The terms “whistleblowing” and “whistleblower” come from the English word “whistle” – literally meaning “whistle” – and define the reporting system and the person who makes the report.

Whistleblowing is a reporting management system that ensures the protection of the individual who reports violations of national or European Union laws that harm public interest, the integrity of public administration, or the private entity the person has become aware of in a public or private work context.

The current legislation is represented by the Decree of March 10, 2023, No. 24, published in the Official Gazette No. 63 on March 15, 2023, in force from March 30, 2023.

The Italian Decree has transposed the European Directive 2019/1937, concerning the protection of individuals who report violations of Union law.

The provisions of the decree take effect from July 15, 2023.

Reports or complaints made to the judicial or accounting authorities before the date of entry into force of this decree, as well as those made until July 14, 2023, will continue to be subject to the previous legal provisions.

For private sector entities that have employed, in the last year, an average of employees under permanent or fixed-term contracts up to two hundred and forty-nine, the obligation to establish an internal reporting channel under this decree will take effect from December 17, 2023, and until then, the previous regulations continue to apply.

• For the public sector, for example, public administrations, independent administrative authorities for guarantee, oversight or regulation, public economic entities, public law bodies, public service concessionaires, public-controlled companies, and in-house companies;
• For the private sector, entities that:

1. Have employed, in the past year, an average of at least fifty employees under permanent or fixed-term contracts;
2. Fall within the scope of Union acts as outlined in parts I.B and II of the annex, even if they have not reached the average of employees mentioned in point 1 in the past year;
3. Are different from those mentioned in point 2), fall within the scope of Legislative Decree No. 231 of June 8, 2001, and adopt the organization and management models provided therein, even if they have not reached the average of employees mentioned in point 1 in the past year.

The European Directive and the Italian Decree ensure the privacy and confidentiality of the whistleblower in order to protect them from retaliation, such as:

• Dismissal, suspension, or equivalent measures;
• Demotion or failure to promote;
• Change of duties, change of workplace, reduction in salary, modification of working hours;
• Adoption of disciplinary measures or other sanctions, including financial ones;
• Coercion, intimidation, harassment, or ostracism;
• Non-renewal, early termination of a fixed-term employment contract, or failure to convert a fixed-term contract into a permanent one, when the employee had a legitimate expectation for such conversion;
• Damages, including harm to the individual’s reputation, particularly on social media, including the loss of economic opportunities and loss of income;
• Request for psychiatric or medical evaluations.
  Of course, it is required that personal data is processed in compliance with the GDPR.

The Decree lists the individuals (physical persons) who can be granted the protection measures provided, and the list is extensive.

For example, it includes:

• Employees of public administrations, employees of public economic entities, entities of private law subject to public control, in-house companies, public law bodies, or public service concessionaires;
• Employees of private sector entities;
• Self-employed workers, freelancers, and consultants working with public or private sector entities;
• Volunteers and interns, both paid and unpaid, working with public or private sector entities;
• Shareholders and individuals with administrative, management, control, oversight, or representative functions;
• Facilitators;
• Individuals from the same work environment as the whistleblower who have a stable emotional or familial relationship with them within the fourth degree;
• Colleagues working in the same work environment as the whistleblower who have a regular and ongoing relationship with that person.
  Also, when:
• The legal relationship has not yet started, if information on violations was acquired during the selection process or other pre-contractual stages;
• During the probationary period;
• After the termination of the legal relationship, if information on violations was acquired during the course of the relationship itself.

The Decree lists among the “violations” subject to protection:

• “Relevant unlawful conduct under Legislative Decree No. 231 of June 8, 2001, or violations of the organizational and management models provided therein, which do not fall under numbers 3), 4), 5), and 6)”;
• Illicit activities related to the following sectors: public procurement; financial services, products, and markets, and prevention of money laundering and terrorism financing; product safety and compliance; transport safety; environmental protection; radiological protection and nuclear safety; food and feed safety and animal health and welfare; public health; consumer protection; protection of privacy and personal data security; and security of networks and information systems.

  Other legal provisions require the use of a Whistleblowing reporting channel. Examples include:

• UNI/PdR 125 for Gender Equality
• The Public Procurement Code
• Some international standards on corporate social responsibility (SA8000)

The Decree defines the necessary steps for the proper management of the reporting channel, establishing that the person or internal office responsible should carry out the following activities:

a) Provide the whistleblower with an acknowledgment of receipt of the report within seven days from the date of receipt;

b) Maintain communication with the whistleblower and request additional information if necessary;

c) Diligently follow up on the reports received;

d) Provide feedback on the report within three months from the date of the acknowledgment of receipt, or, in the absence of such acknowledgment, within three months from the expiration of the seven-day period from the submission of the report;

e) Provide clear information about the channel, the procedures, and the requirements for making internal reports. This information should be displayed and made easily visible in workplaces, as well as accessible to individuals who do not frequent the workplace but have a legal relationship with the organization. If the organization has its own website, the information should also be published in a dedicated section of the website.

• From 10,000 to 50,000 euros when it is found that retaliation has occurred, or when it is found that the report was hindered or attempts were made to hinder it, or when the confidentiality obligation has been violated.
• From 10,000 to 50,000 euros when it is found that reporting channels have not been established, procedures for making and managing reports have not been adopted, or when the adoption of such procedures is non-compliant, as well as when it is found that verification and analysis of the reports received has not been conducted.
• From 500 to 2,500 euros if the whistleblower has been convicted, even in the first instance, for crimes of defamation or slander, or for the same crimes committed through the report to the judicial or accounting authority; if private sector entities include sanctions in the 231 disciplinary system adopted, against those found responsible for the offenses mentioned in paragraph 1.