The European Directive 2019/1937, which came into force on December 16, 2019 and is known as the Whistleblower Directive, introduced a set of rules aimed at ensuring an adequate level of protection for whistleblowers in the public and private sectors, in an effort to standardize the sectoral regulations of European Union member countries.
"Whistleblower" refers to the individual who reports illegal or unethical information or behavior within an organization or public body. His or her role is thus crucial to the uncovering of illegal activities in a business context and the promotion, thus, of a culture of transparency and accountability. However, the decision to report conduct that has come to one's attention can pose significant risks to the whitleblower, such as retaliation or discrimination in the workplace, and, for this reason, the introduction of secure and confidential reporting systems that, at the same time, prevent possible abuse is envisaged.
The Italian legislature implemented the EU principles expressed in the aforementioned directive with Legislative Decree No. 24 of 2023, with whose obligations all companies that employed an average of at least 50 employees in the 12 months prior to the July 15 entry into force of the Legislative Decree must comply. However, the new regulations provided for a gradual start, at least for the private sector. In fact, the date of July 15, 2023 affected only those private companies that had employed, in the last year, an average number of subordinate workers, with fixed-term or open-ended contracts, equal to or greater than 250, as well as those dealing with certain particular sectors, even if in the last year they had not reached the aforementioned size requirement. Conversely, private sector entities that employed, in the last year, an average of 50 to 249 employees, under permanent or fixed-term contracts, have (or should have) complied since Dec. 17, 2023.
Legislative Decree No. 24/2023 has, therefore, revised the entire discipline of reporting channels (overcoming the previous regulatory stratification, which consisted of Legislative Decree No. 165/2001 for the public sector and Legislative Decree No. 231/2001 for the private sector on the prevention of corporate crimes as amended by L. 179/2017) and proposes to intensify the protections afforded to whistleblowers/whistleblowers, expanding the range of employers who will have to fulfill the new obligations, as well as introducing additional potentially unlawful conduct worthy of reporting and outlining the penalty profiles of violations and conduct, including retaliatory conduct.
In addition, the channels that the employer or entity is required to make available to potential whistleblowers must ensure, including through the use of techniques such as encryption or pseudonymization, the confidentiality of the whistleblower's identity.
In summary, private entities that meet at least one of the following conditions are therefore obliged to set up the relevant reporting channels: i) they have employed, in the last year, an average of at least 50 subordinate workers, with permanent or fixed-term employment contracts; ii) they operate in specific sectors (services, financial products and markets, and prevention of money laundering or financing of terrorism, transport safety and environmental protection), even if in the last year they have not reached the average of at least fifty workers referred to in the previous point; iii) they adopt the organization and management models referred to in D. Legislative Decree No. 231/2001, even if in the last year they have not reached the average of at least 50 employees with permanent or fixed-term employment contracts. Obviously, these private-law entities are joined by public-sector entities such as public administrations, independent administrative authorities, public economic entities bodies bodies of public law, etc.
As for those who will be able to make reports, pursuant to Art. 3, paragraph 3, of Leg. 24/2023, in addition to those working in the public sector (employees, including police and military personnel), there are: (i) employees of companies in the private sector; (ii) self-employed workers and holders of a collaborative relationship; (iii) workers or collaborators, who carry out their work in entities in the private sector that provide goods or services or perform works for third parties; (iv) freelancers and consultants, who perform their work at entities in the public or private sector; (v) volunteers and trainees, paid and unpaid, who perform their work at entities in the public or private sector; (vi) shareholders and persons with administrative, management, control, supervisory or representative functions.
Reports, which may be made through internal channels, prepared by public or private entities, or external to the organization, may concern, for example: (i) administrative, accounting, civil or criminal offenses; (ii) illegal conduct under Legislative Decree no. 231/2001 or violation of the organizational and management models provided for in the same decree; (iii) offenses that fall within the scope of the EU or national acts indicated in the specific annex to the decree or in the annex to Directive (EU) 2019/1937; (iv) acts or omissions that harm the EU's financial interests; (v) acts or omissions concerning the internal market
; (vi) acts or conduct that frustrate the object or purpose of the EU provisions in the areas referred to in the decree. On the other hand, cases in which the whistleblower has a personal interest and the whistleblowing has exclusive relevance to his or her employment relationship are excluded from the application of these regulations. Internal whistleblowings are made in writing, including by computer, sealed envelope, or orally through telephone lines or voice messaging systems or through a direct meeting with the whistleblower, if the whistleblower so requests. At this point, the person/office designated to receive the reports should issue the whistleblower with an acknowledgement of receipt of the report and entertain interlocutions with the whistleblower, requesting additions as appropriate. In addition, the whistleblower must be provided with all information regarding the internal reporting channel, procedure and prerequisites for making the report, including through the creation of a dedicated section on the corporate or institutional website. The management of external whistleblower channels is the responsibility of ANAC, to whom one can turn, for example, when there is no internal whistleblower channel in the corporate or institutional context or it is not active or, if active, does not comply with the requirements dictated in this regard.
Finally, for those who fail to comply with the obligations arising from the new regulations, the penalties range from 10,000.00 euros to 50,000.00 euros, upon the occurrence of the following hypotheses: i) failure to establish reporting channels; ii) failure to adopt procedures to make and manage reports; iii) adoption of procedures that do not comply with those established by D. Legislative Decree No. 24/2023; iv) failure to carry out the verification and analysis of the reports received; v) retaliatory behavior; vi) obstruction of reporting or attempts to obstruct it; vii) violation of the obligation of confidentiality regarding the identity of the reporter.
There is also a penalty ranging from €500.00 to €2,500.00 applied by ANAC to the reporter, against whom civil liability for libel or slander in cases of malicious intent or gross negligence is established, even by a judgment of first instance.
