Maximum confidentiality when reporting misconduct
Whistleblowing is the practice of reporting an unlawful act or irregularity committed within a company by an individual, known as the reporting person or whistleblower, who has witnessed it in the performance of their duties. In Italy, Law No. 179/2017 requires public administrations and private companies that have already adopted a Model 231 to establish a secure digital reporting channel in order to ensure maximum confidentiality for the reporting person.
Legislative Decree No. 24/2023 strengthened the existing rules, broadening the scope of the provisions requiring companies to adopt systems for reporting unlawful conduct. Private-sector employers with at least 50 employees and certain public-sector employers are subject to the new legislation, which has been in force since 17 December 2023. Companies must manage reports through software using encryption systems capable of ensuring the confidentiality of the identity of the reporting person, the person involved and the content of the report itself.
Furthermore, the processing of personal data and documentation relating to reports must be managed in compliance with the requirements of the GDPR. With regard to the employment relationship, the law amends Article 54-bis of the Consolidated Law on Public Employment, providing that an employee who makes a report may not be subjected to demotion or sanctions in relation to the facts covered by the report itself.