Whistleblowing: Tips For Business Companies (3rd Part)

1. Introduction

   Following our previous articles published on July 30 and September 25, we conclude our brief analysis of the Whistleblowing Reporting System (hereinafter "Whistleblowing") focusing our attention on the prescription under the privacy law linked to the related reporting system. For a better understanding of this matter, it should be noted that by Whistleblowing we intend an employee's reporting of illicit deeds committed inside of the company where they are employed.

   It should be noted that the Italian Data Protection Authority's most recent six-month inspection plan, published on 12 September 2019, indicates the verifications to be carried out by the Italian Authority in the same period, specifically citing the processing of personal data carried out for the management of the reporting of unlawful conduct (so-called whistleblowing). The following indications, therefore, may be useful in view of possible Inspections by the Italian Data Protection Authority with regard to such processing.

2. Requirements under privacy law: privacy notices, authorization for the processing of personal data, record of processing activities.

   Alongside the prescription set forth by Italian Legislative Decree n. 231 of 2001 (hereinafter the "Decree"), the Whistleblowing system must also be compliant with Regulation EU 679/16 (hereinafter "GDPR" or "Regulation").

   Firstly, it is necessary to write a notice according to what is established in Article 13 of the GDPR, which informs the reporting agent about the processing of their personal data as well as the retention of the data included in the report. This notice should be available to all employees (for example, when the policy about Whistleblowing is communicated to employees) and, if possible, the notice should be published on the corporate intranet.

   At the same time, it is necessary to adequately instruct the authorized persons and therefore the recipients of the reports (receiving agents), providing them with an authorization to process personal data pursuant to Article 2 quaterdecies of the Privacy Code as amended by Italian Legislative Decree 101/2018. This authorisation is supplementary to and not a substitute for the so-called "general" authorisation that the employees receive during the hiring phase.

   In this context, however, there is another issue, namely that of correctly framing the privacy roles of the recipients of the report, in the event that they are "internal" to the company (e.g...