Series
Blogs
Series
Blogs
In July, Legislative Decree No 24/2023 (the “Whistleblowing Decree”) finally came into force. It implements EU Directive 2019/1937 - although misses the December 2021 transposition date by a considerable margin.
This article focuses on how the Whistleblowing Decree navigates the longstanding tensions between whistleblowing programmes and data protection laws, rather than the wider employment law considerations.
One important change is to provide explicit protection for the “concerned person”, that is to say the person against whom the allegation has been made and any other persons mentioned in the report. As the guidelines issued by the National Anti-Corruption Authority (known as “ANAC”) clarify, this is to safeguard the “concerned persons’” reputation before the breach has been proved.
The Whistleblowing Decree also similarly contains strong protection for the whistleblower, whose identity can only be revealed in limited situations (see below).
Further to these confidentiality obligations, the data controller has to implement a reporting channel that complies with general data protection obligations by:
In addition to the general obligations above, the Whistleblowing Decree specifically mentions the need to comply with the privacy by design and privacy by default principles. This is particularly important since it implies that the data controller shall implement reporting channels regarding only personal data useful and necessary for the report itself, by allowing the whistleblower to include only relevant data related to the concerned person and not also unnecessary data such as, by way of example, data related to sexual or religious orientation.
The Whistleblowing Decree also states that data controllers can keep relevant personal data for a period of no more than five years from the closure of the whistleblower file, as specified by the ANAC guidelines. This provision is interesting since, rather than relying on the general storage limitation principle, it is the legislator itself that has expressly decided on the retention period.
Recognising the need to protect the identity of the whistleblower, the Whistleblowing Decree specifically:
The GDPR has had a huge impact on whistleblowing, as with many other fields of activity. This is hardly surprising given the sensitive nature of the personal data being processed and the need to balance the data protection rights of the whistleblower, the concerned person(s) and the legitimate benefits of allowing such reports.
Here, the legislator obviously intends to encourage whistleblowers by demonstrating their identity will be well protected. Similar protection is not provided to the concerned person(s) given the practical consequences of any whistleblowing report which might, for instance, result in judicial proceedings. In any event, care is needed as the Garante is likely to be watching this area and may well take speedy enforcement action against non-compliant whistleblowing systems.
9 August 2023
Up next