The platform can be specifically used to report:

• breaches falling within the scope of the Union acts set out in the following areas:
  • public procurement;
  • financial services, products and markets, and prevention of money laundering and terrorist financing;
  • product safety and compliance;
  • transport safety;
  • environmental protection;
  • radiation protection and nuclear safety;
  • food and feed safety, and animal health and welfare;
  • public health;
  • consumer protection;
  • protection of privacy and personal data, and security of network and information systems
• offenses provided by the Legislative Decree 231/2001 and violations of the 231 Organizational Model.
• acts or omissions that harm the financial interests of the European Union, as indicated in the Whistleblowing Directive and Decree; 
• acts or omissions concerning the internal market, including violations of European Union rules on competition and state aid, acts or omissions concerning the internal market, including violations of European Union rules on competition and state aid, as well as violations concerning the internal market related to acts that violate corporate tax rules or mechanisms aimed at obtaining a tax advantage that defeats the object or purpose of the applicable corporate tax law, as indicated in the Whistleblowing Directive and Decree; 
• acts or behaviors that defeat the object or purpose of the provisions of the Union acts in the sectors indicated in the previous points.

The platform CANNOT be used to report: 

• disputes, claims, or requests related to a personal interest of the reporting person that pertain exclusively to their individual work relationships or their work relationships with hierarchical superiors;
• reports of violations where already mandatorily regulated by European Union or national acts indicated in part II of the annex;
• reports of violations in the field of national security, as well as procurement related to aspects of defense or national security.

The current regulation protects the following subjects:

• employees of private sector entities;
• self-employed workers;
• freelancers and consultants;
• suppliers and customers;
• volunteers and interns, paid and unpaid;
• shareholders and persons with administration, management, control, supervision, or representation functions, even if these functions are exercised de facto.

The protections are guaranteed to the aforementioned subjects even when the legal relationship has not yet begun, if the information on the violations was acquired during the selection or other pre-contractual phases, during the probationary period, or after the termination of the relationship (if the information on the violations was acquired during the relationship itself).

In addition to the whistleblower, the following are protected:

• the facilitator: a natural person, operating within the same work context, who assists a whistleblower in the reporting process;
• persons in the same work context as the whistleblower who are related to them by a stable emotional or kinship bond, up to the fourth degree;
• colleagues of the whistleblower who work in the same work context and have a habitual and ongoing relationship with the whistleblower;
• entities owned by the whistleblower or for which the same persons work, as well as entities operating in the same work context as the aforementioned persons.

The protection measures provided by Legislative Decree 24/2023 and Directive (EU) 2019/1937 apply when the following conditions are met: 

• at the time of the report, the whistleblower had reasonable grounds to believe that the information on the reported violations was true and fell within the objective scope of application of Legislative Decree No. 24/2023 or Directive (EU) 2019/1937;
• the report or public disclosure was made based on what is provided by Legislative Decree 24/2023 or by Directive (EU) 2019/1937.

In these cases, there is an absolute prohibition of retaliation against the whistleblower.

“Retaliation” means any behavior, act, or omission, even if only attempted or threatened, carried out because of the report or public disclosure and which causes or may cause the whistleblower, directly or indirectly, unjust harm.

By way of example and not exhaustively, “retaliation” may include:

• dismissal, suspension, or equivalent measures;
• demotion or lack of promotion;
• change of duties, change of workplace, reduction of salary, change of working hours;
• suspension of training or any restriction of access to it;
• demerit notes or negative references;
• adoption of disciplinary measures or other sanctions, including financial penalties;
• coercion, intimidation, harassment, or ostracism;
• discrimination or otherwise unfavorable treatment;
• failure to convert a fixed-term employment contract into a permanent employment contract, where the worker had a legitimate expectation of such conversion;
• non-renewal or early termination of a fixed-term employment contract;
• damage, including to the person’s reputation, particularly on social media, or economic or financial harm, including loss of economic opportunities and loss of income;
• early termination or cancellation of a supply of goods or services contract;
• cancellation of a license or permit;
• request for psychiatric or medical examinations.

The protections provided by Whistleblowing regulation do not apply when the above conditions are not met (absence of reasonable grounds to believe that the information on the reported violations was true and fell within the objective scope of application of Legislative Decree 24/2023 and that the report was made based on what is provided by the Decree) or when the whistleblower’s criminal liability for defamation or slander offenses is established, even with a first-degree sentence, or their civil liability, for the same title, in cases of willful misconduct or gross negligence.
In these cases, the protection measures are not guaranteed, and the whistleblower is subject to disciplinary sanctions.
In case of inapplicability of the protections, the prohibition of retaliation against the whistleblower ceases.

The internal reporting channel allows anonymous reports, which will be treated by the channel owner in the same way as other reports.
The protection measures and safeguards provided by the Decree apply in the case of an anonymous report if the whistleblower is subsequently identified and has suffered retaliation.
It will be possible to send an anonymous report by checking the relevant option in the questionnaire and omitting the entry of one’s identifying data.

The identity of the whistleblower and any other information from which their identity can be directly or indirectly inferred cannot be disclosed without the express consent of the whistleblower to persons other than those competent to receive or follow up on the reports.
Such communication is regulated according to the provisions of the Decree.

The Decree provides for the establishment of an external channel, managed by ANAC (National Anti-Corruption Authority) to send reports compliant with the Decree directly to ANAC.

Notwithstanding that reports must be submitted primarily and preferably through the internal channel, the whistleblower can use the external channel when one or more of the following conditions exist:

• the mandatory internal channel:
  1. is not active;
  2. is active but not compliant with the provisions of the Decree regarding the subjects and methods of submitting reports;
• the whistleblower has already made an internal report, but it has not been followed up;
• the whistleblower has reasonable grounds to believe that if they made an internal report:
  1. it would not be effectively followed up;
  2. it could pose a risk of retaliation;
• the whistleblower has reasonable grounds to believe that the violation may constitute an imminent or obvious danger to the public interest.

Link to the ANAC external channel:

https://whistleblowing.anticorruzione.it/#/

1. The internal reporting channel must be used according to the provisions and requirements of the current regulation and the company’s Whistleblowing Procedure;
2. The whistleblower undertakes to provide all relevant information to substantiate and evaluate the report, supplementing if needed what has already been communicated at the request of the persons responsible for managing the reports. During the investigation phase, the whistleblower undertakes to collaborate with the managers of the reports to facilitate the verification of the violation;
3. The whistleblower must keep the report key code, consisting of 16 digits and issued upon completion of the reporting procedure, which constitutes the only secure access method to the report after submission, as it cannot be recovered in any way by the platform managers and the owner of the internal reporting channel. In case of loss, it may be necessary to repeat the report. The key code will be issued in written form at the end of the report made through the questionnaire or in vocal form for the oral report made through the IVR system. In case of a direct meeting, the whistleblower must still keep the issued key code, as it is a tool to access their report in the future through the platform;
4. The whistleblower can access the report using their key code to check the status of the report management and to interact and communicate with the manager of the reports through the dedicated channels, in order to provide all the useful information to substantiate the reported violation;
5. The whistleblower must refrain from communicating information that could lead to their identification, except for entering their identifying data in the appropriate section of the questionnaire (in case of a non-anonymous report);
6. In case of an anonymous report, the manager of the reports may ask the whistleblower to provide their identifying data if they consider them essential to substantiate and evaluate the report. The whistleblower can supplement this information by accessing their report using the key code.