Dejan Jasnic · Co-founder & Compliance Lead, Trusty · 20+ years anti-fraud & compliance · ACFE Swiss Chapter Board
Italy transposed the EU Whistleblowing Directive through Legislative Decree No. 24 of 10 March 2023 (the Decree), published in the Italian Official Gazette.
In October 2019, the Whistleblowing Directive in Italy was drafted, marking a significant step in the labor sector by introducing new obligations for implementing internal reporting systems within companies. The primary objective of this regulation is to ensure that all employees have tools to report potential violations or irregularities within the organization while protecting the confidentiality of the whistleblower. Although the directive sets general guidelines for the entire European Union, each country has had to adapt it specifically to the needs of its business sector.
What should we know about the Whistleblowing Directive in Italy?
Thus, in Italy, this directive is transposed into Legislative Decree No. 24 of March 10, 2023, drafted in the Italian Official Gazette on March 15, 2023. The Decree repeals and modifies previous national regulations (mainly, Art. 6, Sec. 2-bis of Legislative Decree 231/2001, “Decree 231”), consolidating in a single legislative text the protection regime for individuals who report illegal conduct. The goal is to ensure the implementation of the directive without diminishing the protections already established in legislation.
However, it should be noted that the legislative process concerning the reporting of irregularities in Italy has been criticized for its lack of transparency, as no public hearings or consultations were held on the proposal announced in January 2022. Although the Ministry of Justice received the official mandate to transpose the Directive, no meetings or consultations were organized, and the proposal eventually lapsed.
In September 2022, the legislative reform resumed with a new mandate for the Government to draft a transposition bill. This new bill was approved in December and presented to Parliament only three days later. Parliamentary committees had the opportunity to comment on the bill before the final review. On March 9, 2023, the legislation was finally approved by the Italian government.
What were the implementation deadlines for the Whistleblowing Directive?
Regarding the implementation period of the Decree, despite it coming into force on March 30, 2023, its provisions became effective from July 15, 2023 for all companies with 250 or more employees and public administrations. For companies with between 50 and 249 employees, the deadline was December 17, 2023.
Who does the Italian law protect?
This regime aims primarily to combat and prevent regulatory violations within public and private organizations. It promotes the reporting of illegal conduct that threatens the entity’s integrity, both public and private, and, consequently, the public interest. Additionally, it ensures a high level of protection for those who report violations of national or European Union law known in the workplace. This is achieved through the implementation of secure reporting channels, both internal and external, that ensure the confidentiality of the whistleblowers, their immunity from retaliation, and the protection of their personal data.
In this vein, protection against retaliation extends to:
- All individuals assisting the whistleblower during the reporting process.
- Relatives or persons with a stable emotional connection, regardless of whether they work with the whistleblower or not.
- Colleagues who have a regular and ongoing relationship with the whistleblower.
- Entities owned by the whistleblower or any of the aforementioned individuals.
Regarding the types of retaliation from which the whistleblower is protected, the Italian Decree provides for the following:
- Dismissal and suspension
- Demotion or lack of promotion
- Change of duties or workplace
- Salary reduction or alteration of work hours
- Suspension of training
- Negative performance reviews
- Disciplinary measures or other sanctions, including financial penalties
- Coercion, intimidation, harassment, or ostracism
- Discrimination or any other unfavorable treatment
- Non-conversion of a fixed-term employment contract into a permanent one when there was a legitimate expectation of such a conversion
- Failure to renew or early termination of a fixed-term employment contract
- Damage, including to the person’s reputation, especially on social media, or economic or financial harm, such as loss of economic opportunities and income
- Revocation of a license or permit
- Request to undergo psychiatric or medical tests
Which companies are affected by Legislative Decree no 24/2023?
The Decree applies to entities in both the public and private sectors. Specifically, regarding the latter, the regulation extends protection to whistleblowers working in entities that have employed an average of at least 50 people in the last year. Additionally, it includes entities operating in sensitive sectors such as financial services, products and markets, anti-money laundering and counter-terrorism financing, transport safety, and environmental protection. It also concerns organizations that implement organizational and management models to prevent the commission of crimes during business activities. in accordance with Legislative Decree 231/2001. In these latter cases, regardless of the number of employees present in the companies.
What violations can be reported under the Whistleblowing Directive in Italy?
Specifically, the following can be reported:
- Actions, facts, or omissions affecting the public interest or the integrity of public administration or private entities, constituting administrative, accounting, civil, or criminal violations.
- Illegal conduct relevant under Decree 231 or violations of the organizational and management models established therein.
- Violations within the scope of EU or national provisions applicable to specific sectors.
- Actions or omissions that harm the financial interests of the Union, as well as those related to the internal market.
- Acts or conduct that contravene the purpose or intent of EU legislative acts.
Who is responsible for evaluating the reports?
The ANAC (Autorità Nazionale Anticorruzione) is the only competent body to evaluate reports and apply administrative sanctions in the public sectors
For private companies, there is some leeway on who can act as a reporting manager. However, the ANAC can still be contacted as a second level manager or if the company has not provided adequate protection tools for the reporter.
How to make a whistleblower report?
The report can be made through an IT platform provided by the company or by the ANAC, in writing, or orally (via telephone lines and other voice messaging systems).
It should be noted that, although it is preferable to provide a telephone number or a messaging system, according to different interpretations, the oral nature of the report would seem to be able to be guaranteed also by providing for the possibility of a face-to-face meeting. However, in any case, if the whistleblower requests it, the possibility of scheduling a face-to-face meeting within a reasonable period of time must be ensured.
The company or the ANAC must respond to the whistleblower within three months or, in justified cases, within six months from the date of notification of receipt of the external report, or failing that, seven days after receiving the report. Regarding case management, Italian regulations establish the following deadlines:
- The first confirmation message to the whistleblower must be sent within 7 days of receiving the case.
- The initial feedback must be provided 3 months (90 days) after the mentioned 7-day period.
- The maximum time to delete closed cases is up to 5 years.
What is the sanction regime and what penalties are provided?
It is important to highlight the sanctions that the ANAC (National Anti-Corruption Authority) will impose on companies in case of non-compliance with the Decree:
- A fine of 10,000 to 50,000 euros if it is found that reprisals have been taken, reporting has been obstructed or attempted to be obstructed, or the confidentiality obligation has been violated.
- A fine of 10,000 to 50,000 euros if it is found that reporting channels have not been established, procedures for submitting and handling reports have not been adopted, adopted procedures do not comply with legal requirements, or verification and analysis of received reports have not been conducted.
- A fine of 500 to 2,500 euros in case the protection under the Decree is lost, except if the whistleblower has been convicted, even in the first instance, for slander or defamation, or for the same offenses committed in the report to judicial or accounting authorities.
Other important updates on the Italian law
Internal reporting channels must use an appropriate encryption system to ensure data protection and confidentiality throughout the process. These channels must be easily accessible to all interested parties and highlighted in a specific section of the company’s website. Additionally, the company must develop a policy explaining how to use the internal channel, how to file a report, what information should be included in a report, and how reports will be managed. For oral reports, phone calls or voice messages must be documented on a suitable device for storage and listening, or through transcription. If not recorded, the report must be documented in writing. In case of transcription, the whistleblower can verify, correct, or confirm the content by signing it. For reports made in-person, the meeting must be recorded with the whistleblower’s consent, using suitable devices for storage and listening, or transcribed and confirmed by signature. In the case of company groups, the reporting function and site can be shared if the total number of employees in all subsidiaries does not exceed 249. If a subsidiary has more than 249 employees, an independent reporting function and website must be established.
In conclusion, what has changed in Italian legislation on whistleblowing?
In the last three years, the changes in Italian law have been as follows:
- Channels have been established for reporting violations in any public or private entity with more than 50 employees.
- The directive applies regardless of the adoption of the MOG (Organization, Management, and Control Model) provided in Legislative Decree 231/2001, therefore the application of the whistleblowing system was already foreseen regardless of the number of employees.
- The implementation of the Directive does not reduce the guarantees already existing for whistleblowers.
- The provisions of the Directive have had a direct impact on the regulatory framework of the private sector.
Frequently asked questions
It entered into force on 30 March 2023 and applied from 15 July 2023 to companies with 250 or more employees and to public administrations, and from 17 December 2023 to companies with 50 to 249 employees.
Public sector entities and private entities that employed an average of at least 50 people in the last year, plus entities in sensitive sectors such as financial services, anti-money laundering, transport safety and environmental protection, and entities with a Decree 231 organisational model, regardless of headcount.
An acknowledgement within 7 days of receipt, feedback within 3 months after that period, and deletion of closed cases within a maximum of 5 years.
ANAC can fine companies 10,000 to 50,000 euros for retaliation, obstruction or breaches of confidentiality, the same range for failing to set up compliant channels and procedures, and 500 to 2,500 euros where the whistleblower loses protection.
Related reading: how the Whistleblowing Directive was transposed across the EU, UNI/PdR 125:2022 gender equality certification in Italy, and Trusty whistleblowing software with D.Lgs. 24/2023 compliant policies.
FROM 49 EUR PER MONTH
Trusty Whistleblowing: a reporting channel compliant with the EU Whistleblower Directive, live in minutes with no IT project. From 49 EUR per month, 7-day free trial.