FAQ On Whistleblowing Hotlines: A Data Protection And Criminal Law Perspective

Whistleblowing hotlines enhance transparency within a company; the creation of a whistleblowing internal procedure for a company implies a number of issues from a data protection and criminal law perspective. Here below you can find a set of FAQs on some relevant aspects related to the creation of such a procedure.

1. What is a whistleblowing hotline?

   A whistleblowing hotline is a specific channel designed for employees to report misconduct internally. As clarified by Article 29 of the Data Protection Working Party's (WP29) "internal whistleblowing schemes are generally established in pursuance of a concern to implement proper corporate governance principals in the daily functioning of companies." For this reason, under a data protection law perspective, whistleblowing schemes enhance transparency, and they are considered a best practice. Under criminal law perspective, Law no. 179/2017 provides indications on reporting crimes and irregularities within the private and public employment context. More specifically, with regard to the private context, this law provides for an amendment to the Legislative Decree no. 231/2001 (231 Law). The 231 Law is aimed at encouraging companies to adopt compliance programs (Models) in order to prevent the commission of certain crimes (listed by the 231 Law) by the directors, managers or their subordinates, or other third parties in the interest or to the advantage of the company. The adoption of the Models is optional and not compulsory. Therefore, only the companies that adopted the Models have to adopt a detailed procedure for the whistleblowers' reports.

2. What needs to be taken into account when a company decides to create a whistleblowing hotline?

   When creating a whistleblowing hotline a company should:

   dedicate specific channels to this procedure (at least one channel has to be based on information technology), suitable to ensure the confidentiality of the whistleblowers; guarantee confidentiality of the whistleblowing hotline's content as well as safeguard the privacy and anonymity of people managing/being involved in the procedure; prohibit discriminatory acts or any form of retaliation against anyone for making a report; provide the application of disciplinary measures for those who violate the confidentiality of the whistleblowers; provide an information notice, since each individual should be made aware of how data are processed within the context of the procedure; ensure that the accused person...