By 
Since the 2019 EU Whistleblowing Directive came into effect, European authorities have continued to expand legislation to further protect and encourage whistleblowers to come forward and report issues relating to fraud, corruption and misconduct within their organisations and industries.
In March 2023, the Italian Government enacted the Legislative Decree 24/2023 (Whistleblowing Decree) to strengthen the legal protection for individuals in the EU reporting regulatory violations that could impact their entity’s interests. This Decree extended the scope of the EU Whistleblowing Directive and introduced key provisions, including:
- Obligations for both public and private entities to establish whistleblowing reporting channels
- The right to report breaches of Union Law, with diligent follow-up procedures
- Additional protections for whistleblowers making public disclosures, including protections to a broad group of people surrounding the whistleblower
Additionally, the Decree broadened the compliance scope for companies. Those with at least 250 employees must comply by 15 July 2023, and those with fewer than 250 employees by 17 December 2023. As the deadline for smaller firms approaches, how can they prepare?
PREPARING FOR COMPLIANCE WITH WHISTLEBLOWING REGULATIONS
When setting up an internal reporting channel for employees and other stakeholders to voice concerns about wrongdoings or misconduct, the identity of the whistleblower needs to remain confidential to protect them from any unjust retaliation. Under the Decree’s provisions, the channel should provide a range of mediums for raising concerns, such as in writing through online platforms, orally by phone or in face-to-face meetings.
Effective management of these channels requires proper governance, ensuring staff are well-trained to understand exactly what protocols must be followed. Notably, the Decree places the burden of proof on employers in case of complaints about retaliatory acts (such as an unfair dismissal). This requires firms to have the right whistleblowing and incident reporting frameworks in place for complaints to be logged securely and anonymously.
Unfortunately, there are often inefficiencies in incident collection when businesses have a fully manual end-to-end process, from raising the concern through to its investigation.
By teaming up with a provider of comprehensive IPM solutions, firms can implement consistent whistleblowing protocols and policies, including a robust hotline and case management process to ensure that necessary action has been taken to investigate and resolve each incident.
This allows firms to move from passive to proactive employee case management, enhancing performance, and strengthening their position for future growth. As a result, they can mitigate the risk of falling short of the Decree’s measure to handle whistleblowing in an efficient and timely manner, thereby avoiding:
- A €5,000 – €30,000 fine if retaliatory activities are found, confidentiality is infringed and where whistleblowing procedure is hindered or attempted to hinder
- A €10,000 – €50,000 fine if no whistleblowing channel is established or fails to comply with the provisions of the Whistleblowing Decree; or where the company failed to follow up on a complaint
While these penalties are significant considerations, adopting the Decree’s new provisions presents an opportunity for firms to instil a culture of compliance, fostering positive behaviours and attitudes throughout the business for continued learning, growth, and overall performance.
