Procedure for managing Whistleblowing reports
Purpose
Procedure management methods
Scope of application
Reference documents and regulations
Terms and definitions
Internal reports
External reports
Protection measures
Penalties
Reference documents
Information
Guidelines
Purpose
Aware that business ethics require governance based on trust, transparency and integrity, Friulchem S.p.A. (hereinafter also “Friulchem” or “the Company”) encourages the collaboration of its employees and third parties for the purpose of the emergence of illegal, fraudulent or suspicious phenomena and any other irregularity or conduct not in accordance with the law and the internal regulatory system of the Company.
To this end, this Procedure, an integral part of the internal regulatory body, has been drafted and approved with the intention of allowing personnel and all third parties operating directly or indirectly on behalf of the Company to report violations of regulatory provisions that harm the public interest or the integrity of the organisation.
In particular, through this document the Company aims to define the principles and rules as well as the roles and responsibilities within the whistleblowing reporting process, in accordance with EU Directive 2019/1937 on the protection of persons reporting breaches of EU law, as better defined in chapter 3.
This Procedure complements the Friulchem Code of Ethics, as well as the Organisational Model adopted pursuant to Legislative Decree No. 231/2001.
The parties involved in the activities referred to in this Procedure are obliged to observe the behavioural and procedural rules defined herein. Each Head of Function/Manager is responsible for ensuring compliance with this Procedure. Any deviation from the actual operation of the Procedure is subject to sanction.
Procedure management methods
This Procedure is adopted by the Board of Directors of the Parent Company Friulchem S.p.a. and constitutes a single document for the entire Group. For this reason, the Companies directly or indirectly subject to the control of the Parent Company are required to accept it and to transpose it through their administrative bodies at the first useful opportunity following the completion of the acquisition transaction, with any changes made necessary on the basis of local regulations.
The Procedure is made available and can be consulted in the following ways:
- on the workplace notice board;
Scope of application
3.1. Scope of application
This Procedure applies to Friulchem S.p.A. and Group Companies controlled by the Parent Company, including FC France SAS (branch)
For the purposes of applying this Procedure, violations, unlawful conduct, even attempted, conduct, acts or omissions that damage the public interest or the integrity of the Company are considered relevant reports.
For a precise detail of the areas relevant to the reports, reference should be made to Annex A – Reports relevant for the purposes of the Procedure.
From the point of view of the protected parties, this Procedure distinguishes the whistleblower (in the strict sense), that is, the natural person who makes the report of violations that occurred within their work context, from other parties who, although not having made the report directly, are still considered worthy of protection.
For a detail of the subjective scope, please refer to Annex B – Whistleblowers and other protected parties.
Reference documents and regulations
This Procedure is drawn up in compliance with the regulatory provisions in force regarding the protection of persons who report breaches, anti-corruption and protection of personal data and also complies with the national collective bargaining agreements applicable to personnel.
Scope | Regulatory references |
European Union | Directive 2019/1937 of the European Parliament and of the Council of 23 October 2019 on the protection of persons reporting breaches of EU law |
EU Regulation 679/2016 on privacy and subsequent provisions (GDPR) and national privacy regulations | |
Italy | Legislative Decree No. 24/2023 containing “Implementation of Directive (EU) 2019/1937 of the European Parliament and of the Council of 23 October 2019 on the protection of persons who report breaches of EU law and on the protection of persons who report breaches of national regulatory provisions” |
Legislative Decree No. 231/2001 containing “Discipline of the administrative liability of legal persons, companies and associations even without legal personality, in accordance with Article 11 of Law No. 300/2000”. | |
Organisational Model: The Organisation, Management and Control Model adopted pursuant to Legislative Decree No. 231/2001, aimed at preventing the commission of particular types of crime in the business environment. | |
ANAC (Autorità Nazionale Anticorruzione) Whistleblowing Guidelines: Guidelines approved by ANAC with Resolution No. 311 of 12 July 2023 on the protection of persons reporting breaches of EU law and the protection of persons reporting breaches of national regulatory provisions. Procedures for the presentation and management of external reports. | |
Regulations for the management of external reports and for the exercise of ANAC’s sanctioning power: Regulation adopted by ANAC with Resolution No. 301 of 12 July 2023 | |
Operational Guide for private entities on the new “whistleblowing” discipline of Confindustria: document prepared by Confindustria, published in October 2023, to offer the Companies affected by the new whistleblowing discipline a series of indications and operational measures deemed suitable to meet the needs outlined by Legislative Decree No. 24/2023. | |
France | Law No. 2016-1691 of 9 December 2016 (Loi relative à la transparence, à la lutte contre la corruption et à la modernisation de la vie économique), as amended by Law No. 2022-401 of 21 March 2022 (Loi visant à améliorer la protection des lanceurs d’alerte) |
Decree No. 2022-1284 of 3 October 2022 (Décret relatif aux procédures de recueil et de traitement des signalements émis par les lanceurs d’alerte et fixant la liste des autorités externes instituées par la loi n° 2022-401 du 21 mars 2022 visant à améliorer la protection des lanceurs d’alerte). | |
Référentiel relatif aux traitements de données à caractère personnel destinés à la mise en œuvre d’un dispositif d’alerte (CNIL, 6 July 2023). |
Terms and definitions
Term | Definition |
Report | Written or oral communication, made in the manner described in this Procedure, containing information (including well-founded suspicions) regarding violations committed or that, on the basis of concrete elements, could be committed in the Organisation with which the whistleblower has a legal relationship, or any other element concerning conduct aimed at concealing such violations. |
Breach | Behaviours, acts or omissions that harm the public interest or the integrity of the Company and that are detailed in Annex A-Relevant reports for the purposes of the Procedure. |
Whistleblower | Natural person who reports information on violations acquired within his or her work context, in the performance of work or professional activities, past or present. |
Facilitator | Natural person operating within the same working context with the task of assisting the whistleblower in the reporting process, keeping their assistance confidential. |
Person involved | Natural or legal person mentioned in the internal or external report as the person to whom the violation is attributed or as a person in any case implicated in the violation reported. |
Whistleblowing Committee (or Direct Channel) | An authorisation profile to view the reports received by the Company and to carry out the preliminary investigation and management of the report in order to assess its admissibility and grounds, including its closure. |
Alternative Channel | Autonomous body that replaces the Direct Channel in the event that the report concerns a member of the Whistleblowing Committee. |
Instructor | Authorisation profile allowing access to the platform and acting as support in the preliminary investigation phase if requested by the Whistleblowing Committee. |
Platform | Computer system that represents the tool for the reception and management of reports, with technical characteristics suitable for protecting the confidentiality of the identity of the whistleblower including through the use of encryption tools. |
Internal reports: the Organisational Model defined by Friulchem
6.1. Tools to support the process: the IT Platform
In defining its Model for the management of reports of violations or illegal conduct, Friulchem has chosen to adopt a Platform to automate and facilitate the reception and management of reports that can also guarantee, with computer methods and data encryption techniques, the confidentiality of the identity of the whistleblower, the content of the report and the related documentation. This platform can be reached at the following link https://whistleblowing.friulchem.com/.
Within the platform, each Group Company has provided for an area dedicated to the individual legal entity in order to keep the reporting channels and their management separate.
Pursuant to this Procedure, any internal report as well as any subsequent communication with the whistleblower must take place within the platform, in which all the documentation of the case will be entered and filed.
The platform, which allows anonymous reports to be sent, enables users to communicate with the whistleblower during internal investigations.
Profiling is provided independently and separately for each Group Company within the scope of this Procedure. Each user is in possession of unique access credentials that they are required to keep secure and not disclose to third parties.
The segregation of the reporting channel and its management takes place in accordance with the provisions of Article 4(4) of Legislative Decree No. 24/2023. Indeed, in compliance with the provisions of current legislation the Group Companies falling within the scope of this Procedure cannot share the same internal reporting channel and its management
6.2. Roles and responsibilities
The whistleblowing management model defined by the Company provides for the following roles and responsibilities.
6.2.1. Whistleblowing Committee (Direct Channel)
The function of direction and governance of the process of handling reports of violations or unlawful conduct is the responsibility of the Whistleblowing Committee or Report Handler, an autonomous body identified independently by each Group Company, composed of specifically trained personnel.
For Friulchem S.r.l. and FC France, the structure of the Whistleblowing Committee consists of:
- Andrea Reghelin, member of the Supervisory Body and formal process manager
The Whistleblowing Committee is responsible for receiving, analysing and addressing reports, and in particular for:
- carrying out the preliminary assessments of the feasibility, admissibility and substantiation of the reports;
- providing a first response to the whistleblower regarding acceptance or rejection of the Report;
- directing and coordinating the conduct of the investigation, aimed at ascertaining the facts covered by the report, using the tools and techniques available and compliant with current regulations;
- arranging for the closure of the investigations and providing feedback to the whistleblower on the outcome of the report;
- activating and supporting management and company departments in the implementation of corrective and/or mitigation measures and in the possible imposition of disciplinary sanctions.
6.2.2. Alternative Channelo
The Alternative Channel is an additional channel other than the Whistleblowing Committee for the reception of reports, and is identified in the person of:
- Margherita Mazzola, Chairperson of the Supervisory Body;
The Company has provided for the establishment of such an additional channel to ensure impartiality and protection of the whistleblower if the report concerns one of the members of the Whistleblowing Committee.
Through a specific use of the platform, the dedicated Alternative Channel therefore performs the same functions as the Whistleblowing Committee (Direct Channel) with reference both to the pre-evaluation phase and the preliminary investigation phase.
As part of the latter, the Alternative Channel activates the competent investigators based on the content of the Report.
6.2.3. Parties to the preliminary investigation
Parties to the preliminary investigation can intervene in the investigation phase, if decided by the Whistleblowing Committee, to provide support to the latter in carrying out the verification activities. Some of these are promptly identified by the Company, e.g. in the corporate or group functions or roles that are strategic and most involved in the management of reports or wrongdoing:
- Carlo Marelli, Head of Administration, Finance and Control
- Elisa Tagliolini, Human Resources Manager
- Michelangelo Leoni, Sales Manager (Human)
- Barbara Ceglia, Commercial and Public Administration Relations Manager
- Mariangela Spitaleri, Prevention and Protection Service Manager
- Elena Basso, Procurement Manager
- Silvia Moiana, Head of Production Management and Certifications
Each investigator shall sign a declaration of commitment to maintain the confidentiality of the identity of the whistleblower and of the information related to the report, where not already provided for by the ethical rules that may be applicable (Annex C – Declaration of Investigator’s Commitment).
Other investigators could be identified and designated for specific reports, depending on the possession of particular skills or according to the specific need in the management of the report. Also in this case, each investigator will have to sign the above declaration of commitment.
6.3. Forms and characteristics of the report
The internal report must be addressed exclusively to the receiving party (Direct Channel or Alternative Channel) and can be made, in a privileged manner, in writing, with the IT methods described in detail in the Annex D-Line guide for sending internal reports through the platform.
On completion of the entry of the report, the platform will generate a code and the related key. It is therefore recommended that the whistleblower periodically view the platform, since communications and requests for document integration by the receiving party, deemed necessary in order to proceed, will be communicated through it.
It should be noted that, in the event of loss of the code and its key, the whistleblower cannot access the report. Indeed, the code and key cannot be replicated. It should therefore be noted that it is the responsibility of the whistleblower to take adequate care of them. In the event of loss, it becomes the whistleblower’s responsibility to inform the receiving party of this situation, communicating any useful information regarding the report whose code or key has been lost.
If it is not possible to proceed with the report in written form, the internal report can also be made orally. The oral report can be made through a voice messaging system made available within the platform, which will allow the report to be recorded, subject to the explicit consent of the whistleblower.
Finally, at the request of the whistleblower, the report may be made orally through a direct meeting set within a reasonable time frame. In this case, a party within the Whistleblowing Committee or the Alternative Channel (in case of reporting to the former) will guide the whistleblower in compiling the report on the platform, in order to manage it properly. Alternatively, with the consent of the whistleblower, the documentation of the report will be guaranteed by means of a recording suitable for storage and listening or by means of a report. If a meeting report is drawn up, the whistleblower may verify, rectify and confirm it by signing it before entering it on the platform.
In any case, those who provide support to the whistleblower will NOT be able to keep the alpha-numeric code and the relative key of the report generated by the platform, which will remain at the exclusive disposal of the whistleblower.
***
It should be remembered that the internal report must have as its subject matter one of the relevant objective areas as reported in Annex A-Relevant reports for the purposes of the Procedure.
The Report must be complete and exhaustive to allow the verification of its validity by the Whistleblowing Committee. Therefore, if he or she wishes to maintain anonymity, the whistleblower is required to provide all the available and useful elements to allow the Whistleblowing Committee and the investigators to proceed with the due and appropriate verifications and assessments to establish the substantiation of the facts covered by the report, such as:
- the circumstances of the time and place in which the facts covered by the report were committed;
- a clear and complete description of the facts that are the subject matter of the report;
- the general information or other elements that facilitate the identification of the person(s) who has/have reported the facts (e.g. job role, place where he or she carries out the activity);
- any other information that may provide useful feedback about the existence of the reported facts;
- an indication of any other parties who may provide information on the facts subject to reporting;
- any documents supporting the report.
The requirements described above do not necessarily have to be complied with at the same time, in view of the fact that the whistleblower may not be in full possession of all the information required at the time of sending the report, but must be able to be reconstructed in the preliminary investigation phase.
The personal reasons or psychological status of the whistleblower are not relevant for the purpose of taking charge of the report.
If the report is submitted to a party other than the Whistleblowing Committee or the Alternative Channel, as identified and authorised by the Company (for example, to the Manager or hierarchical superior) where the whistleblower expressly declares that he or she wishes to avail of whistleblowing protections, or such desire is inferred from the report, the report is considered a “whistleblowing report” and must be transmitted, within seven days of its receipt, to the Whistleblowing Committee or the Alternative Channel, giving simultaneous notification of the transmission to the whistleblower.
Otherwise, if the whistleblower does not expressly declare that he or she wishes to benefit from the protections, or said wish is not inferred from the report, said report is considered to be an ordinary report.
The request may be made within the platform in order to allow the confidentiality of the request.
Via the voice messaging system on the platform.
6.4. Phases and activities
6.4.1 Pre-assessment phase
The Whistleblowing Committee or the Alternative Channel is responsible for the pre-evaluation phase of the report and carries out the following activities:
- issues to the whistleblower notice of receipt of the report within 7 days;
- maintains discussions with the whistleblower, who may be asked, if necessary, to supplement the report;
- diligently follows up on the reports received, promptly initiating the preliminary analysis of the report in order to verify its compliance with the applicable rules and this Procedure, in particular assessing the admissibility and substantiation of the statement.
The pre-evaluation phase may alternatively be concluded:
- with the filing of the report, in the event that it does not fall within the subjective or objective scope of this Procedure, or if the procedural conditions are lacking;
with the opening of the PRELIMINARY INVESTIGATION PHASE, aimed at taking all appropriate action to assess the existence of the reported facts.
6.4.2 Preliminary investigation phase
The Whistleblowing Committee, or the Alternative Channel (if the report is addressed to the latter) are responsible for the preliminary investigation phase, in which they are supported by the investigators who are from time to time competent on the basis of the subject matter of the report (as identified in section 6.2.3 above, or investigators identified from scratch among the parties, internal or external, who are competent with respect to the specific report).
In the case of external investigators, when, in order to follow up on the report, it is necessary to share information relating thereto that can reveal the identity of the whistleblower, before proceeding to share such information the Whistleblowing Committee or the Alternative Channel will ask for the consent of the whistleblower to the disclosure of his or her identity in the manner indicated in section 8.1 below (Right of Confidentiality).
In the event that the report concerns a violation of the Legislative Decree No. 231/2001 or the Organisational Model, the members of the Supervisory Body, as investigating parties, are promptly informed.
The preliminary investigation phase represents all the activities aimed at verifying the content of the reports and acquiring useful elements for the subsequent evaluation phase, in which the utmost confidentiality must be guaranteed regarding the identity of the whistleblower and the party being reported.
This phase has the main purpose of verifying the veracity of the information under investigation and of formalising the facts ascertained through internal verification activities, with the use of objective investigative techniques and the support of the competent and interested company structures with respect to the content of the report.
If interviews with the whistleblower (or other interested parties, witnesses or experts) are necessary, the information collected and/or the documents submitted must be filed and stored exclusively on the platform for the purposes of traceability of the operations carried out.
It is possible that parties external to the Company may be involved in this phase (e.g. experts or the staff of another Group Company).
6.4.3 Evaluation phase of the results of the investigation
The internal preliminary investigation phase must conclude with a judgement on the admissibility of the report. Alternatively:
- with the filing of an inadmissible report, which is deemed to unfounded or for which it has not been possible to ascertain the facts or for other reasons;
- with the communication to the Company representatives of the outcome of the internal investigation, by transmitting a summary report of the actions taken and the information gathered, in the event that the report is substantiated and the facts reported therein are ascertained. In such Report, the following will be acknowledged:
- the evidence collected;
- the information provided;
- the facts ascertained;
- actions taken for the preliminary investigation;
- any mitigating and/or corrective actions taken.
Following the transmission of the report, mitigating and/or corrective actions may be defined and undertaken by the Company, in addition to those aimed at imposing, where appropriate, disciplinary sanctions in line with the provisions of the applicable legislation, collective bargaining agreements and the applicable procedures to protect the interests of the Company (e.g. disciplinary measures, judicial actions, interruption of the existing relationship).
6.4.4 Response to the whistleblower
Throughout the preliminary investigation phase, the Whistleblowing Committee or the Alternative Channel will continue to maintain relations with the whistleblower, informing him or her of the progress of the investigation, at least with reference to the main decision-making junctions.
In order to guarantee maximum transparency in the management of the report, the whistleblower will at all times be able to access the platform and know the processing status of the report, using the alpha-numeric code and the key that are generated by the platform on completion of the entry of the report.
Within three months from the date of the notification of receipt, the Whistleblowing Committee or the Alternative Channel must provide feedback to the whistleblower, informing him or her of the follow-up that is given or that is intended to be given to the report. In any case, once the preliminary investigation has been completed, the Whistleblowing Committee or the Alternative Channel will notify the whistleblower of the final outcome of the reporting procedure, which will allow the report to be closed on the platform, for the purposes of the correct storing of the documentation.
For reasons of guarantee, reports will no longer be accessible to the Whistleblowing Committee or the Alternative Channel after their filing. The possibility of accessing the archived reports will be limited to a party expressly authorised by the Company under specific conditions.
External reports
The ANAC channel Where specific conditions apply, the whistleblower may make a report through an external channel.
External reporting can be carried out when one of the following conditions is met:
- the internal channel, although mandatory, is not active or does not comply with the provisions of the law;
- the whistleblower has already made an internal report and it has not been followed up;
- the whistleblower has reasonable grounds to believe that the Organisation would not effectively follow up on the internal report or sees a real risk of retaliation in the event of an internal report;
- the whistleblower has reasonable grounds to believe that the breach may constitute an imminent or obvious danger to the public interest.
It is the whistleblower’s responsibility to assess the occurrence of one of the situations listed above before proceeding to make an external report.
External reports are made by the whistleblower directly to ANAC, through the channels specially set up for this purpose. These are:
- the IT platform, which can be accessed through the ANAC services portal at the following URL: https://servizi.anticorruzione.it/segnalazioni/#/
- Oral reports
- Direct meetings scheduled within a reasonable time frame
On the website of ANAC, by clicking on the link to the dedicated page, the service dedicated to “whistleblowing” (https://www.anticorruzione.it/-/whistleblowing) can be accessed. It contains clear and easily accessible indications relating to the channel, the competent parties entrusted with the management of reports, as well as the procedures.
The external reporting channel in accordance with French law
With regard to whistleblowers who are subject to French regulations, they may directly contact the competent authorities designated in the appendix of Decree 2022-1284 of 3 October 2022, which can be consulted in Annex E – List of French competent authorities for external reports, through the IT channels made available by the latter.
Article 8 II) of the French law 2016-1691 of 9 December 2016.
Guarantees and protection measures of the whistleblower
The entire process of receiving and managing reports must guarantee the rights of the whistleblower. To this end, in accordance with current legislation, the Company has not only provided for the right to send anonymous reports, but has also provided guarantees and measures for the protection of the whistleblower, which will be applied if the following conditions are met:
- the violation falls within the objective scope of application of the legislation (details of which are provided below and in Annex A-Relevant reports for the purposes of the Procedure);
- the violation concerns conduct, acts or omissions likely to harm or prejudice the public interest or the integrity of the Company;
- there are well-founded reasons that lead the whistleblower to believe that the existence of unlawful conduct or a violation is credible.
If these requirements cannot be met, the report will be filed and the whistleblower informed.
The protection measures referred to in this Procedure are not guaranteed when, in relation to the report:
- the criminal liability of the whistleblower for defamation or slander offences is ascertained, even with a non-definitive first instance judgement;
- the civil liability of the whistleblower is ascertained, for having reported false information with intent or gross negligence.
See Article 16 of Legislative Decree No. 24/2023. On the same subject, see Recital 32 of the Directive, which specifies that “That requirement is an essential safeguard against malicious and frivolous or abusive reports as it ensures that those who, at the time of the reporting, deliberately and knowingly reported wrong or misleading information do not enjoy protection. At the same time, the requirement ensures that protection is not lost where the reporting person reported inaccurate information on breaches by honest mistake. (…). The motives of the reporting persons in reporting should be irrelevant in deciding whether they should receive protection”.
8.1. Right of confidentiality
The identity of the whistleblower and any other information from which such identity may be inferred, directly or indirectly, may not be disclosed, without the express consent of the whistleblower, to persons other than those competent to receive or follow up on reports, expressly authorised to process such data pursuant to Articles 29 and 32(4) of Regulation (EU) 2016/679 and national legislation on the protection of personal data.
It should be noted that the protection of the confidentiality of the whistleblower is also ensured in the jurisdictional and disciplinary sphere.
The disclosure of the identity of the whistleblower and of any other information or element from which the identity of the whistleblower can be deduced directly or indirectly is allowed only if this represents a necessary and proportionate obligation imposed by the law applicable in the country of reference, in the context of investigations by national authorities or judicial proceedings, including in order to safeguard the right of defence of the person involved.
Notwithstanding the obligation of confidentiality, the identity of the whistleblower may only be disclosed in the following cases:
- in the context of disciplinary proceedings, if the dispute is based, in whole or in part, on the report and knowledge of the identity of the whistleblower is essential for the defense of the accused;
- in proceedings instituted following internal or external reports, where such disclosure is also essential for the defence of the person involved.
In any case, even where current legislation allows the possibility of revealing the identity of the whistleblower, before the disclosure of such information it is necessary to acquire his or her express consent and communicate in writing the reasons behind the need to disclose his or her identity.
The Company is also required to protect the identity of the persons involved and of the persons mentioned in the report until the conclusion of the proceedings initiated by reason of the report in compliance with the same guarantees provided in favour of the whistleblower.
8.2. Prohibition of retaliation
The Model defined for the management of reports of violations or illegal conduct also imposes an explicit prohibition to adopt any form of retaliation against the whistleblower and other protected parties.
Any behaviour, act or omission, even if only attempted or threatened, carried out by reason of the report, which causes or may cause the direct or indirect unfair damage to the whistleblower, is considered retaliation.
Below are some cases that constitute retaliation:
- dismissal, suspension or equivalent measures;
- demotion or non-promotion;
- change of functions, change of workplace, reduction of salary, change of working hours;
- suspension of training or any restriction of access to it;
- negative notes of merit or negative references;
- the adoption of disciplinary measures or other sanctions, including financial penalties;
- coercion, intimidation, harassment or ostracism;
- discrimination or in any case unfavourable treatment;
- failure to convert a fixed-term employment contract into a permanent employment contract, where the worker had a legitimate expectation of such conversion;
- the non-renewal or early termination of a fixed-term employment contract;
- damage, including to the person’s reputation, in particular on social media, or economic or financial prejudice, including loss of economic opportunities and loss of income;
- placing on improper lists on the basis of a formal or informal sectoral or industrial agreement, which may make it impossible for the person to find employment in the sector or industry in the future;
- the early conclusion or cancellation of the contract for the supply of goods or services;
- the cancellation of a license or permit;
- the request to submit to psychiatric or medical examinations.
To benefit from protection:
- the whistleblower must reasonably believe, in light of the circumstances of the specific case and the data available at the time of reporting, that the information about the reported violations is true. Simple assumptions or rumours are not sufficient, and neither is news in the public domain;
- the party has reported facts despite not being certain of their actual occurrence or has reported inaccurate facts due to a genuine error or in any case when it comes to well-founded suspicions;
- the report must fall within the objective scope and must have been made on the basis of the provisions of current legislation;
- there must be a close link between the report and the unfavourable behaviour or omission suffered directly or indirectly by the whistleblower.
In the event that the whistleblower or another protected entity referred to in Annex B- The whistleblowers and other protected entities believe that they have suffered retaliation, it is recommended that:
- if the interested party falls within the perimeter of Italian legislation, ANAC, competent for the investigations that the law attributes to it, be notified through the computer platform form available on the website of ANAC, as indicated in section 8 above (The external reporting channel);
- if the interested party falls within the perimeter of French legislation, the Défenseur des doits be notified, which will provide for the necessary investigations with the powers conferred on it by law.
It is important, therefore, that those who have suffered retaliation do not transmit the communication to parties other than those indicated in order not to undermine the protections that the legislation guarantees first and foremost, namely, confidentiality.
By definition, this regulation does not apply to anonymous reports, as it is intended to protect the whistleblower from risks of retaliation. However, it may be applied if, following an anonymous report, the name of the informant is revealed, who may ask to avail of the protection provided for under the decree.
8.3. Processing of personal data
As part of the management of reports, Friulchem and FC France process the personal data of whistleblowers and possibly of other categories of interested party indicated by them in the reports submitted.
The Companies are set up as independent Data Controllers and ensure compliance with the fundamental principles and obligations deriving from Regulation (EU) 2016/679 (GDPR):
- in light of the principle of “lawfulness, fairness and transparency”, each Company gives the whistleblower a specific Disclosure on the processing of personal data, in which the main information relating to the processing is presented (e.g. the purpose, the retention times of personal data, the bases of lawfulness of the processing, the categories of personal data processed and the parties involved in the processing), as well as the rights of the whistleblower and the related methods of exercise;
- in light of the principle of “minimisation”, personal data manifestly not useful for the processing of the report itself are not collected during the management thereof or, if accidentally collected, are promptly deleted;
- with reference to the right of rectification, modification of the elements contained in the report or collected during the preliminary investigation is not allowed. This right, when exercised, must not make it impossible to reconstruct the history of any changes made to important elements of the investigation. Therefore, this right can be exercised exclusively to rectify factual data, the substantial accuracy of which can be verified by the Data Controller on the basis of evidence, and without deleting or replacing the data, even if erroneous, originally collected.
The additional obligations put in place by the Company as Data Controller are:
- a census in the register of processing activities kept by the Company as Data Controller (on the basis of Article 30 of the GDPR);
- the execution of the Data Protection Impact Assessment (DPIA), pursuant to Article 35 of the GDPR, concerning the processing of alerts carried out through the IT Platform, which is necessary because the processing may entail high risks for the rights and freedoms of the persons concerned;
- the designation of the members of the Direct Channel, the Alternative Channel, as well as the staff, the members of the Supervisory Body and the internal investigators of the companies involved in the management of the reports, as parties authorised to process personal data (pursuant to Article 29 of the GDPR);
- the designation of the service providers involved in the reporting process as data processors (pursuant to Article 28 of the GDPR), in particular:
- the provider of the platform for the collection of reports;
- any suppliers who provide support in the management of reports (as pre-assessors, members of the Direct and Alternative Channels or external investigators).
Retention times for reports
In light of the principle of “limitation of retention” in accordance with the provisions of current legislation, reports and all related documentation may not be used beyond the retention terms established under current legislation.
Specifically, the retention period defined by Italian legislation is set at 5 years from the communication of the final outcome of the reporting procedure.
With reference to the retention period implemented in the French perimeter, the data will also be kept for 5 years from the communication of the final outcome of the reporting procedure.
If the report involves the establishment of a dispute or disciplinary proceeding against the reported person or the whistleblower, the data will be kept for the entire duration of the dispute or out-of-court proceeding until the expiry of the terms of applicability of the appeal proceedings.
Penalties
Failure to comply with this Procedure and the protective measures provided for herein implies the possibility of application by Friulchem of its internal disciplinary system, in line with the provisions of the applicable national labour law and the relevant collective bargaining agreements.
The Company reserves the right to undertake any initiatives, including in the courts, in full compliance with current and applicable regulatory provisions. In particular, this Procedure is without prejudice to the criminal, civil and disciplinary liability of the whistleblower in the event of slanderous or defamatory reporting, in cases of wilful misconduct or gross negligence.
It should be noted that a Company or a person who discloses or disseminates information on violations covered by the obligation of secrecy, or relating to the protection of copyrights or the protection of personal data, or discloses or disseminates information on violations that offend the reputation of the person involved, in accordance with the applicable legislation in force for the case, shall not be punishable.
In addition to the sanctions within the entity, in the cases expressly provided for by law, ANAC in Italy and the competent national authorities in France may also apply to natural or legal persons any financial administrative sanctions, as provided for by current legislation and in compliance with their own regulations.
The reference excludes the dissemination of classified information, or information covered by professional or medical secrecy, or concerning the rulings of the courts, for which the application of the applicable legal provisions remains unaffected.