News · Criminal law · – October 2026
Art. 12, paragraph 2, of Legislative Decree (d.lgs.) No 24 of 10 March 2023 prohibits disclosing, without the whistleblower’s express consent, to persons other than those responsible for receiving or following up reports, not only the whistleblower’s identity but any other information from which it may be inferred, directly or indirectly. Art. 4, paragraph 1, requires internal channels that guarantee such confidentiality, including through encryption tools, and provides that the organisation and management models under d.lgs. 231/2001 (the Italian corporate liability regime, “modello 231”) must include them; art. 6, paragraph 2-bis, of d.lgs. 231/2001, as replaced by art. 24, paragraph 5, of d.lgs. 24/2023 and in force on 24 October 2026, requires the models to provide for internal reporting channels, the prohibition of retaliation and a disciplinary system. Art. 21, paragraph 1, letter a), penalises breaches of confidentiality with an administrative fine of EUR 10,000 to 50,000, which the Italian National Anti-Corruption Authority (ANAC) imposes on “the person responsible”. By Resolution (delibera) No 344 of 9 September 2026, filed on 16 September and announced by the Authority on 6 October, the ANAC Board imposed a fine of EUR 15,000 on each of the three members of the collegial body that had handled an internal report in a private company with a 231 model. The report, anonymous and submitted on 9 December 2024 through an encrypted platform, concerned allegedly fictitious amendments to a contract with a client, intended to allow activities due to end in 2025 to be invoiced in 2024; it attached e-mails exchanged among five people, including the whistleblower and the reported person. The body interviewed only those people, starting with the reported person, plus the latter’s superior, telling them that a whistleblowing report existed, which contract and client it concerned and that their names appeared in the attachments. The charge under letter b) was instead dismissed: the Authority checks that verification and analysis were actually carried out, not whether the handler’s conclusions were correct on the merits.
The first principle concerns the object of the offence. In the Authority’s view, the words “may be inferred” shift the inquiry to the capacity of the information disclosed to lead back to the whistleblower, so that the breach exists even without proof that a third party actually identified them; that capacity is measured, with reference to recital 26 of Regulation (EU) 2016/679 (GDPR), against the means the recipients can reasonably use, combining what they learn with what they already know. In this case the relevant factors were the small working group, the whistleblower’s lower seniority and marginal role, and their known disagreements with the superior who was reported. Identification was in any event held proven by circumstantial evidence: the whistleblower’s exclusion from work on the contract, the remark by which the chair of the body attributed the report to them before the interview formally began, the disciplinary charge ten days later and the dismissal, declared null as retaliatory by a judgment that is not yet final. The second principle concerns fault. The investigation “circumscribed” to the single contract and to the persons directly involved, presented by the defence as a precaution, was found to be the very cause of the disclosure: where few people are involved, the handler must widen the scope of the checks, at least in appearance, for instance by extending them to other files or framing them as a compliance audit. Asking interviewees to keep silent is not enough: the information must not be given to anyone able to infer the identity from it. In setting the fine under art. 11 of Law 689/1981, the link with the retaliation, the failure to act after the whistleblower had voiced fears of adverse measures and the members’ senior roles, which made the minimum insufficiently punitive, weighed against them; negligence rather than intent, and the fact that the events predated the Guidelines on internal channels approved by ANAC Resolution No 478 of 26 November 2025, weighed in their favour. The proceedings on retaliation are suspended pending a final judgment. In our view, that mitigating factor will no longer be available for reports handled after those Guidelines.
Summary note by the CommercialistiAvvocati network, based on specialised legal and practice sources. The text does not reproduce original contributions and does not constitute professional advice.