Italy

The implementation of Article 4(1) in Italy is complete and fully aligned with the Directive. Art. 3 Par. 3: “The provisions of this decree apply to the following persons who report, denounce to judicial or accounting authorities, or publicly disclose information about violations they became aware of in the context of their work:
(a) Employees of public administrations as defined in Article 1, Paragraph 2, of Legislative Decree No. 165 of March 30, 2001, including employees referred to in Article 3 of the same decree, as well as employees of independent administrative authorities of guarantee, supervision, or regulation;
(b) Employees of public economic entities, private entities under public control pursuant to Article 2359 of the Civil Code, in-house companies, bodies governed by public law, or public service concessionaires;
(c) Employees in the private sector, including those whose employment relationships are governed by Legislative Decree No. 81 of June 15, 2015, or Article 54-bis of Decree-Law No. 50 of April 24, 2017, as converted, with amendments, by Law No. 96 of June 21, 2017;
(d) Self-employed workers, including those defined in Chapter I of Law No. 81 of May 22, 2017, and those with a collaboration agreement as per Article 409 of the Code of Civil Procedure and Article 2 of Legislative Decree No. 81 of 2015, who perform their work activities for public or private entities;
(e) Workers or collaborators who perform their work for public or private sector entities that provide goods, services, or execute works;
(f) Freelancers and consultants who provide their services to public or private sector entities;
(g) Volunteers and paid or unpaid trainees who perform their activities for public or private sector entities;
(h) Shareholders and individuals with administrative, managerial, supervisory, or monitoring functions, even if these functions are carried out de facto, for public or private sector entities.”

Anonymous reports are allowed but not mandated. They must be processed only if they contain sufficient and reliable information to allow for adequate investigation. Art. 4, Par. 1:
“Public and private sector entities establish internal reporting channels that ensure the confidentiality of the identity of the reporting person, the person involved, and any other person mentioned in the report, as well as the content of the report and related documentation, even if the report is made anonymously.”
Art. 7, Par. 1:
“The National Anti-Corruption Authority (ANAC) activates an external reporting channel that guarantees confidentiality for the identity of the reporting person, the person involved, and any other person mentioned in the report, as well as the content of the report and related documentation, even when the report is made anonymously.”

Italian law encourages the confidentiality of internal reporting channels, explicitly requiring measures such as encryption tools when IT systems are employed. These channels must safeguard the identities of the reporting person, facilitator, individuals mentioned in the report, and the content of the report itself. Additionally, the law provides flexibility in reporting methods to accommodate whistleblowers, including written and oral options. Written reports may utilize secure digital platforms, while oral reports can be made via telephone lines, voice messaging systems, or face-to-face meetings arranged within a reasonable timeframe. Although traditional email and PEC (certified email) are not outright prohibited, the law implies they may not meet the confidentiality standards required for effective whistleblower protection. Art. 4, Par. 1: “Public and private sector entities […] establish their own internal reporting channels that ensure, even through the use of encryption tools, the confidentiality of the identity of the reporting person, the facilitator, the person involved, and any other individuals mentioned in the report, as well as the content of the report and its associated documentation.”
Art. 4, Par. 3:
“Reports may be made in written form, including through electronic means, or orally. Oral internal reports are made via telephone lines or voice messaging systems, or, upon request by the reporting person, through a face-to-face meeting arranged within a reasonable timeframe.”

Italy requires internal reporting channels for private sector entities with fewer than 50 employees in specific circumstances, such as operating in high-risk sectors or being subject to particular regulatory frameworks like Legislative Decree No. 231/2001. Art. 4, Par. 4:
“Private sector entities that, in the last year, have employed an average of no more than 249 employees under fixed-term or permanent contracts may share the internal reporting channel and its management. However, companies that are required to implement organizational models under Legislative Decree No. 231/2001 must establish such channels regardless of employee count.”
Art. 8, Par. 1: “Public and private sector entities establish internal reporting channels for the receipt and management of reports concerning violations, subject to the provisions for exempted entities with fewer than 50 workers, unless higher risk factors necessitate such channels.”

Italy does no exempt smaller municipalities from their obligations under this decree.

To enhance efficiency and specialization in handling reports, while simplifying requirements and reducing costs, the decree permits smaller entities to “share” internal reporting channels and their management. For example, agreements can be made for the joint management of whistleblowing reports. This provision does not, however, waive the obligations to ensure confidentiality, provide feedback, and appropriately manage reported violations.
The option to share reporting channels applies to:
(a) municipalities that are not provincial capitals;
(b) private sector entities that, on average, employed no more than 249 workers in the previous year, under fixed-term or permanent contracts.
According to ANAC, reducing burdens on smaller entities is justified, given that whistleblowing serves as a corruption prevention measure. Public administrations and small public entities may therefore share reporting channels and their management. For identifying such entities, it is reasonable to use the threshold of fewer than fifty employees, as established by the legislature for the simplified Integrated Activity and Organization Plan (IAPO).
In cases of shared channels, the entities involved are co-owners of personal data processing. When external parties manage reports, measures must ensure that each entity can access only the reports relevant to it, based on its responsibilities. Proper technical and organizational safeguards must be implemented to achieve this.

Art. 7, Par. 1: “The National Anti-Corruption Authority (ANAC) activates an external reporting channel that ensures, also through encryption tools, the confidentiality of the identity of the reporting person, the person involved, and any other individual mentioned in the report, as well as the content of the report and the related documentation.”

The law authorizes the National Anti-Corruption Authority (ANAC) to assess reports and determine whether a breach is clearly minor and does not require further action, other than closing the procedure. Art. 8, Par. 5: “In the event of significant inflows of external reports, ANAC may prioritize the handling of reports concerning serious violations or those affecting fundamental public interests or constitutional principles. ANAC may also decide not to proceed with reports deemed to concern minor violations and may close such cases.”

The law authorizes the National Anti-Corruption Authority (ANAC) to assess reports and determine whether a breach is repetitive and does not add new information on breaches. Art. 8, Par. 5: “In the event of significant inflows of external reports, ANAC may prioritize the handling of reports concerning serious violations or those affecting fundamental public interests or constitutional principles. ANAC may also decide not to proceed with reports deemed to concern minor violations and may close such cases.”

The law authorizes the National Anti-Corruption Authority (ANAC) to assess reports and determine to pursue more serious breaches before others. Art. 8, Par. 5: “In the event of significant inflows of external reports, ANAC may prioritize the handling of reports concerning serious violations or those affecting fundamental public interests or constitutional principles. ANAC may also decide not to proceed with reports deemed to concern minor violations and may close such cases.”

Italy provides for a system of protection that includes the protection of confidentiality (see Art. 4.1) for the reporter, the facilitator, the person involved, and the persons mentioned in the report. It also includes protection from retaliation by the entity due to the report, public disclosure, or whistleblowing activity (see § 4.2), along with the conditions for its application. Furthermore, it establishes limitations of liability regarding the disclosure and dissemination of information.
To further strengthen whistleblower protection, the legislature, for the first time, allows ANAC to enter into agreements with Third Sector entities to provide support measures for whistleblowers. These entities, included in a special list published by ANAC on its institutional website, offer assistance and advice free of charge:
– On the procedures for reporting;
– On protection from retaliation recognized by national and EU regulatory provisions;
– On the rights of the person involved;
– On the terms and conditions for accessing legal aid.
This framework represents a broad form of protection, as it aims to ensure both the whistleblower’s ability to effectively submit the report—while safeguarding their identity—and the reported person’s right to defense.

Alleged retaliation, even if only attempted or threatened, must be reported to ANAC. The protection also extends to cases of retaliation following a report submitted to the relevant institutions, bodies and organs of the European Union.
In order to prove that the whistleblower has been retaliated against, the burden of proof is on the person who carried out the alleged retaliation.
Where retaliation is established:
-nullity of the retaliatory measure
-where the retaliatory measure consists of a dismissal, nullity of the dismissal and the right to reinstatement in the workplace
-administrative penalty of 10,000 to 50,000 euros to the person who took the retaliatory measure.

Art. 21: “Without prejudice to other forms of liability, ANAC imposes the following administrative monetary sanctions on the responsible party:
(a) From €10,000 to €50,000 when it is determined that retaliation has been committed, that a report has been obstructed or an attempt has been made to obstruct it, or that the obligation of confidentiality provided for in Article 12 has been violated (Article 12 outlines the duty to maintain the confidentiality of the whistleblower’s identity and the information provided in the report);
(b) From €10,000 to €50,000 when it is determined that reporting channels have not been established, that procedures for making and managing reports have not been adopted, or that the adoption of such procedures does not comply with Articles 4 and 5 (Article 4 establishes requirements for internal reporting channels, while Article 5 details the responsibilities for managing and maintaining these channels), or when it is determined that verification and analysis of received reports have not been carried out;
(c) From €500 to €2,500 in the case referred to in Article 16, paragraph 3 (Article 16, paragraph 3 requires entities to inform whistleblowers of the progress and outcomes of their reports, within specified timelines), unless the reporting person has been convicted, even at the first instance, of the crimes of defamation or slander or for similar offenses committed through a report to judicial or accounting authorities.
Private sector entities referred to in Article 2, paragraph 1, letter q), number 3 (Article 2, paragraph 1, letter q, number 3 specifies private entities required to adopt organizational and management models under Legislative Decree No. 231 of 2001), must include in the disciplinary system adopted under Article 6, paragraph 2, letter e (Article 6, paragraph 2, letter e of Legislative Decree No. 231 of 2001 mandates the establishment of sanctions for individuals who fail to comply with organizational models), sanctions against individuals found responsible for the violations referred to in paragraph 1.”

Also under Art. 21 is provided a penalty of €500 to €2,500, unless the reporting person has been convicted even in the first instance for the crimes of libel or slander, or otherwise for the same crimes committed by reporting to the judicial or accounting authority.

Support from Third Sector: this provision is not explicitly included in the EU Directive; while the Directive encourages support for whistleblowers (Article 20), it does not mandate the establishment of partnerships with Third Sector entities to provide free assistance and advice. Italy’s approach in empowering ANAC to collaborate with Third Sector entities represents an additional national measure. Comprehensive retaliation protections: the Directive outlines protections against retaliation (Article 19) but does not detail specific forms of retaliation like blacklisting or harassment. Italy’s decree provides an expanded list of retaliatory actions explicitly prohibited, which goes beyond the Directive’s general provisions.