LEGISLATIVE DECREE March 10, 2023, no. 24 24
Implementation of Directive (EU) 2019/1937 of the European Parliament and of the Council of October 23, 2019 on the protection of persons who report breaches of Union law and on provisions concerning the protection of persons who report breaches of national laws.
CONTENTS:
Introduction – Legislative framework page
Art.1 Subject of the regulation
Article 5 Internal reporting management – procedure
Art. 7 Duty of Confidentiality
Art. 8 Management of personal data
Art. 9 Filing of documents related to reports
Art. 10 Protection for whistleblowers
Art. 11 Prohibition of reprisals
Art. 12 Limitations of liability
INTRODUCTION:
In fulfillment of international agreements and the recommendations of the Parliamentary Assembly of the Council of Europe, Italy has over the years regulated the handling of whistleblowing that ensures the appropriate protection of whistleblowers within the workplace.
Specifically, Law No. 190 of Nov. 6, 2012, in Article 1, Paragraph 51, introduced a system to facilitate the detection of misconduct, known in English-speaking countries as whistleblowing.
As a result, the European Union enacted the European Directive 2019/1937 on the Protection of Persons Whistleblowing Violations of Union Law to establish a minimum level of protection of whistleblowers’ rights in all member states.
Italy transposed the European Directive with Legislative Decree No. 24 dated March 10, 2023. 24.
By approving these Regulations, F.L. Medical s.r.l. Unipersonale, in compliance with the provisions of Article 2, co. 1, lett. q) of Legislative Decree 24/2023, has aligned itself with the aforementioned legislative provisions, as well as with the directives provided by ANAC over the years.
ART. 1 SUBJECT
These Regulations govern the protection of persons who, within the working environment of F.L. Medical s.r.l. Unipersonale, report violations of national or European Union regulations that harm the public interest or the integrity of F.L. Medical s.r.l. Unipersonale.
The objective of this regulation is:
– Outline the guiding principles of the institution, emphasizing the rules that F.L. Medical s.r.l. Unipersonale respects and adopts;
– Define in detail the procedures for handling reports;
– Clearly explain the methods adopted to protect the confidentiality of the reporter’s identity, the content of the report, and the identity of possible parties involved.
These regulations have the dual purpose of:
– Inform the designated personnel of F.L. Medical s.r.l. Unipersonale on current regulations and provisions, providing clear operating instructions;
– Facilitate reporting by those who become aware of a wrongdoing or irregularity in the workplace while performing their duties and decide to report it, eliminating those factors that may discourage or hinder it.
The reporting process ensures the confidentiality of the reporter’s identity from the time of receipt and in any subsequent contact.
It is hereby clarified that F.L. Medical s.r.l. Unipersonale will also evaluate anonymous complaints to eliminate any wrongdoing and/or irregularities (ART. 6). However, it should be emphasized that only whistleblowers who report unlawful conduct by declaring their identity can benefit from the protection provided by Legislative Decree No. 24 of March 10, 2023 Implementation of Directive (EU) 2019/1937 of the European Parliament and of the Council of October 23, 2019 on the protection of persons who report breaches of Union law and laying down provisions regarding the protection of persons who report breaches of national laws.
The Regulations do NOT apply, as they are outside the scope of the above regulations, to:
a. Disputes, claims, or demands related to a personal interest of the complainant or the person who filed a complaint with the judicial or accounting authority that relate exclusively to his or her individual working relationships, or related to his or her working relationships with superiors;
b. Complaints of violations already mandatorily regulated by the acts of the European Union or national acts specified in Part II of the Annex to Legislative Decree No. 24 of March 23, 2023 or national acts that constitute the implementation of the acts of the European Union specified in Part II of the Annex to Directive (EU) 2019/1937, even if not mentioned in Part II of the previously mentioned Annex;
c. Reports of violations related to national security.
The provisions regarding the right of workers to consult their representatives or trade unions, protection against unlawful conduct or acts committed as a result of such consultations, the autonomy of the social partners and their right to enter into collective agreements, and the suppression of anti-union conduct according to Article 28 of Law No. 28 of May 20, 1970, remain valid. 300.
ART. 2 DEFINITIONS
For proper understanding of the regulation and easier implementation of the regulation, the following definitions are clarified:
a. “Violations”: this term refers to conduct, active (actions) or passive (omissions) that harms the public interest or integrity of F.L. Medical s.r.l. Unipersonale These “violations” also include various offenses, relevant unlawful conduct, violations of specific European Union or national regulations, actions or omissions detrimental to the financial interests of the Union, violations concerning the internal market, and conduct that contradicts the purpose or objective of Union provisions in the specified areas;
b. “Violation Information”: information, concerning facts and circumstances, including reasonable suspicions, regarding violations committed or likely to be committed within F.L. Medical s.r.l. Unipersonale, as well as elements regarding conduct aimed at concealing such violations;
c. “Report” or “reporting”: The effective provision of information on violations found, both written and oral;
d. “Internal Reporting”: Reporting of information on violations through the internal reporting channel specified in Article 4;
e. “External reporting”: Reporting of information on violations through the external reporting channel specified in Article 13;
f. “Public disclosure” or “publicly disseminate”: dissemination of information about violations to the public through print, electronic, or other means capable of reaching a large number of people;
g. “Reporting person” (or “whistleblower”): The person who makes a report or public disclosure of information about violations obtained in the work context;
h. “Facilitator”: one who supports the reporting person during the reporting process, operating in the same work context and whose help should remain confidential;
i. “Work context”: current or past work or professional activities where an individual acquires information about violations and which could lead to retaliation if reported or publicly disclosed;
j. “Person involved”: Individual or entity mentioned in the internal or external report or public disclosure as a person associated with the violation or as a person in some way implicated in the reported or publicly disclosed violation;
k. “Retaliation” or “Reprisal”: any conduct, act or omission, even if only attempted or threatened, which results from the report, complaint to the judicial or accounting authority or public disclosure and which causes or could cause unfair harm to the reporting person or the person who made the complaint;
l. “Follow-up”: The action taken by the person in charge of the reporting channel to assess the accuracy of the reported facts, the results of the investigation and any measures taken;
m. “Reckoning”: communication to the reporting person with information regarding actions being taken or intended to be taken as a result of the report.
ART. 3 PROTECTED SUBJECTS
In the context of disclosures, notifications to judicial or accounting authorities, and public disclosures of violations identified in the normal course of business, the provisions of these Regulations apply in particular to:
a) employees of F.L. Medical s.r.l. Unipersonale;
b) Collaborators in compliance with Article 2 of Legislative Decree No. 81 of 2015 who perform their functions at the company;
c) Workers or collaborators engaged in entities that provide goods, services or carry out work on behalf of the company;
d) Independent professionals and consultants working within the company;
e) Volunteers and interns, paid or unpaid, performing their activities at F.L. Medical s.r.l. Unipersonale;
f) Shareholders and individuals with management, supervisory, control, or representative responsibilities, even if such functions are exercised de facto.
Protection for the reporter is also provided:
a) when the previously mentioned contractual relationship has not yet begun, if the breach information was obtained during the selection process or other pre-contractual stages;
b) during the probationary period;
c) after the termination of the contractual relationship if information about the breach was obtained during its course.
Except as provided in Article 17(2) and (3) of Legislative Decree 24/2023, the protective measures outlined in Chapter III also apply to:
a) facilitators;
b) persons in the same work environment as the whistleblower, the person who has notified a whistleblower to the judicial or accounting authority, or publicly disclosed, and who are related to them by a strong emotional or kinship relationship within the fourth degree;
c) colleagues of the reporter or the person who notified the judicial or accounting authority, or made a public disclosure, and who work in the same environment and with whom they maintain a regular relationship;
d) entities owned by the reporter or the person who notified the judicial or accounting authority, or publicly disclosed, or for whom these persons work, as well as entities operating in the same work environment as the persons already mentioned.
ART. 4 INTERNAL REPORTING
In compliance with current regulations, F.L. Medical s.r.l. Unipersonale has created a reporting system that ensures the protection of the identity of the reporter, the individual involved and anyone else mentioned in the report, as well as the content of the report itself and the attached documentation.
In line with Article 4, of Legislative Decree 24/2023, the management of the reporting system has been entrusted by F.L. Medical s.r.l. Unipersonale to an internal person specifically trained to manage the reporting channel and an external collaborator who supervises the activity for greater protection of the reporter. Only the Reporting Officers, appointed by F.L. Medical s.r.l. Unipersonale will be aware of the report.
For this purpose, reports can be submitted via a specific form available on the company website through an encrypted channel using Trusty AG a provider of secure and anonymous web-based internal reporting systems at
The reporting information is separated from the reporting party’s identifying information and automatically forwarded to the person in charge to promptly initiate the investigation. The person in charge receives a notification of the submission, along with the report ID (without further details).
Identifying data of the reporter are stored in encrypted form and are accessible only to the person in charge.
The appointee can access his or her restricted space and the details of the various reports received.
Alternatively,
– By regular mail (in a sealed envelope marked “DO NOT OPEN – Personal Confidential”) to the address: F.L. Medical s.r.l. Unipersonale via Enrico Mattei 20, 35038 Torreglia (PD);
– By internal mail (in a sealed envelope marked “DO NOT OPEN – Personal Confidential”);
– Regular email to the following address: info@flmedical.com;
– Pec to the following address: info@pec.flmedical.com;
If the report is sent using one of the above methods, the identity of the reporter will be known only to the Reporting Officers who will ensure its confidentiality.
It should be noted that a report for proper management of the same should include:
– The identity of the reporter;
– A clear and detailed description of the reported events;
– The circumstances of time and place in which the events occurred;
– general information or other data identifying the person(s) involved;
– Indication of possible other individuals who can provide information about the reported events;
– Reference to any documents that may support the validity of the reported events;
– Any other information that may be useful in verifying the accuracy of reported events.
The whistleblower should provide all necessary data to enable verification and investigation to confirm the validity of the reported events.
Reports can be sent in writing, including digitally, or even orally. Oral reports may be made through telephone lines, voice messaging systems, or, at the request of the reporter, through a face-to-face meeting scheduled within a reasonable time frame.
If a recorded telephone line or other recorded voice messaging system is used, the report, with the consent of the reporter, is documented by designated personnel by recording or complete transcript. In the case of a transcript, the reporter may verify, correct or confirm the contents of the transcript by signing it.
If an unrecorded telephone line or other unrecorded voice messaging system is used, the report is documented through a detailed account of the conversation written by designated personnel. The reporter may verify, correct and confirm the contents of the transcript by signing it.
If, at the request of the whistleblower, the report is made orally during a meeting with designated personnel, and with the consent of the whistleblower, it is documented by recording or minutes prepared by designated personnel. In the case of minutes, the reporter may verify, correct and confirm the contents by signing them.
ART. 5 INTERNAL MANAGEMENT
Reporting Officers begin handling the report with a preliminary investigation. If necessary, they request additional information from the reporter and/or other individuals involved, concluding the investigation according to legal regulations.
All reports received, investigation records, and related documentation are stored and catalogued in an appropriate, separate, well-maintained, and locked archive.
In the context of managing the internal reporting channel, appointees:
a. provide the reporter with notification of receipt of the report within seven days of the date of receipt;
b. maintain dialogue with the reporter and may request additional information if necessary;
c. diligently follow up on reports received;
d. provide feedback on the report within three months from the date of the notification of receipt or, in the absence of such notification, within three months after the seven-day period from the submission of the report.
In cases where the report is clearly unfounded or inadmissible by falling outside the regulated discipline, appointees based on an analysis of the reported events may decide to dismiss the request. In such a scenario, it will inform the reporter.
The handling and verification of the merits of the circumstances represented in the report are entrusted to appointees who do so in accordance with the principles of impartiality and confidentiality, carrying out any activity deemed appropriate, including the personal hearing of the reporter and any other persons who may report on the reported facts, with the adoption of the necessary precautions.
The activity of the appointees is not one of actual fact-finding, but takes the form of making an initial impartial assessment of the existence of what was reported.
In carrying out the investigative activity, the appointees may request additional information from the Whistleblower, may acquire deeds and documents from other offices of the administration, and may avail themselves of the support of other offices, always taking care that the protection of the confidentiality of the Whistleblower and the Whistleblower is not compromised.
For the definition of the preliminary investigation, the term is 30 days, starting from the date of its initiation, it being understood that, where necessary, F.L. Medical s.r.l. Unipersonale in the person of the sole director may authorize the appointees to extend the aforementioned terms providing adequate justification.
If the Report is found to be unsubstantiated, the appointees shall proceed with the filing, adequately justifying their choice to the Reporter.
If the Report is found to be well-founded, the appointees shall forward a report of investigative findings to the appropriate internal bodies or external authorities in relation to the profiles of illegality found, ensuring that such documentation does not contain references to the identity of the Reporting Party and the Reported Person, or other implicit references that could lead, without a shadow of doubt, to the Reporting Party.
It remains implicit that the same obligation of confidentiality that exists for Reporting Officers applies to the internal supervisors who are reserved the task of verifying the effectiveness of the Report.
For internal supervisory bodies, the deadline for the definition of this phase is 90 days, which starts from the date of receipt of the documentation by the person in charge, it being understood that, where necessary, the legal representative and sole director may authorize the supervisory body to extend the aforementioned deadlines by providing adequate reasons.
The Regulation is brought to the attention of employees in the most appropriate manners and to ensure adequate visibility in the workplace and accessibility to those who, although not frequenting such places, have a legal relationship with F.L. Medical s.r.l. Unipersonale the Regulations are also published in the “Whisteblowing” section of the company’s website.
Art. 6 ANONYMOUS REPORTS
Ensuring anonymity is not the same as accepting anonymous reports, since whistleblower protection applies to reports from identifiable and recognizable individuals.
Notwithstanding the above, F.L. Medical s.r.l. Unipersonale reserves the right to evaluate anonymous reports if they are adequately detailed and specific, i.e., if they report facts of extreme seriousness and contain sufficiently detailed, specific information related to well-defined contexts (e.g., mention of particular names or titles, reference to specific offices, particular procedures or events, etc.).
ART. 7 OBLIGATION OF CONFIDENTIALITY
Reports should not be used beyond what is strictly necessary for proper follow-up. The identity of the whistleblower, as well as any other information that may reveal it, whether directly or indirectly, may not be disclosed without the whistleblower’s explicit consent, except to those persons authorized to receive or handle reports.
In the context of disciplinary proceedings, the identity of the reporter may not be disclosed if the allegation is based on separate and additional verifications to the report, even if arising from the report. If the allegation is based in whole or in part on the report and knowledge of the identity of the reporter is essential to the defense of the accused, the report may be used in disciplinary proceedings only with the explicit consent of the reporter to the disclosure of his or her identity. The whistleblower will be notified in writing of the reasons for the disclosure of confidential data if it is essential to reveal the identity of the whistleblower and related information also for the defense of the person involved.
In accordance with Article 12 of Legislative Decree 24/2023, in proceedings initiated as a result of a report, the individual involved may be heard, or, at his or her request, shall be heard, including through a documentary procedure, by collecting written comments and documents.
ART. 8 PERSONAL DATA MANAGEMENT
Any processing of personal data must be conducted in accordance with Regulation (EU) 2016/679, Legislative Decree No. 196 of June 30, 2003, and Legislative Decree No. 51 of May 18, 2018.
Personal data that are not clearly useful for processing a specific report are not collected or, if collected in error, are immediately deleted.
The rights outlined in Articles 15 to 22 of Regulation (EU) 2016/679 can be exercised within the limits of the provisions of Article 2-undecies of Legislative Decree No. 196 of June 30, 2003.
F.L. Medical s.r.l. Unipersonale manages the processing of personal data related to the receipt and management of reports, in accordance with the principles outlined in Articles 5 and 25 of Regulation (EU) 2016/679 or Articles 3 and 16 of Legislative Decree No. 51 of 2018, providing adequate information to the reporters and data subjects, in accordance with Articles 13 and 14 of Regulation (EU) 2016/679 or Article 11 of the aforementioned Legislative Decree No. 51 of 2018, and taking appropriate measures to protect the rights and freedoms of the data subjects.
ART. 9 FILING OF DOCUMENTS RELATED TO REPORTS
Reports and related documents shall be kept for the period necessary for the processing of the report and, in any case, no longer than five years from the date of the communication of the final result of the reporting procedure, in compliance with the confidentiality obligations of Article 7 of this Regulation and the principle of Article 5(1)(e) of the GDPR and Article 3(1)(e) of Legislative Decree No. 51 of 2018.
ART. 10 PROTECTION FOR THE REPORTER
The safeguards outlined in Chapter III of Legislative Decree No. 24/2023 are applied to individuals specified in Article 3 when the following circumstances are present:
a. At the time of the report, denunciation or public disclosure, the person making the report or denunciation had good reason to believe that the information about the violations reported or made public was true and fell within the scope of Article 1 of these regulations;
b. The reporting or public disclosure was made in accordance with what is stipulated in Articles 7 and 11 of these regulations and, in general, by Chapter II of Legislative Decree No. 24/2023 24/2023.
The individual’s reasons for reporting, whistleblowing, or public disclosure do not affect his or her protection.
However, the reporter may be criminally and disciplinarily liable in the case of defamatory or libelous reports, as stipulated in Articles 368 and 595 of the Criminal Code and Article 2043 of the Civil Code.
Unless otherwise provided for in Article 14, if criminal liability of the whistleblower for defamation or slander, or for the same type of crime committed by reporting to the judicial or accounting authorities, or his civil liability, in cases of willful misconduct or gross negligence, is established, even by a judgment of first instance, the protections established in Chapter III of Legislative Decree No. 24/2013 are not guaranteed and the whistleblower or reporter is also imposed a disciplinary sanction.
ART. 11 PROHIBITION OF REPRISALS
The organizations and individuals listed in Article 3 shall not be subject to reprisals. In the event of judicial, administrative, or extrajudicial litigation concerning the verification of conduct, acts, or omissions prohibited by this article against the persons listed in Article 3, it shall be presumed that they were carried out as a result of the reporting, public disclosure, or complaint. Any person who engages in such conduct or acts has the obligation to prove that they are motivated by reasons unrelated to the reporting, public disclosure or complaint.
ART. 12 LIMITATIONS OF LIABILITY
The entity or person specified in Article 3 is not punishable if it discloses or disseminates information about violations covered by the obligation of confidentiality or relating to the protection of copyright or personal data protection, or if it discloses or disseminates information about violations that damage the reputation of the person involved or reported.
This applies when, at the time of the disclosure or dissemination, there were reasonable grounds to believe that the disclosure or dissemination of the same information was necessary to reveal the violation and that the reporting, public disclosure, or complaint to the judicial or accounting authority was made in accordance with Art.12 12.
Under such circumstances, any further liability, including civil or administrative liability, is excluded.
Unless a crime is involved, the entity or person referred to in Article 3 does not incur any liability, including civil or administrative liability, for acquiring or accessing information about violations.
Exemption from criminal or any other liability, including civil or administrative liability, is not applicable for actions, conduct or omissions that are not directly related to reporting, reporting to judicial or accounting authorities, or public disclosure, or that are not strictly necessary to expose the offense.
ART. 13 EXTERNAL REPORTING
An external report may be submitted if, at the time of its submission, one of the following conditions is met:
a. The internal reporting channel, as mentioned in Article 5 above, is not active;
b. The reporter has already submitted an internal report, which was not followed up;
c. The whistleblower has good reason to believe that, if he or she were to file an internal report, it would not receive adequate follow-up or could pose a risk of retaliation;
d. The reporter has good reason to believe that the violation may pose an imminent or obvious danger to the public interest.
The external reporting channel, as provided for in Article 7 of Legislative Decree 24/2023, is established at the National Anti-Corruption Authority (https://www.anticorruzione.it/-/whistleblowing).
External reports are submitted in writing through the computer platform or orally through telephone lines or voice messaging systems, or, at the request of the reporter, through a face-to-face meeting scheduled within a reasonable period.
Any external report sent to an entity other than ANAC is forwarded to ANAC, within seven days from the date of its receipt, informing the reporter of the transmission.
In managing the external reporting channel, ANAC performs the following activities:
a) Provides information on the use of internal and external reporting channels, and the protection measures provided for in Chapter III of Legislative Decree 24/2023, to anyone with an interest;
b) Acknowledge receipt of the external report to the reporter within seven days from the date of receipt, unless the reporter explicitly requests otherwise or ANAC believes that notification may compromise the confidentiality of the reporter’s identity;
c) Maintains dialogue with the reporter and, if necessary, requests additional information;
d) Follows up diligently on reports received;
e) Conducts the investigation necessary to respond to the report, including through hearings and document acquisition;
f) Provide feedback to the reporter within three months, or, if there are justified and substantiated reasons, six months from the date of notification of receipt of the external report, or, in the absence of such notification, upon the expiration of seven days from receipt;
g) Notify the reporter of the final outcome.
ANAC may decide not to follow up on reports involving minor violations and proceed to file them.
ART. 14 PUBLIC DISCLOSURE
A reporter who makes a public disclosure enjoys the protection provided by the decree if, at the time of the disclosure, one of the following conditions exists:
a. The whistleblower has previously made an internal and external report, or has directly made an external report, in accordance with the conditions and procedures set forth in Articles 4 and 7, and has not received a timely response regarding the measures planned or taken to follow up on the reports;
b. The reporter has a valid reason to believe that the violation may pose an imminent or obvious danger to the public interest;
c. The reporter has a valid reason to believe that the external report could pose a risk of retaliation or could not be effectively followed up due to the specific circumstances of the case, such as those where evidence could be concealed or destroyed or where there is a well-founded fear that the reporter may be in connivance with or involved in the violator.
The rules on professional secrecy for journalists, in relation to the source of the news, remain unchanged.
ART. 15 SUPPLEMENTARY RULES
Retaliation, hindering or attempting to obstruct a report, violation of the duty of confidentiality as stated in Article 7, failure to verify and analyze reports received, and reports manifestly made with the intent to defame and/or slander the whistleblower or other individuals are subject to disciplinary sanctions.
Any waiver or agreement, in whole or in part, concerning the rights and protections provided for in these Regulations and, in general, in Legislative Decree 24/2023, are invalid, unless they are entered into in the form and manner provided for in Article 2113, co. 4, of the Civil Code.
In accordance with the provisions of Article 18 of Legislative Decree 24/2023, a list of Third Sector entities that offer support to people who make reports is established at ANAC.
The appointees report annually, on the number of reports received and their progress, ensuring the confidentiality of the reporters.
For matters not expressly mentioned, reference is made to Legislative Decree 24/2023 24/2023.
ART. 16 ENTRY INTO FORCE
These Regulations were ratified by F.L. Medical s.r.l. Unipersonale on December 10, 2023, superseding, where present, any other previous regulations on the subject.