Guidelines on Whistleblowing
For the protection of persons reporting breaches of Union law
Last update: September 2024
1. Scope of the Whistleblowing regulation
“Whistleblowing” is the act of reporting illicit or improper behavior within an entity – public or private – with the aim of protecting the public or private interest. The protection of people who report violations is regulated by Legislative Decree 10 March 2023, no. 24, which is the implementation of EU Directive 2019/1937. The provisions contained in the Decree, for companies that have fewer than 250 workers, take effect from 17 December 2023.
2. Who can report
“Whistleblowers” may include employees, even with atypical contracts (part-time or fixed term), self-employed workers and coordinated and continuous collaborators, shareholders, members of the administrative and supervisory bodies, interns, volunteers, owned by the reporter or who operate in the same work context as the reporter. The Decree provides that the protection measures apply not only to whistleblowers, but also to facilitators (i.e., those who assist a reporting person in the reporting process), colleagues and family members who have working relationships in the same work context as the reporting person.
3. Subject of the report: inclusion and exclusion criteria
The subject of the report is information on violations, including well-founded suspicions, of national and European Union regulations that harm the public interest or the integrity of the public administration or private entity. This also includes violations that have not yet been committed, but which are reasonably believed to be committed on the basis of concrete elements, such as irregularities and anomalies that the reporting party believes could cause a violation.
The main violations that may concern national law are: Civil, administrative, criminal, accounting offenses, unlawful conduct relevant pursuant to Legislative Decree 231/2001[1].
The main violations of EU law concern: environmental crimes such as dumping, emission or other release of hazardous materials into air, land or water or the unlawful collection, transport, recovery or disposal of hazardous waste, acts or omissions which harm the financial interests of the European Union, fraud, corruption or other illegal activities related to Union expenditure, acts or omissions concerning the internal market, which undermine the free movement of goods, people, services and capital, acts or behavior that defeats the object or purpose of the provisions of the European Union, abusive practices that lead to unfair competition.
Disputes, claims, or requests linked to a personal interest of the reporting person, which relate exclusively to their individual working relationships or inherent to their working relationships with hierarchically superior figures, are therefore excluded from the subject of the report. For example, reports regarding labor disputes and pre-dispute phases, discrimination between colleagues, interpersonal conflicts between the reporting person and another worker or with hierarchical superiors, reports relating to data processing carried out in the context of the individual employment relationship in absence of harm to the public interest or private entity[2]. Furthermore, Decree 24/2023 does not apply to reports of violations regulated in the directives and regulations of the European Union and in the implementing provisions of the Italian law which already guarantee specific reporting procedures, e.g., in matters of market abuse, in matters of national security etc.
4. Internal communication and reporting procedures and characteristics of reporting
The following channels are available to express your reports:
- In written form, even anonymously, using the appropriate box (see image below).
The report can also be made through a request for a direct interview, by inserting the request into the box or by sending it by registered mail or ordinary mail to the address of the operational headquarters in Corso Ferrucci 112, 10138 Turin. If using post, it is advisable to indicate “Whistleblowing Contact” as the recipient also on the outer envelope. To present the report, it is necessary to separate the content of the report from the identity of the person making the report by placing them in two closed envelopes, with “report” and “reporter” written on them (unless the report is anonymous), both inserted in a third envelope with written “Whistleblowing Reports – Confidential”. To ensure greater autonomy and impartiality in the management of reports, 2 contact persons have been identified. Reporter can therefore indicate, if they wish, the contact person to whom the report should be addressed by writing it clearly on the outermost envelope. - In oral form, at the request of the reporting person, through a direct meeting which will be set within a reasonable time with the Tierra contact person in charge. The request for an interview can be sent via the reporting box or by post as indicated above.
In order to be taken into account, the report must include the circumstances of the time and place in which the event, which is the subject of the report occurred, the description of the event, general information or other elements which allow the identification of the person to whom the reported events can be attributed. It is possible to submit anonymous reports, which must be adequately detailed to be processed. Anonymity could limit the investigation phase of the report and does not allow the reporting party to be kept informed of its management and outcome.
5. What happens after submitting the report
The reports received are examined by the contact person in charge who directs their management, according to the specific PRO 18 “Whistleblowing_Gestione (Management) of reports
The Procedure, which also applies in the case of reports received via direct interview, involves the following steps:
- issue to the reporting person of an acknowledgment of receipt within 7 days of the date of receipt
- analysis of the report to assess the existence of the essential requirements to evaluate its admissibility and therefore be able to grant the reporting party the expected protections. Reports are not admissible in the event of manifest unfoundedness due to the absence of suitable elements to justify investigations or generic content of the crime report such as not to allow understanding of the facts or crime report accompanied by inappropriate documentation. In this phase or in the following one, the contact person in charge, can start a dialogue with the whistleblower asking for clarifications, documents, or further information, maintaining confidentiality.
- start of the internal investigation into the facts or conduct reported to assess their existence.
- feedback on the outcome to the reporting person within 3 months, communicating the information relating to the follow-up that has been given or is intended to be given to the report.
In particular cases the reporter can turn to the ANAC’s external channel [3], for example if the internal channel is not active, if you have already made an internal report which has not been followed up, if you fear retaliation, if you have reasonable grounds to believe that making an internal report would not be followed up effectively or if you have reason to believe that the violation may constitute a danger to the public interest.
6. Protection measures for the whistleblower
The law guarantees protection – both in terms of protection of confidentiality and protection from retaliation, of subjects who expose themselves with reports, complaints or who contribute to the emergence and prevention of risks and prejudicial situations. Any act of retaliation against the whistleblower is prohibited, including dismissal, demotion, or failure to promote, change of duties, transfer of headquarters, adoption of disciplinary measures, failure to renew a fixed-term contract. and any other action that has negative effects on employment contracts, etc. Any retaliatory acts are null and void. In particular, people who have been fired as a result of reporting have the right to be reinstated in their jobs. The burden of proving that such acts are motivated by reasons unrelated to the report is borne by the employer. Whistleblowers who believe they have suffered retaliation can inform the ANAC, which informs the National Labor Inspectorate for the measures within its jurisdiction. The protection guaranteed to whistleblowers by law ceases when their criminal liability for defamation or slander or their civil liability is ascertained and in cases of willful misconduct or gross negligence. In such cases, a disciplinary sanction may be imposed on the whistleblower.
7. Processing of personal data
As part of the disciplinary proceedings, the identity of the reporting person cannot be revealed without his or her consent, in particular if the dispute is based on other investigations made following the report itself. If, however, the dispute is based on the report and knowledge of the identity of the person making the report is essential for the defense of the accused, the report will only be usable in the presence of the consent of the person making the report to reveal his or her identity. Any exchange and transmission of information involving the processing of personal data must take place in compliance with the legislation on the protection of personal data. The protection of personal data must be ensured not only to the reporting or reporting person but also to other subjects to whom confidentiality protection applies, such as the facilitator, the person involved, and the person mentioned as “interested” in the data processing.
[1] Decree which establishes the responsibilities of the employer and the company in the event of offenses committed by its employees, and which requires the company to have a mapping of the areas at risk of crime and the related possible ways of committing the offences. Incidentally, Tierra has not adopted an organizational model pursuant to 231/2001.
[2] Staff are invited to forward all reports they deem appropriate via the established channels. The reports will be examined and processed by the Company through the relevant personnel, but only the reports that fall within the inclusion criteria of the Decree will be treated as described in the specific PRO 18 “Whistleblowing_Gestione (Management) of reports”.
[3] ANAC is the National Anti-Corruption Authority with a dedicated reporting service https://www.anticorruzione.it/-/whistleblowing
Information on the processing of personal data
conferred for the purpose of reporting illicit conduct (whistleblowing) at the company Tierra S.p.A. pursuant to articles 13 and 14 of Regulation (EU) no. 2016/679
Data controller
Tierra S.p.A. Via Lombardore 223, 10040 Leinì (Turin), the “Company”.
Type of personal data processed
The following personal data are processed:
– personal data, contact details and, possibly, data on professional qualification, as well as further data and information connected to the report reported.
Purpose of processing and legal basis
The processing of your personal data is carried out exclusively for the purpose of taking charge and managing the report.
The legal basis is identified in the execution of a task of public interest or connected to the exercise of public powers with which he is invested as Data Controller (European Regulation 2016/679 – Art. 6, paragraph 1, letter e).
Data retention
The data will be kept for 5 (five) years and in any case for the entire duration of any disciplinary or criminal proceedings. In the event that criminal proceedings are instituted, the data may be retained for the times established by current legislation.
Communication of data to possible recipients
In order to guarantee the confidentiality of the whistleblower for the entire duration of the management of the report, the identity of the same will be known only by the contact person(s) appointed by the Company, employees formally authorized for the relevant processing, pursuant to articles. 29 and 32 of the GDPR and art.2-quaterdecies of Legislative Decree 101/2018 and by any consultants if they were appointed by the Company, appointed as data controllers.
An exception is made in cases in which liability for slander and defamation can be established pursuant to the provisions of the penal code or art. 2043 of the civil code and in cases in which anonymity is not enforceable by law (for example, criminal, tax or administrative investigations, inspections of supervisory bodies), the identity of the reporter is protected in every context following the report. Therefore, without prejudice to the aforementioned exceptions, the identity of the reporter cannot be revealed without his express consent, and all those who receive or are involved in the management of the report are required to protect the confidentiality of this information.
Treatment methods
The processing will be carried out with the use of computerized procedures, equipped with tools to guarantee the confidentiality of the identity of the whistleblower and of the content of the reports and the related documentation, adopting adequate technical and organizational measures to protect them from unauthorized or illicit access, from destruction, loss of integrity and confidentiality, even accidental.
Rights of the interested party
The interested party has the right to obtain from the Data Controller confirmation as to whether or not personal data concerning him or her are being processed and, in this case, to obtain access to the personal data and the following information: the purposes of the processing, the categories of personal data, the recipients or categories of recipients to whom the personal data have been or will be communicated (including recipients in third countries or international organisations), the envisaged retention period of the personal data or, if this is not possible, the criteria used to determine this period, the origin of the personal data if not collected from the interested party, the existence of an automated decision-making process including profiling and information on the logic used.
Furthermore, the interested party has the right, in the cases provided for by European Regulation 2016/679, to obtain:
- Revocation of consent at any time without prejudice to the lawfulness of the processing based on the consent given before the revocation;
- Rectification of inaccurate personal data;
- Integration of incomplete personal data;
- Cancellation (right to be forgotten);
- Limitation of the processing of personal data (in this case, the data are processed only with the consent of the interested party, except for the necessary conservation of the same and in other cases permitted by law);
- Data portability, including through the transmission of the interested party’s personal data from one Data Controller to another, where technically feasible;
- Opposition to their treatment.
Vice versa, the person involved or the person mentioned in the report, with reference to their personal data processed in the context of the report, cannot exercise – for the time and within the limits in which this constitutes a necessary and proportionate measure – the rights that normally the Regulation (EU) 2016/679 recognizes the interested parties (the right of access to personal data, the right to rectify them, the right to obtain their cancellation or so-called right to be forgotten, the right to limit processing, the right to portability of personal data and that of opposition to the processing) if the exercise of these rights could result in an effective and concrete prejudice to the protection of the confidentiality of the identity of the reporting person.
Requests can be submitted through the reporting channel established by the Company or by contacting the following address: privacy@tierratelematics.com
Right to lodge a complaint
If the interested party believes that the processing carried out by the Data Controller may have violated the current regulations on the protection of personal data, he or she has the right to lodge a complaint with the Guarantor Authority for the protection of personal data pursuant to Art. 77 of the European Regulation 2016/679 or to take action in the appropriate judicial offices (art. 79 of the Regulation).
Communication of personal data and consequences of a possible refusal to respond
The provision of personal data is optional. Failure to provide information could, however, jeopardize the investigation of the report: anonymous reports, in fact, will be taken into consideration only if they are adequately detailed and provided in great detail, so as to bring out facts and situations connected to specific contexts.
In any case, the report made anonymously is not considered pursuant to the art. 54-bis for the purposes of acquiring any legal protection.
