On 7 October 2019, the European Council adopted the Directive on the “Protection of individuals who report breaches of EU law“ (known as whistleblowers), i.e. those within the territory of the European Union who report misconduct of which they have become aware in the workplace.

Member States of the Union have two years from the forthcoming date of publication of the Directive in the Official Journal of the European Union, in order to transpose the EU regulations into national law.

The measure aims to harmonise, within the European Union, the regulations on whistleblowing, giving all countries the opportunity to model their national legislation on the basis of best international standards and practices.

In this context, Italian Law 179/2017 will be affected by numerous changes.

Comparison between Italian legislation and the EU Directive

The first aspect intended to be amended concerns the scope. Whilst the Italian law applies only to companies that have adopted management and control models (so called “Organisational Model 231”), the Directive concerns all private companies with more than 50 employees or an annual turnover exceeding €10 million (irrespective, therefore, of the application of Model 231). Small- and medium-sized enterprises are therefore exempted, with the exception of those operating in high-risk sectors (e.g. financial risk or money laundering risk). As regards the public sector, the EU directive leaves it up to the Member States to exempt municipalities with less than ten thousand inhabitants and public bodies with less than fifty employees.

The directive also broadens the scope of protected subjects, including, not only employees, but also self-employed workers, freelancers, consultants, contractors, suppliers, volunteers, trainees, etc. Protection is also extended to informants’ family members and colleagues.

Public authorities and companies receiving a report are required to follow up within three months, otherwise the reporter shall be entitled to publish the information (e.g. via the internet or social media).

In addition, as regards the Italian legislation that refers to “information channels”, the directive provides for the appointment of a company contact person (department or person) responsible for receiving the report to be verified within three months.

The European Directive also covers the sectors subject to reporting. Whilst in Italian legislation the areas covered by the reports concern the offences referred to in Legislative Decree no. 231/2001 (i.e.., “alleged offences”), the European directive, on the other hand, includes additional sectors, such as public procurement, financial services, privacy and data protection, etc.

Lastly, as regards anonymous reports, whilst in Italy, in the public sector, the identification of the reporter is foreseen and, in the private sector, anonymous reports are permitted, the Directive allows for anonymity, leaving it up to the Member States to decide whether public bodies and authorities are obliged to accept these types of alerts.