Article authored by Niccolò Ballerini published on N&T Plus Diritto – Il Sole 24ORE.
Following the approval and publication in the Official Gazette of Legislative Decree No. 24/2023, implementation has been given to EU Directive No. 1937/2019 (the so-called “Whistleblowing Directive”).
The new regulation shall enter into force on 15 July 2023, except for the extended deadline of 17 December 2023 for private sector entities that have employed up to 249 workers in the previous year.
Legislative Decree No. 24/2023 has repealed and amended the previous legislation, regulating through a single measure, applicable to both the public and private sectors, the protection regime for subjects who report unlawful conduct in violation of European and national provisions.
Currently, the scope of application of the regulation differs based on:
- – the subject matter of the violation;
- – the nature of the entity, whether public or private, to which the reporting person belongs;
- – the size of the private entity and the concrete applicability thereto of the discipline set forth in Legislative Decree No. 231/2001.
Legislative Decree No. 24/2023, in addition to assigning specific competencies to A.N.A.C. and regulating in greater detail certain aspects already provided for in the previous legislation, has introduced important innovations regarding reporting channels.
Protection from retaliatory treatment is guaranteed to all subjects who report violations of which they have become aware within their working context (employees or collaborators, subordinate and self-employed workers, independent professionals, volunteers and trainees, including unpaid ones, shareholders and persons with functions of administration, management, control, supervision or representation) as well as to “facilitators”: colleagues, relatives or stable partners of the person who has reported.
The scope of application of the institution is furthermore extended to private companies with more than 50 employees; should it instead be enterprises operating in sensitive sectors, such as the financial sector, the regulation shall apply regardless of the size of the company workforce.
Legislative Decree No. 24/2023 also provides for the obligation for private sector entities to formalize activities relating to Whistleblowing by integrating the system of internal controls and organizational arrangements through the activation of an efficient internal channel that enables timely and effective management of reports.
Furthermore, an external channel shall be activated at A.N.A.C. through which reports may be submitted to such Authority, provided that the appropriate internal company systems have already been activated.
In any case, pursuant to Legislative Decree No. 24/2023, recourse to A.N.A.C. may also be had in the event of inefficiency of internal systems, where there is a risk of retaliation or in the event that the violation may constitute an imminent or manifest danger to the public interest.
A.N.A.C., having consulted the Data Protection Authority, shall issue, within three months from the date of entry into force of Legislative Decree No. 24/2023, Guidelines relating to the procedures for the submission and management of external reports.
A.N.A.C. is furthermore assigned competence in sanctioning matters, both in the public and private sectors.
A register of Third Sector entities that have entered into specific agreements to support reporting persons through free consultation and assistance is furthermore established at A.N.A.C.
Particular attention has finally been devoted to confidentiality obligations, so as to resolve certain uncertainties that emerged in the application of the previous legislation and to align national regulations with EU Directive No. 1937/2019.
