Italy

What stage has the legislature reached in implementing the Whistleblowing Directive? If not already implemented, when is it expected or planned that the required legislation will be passed?

Law No. 127 of August 4th, 2022, was published In the Official Journal (Gazzetta Ufficiale): 'Delegation to the Government for the transposition of European directives and the implementation of other normative acts of the European Union - European Delegation Law 2021'.

The law entered into force on September 10th, 2022.

Among the directives for the transposition of which the Government has been delegated to implement is - according to Article 13 - also Directive (EU) 2019/1937, concerning the protection of persons who report breaches of Union law (so-called Whistleblowing Directive).

Status

Legislation passed / Directive implemented.

Private employers with fewer than 250 employees are required to establish the internal reporting channel as of 17 December 2023. 

Reporting topics covered (in addition to those covered by the Directive)

In addition to the topics covered by the Directive, Legislative Decree 24/2023 has included:

- administrative, financial, civil and criminal offences that do not fall within the provisions of the Whistleblowing Directive;
- infringements related to provisions of Legislative Decree no. 231/2001 or to organisational and management models therein provided, which do not fall within the provisions of the Whistleblowing Directive.

Categories of person who may report (in addition to those specified in the Directive)

Categories of person who may report according to Legislative Decree 24/2022 are the same provided in the Directive.

Are there any stipulations as to who may investigate a report?

Yes.

In case of implementation of an internal reporting channel, the latter is entrusted to a person or an autonomous internal office or to an autonomous external entity, composed of specifically trained personnel who are responsible for the process of the reports received.

For the purpose of the establish of the internal reporting channel, it is mandatory to proceed with the consultation of the trade unions or work council.

Are entities with fewer than 50 workers exempt?

According to the provisions of Legislative Decree 24/2023, the regulation applies to employers of the private sector who have employed, in the past year, an average of at least 50 employees with permanent or fixed-term employment agreements.

Regardless the size of the workforce, the provisions apply to all private employers who fall within the application of Legislative Decree 231/2001 and adopted organizational and management models herein provided.

If an exempt organisation implements a whistleblowing scheme will the Directive / implementing law apply?

Yes.

Are there any specific timescales that apply (e.g. for acknowledgements and responses) (Yes/No)?

Yes:

i) within seven days from the receipt of the report, the Whistleblower shall receive by the competent internal body the acknowledgement of receipt of the report;
ii) within three months from the above term, the designated person or department shall follow-up the report and provide a feedback to the Whistleblower.

Can reports be made anonymously?

Yes.

The protection measures provided for by the Legislative Decree 24/2023 applies also to report addressed to judicial or accounting authorities or to public disclosures, even if done anonymously.

Are private sector entities required to accept and follow up on anonymous reports?

No.

Remedies for retaliation

All retaliatory measures adopted against the whistleblower are null and void and the latter is entitled to compensation for damages.

In case of dismissal, the reporting person is entitled to the reinstatement in the workplace and to a compensation for damages, for the period from the date of the dismissal to the date of the reinstatement in the workplace, in any case not less than 5 months salary.

Are group-wide reporting channels permitted?

Legislative Decree 24/2023 provides that private entities that have employed, in the past year, an average of no more than 249 employees with permanent or fixed-term agreement, may share the internal reporting channel and the relevant management.