Whistleblowing
In order to combat and prevent corruption, maladministration and, more generally, violations of the law, the company Medac Srl in compliance with the provisions of Legislative Decree no. 24 of 10 March 2023 containing ” Implementation of Directive (EU) 2019/1937 of the European Parliament and of the Council of 23 October 2019 on the protection of persons reporting violations of Union law and containing provisions concerning the protection of persons reporting violations of national regulatory provisions “, as well as the indications provided by ANAC, has set up specific internal channels to allow stakeholders to report, in a secure and confidential manner, behaviors, acts or omissions that may constitute violations of regulations internal or external to the Company.
Who can report?
The following are authorised to report:
- subordinate workers;
- self-employed workers;
- collaborators, freelancers and consultants;
- interns and trainees, paid and unpaid;
- shareholders and persons with administrative, management, control, supervisory or representative functions, even when such functions are exercised as a matter of fact.
The report can be made:
- when the legal relationship is ongoing;
- during the probationary period, if the information was acquired during the selection process or in other pre-contractual phases;
- when the legal relationship has not yet begun, if information on the violations was acquired during the selection process or in other pre-contractual stages;
- after the termination of the legal relationship, if the information on the violations was acquired before the termination of the legal relationship itself (pensioners).
Are anonymous reports allowed?
Anonymous reports are permitted if sufficiently detailed and are treated in the same way as “nominative” reports. In this case, the protection measures for retaliation will be applicable only if the reporting person is subsequently identified.
What can be reported?
The report may concern two types of violations, as summarized below:
- Offences relating to matters pursuant to art. 2, paragraph I, letter a), numbers 3 to 6 (public procurement, public health, protection of personal data, consumer protection, environment, competition and state aid.)
- Where a Model 231 is adopted: Illicit conduct relevant pursuant to Legislative Decree 8 June 2001, no. 231 (predicate crimes by way of example: Undue receipt of grants, fraud against the State, a public body or the European Union for the purpose of obtaining public grants, computer fraud against the State or a public body and fraud in public supplies), or violations of the Organization and Management Model adopted pursuant to Legislative Decree 231/01 or the Company’s Code of Ethics.
- Offences falling within the scope of EU acts in the following areas: public procurement; financial services, products and markets and prevention of money laundering and terrorist financing; product security and compliance; Transport safety; Environmental protection; Radiation protection and nuclear safety; Food and feed safety and animal health and welfare; Public health; Consumer protection; Privacy and personal data protection and network and information system security.
- Acts or omissions which harm the financial interests of the Union (for example fraud, corruption and any other illegal activity relating to the expenditure of the Union).
- Acts or omissions concerning the internal market (for example, infringements of competition and State aid).
- Acts or behaviour which undermine the object or purpose of the provisions laid down in the acts of the Union (e.g. acts which infringe the principle of free competition)
What CANNOT be reported?
- News that is clearly unfounded , information that is already entirely in the public domain , as well as information acquired solely on the basis of indiscretions or unreliable rumours (so-called “ corridor gossip” or “hearsay”).
- Disputes, claims or requests related to a personal interest of the reporting person or the person who has filed a complaint with the judicial or accounting authority that relate exclusively to their individual employment or public employment relationships , or inherent to their employment or public employment relationships with hierarchically superior figures. Therefore, excluded are, for example, reports regarding labor disputes and pre-litigation phases , discrimination between colleagues, interpersonal conflicts between the reporting person and another worker or with hierarchical superiors, reports relating to data processing carried out in the context of the individual employment relationship in the absence of harm to the public interest or the integrity of the public administration or private entity ;
- Violations already mandatorily regulated by the European Union or national acts indicated in Part II of the Annex to the Decree or by the national acts that implement the European Union acts indicated in Part II of the Annex to Directive (EU) 2019/1937, even if not indicated in Part II of the Annex to the Decree (for example, reports regulated by Legislative Decree 1 September 1993, no. 385 “Consolidated law on banking and credit” and by Legislative Decree 24 February 1998, no. 58. – Consolidated law on provisions on financial intermediation are excluded);
- Breaches of national security, as well as procurement relating to defence or national security aspects, unless such aspects are covered by the relevant secondary legislation of the European Union.
- Problems relating to goods and services provided by the Company (e.g. complaints).
What information should the report contain?
Reports must be as detailed as possible, including all elements useful to the management body to carry out the checks and investigations necessary to evaluate their validity.
To this end, the whistleblowers must provide at least the following elements:
- the circumstances of time and place in which the reported event occurred;
- the description of the fact with an indication of the known circumstances (of manner, time and place);
- the personal details or other elements that allow the identification of the person to whom the reported facts are to be attributed (the so-called reported person).
- Unless the report is anonymous, the personal details of the person making the report, indicating the position or function held within the company;
- the absence of any private interests connected to the report and one’s good faith;
- any information or evidence (attaching the relevant documents) that may provide useful confirmation of the existence of what has been reported, in particular also the indication of any other subjects who may report on the facts being reported;
- Where the report is not anonymous, the identifying data of the reporting person (name, surname, qualification, etc.). As will be better explained, the latter are supported by specific technical and organizational security measures aimed at guaranteeing absolute confidentiality of the reporting person’s identity.
Where the report is sent in written form via the Whistleblowing Portal, the whistleblower will be guided in providing these elements by the questions provided in the reporting form .
In any case, where the report is not adequately detailed, the Management Body may request additional information from the whistleblower via the Whistleblowing Portal or even in person, where the whistleblower has requested a direct meeting.
Reports must not contain excessive personal data, but only the data necessary to demonstrate the validity of the complaint. As a rule, therefore, no special data should be included, nor personal data suitable for revealing the state of health or judicial matters.
How can it be reported?
The reporter has the possibility to make a Report, written or oral, using the internal channels listed below:
- Via the Whistleblowing Portal : https://digitalroom.bdo.it/Medac
Medac Srl has implemented an IT platform that allows the sending of reports both in written form through the completion of a questionnaire, and in oral form, through the use of a voicemail.
The Portal will ask the reporter whether or not he/she intends to reveal his/her identity. In any case, the reporter may provide his/her personal details at a later time, also through the messaging system provided by the Portal.
When the report is sent, the Portal will issue the reporter a unique identification code (ticket). This number, known only to the reporter, cannot be recovered in any way if it is lost. The ticket will be used by the reporter to access, always through the Portal, his/her report in order to: monitor its progress; enter additional elements to substantiate the report; provide his/her personal details; answer any questions for further information.
Through a direct meeting: The request must be sent to the following address organogestoriomedac@gmail.com in order to guarantee the protection of confidentiality and security of communications, on this occasion the reporter is invited NOT to provide detailed information on the report (factual circumstances, name of the reported person and/or witnesses etc.) but only to agree on the terms of the meeting.
Who can provide assistance to the whistleblower?
The whistleblower may decide to turn to a person in whom he or she places his or her trust who, acting as a “Facilitator” pursuant to the legislation in question, receives similar protection as the whistleblower.
How can I view a submitted report and find out its outcome?
When sending the report via the Whistleblowing Portal, the whistleblower will receive a code that he/she can use to access, always via the Portal, his/her report in order to: monitor its progress; insert further elements to substantiate the report; provide his/her personal details; answer any questions for further information.
In any case, the Management Body:
- issues the reporter an acknowledgement of receipt within 7 days of the date of receipt of the report:
- provides timely feedback to any requests forwarded by the whistleblower through the reporting channels (messaging system implemented on the platform)
- provides feedback to the report within three months from the date of acknowledgement of receipt or, in the absence of such acknowledgement, from the expiry of the seven-day period from the submission of the report.
Who manages the reporting?
The Management Body consists of a dedicated office composed of the following resources: SG (internal resource) and RSPP (external consultant).
The Management Body, as Recipient of the Report:
- is autonomous and independent;
- ensures a fair and impartial assessment of the report received;
- respects confidentiality obligations, especially regarding the identity of the whistleblower, the person reported and other subjects involved (facilitator, family members, work colleagues, witnesses, etc.);
- manages the report (evaluates admissibility and carries out the investigation into the reported facts or conduct);
- manages discussions with the whistleblower (notices of receipt and closure of the report and exchanges of information);
- communicates the outcome to the reporting party (giving an account of the measures planned or adopted or to be adopted to follow up on the report and the reasons for the choice made).
- Ensure adequate publicity for this procedure and on the other channels (external channel, public disclosure, reporting) provided for by Legislative Decree 24/2023 with particular regard to the conditions for accessing it to the competent subjects and procedures.
If the report is submitted to a person other than the one identified and authorised by the administration or body, the latter will proceed to transmit it, within seven days of its receipt, to the competent person, giving simultaneous notice of the transmission to the reporting person.
What are the protections for the whistleblower?
The protection system provided by Legislative Decree no. 24/2023 is divided into the following types of protection:
- the protection of the confidentiality of the whistleblower, the facilitator, the person involved and the persons mentioned in the report;
- protection from any retaliatory measures adopted by the entity as a result of the reporting, public disclosure or denunciation made and the conditions for its application;
- limitations of liability with respect to the disclosure and dissemination of certain categories of information that operate under certain conditions;
- the provision of support measures by third sector entities included in a specific list published by ANAC.
These measures are extended, in addition to the whistleblower, to the following subjects:
- to the facilitator (a natural person who assists the whistleblower in the reporting process, operating within the same work context and whose assistance must remain confidential). For example, the facilitator could be a colleague from an Office other than the one to which the whistleblower belongs who assists the latter in the reporting process on a confidential basis, i.e. without disclosing the information learned. The facilitator could be a colleague who also holds the qualification of trade unionist if he assists the whistleblower in his name and on his behalf, without using the trade union acronym;
- to persons in the same work context as the reporting person, the person who filed a complaint or the person who made a public disclosure and who are linked to them by a stable emotional or kinship bond within the fourth degree;
- to work colleagues of the reporting person or of the person who made a complaint or made a public disclosure, who work in the same work context as the reporting person and who have a habitual and ongoing relationship with that person.
- to entities owned by the reporting person or for which the same persons work as well as to entities operating in the same work context as the aforementioned persons.
Waivers and transactions, whether complete or partial, which have as their object the rights and protections provided for by the decree are not valid, unless they are carried out in the protected locations referred to in art. 2113, paragraph 4, of the civil code .
How is the confidentiality of the whistleblower protected?
The Company guarantees the confidentiality of the identity of the Reporting Person starting from the stage of receiving the report, in compliance with the provisions of the law. To this end, the personal identification data of the reporting person are stored in such a way as to be visible exclusively to the body responsible for managing the report. The company adopts all guarantees and technical and organizational measures provided by law in order to protect the confidentiality of the identity of the reporting person, so that it is not revealed to third parties without the express consent of the latter, except in the case of reports in bad faith or defamatory. These measures include the obscuring of personal data, especially those relating to the reporting person but also of other subjects whose identity, pursuant to Legislative Decree 24/2023, must remain confidential (the facilitator, the reported person, the other persons mentioned in the report), if, for investigative reasons, other subjects must also be made aware of the content of the report and/or the documentation attached to it.
When can the identity of the whistleblower be revealed?
In the event of disciplinary proceedings , the identity of the whistleblower may not be revealed where the contestation of the disciplinary charge is based on investigations that are separate and additional to the report, even if consequent to the same; the identity of the whistleblower may be revealed only where:
- the challenge is based, in whole or in part, on the report itself and knowledge of the identity of the whistleblower is absolutely indispensable for the defence of the accused; and
- there is the consent of the whistleblower.
In such a case, the Company will take care to communicate, always in advance, in written form to the reporting person the reasons that lead to the disclosure of his/her identity.
In what cases is the whistleblower’s protection not guaranteed?
No retaliation or discrimination, direct or indirect, may be suffered by anyone who has made a report in good faith , regardless of whether the report is later found to be well-founded or not.
Sanctions are foreseen for those who violate the measures of protection and confidentiality of the whistleblower.
The protection of the whistleblower is not guaranteed in the case of reports made with malice or gross negligence or that turn out to be false, unfounded, with defamatory content or in any case made for the sole purpose of damaging the Company, the reported person or other parties involved in the report. Sanctions are provided for the whistleblower, if it is possible to trace him/her in the case of reports made with malice or gross negligence or that turn out to be false, unfounded, with defamatory content or in any case made for the sole purpose of damaging the Company, the reported person or other parties involved in the report.
The Company may also undertake appropriate legal initiatives.
When and how a report can be made to ANAC
The competent Authority for the management of the external channel is ANAC. It is possible to report to the Authority if one of the following conditions occurs:
- In the workplace context, the mandatory activation of the internal reporting channel is not foreseen, or rather, even if mandatory, it is not active or, even if activated, it does not comply with the provisions of Article 4 of Decree 24/2023;
- The reporting person has already made a report through the internal channel and the same has not been followed up;
- The reporting person has reasonable grounds to believe that, if he or she were to make an internal report, it would not be followed up effectively, or that the report itself could give rise to the risk of retaliation;
- The reporting person has reasonable grounds to believe that the violation may constitute an imminent or manifest danger to the public interest.
For any further information, please refer to the Authority’s institutional website at the following link Whistleblowing – www.anticorruzione.it
To submit a report via the Whistleblowing Portal, click here https://digitalroom.bdo.it/Medac
For further information on the procedure and the processing of personal data, click here.
To contact the management body and request a direct meeting organogestoriomedac@gmail.com