A new italian law creates more protection for whistleblowers in SMEs

This new law, which draws some inspiration from Common Law systems, is of particular note for the requirements and obligations on the side of company directors - especially in terms of their administrative liability. Here we are also speaking of the workplace Model 231 (Legislative Decree no. 231/2001) which seeks to protect the position of those who, upon learning of illegal conduct during the exercise of their work, are able to report what they have witnessed to the company anonymously and with the protection of the competent authorities from any adverse repercussions.

An earlier regulation (Law 179/2017) had intended to introduce a specific protection for businesses operating in the private sector - as there already was legal protection for whistleblowers in the public sector. However, only a limited number of companies adopted that governance procedure – even though it should have been ‘baked into the cake' when implementing their workplace compliance Model 231. Hence, there was a need in the private sector – beyond the Model 231 - to ensure one, or more, specific channels for the reporting of offenses directly connected with a violation within a corporate organisation or relating to the management of the business.

In fact, Model 231 governance procedures require companies operating in the private sector to pre-establish a valid management system aimed at making the protection of any whistleblower concrete.  By “concrete” we intend that whistleblowers would not be subject to any adverse impacts due to flagging potentially dodgy situations.  Adverse impacts could include, but not limited to, being subject to disciplinary actions, transfers, changes in duties or dismissals.  This last instance is of note as a dismissal of this nature could be considered null and void by a court – as the action was aimed, even unknowingly, towards a whistleblower and hence could be interpreted as retaliatory or discriminatory in nature.

The new Legislative Decree no. 24/2023, as a result of major EU Legislation, has created stronger protection regulations and at the same time makes Italian laws on this front more compliant with EU law.  Here we see a new regulation that goes beyond the scope of the requirements of Model 231 in terms of the administrative liability of legal persons (read: company directors) and at the same time creates a stronger mechanism of protection to shield whistleblowers from any adverse retaliatory actions.

Alongside the companies that today are obliged to be in line with Model 231, the new law must be applied to:

a) all companies which in the past 12 months have had 50 or more employees;

b) any company, regardless of size, operating in the services, products, financial markets, or in the area of the prevention of money laundering or financing terrorism.

These companies must implement a protection system for whistleblowers.

This novelty is not of little importance, because alongside of the subjective requirements - it also introduces a large amount of objective criteria for information on breaches which can be much wider than the criminal violation provided for by Model 231 governance framework.  Under the existing Legislative Decree n. 231/2001 these behaviours can already be recognised as a criminal violation.  However, the new legislation may be referred to additional and broader situations that may occur  in the private and public sector.

In more detail, on the basis of the national law provisions, the conduct which may be involved in the information of breaches reported by the whistleblower regards administrative, accounting, civil or criminal offences - apart from those already considered as violations under European Union law. 

This is in addition to being aware of all relevant unlawful conduct already described in Legislative Decree. 8 June 2001, n. 231 - apart from those already considered by the new Decree n. 24/2023.

On the other side, on the basis of EU regulations - the conduct which may be involved in the information of breaches reported by a whistleblower also includes offenses falling within the scope of the entire European Union in addition to offences falling into national law provisions that comes from the UE provision - even if not indicated in Annex 1 of the Legislative Decree. n. 24/2023.

These violations may be referred to specific sectors indicated in the decree. This particular list is remarkably broad as it includes not only the area of public procurement (which is usually particularly sensitive to specific violations) but also transportation safety; environmental protection; animal feed, food, safety, health and welfare; public health; consumer protection; the protection of privacy, the protection of personal data and the security of networks and information systems as well as financial services, products and markets and the prevention of money laundering and terrorist financing; as well as acts that harm the financial interests of the European Union (as per Art. 325 TFEU).

There are also significant innovations regarding the management of the employment relationship which employers in Italy must consider as the new Decree No. 24/2023 introduces more complex and incisive provisions compared to earlier regulations (such as the regulation that was introduced in 2017). For example, the revision of the definition of discriminatory dismissal – now includes dismissals not only determined to be caused by political beliefs or religious faith, membership of a trade union, participation in trade union activities, the exercising of a right but also the right to communicate breaches and of course the right for a whistleblower to report to judicial or accounting authorities.

Then there is also the introduction of additional methods for the courts to evaluate acts of direct and indirect discrimination – which also includes a list of acts to be presumed null and void, which could lead to the managers of the employment relationship getting into trouble. In fact, acts of retaliation towards a whistleblower (according to Article. 17, paragraph 4 of Italian Legislative Decree no. 24/2023) now includes:

a) dismissal, suspension or equivalent measures;

b) demotion or failure to promote;

c) change of functions, change of work place, reduction of salary, modification of working hours; d) the suspension of training or any restriction of access to training programs;

e) negative merit notes or negative references;

f) the adoption of disciplinary measures or other sanctions, including pecuniary ones;

g) coercion, intimidation, harassment or ostracism;

h) discrimination or otherwise unfavourable treatment;

i) failure to convert a fixed-term employment contract into a permanent employment contract, where the worker had a legitimate expectation of such a conversion;

l) failure to renew - or early termination of - a fixed-term employment contract;

m) damage, including to the person's reputation, in particular on social media, or economic or financial prejudice, including the loss of economic opportunities and loss of income;

n) improper listing on the basis of a formal or informal sector specific or industry agreement, which may result in the person being unable to find future employment in the sector or industry  where they are currently occupied;

o) the early termination or cancellation of the contract for the supply of goods or services; p) the cancellation of a license or permit;

q) the request to undergo psychiatric or medical tests.

In summary, this new regulation has introduced stronger protections in Italy from repercussions resulting from flagging up crimes and forms of corruption in the workplace - in line with the latest European whistleblower legislation.  Most importantly, employees of SMEs in Italy will now also have the same whistleblowing laws applied to them that offers protection for workers in larger companies and government offices.

For employers in Italy, the whistleblower regulations will require organizations of all sizes to adopt more structured policies - both from a technical point of view as well as in terms of the correct processing of whistleblower data… and the potential perpetrators of offenses they have reported.

It is recommended that HR departments also ensure that their current corporate governance policies in Italy reflect the new rules – made in essence to protect the business activity in more ways than one.