Whistleblowing: Upcoming Obligations for Companies

As is well known to many, the EU Directive no. 2019/1937 required EU member states to fully regulate whistleblowing procedures.

Whistleblowing: What is it About?

The term whistleblowing commonly refers to the disclosure by an individual of a wrongdoing committed within an entity, and with which the individual has become acquainted while carrying out their duties.

Four years after the directive came into force, and after having been subject to an infringement procedure by the European authorities, on March 2023 Italy implemented the directive through the approval of the Legislative Decree no. 24/2023 (the Whistleblowing Decree).

The purpose of the Whistleblowing Decree is to protect people who report violations of regulatory provisions that could affect the interest or the integrity of the public administration or of a company.

Contents of the Whistleblowing Decree

The main content of the Whistleblowing Decree can be summarized as follows:

• Broadening the range of companies affected;
• Establishing a whistleblowing channel;
• Identification of reporting individuals;
• Extending protection for whistleblowers;
• New sanctions for those who do not comply with the provisions.

Private companies should take particular note of the following provisions, which have significant implications.

Affected Companies: Who is Subject to the New Rules? What About Timeline?

Section 2 (1), letter q) of the Whistleblowing Decree provides that the new regulation will apply to companies that:

• Have employed more than 50 employees during the previous year;
• Have adopted the organizational and management model required by Legislative Decree no.231/2001, even if they employed less than 50 employees during the previous year; or
• Operate in markets expressly mentioned by the law (financial services, products and markets; transport safety; environmental protection; prevention of money laundering and terrorism), even if they have employed less than 50 employees during the previous year.

Companies employing at least 250 employees are required to comply with the Whistleblowing Decree by 15 July 2023.

Companies employing less than 250 employees may benefit from an extension of the compliance until 17 December 2023.

The Notification Channel: What Are Companies Required to Do?

Sections 4 – 9 of the Whistleblowing Decree regulate the processing of reports. Companies will be required to establish their own whistleblowing channel to protect the identity of the individual whistleblower and to safeguard their confidentiality. For example, such a channel may be established by means of a digital procedure accessible to all stakeholders, through which the whistleblower can send their report without being required to access the company premises.

Management of the whistleblowing channel may be assigned to an internal body within the company (duly trained for this purpose) or to an external one. Companies with less than 250 employees are allowed to share their internal whistleblowing channel with other companies.

Furthermore, there must be a trade union consultation prior to the establishment of such a channel; the relevant negotiation must involve the company’s works council or the most representative trade unions at a national level.

According to Section 3 of the Whistleblowing Decree, the whistleblowing channel must guarantee the confidentiality of the whistleblower as well as of a broad group of people surrounding them. The reference in the provision is to the so-called “facilitators” (see letter c) below for more details). The guarantee of confidentiality does not just concern the identity of the people involved, but also extends to the content of the report, the relevant documents and the people mentioned in the report.

Definition of the Individuals Covered by the Provisions of the Whistleblowing Decree

Section 3 identifies the categories of individuals to whom the protections of the Whistleblowing Decree apply. Namely:

1. Employees, self-employees, consultants, independent contractors, volunteers, trainees;
2. Company shareholders;
3. Individuals covering administrative, managerial, supervisory or representative roles;
4. So-called “facilitators”, i.e. individuals assisting a whistleblower in the notification process and working in the same context;
5. Relatives of the whistleblower as well as individuals linked to the latter by a stable emotional bond; and
6. Colleagues of the whistleblower having a regular and continuous relationship with the whistleblower.

Section 5 of the Whistleblowing Decree provides that information on the functioning of the whistleblowing channel must be made available to stakeholders both physically in the workplace and through posting on a specific section of the company’s website.

Protection for Whistleblowers: Conduct to Be Avoided

Sections 17 and following list measures to protect whistleblowers, which mainly result in any “retaliatory” acts arising from the whistleblowing being null and void. In this respect, the Whistleblowing Decree provides that retaliatory conduct by the employer is presumed and that, as a result, the burden of proof lies with the employer. This means that, in the event that the individual reporting wrongdoing claims to have suffered retaliation from the employer as a result of the whistleblowing, the burden of proof that such conduct or acts are based on reasons other than the whistleblowing lies with the employer.

Section 17, paragraph 4 provides a list of allegedly retaliatory conduct, ranging from dismissal to suspension of training, from unfavorable treatment to early termination of contracts for the supply of goods and services (in case, for example, suppliers are the target of the retaliatory conduct), and many others.

Sanctions Provided in Case of Non-Compliance

Section 21 of the Whistleblowing Decree provides for sanctions applicable to companies failing to adopt the necessary measures to handle whistleblowing in a timely fashion. In particular:

• A fine ranging between €5,000 and €30,000 where retaliatory activities are ascertained, the obligation of confidentiality is infringed and where the company has hindered, or attempted to hinder, the fulfillment of a whistleblowing procedure; or
• A fine ranging between €10,000 and €50,000 where the company failed to establish the whistleblowing channel, or such channel does not comply with the provisions of the Whistleblowing Decree, or where the company failed to follow up on a notification of wrongdoing

The body with authority to issue sanctions and which has investigative powers is the Italian National Anti-Corruption Authority (ANAC), which can also act as the recipient of notifications if the channel provided for in the Whistleblowing Decree has not been established within the company.

*****

Our Labor, Employment, and Workplace Safety team is available to assist with any advice necessary to allow companies to comply with the Whistleblowing Decree correctly and on time, including consultation with trade unions/works council, drafting and reviewing company policies, as well as setting up and operating whistleblowing channels.