In implementation of Directive (EU) 2019/1937 of the European Parliament and of the Council of 23 October 2019 concerning the protection of persons who report breaches of Union law, Legislative Decree n. 24 of 10 March 2023 has been issued with title “Implementation of Directive (EU) 2019/1937 of the European Parliament and of the Council, of 23 October 2019, concerning the protection of persons who report breaches of Union law and containing provisions concerning the protection of persons who report violations of national regulatory provisions” (the “Decree”).

Pursuant to this regulation, companies such as Gestore dei Mercati Energetici S.p.A. (“GME”) must set up internal reporting channels through which conduct, acts or omissions that harm the public interest or the GME integrity can be reported and which consist of::

• administrative, accounting, civil or criminal offences;
• relevant unlawful conduct pursuant to Legislative Decree 231/2001, or violations of the organization and management models set forth therein;
• offences that fall within the scope of European Union or national acts relating to the following sectors: public procurement; financial services, products and markets and the prevention of money laundering and terrorist financing; product safety and compliance; transport safety; environmental protection; radiation protection and nuclear safety; food, and animal feed safety and animal health and welfare; public health; consumer protection; protection of privacy and protection of personal data and security of networks and information systems;
• acts or omissions affecting the financial interests of the European Union;
• acts or omissions related to the internal market;
• acts or behaviours that cause disorder in relation to the object or purpose of the provisions referred to in the acts of the European Union.

As required by Article 5 of the Decree, information on the channel, procedures and conditions for making internal reports is provided below, as well as on the channel, procedures and conditions for making external reports (all as defined below).

***

Article 4 of the Decree - Internal reporting channels

1. Subjects in public and private sector, having heard the representatives or trade union organizations referred to in Article 51 of Legislative Decree n. 81 of 2015, activate, pursuant to this article, their own reporting channels, which guarantee, also through the use of encryption tools, the confidentiality of the identity of the reporting person, of the person involved and of the person in any case mentioned in the report, as well as the content of the report and related documentation. The organization and management patterns mentioned in Article 6, paragraph 1, letter a), of Legislative Decree n. 231 of 2001, provide for the internal reporting channels mentioned in this Decree.
2. The management of the reporting channel is entrusted to a person or to a dedicated independent internal office and with specifically trained personnel for its management, or it is entrusted to an external entity, also independent and with specifically trained personnel.
3. The reports are made in written form, also by electronic means, or in verbal form. Internal reports in verbal form are made through telephone lines or voice messaging systems or, at the request of the reporting person, through a direct meeting set within a reasonable time.
4. […].
5. The subjects of the public sector which are required to provide a role for the person responsible for prevention of corruption and transparency, as per Article 1, paragraph 7, of the law of 6 November 2012, n. 190, entrust to the latter, even in the cases of sharing as per paragraph 4, management of the internal reporting channel.
6. […].

Article 5 of the Decree - Management of the internal reporting channel

1. As part of the management of the internal reporting channel, the person or the internal office, or the external entity, that is entrusted with the management of the internal reporting channel, carry out the following activities: a) issue the reporting person with acknowledgement of receipt of the report within seven days of the date of receipt; b) maintain discussions with the reporting person and can ask the latter, if necessary, for further information; c) provide proper follow-up to the reports received; d) answer to the report within three months of the date of the acknowledgement of receipt or, in the absence of such notice, within three months of the expiry of the term of seven days from the submission of the report; e) make available clear information on the channel, procedures and conditions for making internal reports, as well as on the channel, procedures and conditions for making external reports. The aforementioned information is displayed and made easily visible in the workplace, as well as accessible to people who, while not attending the workplace, maintain a legal relationship according to one the forms mentioned in Article 3, paragraphs 3 or 4. If they have their own Web site, public and private sector entities publish the information referred to in this letter also in a dedicated section of the aforementioned Web site.

Article 6 of the Decree - Conditions for carrying out external reporting

1. The reporting person can make an external report if, at the time of its submission, one of the following conditions is met: a) the mandatory activation of the internal reporting channel is not provided in the context of his/her working context or this, even if mandatory, is not active or, even if activated, does not comply with the provisions of Article 4; b) the reporting person has already made an internal report pursuant to Article 4 and it has not been followed up; c) the reporting person has clear grounds to believe that, in case of an internal report, it would not receive the proper follow up or that the report itself could lead to the risk of retaliation; d) the reporting person has reasonable grounds to believe that the violation may constitute an imminent or obvious danger to the public interest.

Article 12 of the Decree - Confidentiality obligation

1. Reports cannot be used beyond what is necessary to provide their proper follow-up.
2. The identity of the reporting person and any other information from which it can be understood, directly or indirectly, this identity cannot be disclosed, without the clear consent of the reporting person himself, to persons other than those competent to receive or follow up on the reports, clearly authorized to process such data pursuant to Articles 29 and 32, paragraph 4, of regulation (EU) 2016/679 and Article 2 -quaterdecies of the Code regarding the protection of personal data as mentioned in Legislative Decree n. 196 of 30 June 2003.
3. In the context of criminal proceedings, the identity of the reporting person is covered by secrecy in the manner and within the limits established by Article 329 of the Criminal Procedure Code.
4. In the context of the proceedings before the Court of Auditors, the identity of the reporting person cannot be disclosed until the conclusion of the investigation phase.
5. In the context of the disciplinary proceedings, the identity of the reporting person cannot be disclosed, where the contestation of the disciplinary charge is based on separate and additional assessments with respect to the report, even if consequent to the same. If the dispute is based, in whole or in part, on the report and knowledge of the identity of the reporting person is essential for the defence of the accused person, the report can be used for the purposes of the disciplinary proceedings only with clear consent of the reporting person to reveal their identity.
6. Notice is given to the reporting person by written communication of the reasons for the disclosure of confidential data, according to the event mentioned in paragraph 5, second sentence, as well as in the internal and external reporting procedures referred to in this chapter when the disclosure of the identity of the reporting person and of the information mentioned in paragraph 2 is also required for the purpose of defending the person involved.
7. The subjects of the public and private sector, the ANAC, as well as the administrative authorities to which the ANAC sends the external reports of their competence, protect the identity of the persons involved and of the persons mentioned in the report until the conclusion of the proceedings started in connection with the report, in compliance with the same guarantees provided in favour of the reporting person.
8. The access to the report is denied, according to Articles 22 and following of the Law of 7 August 1990, n. 241, as well as by Articles 5 and following Articles of the Legislative Decree n. 33 of 14 March 2013.
9. Without prejudice to the provision of paragraphs 1 to 8, in the internal and external reporting procedures mentioned in this chapter, the person involved can be heard, or, upon his/her request, is heard, also through a dematerialised procedure through the acquisition of written observations and documents.

Article 14 of the Decree - Storage of documents related to reports

1. The internal and external reports, and the related documents, are kept for the time necessary to process the report and in any case no later than five years from the date of communication of the final outcome of the reporting procedure, in compliance with the confidentiality obligations pursuant to Article 12 of this Decree and to the principle mentioned in Articles 5, paragraph 1, letter e), of Regulation (EU) 2016/679 and 3, paragraph 1, letter e), of Legislative Decree n. 51 of 2018.
2. […].
3. […].
4. When, upon request of the reporting person, the report is made in verbal form during a meeting with the personnel in charge, it is documented by the personnel in charge, with the prior consent of the person in charge, by recording it on a suitable device for storage and listening or by written minutes. In case of minutes, the reporting person can check, correct and confirm the minutes of the meeting by means of his/her signature.

***

Further information is available on the ANAC Web site, at the following link https://www.anticorruzione.it/-/whistleblowing

Internal reporting system - Gestore dei Mercati Energetici S.p.A.

Furthermore, pursuant to the provisions of Article 14, paragraph 4, of the Decree, the internal report, upon request to that effect by the reporting party, may also be made in verbal form during a meeting with the assigned personnel who, with the consent of the reporting party, will record it on a suitable device for storage and listening or will transcribe it in specific minutes.

External reporting system - National Anti-corruption Authority