What is Whistleblowing?

With Legislative Decree 24/2023, Italy transposed Directive (EU) 2019/1937, introducing—for the first time—a requirement for enhanced protection for individuals who report violations of national or European law.

Legislative Decree 24/2023 (the Whistleblowing Decree) was created as a tool to combat and prevent corruption and maladministration in both the public and private sectors, while simultaneously ensuring full respect for constitutional rights regarding freedom of expression, information, and media pluralism.

Which entities are required to comply with the Whistleblowing Decree?

The whistleblowing obligations set out in Legislative Decree 24/2023 apply to the following categories of entities:

  • Public administration bodies and their subsidiaries
  • Companies that have employed an average of at least 50 workers over the past year
  • Companies that have adopted an “Organizational Model 231”
  • Entities subject to legal obligations regarding financial markets, anti-money laundering, environmental protection, and transport safety (e.g., professionals, banking and financial intermediaries, etc.)

What can be reported

Behaviours, acts, or omissions that harm the public interest or the integrity of the public administration or private entity, consisting of:

  • administrative, accounting, civil, or criminal offenses;
  • illicit conduct relevant under Legislative Decree 231/2001, or violations of the organizational and management models provided therein;
  • physical or verbal aggression and/or harassment occurring in physical or virtual spaces (the Internet);
  • offenses falling within the scope of European Union or national acts regarding the following sectors: public procurement; financial services, products, and markets, and the prevention of money laundering and terrorist financing; product safety and compliance; transport safety; environmental protection; radiation protection and nuclear safety; food and feed safety and animal health and welfare; public health; consumer protection; protection of privacy and personal data, and security of network and information systems;
  • acts or omissions harming the financial interests of the Union;
  • acts or omissions concerning the internal market;
  • acts or behaviours that defeat the object or purpose of the provisions set out in Union acts.

What to include in the whistleblowing report

Preliminary note

At the time of reporting, the reporting person must have reasonable and well-founded grounds to believe that the information regarding the reported violations is true and falls within the scope of the regulations.

Content of the report

To ensure a proper understanding of the reported facts and/or behaviours, it is advisable to provide as much detail as possible, indicating—if known—the time and place where the event occurred, a description of the event, and the personal details or other information enabling the identification of the person to whom the reported facts are attributed. It is also useful to attach documents that substantiate the reported facts, as well as to identify individuals who can help provide the most complete picture possible of the matter being reported.

Protection of the whistleblower

Anonymity and privacy protection

The whistleblower’s identity may not be disclosed to persons other than those authorized to receive or follow up on reports.

Protection extends not only to the whistleblower’s name but also to any elements of the report from which the whistleblower’s identity could be inferred, even indirectly.

Furthermore, the report is exempt from administrative access requests and the right of generalized civic access.

Confidentiality protection extends to the identities of persons involved in and mentioned in the report until the conclusion of proceedings initiated as a result of the report, subject to the same safeguards afforded to the whistleblower.

The processing of personal data related to the receipt and management of reports is carried out by public and private sector entities, as well as by ANAC (acting as data controllers), in compliance with European and national principles regarding personal data protection; this involves providing appropriate information to whistleblowers and persons involved in reports, as well as adopting measures to safeguard the rights and freedoms of the data subjects.

Internal and external reports and related documentation are retained for the time necessary to process the report and, in any event, for no longer than five years from the date the final outcome of the reporting procedure is communicated, in compliance with confidentiality obligations under European and national personal data protection laws.

Retaliation

The regulations protect the whistleblower against conduct, acts, or omissions—including mere threats thereof—carried out by the reported party specifically as a result of the report. Such retaliatory conduct, which may cause unfair harm to the whistleblower (either directly or indirectly), is prohibited and subject to sanctions under the regulations.

Protection against retaliation also extends to:

  • facilitators—that is, natural persons who assist the whistleblower during the reporting process and operate within the same work context; individuals within the same work environment as the whistleblower who are linked to them by a stable personal relationship or a family relationship up to the fourth degree;
  • work colleagues of the whistleblower who work in the same environment and maintain a regular, ongoing professional relationship with them;
  • entities owned by the whistleblower or for which they work, as well as entities operating within the same work environment as the aforementioned individuals.

Reports concerning GM International S.r.l.

To submit reports, the following MISCONDUCT REPORTING FORM may be used.

Reports will be collected by a law firm designated as the Officer for the Prevention of Corruption and Transparency, staffed by personnel specifically trained to manage the reporting channel. This ensures the confidentiality of the identities of the whistleblower, the person involved, and any other person mentioned in the report, as well as the confidentiality of the report’s content and related documentation, in compliance with applicable regulations.

Each report will be assigned a unique code, communicated exclusively to the whistleblower, enabling them to communicate with the law firm regarding any clarifications or updates on the status of the report.

Regulatory references

D.lgs. 24-2023 https://www.gazzettaufficiale.it/eli/id/2023/03/15/23G00032/sg

ANAC Website https://www.anticorruzione.it/-/whistleblowing#p0