Whistleblowing: New obligations for companies

On 9 March 2023, Italy transposed the EU Whistleblowing Directive by adopting Legislative Decree No. 24/2023 published in the Official Journal on 15 March 2023 (the 'Decree').

On 15 July 2023, the National Anticorruption Authority (ANAC) Guidelines on Whistleblowing also came into force, aimed at providing guidance to public and private entities for their internal whistleblowing channels and models.

Who is covered by the Decree?

The provisions of the Decree apply to:

• public sector entities; and
• private sector entities that in the last year:
  • have employed an average of at least 50 employees with open-ended or fixed-term employment contracts;
  • despite having employed less than 50 subordinate employees, adopt organisation and management models in accordance with Legislative Decree 231/2001 ('MOG'); 
  • although they employ fewer than 50 employees, they operate in regulated sectors at European level (e.g. financial markets or credit sector).

Who is protected?

The category of persons entitled to protection under the Decree has been broadened: employees, self-employed and freelance workers, volunteers, trainees, shareholders as well as persons with administrative, management, control or supervisory functions are now covered.

What reporting channels can whistleblowers use?

Under the Decree, a whistleblower can now use three channels to report a breach:

• an internal channel which must be implemented by all legal entities to which the Whistleblowing Decree applies; 
• an external channel, established by ANAC;
• a public disclosure channel, e.g. through the press.

What do companies covered by the Decree need to do?

Companies with more than 249 employees were required to comply with the provisions of the Decree by 15 July 2023.

Companies with up to 249 employees must comply with a number of obligations in order to implement the provisions of the Decree by 17 December 2023.

In particular, employers who have not already done so, must:

• prepare and activate, after consultation with relevant trade union representatives referred to in Article 51 of Legislative Decree 81/2015, internal reporting channels that are suitable to guarantee the confidentiality of the identity of the individual making the report, the persons involved and those mentioned in the report, the content of the report and the relevant supporting documents;
• assign responsibility for managing the reporting channel to an autonomous internal office dedicated to this activity, or to specially trained staff, or to trained external parties;
• where a company already has a compliant organisational model in place, this should be updated to include the changes to the internal procedures and policies on whistleblowing;
• have a report that clearly describes how irregularities are reported internally and externally;
• make all employees, as well as persons who do not frequently visit the workplace but have a legal relationship with the company, aware of the procedure for reporting, by posting it in easily visible places in the workplace (e.g. on the company notice board) and publishing it on a dedicated section of the company's website, if one exists;
• comply with the provisions of the GDPR in relation to the processing of personal data and documentation relating to the report and, where necessary, provide an appropriate data protection and privacy notice.

What are the key protections for whistleblowers and penalties for companies involved?

Whistleblowers must not suffer any form of retaliation. This includes acts such as dismissal, failure to promote, a change of job, change of location, reduction in salary, change in working hours, disciplinary or other sanctions, discrimination or other unfavourable treatment. 

Such acts are presumed to be by reason of the individual making a report (i.e. retaliatory), subject to proof to the contrary (Articles 17 and 19 of Legislative Decree No. 24/2023), if they occur after the report has been made. In addition, for damages occurring after the report, the company is presumed to be civilly liable.

Any detrimental act is considered null and void. So, in the event of dismissal as a result of whistleblowing, whistleblowers have the right to be reinstated to their role in accordance with Article 18 of L 300/1970 or Article 2 of Legislative Decree 23/2015, depending on the applicable regulations.

Particular attention should be paid to any disciplinary proceedings initiated following a report, bearing in mind that specific safeguards are provided with regard to the identity and confidentiality of the reporting person.

The Decree also provides for a fine of between EUR 10,000 and EUR 50,000 to be imposed where, there is proven retaliation against the whistleblower, if the whistleblowing report was obstructed or attempted to be obstructed, if the obligation of confidentiality was breached or the failure of the company to set up the internal reporting channels. 
Finally, any waiver or settlement, in whole or in part, of the rights and protections provided for in the Decree shall be null and void unless made in a protected place as set out under Article 2113 of the Italian Civil Code. 

Our team remains at your disposal to assist you in this implementation phase and to provide any further information you may require.