Italy transposes the EU Whistleblowing Directive

Italy has finally implemented the EU Whistleblowing Directive now requiring companies to set up effective reporting channels, protect whistleblowers from retaliation, and duly investigate reported concerns. By promoting practices of business ethics and further discouraging misconducts, this move will help fostering a more responsible business environment in Italy.

Introduction

The Italian government enacted Legislative Decree no. 24/2023 (the Italian Whistleblowing Legislation) implementing EU Directive (EU) 2019/1937 of the European Parliament and of the Council of 23 October 2019 (the EU Whistleblowing Directive). The Italian Whistleblowing Legislation aims at protecting those who report violations of EU law and expanding the scope of the EU Whistleblowing Directive breaches of national legislation.

The Italian Whistleblowing Legislation adds up to certain whistleblowing provisions already existing in specific sectors (e.g., for the reporting of infringements to financial services regulations, anti-money laundering provisions, etc.) while also preserving the current regulation concerning the protection of classified information and professional, medical and judicial secret.

The most significant innovation is the expansion of the scope of application of whistleblowing obligations previously limited to the public sector and to private entities already adopting an organizational model (231 Model) under Legislative Decree no. 231/2001 (Law 231) on corporate quasi-criminal liability which are now extended to any company with at least 50 employees or which otherwise are subject to specific EU law provisions (e.g., entities subjected to regulations on financial services and financial markets, anti-money laundering legislation as well as civil aviation and safety of offshore oil and gas operations related provisions). 

General obligations

While whistleblowing-related obligations already existed for public and private entities with a 231 Model in place, the new Italian Whistleblowing Legislation takes a step further setting out a comprehensive regime that applies to both public and (most) private entities. This move aligns Italy with the EU Whistleblowing Directive and provides a single framework for whistleblowing. Under the new regime, employees of the entities subject to the Italian Whistleblowing Legislation may resort (a) to an internal reporting channel to a designated office within the entity itself and/or (b) to an external reporting channel to the National Anti-Corruption Authority (ANAC). This does not exclude that, in limited circumstances, a violation may be also publicly disclosed.

Relevant thresholds / timeline

A private entity shall comply with the newly established whistleblowing regime if:

• it has at least 50 employees; or
• regardless of the number of employees, it falls within the scope of certain specific EU law provisions (e.g., entities subjected to regulations on financial services and financial markets, anti-money laundering legislation as well as civil aviation and safety of offshore oil and gas operations related provisions); or
• the entity has adopted a 231 Model.

The obligations set out by the Italian Whistleblowing Legislation must be implemented by 15 July 2023, unless the entity has up to 249 employees, in which case the obligations must be implemented by 17 December 2023.

Material scope

The Italian Whistleblowing Legislation has a material scope broader than the EU Whistleblowing Directive, as it applies to both EU law (e.g., public procurement, financial services, environmental protection, nuclear safety, and data protection) and Italian law violations (i.e., (a) any illicit activities which may give to criminal, civil or administrative liability and (b) any conducts amounting to any of the offences listed in Law 231). However, the whistleblowing regime is not applied uniformly to all public and private entities, or even among private entities. In fact, it applies to:

• Any public entity – which entity shall set up internal channels (and whose employees may also use the external channel to ANAC) to report violations of both EU law and any Italian law.
• Any private entity with a 231 Model in place and up to 49 employees – which entity shall set up internal channels to report conducts amounting to any of the offences listed in Law 231.
• Any private entity with a 231 Model and 50 or more employees – which entity shall set up internal channels (and whose employees are also allowed to use the external reporting channel to ANAC) to report violations of (a) EU law and (b) conducts amounting to any of the offences listed in Law 231.
• Any private entity with 50 or more employees or which is otherwise subject to certain specific duties under EU Law – which entity shall set up internal channels (and whose employees may also use the external channel to ANAC) to report EU law violations.

Internal reporting channels

The internal reporting channels shall ensure the confidentiality of the identity of the whistleblower and of any third party involved, as well as of the content of the report and the related documentation.

After a report is received through the internal channel, the designated office (usually the supervisory board under Law 231 so-called Organismo di Vigilanza or other dedicated office within or outside the company) shall acknowledge receipt and inform the whistleblower within seven days and shall provide feedback on the report received within the following three months. The internal reporting channel must be established based on a comprehensive data protection impact assessment (under article 35 of the GDPR). This assessment shall identify the specific risks associated with processing operations and enable the identification of appropriate security measures.

External reporting channels

ANAC shall establish a confidential external reporting channel for whistleblowers and third parties, suitable to receive written or oral reports. Upon receipt of a report, ANAC shall (i) acknowledge receipt of the report within seven days and (ii) provide feedback on the report within three months, unless there is a valid reason for delay.

The external channel may be used if one of the following conditions exists:

• The mandatory internal reporting channel has not been activated or does not comply with the Italian Whistleblowing Legislation.
• The whistleblower has already made an internal report which has not been acknowledged or followed-up on by the entity.
• The whistleblower has reasonable grounds to believe that an internal report would not be effectively followed-up on by the entity, or that the report itself could lead to the risk of retaliation.
• The whistleblower has reasonable grounds to believe that the breach may constitute an imminent or clear danger to the public interest.

The whistleblower’s protection

Who is protected?

• Whistleblower (i.e., any person whether or not still employed by the legal entity at the timing of reporting who have reported or have publicly disclosed information about a possible violation falling within the scope of the Italian Whistleblowing Legislation).
• Facilitator (i.e., any third party who is related to the whistleblower and who may experience retaliation in a work-related context e.g. colleagues or family members including, legal entities owned by, or having working relations with, the whistleblower).

Which conditions must be met for publicly disclose the information reported?

In specific cases, the whistleblower may also publicly disclose the information reported if one of the following conditions are met:

• he/she had previously filed an internal or external report, and has not received a response within the time limits set out in the Italian Whistleblowing Legislation; or 
• he/she has reasonable grounds to believe that the breach may pose an imminent or clear danger to the public interests; or
• he/she has reasonable grounds to believe that an external report to ANAC may pose a risk of retaliation or there is a low prospect of the breach being effectively addressed due to the particular circumstances of the case.

What does the protection include?

• Prohibition of retaliation against the whistleblower who cannot, by way of example, be dismissed, suspended, downgraded, negatively reviewed, discriminated or harassed, or subjected to disciplinary measures or any other sanction.
• Supporting measures, i.e., information, assistance and advice (free of charge) on how to report and on the protection from retaliation offered by national and EU regulatory provisions, on the rights of the person involved, as well as on the terms and conditions of access to legal aid.
• Remedies against retaliation, i.e., filing a complaint with ANAC, who shall then inform the National Labour Inspectorate, to seek reinstatement in his/her job if the employee has been dismissed as a result of the report or complaint, as well as, damage compensation.

Sanctions

In case of failure to introduce an internal reporting channel in line with the Italian Whistleblowing Legislation or to properly investigate a reported violation, ANAC may impose pecuniary sanctions (from 500 to 50,000 EUR). Sanctions are also provided in case of retaliation or obstruction of the reporting process.