the 231 Model),²
• companies that have not adopted a 231 Model but have employed an average of at least 50 workers in the last year,
• private entities that fall within the scope of the European Union legislation listed in the annex to the WB Decree, relating to financial services, products and markets, prevention of money laundering and terrorist financing, transport safety and protection of the environment, regardless of the number of workers and previous implementation of a 231 Model.

Failure to establish reporting channels in accordance with the WB Decree will result in administrative fines of up to EUR 50,000 imposed by the national anti-corruption authority ANAC (Article 21(1) WB Decree). Breaches sanctioned by the WB Decree include:

• any form of retaliation,
• obstructing (or attempting to obstruct) reporting,
• breach of confidentiality,
• failure to verify and analyse reports received.

According to the new legislation, entities that have adopted a 231 Model shall include specific disciplinary measures against those responsible for the above breaches in their disciplinary system (Article 21(2) WB Decree).

Furthermore, according to the new Article 6 para. 2-bis of Decree 231/2001 (introduced by Article 24(5) WB Decree), the establishment of a reporting channel pursuant to the WB Decree is a mandatory requirement for the adequacy of the 231 Model, and the effective functioning of a reporting channel is an essential aspect to be evaluated by the judge in criminal proceedings in order to ascertain the effective implementation of a 231 Model.

As a consequence, in addition to administrative fines imposed by ANAC as mentioned above, failure to comply with the WB Decree may also trigger criminal liability of companies under Decree 231/2001 in the event of the commission of a crime within the organisation.

Italian legislation imposes prior consultation with trade union representatives or organisations referred to in Article 51 of Legislative Decree 81/2015 as a mandatory requirement for the establishment of a whistleblowing system (Article 4(1) WB Decree).

This is without prejudice to the application of the provisions on the exercise by workers of their right to consult their representatives or trade unions, on protection against any unjustified detrimental measure prompted by such consultations, on the autonomy of the social partners and their right to enter into collective agreements, and on the repression of anti-union conduct.

Regarding the operation of a reporting channel, in general terms communications sent or received by workers via email, telephone calls or other electronic communications must be inviolable, otherwise criminal penalties may be applied. Of course, an assessment on a case-by-case basis is necessary.

Yes, the WB Decree requires consultation with trade union representatives or organisations referred to in Article 51 of Legislative Decree 81/2015 before establishing an internal reporting channel (Article 4(1) WB Decree).

No. On the contrary, under certain conditions, the WB Decree provides that breaches may also be reported through external reporting channels and publicly disclosed.

In greater detail:

• The external reporting channel³ established and operated by ANAC (which has the authority to conduct investigations of reported breaches⁴ may be used if one of the following conditions is met:
  • an internal reporting channel is not established or, if established, does not comply with the regulations,
  • the whistleblower has previously made an internal report and there has been no follow-up,
  • the whistleblower has reasonable grounds to believe that an internal report would not be followed up on effectively or that it could lead to a risk of retaliation,
  • the whistleblower has reasonable grounds to believe that the breach may constitute an imminent or manifest danger to the public interest.
• Public disclosure (e.g. press, social networks, etc.) is possible if:
  • the whistleblower has used internal and external reporting channels, but no appropriate action has been taken, or
  • the whistleblower has reasonable grounds to believe that the breach may constitute an imminent danger to the public interest or that there is a risk of retaliation.

According to the WB Decree, the whistleblower (and persons connected with him/her⁵ may not suffer any form of retaliation (e.g. dismissal, demotion, non-renewal of contract, etc.). Any retaliation shall be null and void.

Whistleblowers (and persons connected with them) may inform ANAC of the retaliation they believe they have suffered, and the authority is required to inform the National Labour Inspectorate for actions within its competence.

The judicial authority shall take all necessary measures, including provisional measures, to ensure the protection of the subjective rights asserted, such as

• compensation,
• reinstatement in the workplace,
• an order to cease the retaliatory conduct,
• a declaration of nullity of the retaliatory measures taken.

A waiver of protection is valid only if it is made in the manner provided for in Article 2113(4) of the Civil Code.

With regard to data protection requirements, in order to protect the confidentiality of the whistleblower, as well as the integrity and confidentiality of the personal data reported, any processing of personal data related to a whistleblowing report must be carried out in accordance with the GDPR and Italian data protection legislation, i.e. Legislative Decree 196/2003, known as the Privacy Code (lex generalis).

Furthermore, specific provisions set out in Article 13 of the WB Decree under the heading “Processing of personal data” apply (lex specialis), including the following protective measures:

• Personal data that are not relevant for the handling of a specific report shall not be collected or, if accidentally collected, shall be deleted without undue delay (data minimisation principle).
• The rules on restrictions of the exercise of the data subject’s rights under Articles 15-22 GDPR (e.g. access, rectification, restriction of processing, etc.) apply in accordance with Article 2-undecies of the Privacy Code.
• The processing of personal data relating to the receipt and handling of reports is carried out by data controllers, providing appropriate information to the reporting persons and persons concerned pursuant to Articles 13 and 14 of the GDPR (obligation to provide information).
• The model for receiving and handling reports must undergo a data protection impact assessment (DPIA) in order to identify and adopt appropriate technical and organisational measures to ensure a level of security appropriate to the confidentiality, integrity and availability risk (principle of data protection by design and by default).

Other related provisions concern the timeframe and modalities for keeping records of reports under Article 14 of the WB Decree, which establishes specific rules for the retention of documents related to whistleblowing:

• Retention time (data retention): no more than five years from the date of communication of the final outcome of the whistleblowing procedure.
• Storage: specific provisions on the transcription of oral reports and on the whistleblower’s right to check/rectify the transcript (Article 14, paragraphs 2, 3 and 4 of the WB Decree).

Despite Confindustria’s suggestion,⁶ the WB Decree does not provide any specific guidelines for the handling of reports in groups of companies, specifically multinational groups.

It only provides that companies with an average of no more than 249 workers with permanent or temporary employment contracts in the last year (basically, small and medium-sized enterprises) may share an internal reporting channel and its operation. This applies both to distinct companies with no link to one another and to companies that belong to the same group while being distinct legal entities.

¹ The matter was previously regulated in both the public and private sectors, by Legislative Decree 165/2001 (Article 54-bis), Legislative Decree 231/2001 (Article 6 para. 2-bis), and by Law No. 179 of 30 November 2017, respectively.

² Legislative Decree No. 231 of 8 June 2001 (Decree 231/2001) provides for the criminal liability of legal entities, companies and associations for certain offences explicitly listed in the law if these are committed by their representatives. Articles 6 and 7 of Decree 231/2001 provide for specific exemptions from liability if the company can demonstrate that it adopted and effectively implemented an organisation, management and control model (231 Model) before the crime was committed. The implementation of a 231 Model is not mandatory by law, but it is the only way for a company to avoid liability under Decree 231/2001. The adoption of a 231 Model is therefore considered a de facto obligation to protect a company from future sanctions. According to the new Italian legislation, whistleblowers in the private sector can also report breaches that may entail corporate criminal liability under Decree 231/2001, as well as breaches of a 231 Model.

³ See the guidelines for the external reporting channel procedure published by ANAC.

⁴ ANAC is also entitled to submit reports to the administrative/judicial authorities for breaches falling within their competence.

⁵ The same protection provided to the whistleblower also applies to facilitators, persons connected with the whistleblower by a stable emotional or family relationship up to the fourth degree and operating in the same work-related context, colleagues of the whistleblower, entities that the whistleblower owns or is connected with in a work-related context, and anonymous whistleblowers if they are subsequently identified and suffer retaliation.

⁶ Confindustria is the main association representing manufacturing and service companies in Italy.