Legislative Decree No. 24/2023 (the ‘Decree‘) has finally transposed into Italian law the Directive (EU) 2019/1937 ‘on the protection of persons who report breaches of Union law‘ (the ‘Directive‘).
Here is a summary of the Decree’s main provisions, focusing in particular on those affecting private employers.
| 01. Scope of application |
Until now, only employers, which had previously adopted the set of organizational and management rules, policies and procedures aimed at preventing the criminal offences referred to in Legislative Decree No. 231/2001 (the so-called “Model 231”), were required to have a specific whistleblowing procedure. All other employers, which had decided not to have a Model 231, were under no obligation to approve a whistleblowing procedure.
The Decree significantly changes that approach and imposes the adoption of whistleblowing procedures to all employers:
- staffed with an average of at least 50 employees in the last year; or
- if smaller,
- are active in certain specific industries (e.g., ships/flight security) or
- have adopted a Model 231.
Italian businesses of this size, however, are generally not adequately prepared or structured to handle such complex procedures; therefore, we expect that they will face significant organizational challenges in aligning with the Decree.
| 02. Effective date |
The Decree will enter into force on July 15, 2023 for employers staffed with an average of at least 250 employees in the last year and on December 17, 2023 for companies employing in the last year an average up to 249 employees.
The introduction of whistleblowing procedures and also the adaptation of previous ones to the new requirements are subject to a prior consultation with the internal work councils or the external trade unions. Therefore, such procedures must be ready well in advance, so to start and complete the consultation phase and have the whistleblowing procedure in place by the above dates.
| 03. Protected individuals |
The Decree protects the whistle-blower and those persons who have a special relationship with the whistle-blower. In particular, the following persons may avail of the legal protection granted by the Decree:
- The whistle-blowers (and the category of those who are entitled to the reporting is broad: candidates to employment, employees, former employees, trainees, shareholders, members of corporate bodies, consultants and professionals, employees or consultants of contractors);
- The so-called facilitators (i.e., the persons who have supported and helped the whistle-blower);
- Those individuals who operate in the same work context and have family, affective or continuous contacts with the whistle-blower; and
- legal entities owned by the whistle-blower or for which the whistle-blower works (e.g., a contractor) or are related to the whistle-blower.
| 04. Protected reporting |
The reporting of information falls within the frame of the Decree if it relates to violations causing a prejudice to public interests or to companies’ integrity; namely:
- in companies having at least 50 employees, the whistle-blower may report breaches of certain specifically identified laws (financial services, money laundering, environment, public health, etc.);
- in companies that have approved the Model 231, the whistle-blower may report breaches of the Model 231 and the laws related thereto (i.e. offences or attempted offences);
- in companies that have approved the Model 231 and have at least 50 employees, the whistle-blower may report breaches of both (i) and/or (ii).
The Decree does not apply instead to reports having a personal nature (e.g. harassment).
While it may not be easy, in certain cases, to understand whether a report actually falls within the scope of the Decree, companies should also identify special procedures to manage reports received through ‘official’ channels but falling outside the scope of the Decree.
| 05. Internal reporting channels |
Employers are required to implement internal reporting channels after consulting the internal work councils or the external trade unions. The obligation to consult – which by the way is not specifically contemplated by the Directive – may entail significant implications, in particular for those employers that do not have an internal works council and, therefore, should involve the external trade unions (not familiar with, or already present in, the organization).
Internal channels must allow written and oral reports and can be managed either internally (by a designated person/department) or externally (by a third party). In any case, managers must provide clear information on how the channel works, issue acknowledgement of receipt, diligently follow up any report, give feedback within three months, ensure confidentiality, keep the relevant documentation.
Only employers staffed with less than 250 employees can share the same reporting channels; this means that legal entities belonging to the same group cannot share internal channels if they exceed such threshold.
It is important to underline that the Decree provides for a detailed sequence of procedural steps and confidentiality and data protection provisions, as well as technical protections (e.g., cryptography), whose breach can entail fines (including fines levied by the Data Protection Authority) and/or legal issues in using the outcome of the internal investigation in Court and/or in disciplinary proceedings.
| 06. Other forms of reporting |
Reporting can also be made through:
- external channels (i.e., reporting to public authorities) but only to the extent (i) internal channels do not exist or are not active or do not comply with the Decree, or (ii) whistle-blowers have already made an internal reporting, but there has been no follow-up; or (iii) whistle blowers have reasonable grounds to believe that an internal report would not be effectively followed up or could imply retaliation risks, or the breach is an immediate/clear danger for public interests. The national anti-corruption authority (“ANAC”) is responsible for implementing and managing an external reporting channel that is compliant with the requirements set by the Decree. In case the reporting is filed to another public authority, it will be forwarded to ANAC, informing of this the individual who made the report;
- public disclosure (i.e., making information available in the public domain), but only to the extent that (i) whistle-blowers have already made internal or external reporting but no feedback has been timely received, or (ii) whistle-blowers have reasonable grounds to believe that the breach is an immediate/clear danger for public interests, or that other reporting channels could entail the risk of retaliation or not be effectively followed up in connection with the specific circumstances of the case (such as where evidence may be concealed or destroyed or where there is a well-founded fear of collusion).
Safeguards might apply in case of reports made directly to the judicial or accounting authority.
| 07. Forms of Protection |
Whistleblowers (and persons mentioned in paragraph 3 above) are entitled to certain protections provided that:
- at the time of reporting they had reasonable grounds to believe that the reported information was true and falling within the scope of the Decree; and
- the report was made through the above reporting channels in compliance with the Decree.
As a strong form of protection, any action taken by the employer vs the whistle-blower (e.g. dismissal, lay-off, change of work location) is presumed to be retaliation and is considered null and void, unless the employer is able to demonstrate in Court that the measure was instead fully unrelated to the whistleblowing (the Decree thus introduces a full shift of the burden of proof).
Note that the Decree provides that records of reports can be kept by employers for a maximum of five years; clearly, this might in principle prevent/limit the employer’s defence in Court cases started by employees after such deadline.
In addition, whistle blowers are authorized to breach commercial/professional secrets to the extent they have reasonable grounds to believe that it is necessary to report the breach and they act in compliance with the Decree.
Further, the whistle blowers’ identity must in principle remain secret, even in the disciplinary procedure against any accused individuals; this might affect the actual possibility to start (or effectively conduct) such a procedure, taking into account that under Italian law employers are required to be specific and give precise detail when taking disciplinary actions.
Safeguards do not apply if a Court ascertains a criminal liability (for slander, defamation or other crimes) or civil liability in cases of wilful misconduct or gross negligence of the whistle blower. In such event the whistle blower can also be sanctioned by ANAC with a fine ranging from Euro 500 to Euro 2,500 (unless already sentenced by a Criminal Court for the above crimes) and may be subject to disciplinary procedures which may also lead to dismissal in the most serious cases.
| 08. Administrative sanctions |
ANAC may apply administrative sanctions in case of:
- adoption of retaliatory measures or acts aimed at hampering the report or breaching confidentiality to employers (fine ranging from Euro 10,000 to Euro 50,000); or
- failure to implement the internal reporting channels in compliance with the Decree and/or failure to adopt/follow the relevant procedures (fine ranging from Euro 10,000 to Euro 50,000).
| 09. Suggested actions |
With the entry into force of the Decree many Italian employers will be required to define actions for ensuring its implementation and avoiding sanctions. In particular:
- any existing reporting channel and procedure must be assessed in the light of the new and more stringent requirements imposed by the Decree;
- if no channel exists, it is advisable to introduce it as soon as possible, so to have a test period before the Decree comes into force. Companies that have not yet adopted a Model 231 should consider this option, so as to show a more comprehensive approach against prohibited conducts;
- the works council (or the external unions) must be informed about the need to introduce new channels or improve the existing channels;
- greater attention must be paid when planning dismissals or other measures involving people who are in a position to report a breach or individuals who are in close contact with them, so to avoid claims of retaliation. This would imply additional work for HR teams, also considering that the identity of the whistle blower cannot be disclosed.