Pursuant to Directive (EU) 2019/1937, Legislative Decree No. 24 of 10 March 2023 was enacted, concerning “the protection of persons who report breaches of Union law and laying down provisions for the protection of persons who report breaches of national legislation”.
The Decree applies to both public sector and private sector entities.
With specific reference to the private sector, the legislation extends its scope to entities which, in the previous year, employed an average of at least fifty employees, as well as—irrespective of this threshold—entities operating in so-called sensitive sectors (financial services, products and markets, prevention of money laundering or terrorist financing, transport safety and environmental protection), and entities which have adopted organizational and management models pursuant to Legislative Decree No. 231/2001.
What May Be Reported
Acts, conduct or omissions that harm the public interest or the integrity of a public administration or a private entity, consisting of:
-
unlawful conduct relevant under Legislative Decree No. 231/2001, or breaches of the organizational and management models provided therein;
-
offences falling within the scope of application of European Union or national acts relating to the following sectors: public procurement; financial services, products and markets and the prevention of money laundering and terrorist financing; product safety and compliance; transport safety; environmental protection; radiation protection and nuclear safety; food and feed safety and animal health and welfare; public health; consumer protection; protection of privacy and personal data and security of networks and information systems;
-
acts or omissions affecting the financial interests of the European Union;
-
acts or omissions concerning the internal market;
-
acts or conduct which undermine the object or purpose of the provisions set out in European Union acts.
At the time of submitting a report, lodging a complaint with the judicial authority or making a public disclosure, the reporting person must have reasonable grounds to believe that the information reported, disclosed or reported to the authorities is true and falls within the scope of the applicable legislation.
What May Not Be Reported
The legislation specifies matters that cannot be reported. In particular, the whistleblowing framework does not apply to complaints, claims or requests relating to a purely personal interest of the reporting person or of the person who has lodged a complaint with the judicial authority, which relate exclusively to their individual employment or public service relationship, or to their working relationship with hierarchically superior figures.
In any event, reports whose content is unrelated to the purposes of the Decree—such as unsolicited job applications, product complaints, suggestions, etc.—will not be taken into consideration.
Who May Submit a Report
-
Employees and collaborators of Galbusera;
-
Self-employed professionals and consultants providing services to Galbusera;
-
Volunteers and trainees, whether paid or unpaid, working at Galbusera;
-
Shareholders (natural persons);
-
Persons with functions of administration, management, control, supervision or representation, even where such functions are exercised de facto.
For all the above categories, protection also applies during the probationary period and before or after the establishment of the employment relationship or any other legal relationship connected with the work context.
Protection of the Reporting Person’s Identity and Confidentiality
-
The identity of the reporting person may not be disclosed to persons other than those authorised to receive or follow up on reports;
-
Protection applies not only to the name of the reporting person, but also to all elements of the report from which the identity of the reporting person may be inferred, even indirectly;
-
Confidentiality protection is also extended to the identity of the persons involved and of those mentioned in the report until the conclusion of the proceedings initiated as a result of the report, subject to the same safeguards provided for the reporting person.
Protection Against Retaliation
-
Any form of retaliation, including attempted or threatened retaliation, carried out as a result of the report and causing or likely to cause unjust harm to the reporting person, is prohibited;
-
Legislative Decree No. 24 provides a broad, non-exhaustive list of retaliatory measures (dismissal, demotion, change of duties, transfer of workplace, reduction of salary, modification of working hours, disciplinary notes or negative references, adoption of disciplinary or other sanctions, including financial sanctions, etc.).
How to Submit a Report
Reporting Channels
-
Internal (within the work context);
-
External (ANAC);
-
Public disclosure (through the press, electronic means or media capable of reaching a large number of persons);
-
Report to the judicial authority.
Choice of Reporting Channel
As a priority, reporting persons are encouraged to use the internal channel. External reporting or public disclosure may be used only where specific conditions are met.
Reporting persons may use the external channel (ANAC) where:
-
the activation of an internal reporting channel is not required within the work context, or such channel, although required, is not operational or is not compliant with legal requirements;
-
an internal report has already been submitted and has not been followed up;
-
the reporting person has reasonable grounds to believe that an internal report would not be effectively followed up or could expose them to a risk of retaliation;
-
the reporting person has reasonable grounds to believe that the breach may constitute an imminent or manifest danger to the public interest.
Reporting persons may make a public disclosure where:
-
they have previously submitted an internal and an external report, or have submitted an external report directly, and no response has been provided within the prescribed time limits regarding the measures envisaged or adopted;
-
they have reasonable grounds to believe that the breach may constitute an imminent or manifest danger to the public interest;
-
they have reasonable grounds to believe that external reporting may entail a risk of retaliation or may not be effectively followed up due to the specific circumstances of the case, such as where evidence may be concealed or destroyed, or where there is a justified concern that the recipient of the report may be colluding with the author of the breach or be involved in the breach itself.
Internal Reporting Channel
Reports are received by specifically authorized and trained personnel operating within the Human Resources Department.
To facilitate the use of this important mechanism as a tool for the prevention and detection of unlawful conduct, Galbusera provides several reporting methods.
-
Online platform: by clicking on the link https://digitalroom.bdo.it/galbusera, a simple guided procedure opens, allowing the completion, submission and receipt of reports of alleged unlawful conduct through encryption systems that ensure the confidentiality of the reporting person’s identity.
For this reason, this is the preferred reporting method.
-
Exceptional cases: where it is not possible to use the online platform, reports may be submitted to Galbusera via:
In order to benefit from confidentiality safeguards and to ensure confidential registration, the report must be placed in a sealed envelope bearing the wording “Confidential / Whistleblowing” on the outside. The report will be recorded by scanning and registering the external envelope only and promptly forwarded to the authorized personnel indicated above.
Reporting to ANAC
Protection is also afforded where the reporting person submits a report to ANAC or to the ordinary judicial authority.
Reports to ANAC may be submitted through various channels, including the dedicated online platform, which offers enhanced safeguards and is accessible at:
https://servizi.anticorruzione.it/segnalazioni/
Submit a report
Last updated: July 2023