Whistleblowing: new obligations

By Legislative Decree no. 24 of March 10, 2023, Directive (EU) 2019/1937 on the protection of persons who report breaches of EU rights of which they become aware in a public or private employment context (so-called whistleblowing directive) was implemented in our law.
The term whistleblowing identifies the whistleblowing activity of the employee (or as we shall see, also of third parties) of illegal facts discovered in the course of the performance of his or her work.

The report may concern, whether in the public or private sphere, actions or omissions, committed or attempted, inherent in:
– criminally relevant incidents;
– violations of the code of ethics;
– Violations of company regulations;
– Violations of disciplinary codes;
– Violations of regulations for the protection of occupational health and safety under Leg. 9.4.2008 n. 81;
– Violations of the Workers’ Statute (L. 20.5.70 No. 300);
– Violations of the regulations on the prevention of the use of the financial system for the purpose of money laundering and the financing of terrorism set forth in Leg. 21.11.2007 n. 231;
– Violations of regulations placed to protect the environment;
– violations likely to cause pecuniary harm to the administration or company to which it belongs;
– violations that may cause harm to users, employees or others who carry out their activities at the relevant administration or company;
– episodes of passive corruption (to the detriment of the administration or company and in the interest of the individual or third party) and/or episodes of active corruption (to the benefit of the administration or company).

With reference to the private sector, the decree stipulates that the regulations apply:
– To companies that adopt the 231/2001 organizational model;
– to companies that in any case employed an average of more than 50 employees in the previous year (even if they did not adopt the 231/2001 organizational model).
The scope of protected parties has been expanded to include not only employees but also external parties (self-employed contractors, freelancers, shareholders, directors, interns, suppliers, customers).

The decree will become effective on July 15, 2023.

In addition, for companies that employed more than 50 but fewer than 250 employees in 2022, the requirement to establish the internal whistleblowing channel will take effect Dec. 17, 2023.

There are three channels for reporting:

1. internal to the enterprise, which in any case ensures the confidentiality of the reporter’s identity;
2. external, state-activated (managed by ANAC), accessible only on a residual basis, that is, when the internal reporting channel cannot be activated;
3. public, accessed further residually through the press or the Web, only after the first two channels have failed to yield any feedback. Therefore, the new discipline requires setting up whistleblowing compliance. An action plan is needed that brings together different aspects, from the provision of adequate and technologically reliable reporting channels to internal training of employees and external training of other stakeholders on the use of the tool, but also specific training of those who receive reports and the approval of effective procedures.

Given the sensitivity of the topic, we believe it is appropriate and necessary that each Company that falls under the discipline of Leg. 24/2023 take action as soon as possible to organize adequate and protective whistleblowing compliance.