On March 15, 2023, Legislative Decree No 24 of March 20, 2023, transposing EU Directive 2019/1937, was published in the Italian Official Journal. The new law entered into force on March 20, 2023, and must be implemented. The new rules came into effect on:
- July 15, 2023, in the case of all public entities, and private entities with an average of 250 or more employees
- December 17, 2023, in the case of private entities with an average of 50 or more employees.
The new rules include within the notion of whistleblower not only employees, but also self-employed workers, freelancers and consultants, volunteers and trainees, shareholders and persons with administrative, management, control and supervisory or representative functions, and former employees.
A whistleblower is protected against retaliation, even indirect retaliation including dismissal, suspension, downgrading or non-promotion, demotion, negative references, intimidation or harassment, reputational damage, etc. and benefits from supportive measures such as information, assistance and advice free of charge on how to report and on protection from retaliation.
The Decree extends the obligation to implement reporting channels, adopt procedures for making reports, and ensure safeguards applies to all private entities that:
- in the last year (ending for the first year on December 31, 2022), employed an average of at least 50 employees
- adopted an organizational model pursuant to Legislative Decree 231/2001 (Model 231), regardless of the number of employees and the sector to which they belong
- fall within the scope of the acts of the European Union – listed in the annex to the Decree – concerning financial services, products and markets, prevention of money laundering and financing of terrorism, transport safety and environmental protection, irrespective of the number of employees.
Under the new rules every company operating in Italy and falling into the above-mentioned categories must:
- set up internal reporting channels, to allow reports in written form (analogue or digital), or in oral form, through telephone lines, voice messaging systems or direct meetings with the reporting manager
- entrust the management of internal channels to an autonomous and specifically trained in-house person or department, or to an external party
- adopt a procedure to precisely regulate the handling of reports, providing clear deadlines and the obligation to diligently carry out the reports themselves, assessing the truthfulness and existence of the facts reported and taking the necessary corrective action
- ensure clear information on the channel, procedures and prerequisites for making internal or external reports using the external reporting channel, set up by the National Anti-Corruption Authority (ANAC) or public disclosures (through the mass media)
- ensure safeguards for the reporting person, concerning the confidentiality of the identity of the reporting person or of the person involved/mentioned in the report, as well as of the content of the report and of the relevant documentation
The scope of whistleblower reporting is provided for in the Decree as follows:
- in companies having at least 50 employees, the whistleblower may report breaches of certain laws relating to financial services, money laundering, environment, public health, etc.
- in companies that have approved the Model 231, the whistleblower may report breaches of the Model 231 and the laws connected thereto and may report either offences or attempted offences
- in companies that have adopted the Model 231 and have at least 50 employees, the whistle-blower may report breaches of both instances as listed above.
Violations of the Decree may result in administrative fines of up to EUR 50,000.
Arcangela Gerbino (Trainee) contributed to this article.
