Whistleblowing was introduced in Italy with specific legislation in late 2017, with Law No.179. This legislation comprehensively regulated the institution for the public administration, while also introducing some provisions for private sector organizations with a management and control organizational model under Legislative Decree No. 231/2001.
Law No. 179/2017 has been superseded by Legislative Decree No. 24/2023, which transposes Directive (EU) 2019/1937 of the European Parliament and of the Council of October 23, 2019, on the protection of persons who report breaches of Union law and laying down provisions regarding the protection of persons who report breaches of national laws.
The new regulations impose burdens on public and private organizations, specifically: all public entities must provide internal procedures for handling reports; the same obligation is incumbent on private sector entities that have an organizational model under Legislative Decree No. 231/2001 and all private organizations with at least 50 employees.
Whistleblowing procedures encourage reporting by anyone who acquires, in the context of work activity, information about wrongdoing by or on behalf of the organization.
The purpose of the procedure is to facilitate the reporting of information related to violations encountered during work activities. For this purpose, the spectrum of potential reporting persons is very broad. The procedure is intended to secure these individuals when they report misconduct related to the Company.
The following categories of individuals can make a report through the procedure:
The procedure also protects the identity of facilitators, the individuals who assist
a reporting person in the reporting process, operating within the same work context.
Within this procedure, unlawful facts of which you have become aware in the context of your work activity may be reported. Qualified suspicions of crimes or other violations of legal provisions or potential risks of their commission may also be reported.
The reporting person is not required to fully prove the commission of wrongdoing, but reports should be as circumstantial as possible in order to allow for an investigation of the facts reported by the receiving parties. At the same time, reporting persons are not asked to engage in investigative activities that may expose them individually.
Reports may concern criminal, civil, administrative or accounting offenses, as well as violations of community regulations.
Reports of a personal nature, for example, pertaining to one's employment contract, which are governed by other procedures of the Company, do not fall within the scope of this procedure.
The whistleblowing manager, identified as Dr. Monica Berna, with Office in Treviso, Via Indipendenza n. 5, tel. 0422-544367, receives the reports and dialogues with the reporting person to clarify and elaborate on what has been received. The dialogue with the reporting person also continues during the investigation phases.
The manager or office, after an initial assessment, conducts an activity to ascertain the reported information, including requesting specific information from other offices and functions within the organization.
The receiver provides periodic feedback to the reporting person and, upon completion of the assessment activities, communicates the outcome of the assessment activities. The communication of the outcome shall not include references to any personal data related to the reporting person, if any.
Possible outcomes that can be communicated to the reporting person include: o correction of internal processes .
A report that is mistakenly sent to the hierarchical superior may not be treated as a whistleblowing report, as the latter does not have the same confidentiality obligations incumbent on the receiving party.
The Company makes available to reporting persons different channels for reporting violations under this procedure. In particular, reports can be made orally and in written form.
Regarding written reports, the Company provides an encrypted computer platform, provided by NTS Project S.p.A., at the following link https://ourwhistleblowing.it/hfarm-education-srl
A questionnaire is uploaded on the platform that guides the reporting person through open and closed questions, some of which are mandatory. It is also possible to attach documents to the report. Upon completion of the report, the reporting person receives a unique code, with which he or she can access the report and engage in a two-way dialogue with the receiving party, exchange messages and send new information. All information contained on the platform is encrypted and can be read only by individuals authorized to receive the report.
Other reports received in written form cannot be handled. If these are sent, the receiving party, where possible, will invite the reporting person to resubmit the report through the IT platform.
For reports in oral form, we invite the reporting person to contact the receiving party, requesting availability for a telephone interview or possibly a personal meeting. Reports in oral form are verbalized, and the minutes must be signed by the reporting person in order for them to be processed. It should be noted that oral reports do not offer the same technological confidentiality as reports made through an encrypted platform.
At the end of the reporting path, the platform displays a receipt code confirming that the report has been delivered and taken over by the receiving party.
Within 7 days, the receiving party will confirm to the reporting person that the report has been taken over and invite the reporting person to monitor his or her report on the platform to respond to possible requests for clarification or further investigation.
Within 3 months from the day of the report, the receiving party shall provide the reporting person with feedback with respect to the fact-finding activities carried out to verify the information disclosed in the report.
The feedback provided within 3 months may coincide with the outcome of the assessment activities. If these are not concluded, the receiver invites the reporting person to keep the platform monitored until the final outcome is known.
The receiving party is required to treat reports while preserving their confidentiality. Information regarding the identity of the reporting person, the reported person, and any other person mentioned in the report shall be treated in accordance with the principles of confidentiality. Likewise, all information contained in the report is also treated confidentially.
The identity of the reporting person may not be disclosed without his or her consent. Knowledge of the reports and related investigative acts are also removed from the right to administrative access by the individuals concerned.
The only reason for possible disclosure of the identity of the reporting person may occur in the event that the investigative documents are forwarded to an ordinary public prosecutor's office or accountant's office and knowledge of the same is necessary for the purpose of the right of defense during judicial proceedings.
Confidentiality is ensured through technological tools, such as an encrypted platform for reporting and a confidential protocol, and within organizational processes designed to minimize the circulation of information.
Sending anonymous reports is also possible. The receiving party can decide whether or not to process them. In any case, reports are processed according to the same principles of confidentiality. However, in the case of anonymous reports, the receiving party has no knowledge of the identity of the reporting person and may unintentionally expose him or her during the investigation activities.
Reports received, investigative activities, and communications between the reporting person and the receiving person are documented and retained in accordance with confidentiality and data protection requirements.
Reports contain personal data and may be processed and retained only as long as necessary for their processing: this time includes analysis, ascertainment activities, and communication of outcomes, as well as any additional timeframe for possible additional comments. In no case will reports be retained beyond 5 years after the outcome of the assessment activities is communicated to the reporting person.
Regarding access to personal data, these are known only to the receiving party and, if indicated in specific organizational act, to the staff members supporting the handling of the report.
In the course of the assessment activities, the receiving party may share with other functions of the Company information that has been previously anonymized and minimized with respect to the specific activities for which they are responsible.
The person referred to in the report as being responsible for the suspected wrongdoing shall benefit from identity protection measures similar to those of the reporting person and other persons mentioned in the report.
In addition to the protection of the confidentiality of the identity of the reporting person and those mentioned in the report, as well as the content of the report, there are other forms of protection guaranteed through this procedure.
Indeed, protection is guaranteed to the reporting person against any form of retaliation or discrimination that he or she may suffer as a result of and because of a report. Retaliation is defined as any threatened or actual action or omission, direct or indirect, related to or resulting from reports of actual or suspected wrongdoing, which causes or is likely to cause physical harm, psychological harm, damage to the person's reputation, or economic loss.
Possible discriminations include:
Legislative Decree No. 24/2023 provides for administrative sanctions, which can be imposed by the National Anti-Corruption Authority in case of violation of whistleblowing regulations.
Penalties specifically address any retaliation against reporters, breaches of the duty of confidentiality, boycotting an attempt to report, failure to
taking charge of a report or insufficient investigative activity initiated as a result of the report. Abuses of the reporting system are also punishable, with possible sanctions for the person who slanders or defames another person by means of the procedure. The Company may take disciplinary action against individuals responsible for such conduct.
Outside of the internal reporting procedure, the law also allows for external reporting to the National Anti-Corruption Authority.
The reporting person may report externally to the Company if he or she has already made a report that has not been acted upon, if he or she has reasonable grounds to believe that an internal report will not be acted upon or that the report may result in a risk of retaliation, or if he or she has reasonable grounds to believe that the violation may pose an imminent or obvious danger to the public interest.
The procedures for reporting to the National Anticorruption Authority are available at the dedicated page on the ANAC website: anticorruption.it/-/whistleblowing.
There are additional conditions under which a reporting person may make a public disclosure: failure to respond to a previously made internal or external report, imminent or obvious danger to the public interest, well-founded reasons that an internal report will not be dealt with, or that evidence of the report may be destroyed or concealed.