Decree Law 24/2023: the new regulations on whistleblowing came into force on 15 July

 

The Legislative Decree no. 24 of 10 March 2023 laying down " Implementation of Directive (EU) 2019/1937 of the European Parliament and of the Council, of 23 October 2019, concerning the protection of persons who report violations of Union law and containing provisions concerning the protection of persons who report violations of national regulatory provisions ”, which entered into force last July 15, in transposing and implementing EU Directive n. 1937/2019 (so-called " Whistleblowing Directive"), repealed and amended the previous legislation by regulating, through a single provision, valid for both the public and private sectors, the entire system of protections concerning the subjects who denounce unlawful conduct of which they have become aware in a working context, public or private, which harms the public interest or the integrity of the public administration or private entity and which occurred in violation of European and national provisions.

 

1.) Entry into force and scope of application of the new regulation

Pursuant to art. 24, the new provisions take effect from 15 July 2023 as regards specifically public bodies and a part of subjects belonging to the private sector. On the contrary "private sector subjects who have employed, in the last year, an average of subordinate workers, with permanent or fixed-term employment contracts, up to two hundred and forty-nine”, will be obliged to set up the internal reporting channel starting from 17 December 2023. Furthermore, the legislation in question also contemplates a transitional regime, according to which reports made prior to its entry into force and those made up to 14 July 2023 continue to be subject to the previous legislation.

On the other hand, as regards to the scope of application, the legislative decree extends this scope by including all the entities belonging to the public sector in the category of recipients of the obligations envisaged by the new regulation, i.e. : all public administrations referred to in art. 1, paragraph 2, of the decree 30 March 2001, n. 165; the independent administrative Authorities of guarantee, supervision or regulation, the economic public bodies but also the public law bodies referred to in article 3, letter d), of the decree of 18 April 2016, n. 50 and public service concessionaires, publicly controlled companies and in- house companies. In this context, the protection applies to those who make internal or external reports, public disclosures or complaints to the judicial or accounting authorities in relation to each of the violations envisaged in art. 2, c. 1, letter a) of the decree, therefore: administrative, accounting, civil or criminal offences, unlawful conduct which falls within the scope of application of European or national acts indicated in the annex or national acts adopted in implementation of EU acts in the sectors indicated but also acts and omissions which harm the financial interests of the Union, the internal market or frustrate its purposes.

With reference to the private sector, on the other hand, the new regulation makes a differentiation, identifying as recipients of the new regulation:

• companies that have employed on average at least fifty subordinate workers with permanent or fixed-term contracts in the last year. Here the protection applies to those who make internal or external reports, public disclosures or complaints to the judicial or accounting authority of information on violations of offenses concerning violations of European standards or domestic law in the sectors indicated
• companies operating in sectors regulated at European level, even if in the last year they have not reached the minimum average threshold of fifty subordinate workers. In this case, the legislation provides that the protection applies to those who make internal or external reports, public disclosures or complaints to the judicial or accounting authorities of information on violations of offenses concerning violations of European standards or domestic law in the sectors indicated;
• companies that adopt organization, management and control models pursuant to decree 231/2001 even if in the last year they have not reached the average of at least fifty subordinate workers. In this case, the protection applies to those who make internal reports of violations relating to relevant illicit conduct pursuant to the same decree. In the event that these companies exceed the limit of fifty employees, the protection also applies to those who make internal or external reports or public disclosures or complaints to the judicial or accounting authorities, including information on violations of European standards or internal law in the sectors indicated.

As for the objective scope of application, as previously highlighted, the new decree reduces to a single text the discipline relating to the protection of persons who report events or conduct harmful to national or EU legislative provisions, which in fact harm the public interest or the integrity of the public administration or private entity, of which they have become aware in a public or private working context. The second paragraph of the art. 1 of the decree in question, moreover, explicitly establishes the exclusion from the scope of application of the new regulation, of disputes or claims of a personal nature arising from ordinary individual employment relationships or public employment and reports of violations in matters of national security or contracts relating to matters attributable to the defense or national security sectors, unless the aforementioned violations concern provisions of a European nature. In summary, therefore, the object of the report may concern both actual or potential violations of European legislation in certain sectors and violations of national and regulatory legislation. By violation, in addition to the conduct concretely implemented, we must also understand the acts and omissions in relation to which the person who reports has well-founded suspicions that they could evolve into real violations, suspicions which in any case must be supported by concrete indications . Furthermore, the new regulations contemplate the introduction of a general safeguard clause in favor of the provisions of criminal procedure and of those on the trade union prerogatives of workers and on the repression of anti-union conduct, pursuant to article 28 of the Rule of 20 May 1970, no. 300.

With reference to the subjective application of the new regulation, art. 3 of Decree 24/2023 identifies as subjects involved in the protection for the reporting of offences, as invested by the risk of facing potential retaliatory acts, all those who, without distinguishing between the public and private sectors, provide work services to favor of third parties for any reason, regardless of the nature of such activities, even in the absence of consideration: the subjects drawn up by the aforementioned article is, in fact, the widest possible. Furthermore, the same protection is also extended to shareholders and to persons in charge of carrying out administrative, management, control, supervisory or representative functions, even where these roles are exercised by mere deed. Furthermore, the protection against these subjects (understood as protection of confidentiality, protection against retaliation and provisions of causes of exclusion of liability) must be ensured even when the employment relationship has not yet begun and, that is, during the probationary period or after the termination of the relationship, provided that the information was acquired during the relationship itself or during the selection process. Lastly, the extension of the operational scope of the aforesaid protection comes to include the so-called "facilitators", i.e. those who assist the person who reports the violation in the complaint process, to the people linked to them by a stable emotional bond or relatives and work colleagues who operate within the same working context of the whistleblower but also to entities owned by him or in which he works.

 

2.) The reporting process

The discipline provided by the decree provides for three different reporting channels, the use of which is to be intended, upon the occurrence of certain conditions, on a progressive and subsidiary basis:

- internal reporting, a method to be activated " after consulting the trade union organizations ", must be activated after careful preparation of precautionary measures such as to guarantee not only the protection of the personal identity of the reporting subject, but also the identity of those who are involved or mentioned in the violation report. The same provision is adopted with reference to the content of the report and the pertinent documentation.

The internal report will be managed by virtue of its assignment to an independent internal subject (person or office), prepared for this and who, moreover, can demonstrate specific skills in this area or, alternatively, in the event that there is no possibility of resorts to a subject like the one just mentioned, to an external subject, also having the characteristics of autonomy and competence. Instead, it remains entrusted to the Head of the prevention of corruption and transparency, referred to in article 1, c. 7, of the Rule of 6 November 2012, n. 190, for subjects already obliged to appoint him. The reports can take written form, also by electronic means, or in oral form through but also, at the request of the reporting subject , through a direct meeting set within a reasonable time.

The procedural path following the report complies with the following deadlines: within seven days of submission, the person in charge must issue an acknowledgment of receipt to the whistleblower and, where necessary, request additions; within three months, a response must be provided to the whistleblower; within seven days the report received by an incompetent subject must be forwarded to the correct recipient.

The methods, conditions and procedures to make reports have to be clear, visible and easily accessible to all possible recipients, even to those who do not frequent the workplace. Furthermore, if possible, all the information has to be published in a dedicated section on the organisation's website in order to ensure that all interested parties know it;

 

- external reporting is governed by articles 6-7, legislative decree 24/2023. This type of report represents a novelty in the regulatory landscape concerning the issue of whistleblowing, since it leaves the right to resort to such a report upon the occurrence of one of the following hypotheses to the independent assessment of the reporting party:

1. if in the specific working context the activation of the internal reporting channel is not mandatory or the channel is not active or has not been designed in compliance with the regulatory requirements;
2. if the whistleblower has already made an internal report, but it has not been followed up or ended with a negative final measure;
3. if the whistleblower has reasonable grounds to believe that, if he made an internal report, it would not be followed up effectively (for example in the event that the ultimate manager of his working context is involved in the violation) or that the same report could determine the risk of retaliation;
4. if the whistleblower has reasonable grounds to believe that the reported violation may constitute an imminent or obvious danger to the public interest.

The subject who has the duty to activate the IT platform that will allow the correct functioning of this reporting process by the whistleblower is the Anac , which will have to offer the same guarantees of confidentiality already indicated for the internal reporting channel. The Authority will be subject to the same obligations applicable to internal reports; moreover, in the event that the Anac should receive a report falling within the competence of another authority, even of a Union nature , it is obliged to forward it to the latter, giving notice to the reporting party.

The new legislation, however, provides for some peculiarities:

1. the Anac, for justified and motivated reasons, can extend by three months the term for replying to the interested party (art.8, c. 1, letter f) of Decree 24/2023);
2. In the event of a significant influx of external reports, the Anac can treat as a priority the reports concerning information on violations concerning a serious harm to the public interest or the harm to principles of constitutional or European Union law (article 8, paragraph 4, of Decree 24/2023);
3. Anac may not follow up on reports of minor violations and proceed with their archiving (art.8, c. 5 of Decree 24/2023).

It appears extremely clear that the competences of the Anac have known a considerable extension in this matter, thanks to the introduction of the examined decree: in fact, it finds itself playing the role of subject competent to receive both the reports of discrimination from whistleblowing, which is direct reporting by every possible public and private whistleblower;

- public disclosures are a reporting method, apparently of a residual nature, governed by art. 15 of the decree, the use of which is left to the total discretion of the whistleblower. In this case, the whistleblower will benefit from the precautions provided for by legislative decree 24/2023, only if:

1. has previously made an internal or external report without having received a reply within the established deadlines;
2. has reasonable grounds to believe that the infringement may constitute an imminent or manifest danger to the public interest;
3. has reasonable grounds to believe that the external report may involve the risk of retaliation or may not be followed up effectively due to the specific circumstances of the concrete case, such as those in which evidence may be hidden or destroyed or in which there is a well-founded fear that the person received the report may be colluded with the author of the violation or involved in the violation itself.

 

3.) The protective measures and the protection of privacy

Chapter III of the legislative decree 24/2023 provides for a series of remedies and safeguards aimed at protecting the reporting subject both from potential direct repercussions and from the possibility that he may be involved in indirect retaliation.

The foregoing remedies shall apply, at the time of reporting, the whistleblower has reasonable grounds to believe that the information on the violations, reported in compliance with the related reporting procedure, are true and fall within the objective scope; while the reasons on the basis of which the report was made are considered irrelevant. The ratio underlying the rule is to encourage the worker to report any unlawful behavior of which he is aware, mitigating or eliminating the fear of suffering negative consequences. The reversal of the burden of proof is also envisaged : retaliation is presumed to have taken place and any damage suffered is a consequence of the report and the burden of demonstrating that conduct and acts had been motivated by reasons unrelated to reporting or disclosure or denunciation. Article 18 of the decree regulates the support measures in favor of the reporting person and legitimizes the judicial or administrative authority to which the reporting person has turned to obtain protection from retaliation, to request information and documents relating to the report from the Anac, while the competence to receive reports of possible retaliation, to start the preliminary investigation, to report the cases within its competence to the responsible bodies and to apply the relative sanctions remains with the Anac .

 

Other protective measures include:

• the nullity of any waivers and transactions relating to rights and protections provided for by the decree;
• a general exemption in favor of the subject who reports information covered by secrecy, by authorial prerogatives or protected by data protection regulations, provided that at the time of disclosure there were well-founded reasons for deeming it necessary to reveal the violation;
• any other responsibility for the acquisition or access to information on the violations is excluded, except in the hypothesis in which the conduct constitutes a crime. Exempt, however, excluded for conduct not strictly necessary to reveal the violation or, in any case, not connected to the report, denunciation or public disclosure.

 

Furthermore, the new regulation expresses as its cornerstone the protection of the regulations on the protection of personal data and highlights the need to fully respect the principle of minimization of the data processed. In this way, a reinvigorated regulatory system is outlined also with reference to the issues of protecting the identity of the reporting subject and confidentiality as a tool to encourage the subject who becomes aware of offenses to activate the consequent report.

 

4.) The disciplinary framework

The legislative decree in question also regulates the administrative sanctions of a pecuniary type applicable in the event that a concrete verification of the reported violations is reached. The sanctions mentioned must have precise characteristics in order to be adequately imposed, in fact they must be effective, proportionate and dissuasive.

 

Without prejudice to other liability profiles, the Anac applies sanctions:

• from € 10,000 to € 50,000 when it ascertains that: retaliations have been committed; the report was obstructed or an attempt was made to obstruct it or the obligation of confidentiality was violated; reporting channels have not been established or procedures have not been adopted for making and managing reports or their adoption or implementation does not comply with the law; it is not that the verification and analysis of the reports received was not carried out;
• from € 500 to € 2,500 when it ascertains that the obligation of confidentiality regarding the identity of the reporting party has been violated.

 

Finally, in order to ensure absolute equality between the public sector and the private sector in pursuing the aims of the new discipline, there is an obligation for SMEs that apply the organizational models envisaged by decree 231/2001 to expressly provide, as part of their disciplinary system, for sanctions against those who are found to be responsible for the aforementioned illegal activities.