InsightsPublications

We hereby inform you that the Council of Ministers during the meeting of the December 9^th, 2022, has declared its approvement, in the preliminary examination, of the Legislative Decree concerning the transposition of Directive (EU) 2019/1937 ("Directive"), concerning the protection of persons who report breaches of the European Union law causing or threatening to cause prejudice to the public interest and the financial interests of the European Union.

SCOPE OF APPLICATION 

The scope of application of the common minimum standards for the protection of persons who report breaches of EU law harming the public interest now includes:

•      the breaches falling within specific sectors (e.g. public procurement, financial services, environment and public health);
•      the breaches affecting the financial interests of the Union;
•      the breaches affecting the internal market;
•      the norms regarding of competition and state aid.

DEFINITION OF WHISTLEBLOWER

Art. 4 of the Directive broadens the definition of whistleblower that now also include self-employed workers, shareholders, members of management and supervisory bodies, external collaborators, trainees, volunteers, persons working under the supervision and direction of contractors, sub-contractors and suppliers, as well as the so-called facilitators (i.e., those who assist the whistleblower in the whistleblowing process), colleagues and relatives of the whistleblower.

OBLIGATION TO ESTABLISH REPORTING CHANNELS

The Directive outlines the obligation to set up internal reporting channels, irrespective of the adoption of an organizational, management and control model according to Legislative Decree no. 231 of 2001, for all private entities with at least 50 employees. This threshold does not apply to entities falling within the scope of the European Union acts and in particular those concerning financial services, products and markets, transport safety and environmental protection.

This obligation also applies to all public-sector entities with at least 50 employees.

The above-mentioned entities are required to have procedures for internal reporting that guarantee the following elements:

•      the implementation of secure reporting channels, definable by each obliged legal entity, such as to ensure the confidentiality of the reporter and the protection of any third parties named in the report;
•      an acknowledgement of receipt of the report to the reporting person within 7 days;
•      the appointment of a competent and diligent impartial person or department to follow up on the report, within 3 months from the date of the acknowledgement of receipt of the report;
•      the provision of clear and easily accessible information on the procedures for making reports.

It should be noted that the Legislative Decree implementing the Directive has not yet been promulgated and published in the Gazzetta Ufficiale and may introduce additional and more stringent obligations to the EU provisions.