REPORTING (LEGISLATIVE DECREE 24/2023)
F.LLI SACLÀ S.p.A. has always been particularly attentive to the prevention of risks that could compromise the responsible and sustainable management of its functions.
F.LLI SACLÀ S.p.A., in accordance with the provisions of Legislative Decree of 10 March 2023, no. 24, which transposes into Italian law Directive (EU) 2019/1937 of the European Parliament and of the Council of 23 October 2019 on the protection of persons who report breaches of Union law, and in line with international best practices, has adopted a whistleblowing procedure for the management of reports.
At the same time, we have implemented this online portal to guarantee the confidentiality of the reporting party’s identity in the management of reports, entrusting the service to Lumina Fiduciaria S.p.A., a fiduciary company operating under authorisation obtained from the Ministry of Economic Development (MISE) as established by Law 1966/39.
WHO CAN SUBMIT A WHISTLEBLOWING REPORT?
The decree defines a “reporting person” as the natural person who submits a report or makes a public disclosure of information concerning violations acquired in the context of their working environment.
The “reporting persons” protected by the decree are:
- employees of public administrations, independent administrative authorities, public economic entities, private law entities subject to public control, in-house companies, bodies governed by public law or public service concessionaires;
- subordinate workers in private sector entities, including workers whose employment relationship is governed by Legislative Decree of 15 June 2015, no. 81, or by Article 54-bis of Decree-Law of 24 April 2017, no. 50, converted with amendments by Law of 21 June 2017, no. 96;
- self-employed workers, including those referred to in Chapter I of Law of 22 May 2017, no. 81, as well as holders of a collaboration relationship pursuant to Article 409 of the Code of Civil Procedure and Article 2 of Legislative Decree no. 81 of 2015, who carry out their work for public or private sector entities;
- workers or collaborators who carry out their work for public or private sector entities that supply goods or services or carry out works on behalf of third parties;
- freelance professionals and consultants who provide their services to public or private sector entities;
- volunteers and trainees, whether paid or unpaid, who provide their services to public or private sector entities;
- shareholders and persons with administrative, management, control, supervisory or representative functions, even where such functions are exercised merely in fact, within public or private sector entities.
The protections provided for the reporting person also apply to:
- so-called facilitators (those who assist the worker in the reporting process);
- persons within the same working environment as the reporting person or the person who has filed a report with the judicial or accounting authority, or who has made a public disclosure, and who are linked to them by a stable affective or family relationship up to the fourth degree of kinship;
- colleagues of the reporting person or of the person who has filed a report with the judicial or accounting authority or made a public disclosure, who work in the same working environment and who have a habitual and ongoing relationship with such person;
- entities owned by the reporting person or by the person who has filed a report with the judicial or accounting authority or made a public disclosure, or for which such persons work, as well as entities operating in the same working environment as the aforementioned persons.
WHAT PROTECTIONS ARE GUARANTEED TO THE REPORTING PERSON?
Reporting persons may not be subjected to any form of retaliation. The decree identifies certain circumstances which, where they fall within the definition of retaliation, and establishes measures and conditions for the protection of reporting persons.
Protection also applies:
- where the legal relationship has not yet commenced (selection and pre-contractual phases);
- during the probationary period;
- following the termination of the relationship (where the information was acquired during the course of the relationship).
WHAT CAN BE REPORTED?
The decree defines a “report” as a written or oral communication of information concerning “violations”, defined as conduct, acts or omissions that harm the public interest or the integrity of a public administration or private entity, and which consist of: 1) Administrative, accounting, civil or criminal offences; 2) unlawful conduct relevant pursuant to Legislative Decree 231/2001, or violations of organisational and management models; 3) offences falling within the scope of application of European Union or national acts listed in the annex to the decree, or of national acts implementing the European Union acts listed in the annex to Directive 2019/1937, even if not listed in the annex to the decree, with regard to the following sectors: public procurement; financial services, products and markets; prevention of money laundering and terrorist financing; food and feed safety and animal health and welfare; product safety and compliance; transport safety; public health; protection of privacy and personal data; environmental protection; radiation protection and nuclear safety; consumer protection; network and information systems security; 4) acts or omissions that harm the financial interests of the European Union (Article 325 TFEU); 5) acts and omissions concerning (Article 26, paragraph 2 TFEU) the free movement of goods, persons, services and capital in the internal market, including violations of European Union rules on competition, state aid and corporate taxation; 6) acts or conduct that undermine the object and purpose of the EU provisions referred to in points 3, 4 and 5.
The decree defines “retaliation” as any conduct, act or omission, even if merely attempted or threatened, carried out by reason of the report, the complaint filed with the judicial or accounting authority, or the public disclosure, and which causes or may cause, directly or indirectly, an unjust detriment to the reporting person or to the person who filed the complaint.
Privacy
All personal data will be processed in accordance with the applicable Privacy Regulations (meaning EU Regulation 2016/679 of the European Parliament and of the Council of 27 April 2016 on the protection of natural persons with regard to the processing of personal data and on the free movement of such data (GDPR), Legislative Decree no. 196/2003, Legislative Decree no. 101/2018 and any other personal data protection regulations applicable in Italy, including the measures issued by the Data Protection Authority), in full compliance with fundamental rights and freedoms, with particular regard to the confidentiality of the identity of the parties involved and the security of the processing.
For further information, download the Lumina Fiduciaria Privacy PDF
HOW TO SUBMIT A REPORT
Reports may be submitted using the dedicated web channel available at www.WB24.it, which allows both written and verbal reports. Following an initial registration, the portal enables users to submit their report and subsequently monitor the progress of their case.
ACCESS WWW.WB24.IT TO SUBMIT YOUR REPORT
WHAT HAPPENS IF I SUBMIT A REPORT THROUGH OTHER CHANNELS?
The whistleblowing regulations recognise the right to protection for the reporting person regardless of the means of communication used, expressly prioritising the digital channel. The Company has established a digital reporting channel in order to guarantee the anonymity of the reporting person. Reports submitted to parties other than Lumina Fiduciaria, or made through other channels (e.g. email, certified email, ordinary mail, telephone), are by their nature not suitable for guaranteeing the anonymity of the reporting person. All parties involved will nonetheless handle the report with the utmost care and in accordance with applicable regulations. Reports submitted to parties who are not designated and therefore not trained to handle whistleblowing reports may compromise anonymity and make it impossible for the Company to guarantee the rights of the reporting person.
HOW IS THE ANONYMITY OF THE REPORTING PERSON GUARANTEED?
The reporting process is managed in complete outsourcing by Lumina Fiduciaria S.p.A., a fiduciary company operating under authorisation obtained from the Ministry of Economic Development (MISE) as established by Law 1966/39.
Lumina Fiduciaria collects reports through the dedicated portal www.WB24.it, which, through encryption technology, separates the personal details of the reporting person from the report itself.
The report will therefore be processed in a completely anonymous manner in accordance with whistleblowing regulations, while the personal details of the reporting person will be retained and kept confidential by the fiduciary company, accessible only in the specific cases provided for by law.
WHAT HAPPENS AFTER THE REPORT IS SUBMITTED?
Within seven days of the date of receipt, Lumina Fiduciaria issues an acknowledgement of receipt. The report, in anonymous form, is immediately transmitted to the designated office of the reported company.
In this specific case, the report is transmitted to the following parties:
- Chairman of the Board of Directors
- Chief Executive Officer
- Chairman of the Board of Statutory Auditors
- Supervisory Body (ODV 231)
- Whistleblowing Report Management Committee
- depending on the organisational model of the company subject to the report
Within the mandatory deadline of 3 months from the acknowledgement of receipt, the reporting person must receive the outcome of the report. The reporting person may consult the acknowledgement of receipt, the outcome of the report and any communications from the company by accessing the site www.WB24.it anonymously.
WHAT CAN THE REPORTING PERSON DO IF THE REPORTED COMPANY FAILS TO FOLLOW UP ON THE REPORT?
Whistleblowing regulations allow the reporting person to submit an external report directly to ANAC (the National Anti-Corruption Authority) at https://www.anticorruzione.it/-/whistleblowing in the event that:
- Three months have elapsed since the report was submitted through the dedicated internal channel without the company having provided any response.
- The internal channel is not active, or if active, does not comply with the provisions established by the decree.
- The reporting person has reasonable grounds to believe, based on concrete circumstances and information that is actually obtainable, and therefore not mere conjecture, that if they were to submit an internal report:
- it would not be effectively followed up. This occurs when, for example, the ultimate responsible party in the working environment is involved in the violation, there is a risk that the violation or related evidence could be concealed or destroyed, the effectiveness of investigations conducted by the competent authorities could otherwise be compromised, or because it is considered that ANAC would be better placed to address the specific violation, particularly in matters within its own competence;
- it could give rise to a risk of retaliation (for example, as a consequence of a breach of the obligation of confidentiality of the reporting person’s identity).
- The reporting person has reasonable grounds to believe that the violation may constitute an imminent or manifest danger to the public interest. This may occur, for example, where the violation requires urgent action to safeguard the health and safety of persons or to protect the environment.
Whistleblowing regulations allow the reporting person to make a public disclosure.
Through public disclosure, information on violations is made available to the public through the press, electronic means or any other means of dissemination capable of reaching a large number of people. The legislator naturally takes into account the evolution of mass media, including social networks and new communication channels (such as Facebook, Twitter, YouTube and Instagram), which constitute a rapid and interactive tool for the transmission and dissemination of information and exchanges between networks of people and organisations.
The public disclosure of violations must take place in compliance with the conditions established by the legislator in order for the person making the disclosure to subsequently benefit from the protections recognised by the decree.
Accordingly, protection will be recognised if, at the time of disclosure, one of the following conditions is met:
- an internal report to which the administration or entity has not provided feedback regarding the measures envisaged or adopted to follow up on the report within the prescribed timeframe;
- the person has already submitted an external report directly to ANAC, which however has not provided the reporting person with feedback regarding the measures envisaged or adopted to follow up on the report within a reasonable timeframe (three months or, where justified and reasoned grounds exist, six months from the date of the acknowledgement of receipt of the external report or, in the absence of such acknowledgement, from the expiry of seven days from receipt);
- the person makes a public disclosure directly because, on the basis of reasonable and well-founded grounds in light of the circumstances of the specific case, they believe that the violation may represent an imminent or manifest danger to the public interest. This may occur, for example, in an emergency situation or where there is a risk of irreversible harm, including to the physical safety of one or more persons, requiring that the violation be revealed promptly and receive wide attention in order to prevent its effects;
- the person makes a public disclosure directly because, on the basis of reasonable and well-founded grounds in light of the circumstances of the specific case, they believe that an external report may give rise to a risk of retaliation or may not be effectively followed up, for example because they fear that evidence may be concealed or destroyed, or that the recipient of the report may be colluding with the perpetrator of the violation or otherwise involved in the violation itself. Consider, by way of example, the case in which the recipient of a report of a violation, in agreement with the person involved in the violation, proceeds to archive the report in the absence of the requisite conditions.