WHO CAN REPORT?

(Reports from other subjects are not admissible)

• Employees
• Self-employed workers
• Workers or collaborators supplying goods or services or carrying out works on behalf of third parties (e.g., employees or collaborators of suppliers)
• Freelancers and consultants
• Volunteers and interns
• Individuals holding administrative, managerial, supervisory, monitoring, or representative roles within MASTELLI
  

What Can Be Reported?

(Reports on other violations are inadmissible)

For private companies with more than 50 employees, reports may concern:
Violations of specific EU laws that harm public interest or the integrity of public/private entities, known by the whistleblower in their work context, consisting of:
a. Violations under the scope of EU or national acts in the following areas:

1. Public procurement
2. Financial services, products, and markets
3. Anti-money laundering and counter-terrorism financing
4. Product safety and compliance
5. Transport safety
6. Environmental protection
7. Radioprotection and nuclear safety
8. Food and feed safety
9. Animal health and welfare
10. Public health
11. Consumer protection
12. Privacy and personal data protection
13. Network and information systems security
    b. Acts or omissions affecting the EU's financial interests
    c. Acts or omissions concerning the internal market
    d. Acts or behaviours undermining the object or purpose of EU provisions

as detailed in the "Defined Catalogue" annexe.

Practical examples of reportable violations:

1. Irregularities in renewable energy incentive procedures
2. Breaches of rules for manufacturing authorizations, labelling, package leaflets, or pharmacovigilance
3. Violations in clinical trials or medicine surveillance
4. Breaches in animal by-product transportation and health standards
5. Violations of GDPR provisions, e.g., processing personal data without required consent

What Cannot Be Reported?

(Legislative Decree 24/2023 protections do not apply to):

1. Reports related to personal interests involving only the whistleblower's individual employment relationship (these are treated as regular complaints).
2. Violations already governed by specific EU or national provisions, such as market abuse under EU Regulation No. 596/2014.
3. Violations related to national security and defense
   

Minimum Requirements for a Report

A report must include:

• The whistleblower's identity and contact information for follow-up communication (anonymous reports are not eligible for whistleblowing protections, but will be handled as regular reports)
• A declaration of intent to benefit from whistleblowing protections (e.g., "Confidential for the Report Management Committee")
• Time and place circumstances of the reported events.
• A detailed description of the facts.
• Identifying information of individuals involved in the reported events.

Protections for Whistleblowers

(For valid and admissible reports):

a. Confidentiality Obligation:

• The whistleblower's identity and report details cannot be disclosed without their consent, except to authorized individuals.
• Confidentiality also extends to individuals mentioned in the report until the related proceedings conclude.

b. Data Protection Compliance:

• Personal data related to reports is processed following EU and national data protection laws.
• Reports and related documents are retained only for the necessary duration, not exceeding five years from the outcome's communication date.

c. Protection Against Retaliation:

• Retaliation includes any act, omission, or attempt causing unjust harm to the whistleblower (e.g., sanctions, dismissal).

Protections Extend To:

• Facilitators (individuals assisting the whistleblower in the reporting process);
• Colleagues or individuals in the same work context with close ties to the whistleblower (e.g., relatives up to the fourth degree, frequent collaborators).
  

Internal Reporting Channels (MASTELLI)

How to Report Internally:

1. Written Reports: Use a system of letters and envelopes:

• First envelope: identifying information of the whistleblower
• Second envelope: report content

Both placed in a third envelope labelled "Confidential for the Report Management Committee." A dedicated mailbox for submission is available at each local unit of MASTELLI. External individuals can mail letters with the same label on the envelope

1. Oral Reports:

• Direct meetings with the Report Management Committee, which will draft a signed report, providing a copy to the whistleblower
  

Who Handles Reports?

The Report Management Committee, composed of Dr. Maria Claudia Torlasco and Dr. Vittorio Borgo, ensures confidentiality and adheres to EU data processing principles.

REPORTING PROCEDURE – How a Report is Handled

If the whistleblower has provided contact details, they will receive an acknowledgement of receipt within 7 days from the date the Committee receives the report.

The Committee conducts a preliminary review, verifying only eligible and admissible reports. A response is provided to the whistleblower within 3 months from the acknowledgement date, indicating one of the following outcomes:

• Closure of the report (with or without further action)
  
• Archiving of the report
• Request for additional information or clarification
  

External Reporting Channel (ANAC)

External reporting via ANAC's platform is allowed if:

• The internal channel is inactive or non-compliant with Legislative Decree 24/2023.
• No follow-up was provided for the internal report.
• The whistleblower reasonably believes the internal report would be ineffective or lead to retaliation.
• The violation poses an imminent and obvious risk to public interest.