Support Procedure

1. INTRODUCTION

1.1. Purpose and Scope

Legislative Decree 24/2023 implements Directive (EU) 2019/1937 concerning the protection of persons who report breaches of Union law, both in terms of confidentiality protection and protection against retaliation. The new regulations ensure on one hand the manifestation of freedom of expression and information, and on the other hand, they serve as a tool to combat and prevent corruption and bad administration phenomena.

The purpose of this procedure is to define:

• The methods for forwarding internal reports made available by the company;
• The methods for managing reports of violations of national or European Union regulatory provisions;
• The protection provided for individuals making reports, whether internal or external, public disclosures, or complaints to the judicial or accounting authority;
• The procedures for conducting investigations following reports.

1.2 Reception, Distribution, and Update

This support procedure is approved by the Board of Directors’ resolution dated January 22, 2024, and is distributed and disseminated as follows:

• Publication on the company’s website;
• Inclusion of a link to the company website page dedicated to whistleblowing;
• Publication on the company’s intranet site with email notification to all company staff;
• Conducting a training course aimed at the Administrative Body and all employees of the Company.

2. INTERNAL AND EXTERNAL REGULATORY REFERENCES

• Legislative Decree March 10, 2023, No. 24 “Implementation of Directive (EU) 2019/1937 of the European Parliament and of the Council of 23 October 2019 on the protection of persons who report breaches of Union law and on the protection of persons who report breaches of national legal provisions”
• Legislative Decree No. 231/2001 Regulation of the Administrative Liability of legal persons, companies, and associations even without legal personality;
• EU Regulation 679/2016 on the protection of personal data;
• Legislative Decree 196/2003 Code regarding the protection of personal data;

ANAC Resolution No. 311 of July 12, 2023 Guidelines on the protection of persons reporting breaches of Union law and protection of persons reporting breaches of national legal provisions. Procedures for the submission and management of external reports;

• National Collective Labor Agreement for the Brick Industry;
• UNI EN ISO 9001:2015 Quality Management Systems – Requirements;

References to the terms and definitions indicated in Legislative Decree 24/2023 and the ANAC Guidelines on whistleblowing are made. The following abbreviations are defined below:

• FC: Compliance Function for corruption prevention of Società Italiana Lastre Spa
• ANAC: National Anti-Corruption Authority

3. OPERATIONAL MODES

3.1. What can be reported (objective scope)

The violations relevant to this procedure and therefore can be the subject of reporting include behaviors, acts, or omissions that harm the public interest or the integrity of Società Italiana Lastre Spa (hereinafter referred to as the Company) of which the whistleblower became aware in the work context of the Company (where the term work context must necessarily be broad and considered not only with regard to those who have a “strict sense” employment relationship with the organization; therefore, to be understood as extended to any collaboration relationship even without a subordination bond with the Company) and which consist of:

• administrative, accounting, civil, or criminal offenses that do not fall into the following points 3), 4), 5), and 6);
• illicit conduct relevant under Legislative Decree June 8, 2001, No. 231, or violations of the Organization and Management Model adopted by the Company, that do not fall into the following points 3), 4), 5), and 6);
• offenses that fall within the scope of application of the European Union or national acts indicated in the annex to Legislative Decree 24/2023 or the national acts that implement the acts of the European Union indicated in the annex to Directive (EU) 2019/1937, even if not indicated in the annex to Legislative Decree 24/2023, relating to the following sectors: public procurement, services, financial products and markets, and prevention of money laundering and terrorist financing; safety and compliance of products; transport safety; environmental protection; radioprotection and nuclear safety; safety of food and feed and health and welfare of animals; public health; consumer protection; protection of privacy and personal data protection and security of networks and information systems;
• acts or omissions that harm the financial interests of the Union as specified in Article 325 of the Treaty on the Functioning of the European Union specified in the relevant derived law of the European Union;
• acts or omissions concerning the internal market, as per Article 26, paragraph 2, of the Treaty on the Functioning of the European Union, including violations of European Union rules on competition and state aid, as well as violations concerning the internal market related to acts that violate rules on corporate taxation or mechanisms whose purpose is to obtain a tax advantage that defeats the object or purpose of the applicable corporate taxation regulations;
• acts or behaviors that defeat the object or purpose of the provisions of the Union acts in the sectors indicated in the previous points 3), 4), and 5).

Information may concern both committed violations and those not yet committed that the whistleblower reasonably believes could be based on concrete elements.

3.2. Exclusions (objective scope)

Not included among the reportable or denounceable information are blatantly unfounded news, information that is already entirely in the public domain, as well as information acquired solely based on rumors or poorly reliable rumors (so-called corridor voices).

According to Legislative Decree 24/2023, the following cannot be the subject of reporting, public disclosure, or complaint:

• disputes, claims, or requests related to a personal interest of the reporting person or the person who made a complaint to the Judicial or Accounting Authority relating exclusively to their individual employment or public employment relationships, or concerning their employment or public employment relationships with hierarchically superior figures (for example, reports concerning labor disputes, discrimination among colleagues, interpersonal conflicts between the reporting person and another worker are excluded);
• reports of violations where already mandatorily regulated by European Union or national acts indicated in Part II of the annex to Legislative Decree 24/2023 or by those national acts that implement the acts of the European Union indicated in Part II of the annex to Directive (EU) 2019/1937, although not indicated in Part II of the annex to the decree;
• reports of violations in matters of national security, as well as contracts relating to defense or national security aspects, unless such aspects fall within the relevant derived law of the European Union.

It is necessary that the report is as detailed as possible to allow the evaluation of the facts by the recipients. In particular, it is necessary that the following are clear:

• the circumstances of time and place in which the fact being reported occurred;
• the description of the fact;
• the general information or other elements that allow identifying the subject to whom the reported facts are attributed.

It is also useful to attach documents that can provide elements of the foundation of the facts being reported, as well as the indication of other subjects potentially aware of the facts.

3.3. Who can report (subjective scope)

Reports covered by this procedure can be made by:

• employees of the Company;
• self-employed workers, including those indicated in Chapter I of the law of May 22, 2017, No. 81 (e.g., contract work, intellectual professions), as well as holders of a collaboration relationship as per article 409 of the code of civil procedure (e.g., agency relationships, commercial representation, lawyers, engineers who provide their activities for a subject organizing it autonomously) and article 2 of Legislative Decree No. 81 of 2015 (these are collaborations organized by the client that are expressed in exclusively personal or continuous work performances, whose execution methods are organized by the client), who carry out their work activity at the Company;
• workers and collaborators who carry out their work activity for economic operators that provide goods or services or that realize works in favor of the Company;
• freelancers and consultants who provide their activity for the Company;
• volunteers and interns, paid and unpaid, who provide their activity for the Company;
• shareholders and persons with administration, management, control, supervision, or representation functions of the Company. The protection of reporting persons as per the previous points also applies in the following cases:

when the legal relationship as per the previous points has not yet started, if the information on the violations was acquired during the selection process or in other pre-contractual phases;

during the probationary period;

following the termination of the legal relationship if the information on the violations was acquired during the relationship itself.

The protection measures provided for by this procedure also apply to:

a) the facilitator, identified as the physical person who assists a reporting person in the reporting process, operating within the same work context and whose assistance must be kept confidential (for example, the facilitator could be a colleague from a different office than that of the reporting person who assists the latter in the reporting process confidentially, that is, without disclosing the learned news. The facilitator could be a colleague who also holds the qualification of a trade unionist if he assists the reporting person in his name and on his behalf, without spending the trade union acronym. It is specified that if, on the other hand, he assists the reporting person using the trade union acronym, he does not hold the role of facilitator. In this case, the application of the provisions on the consultation of trade union representatives and the repression of anti-union conduct as per law No. 300/1970 remains firm);

b) to persons in the same work context of the reporting person (persons linked by a network of relationships that arise because they operate, or have operated in the past, in the same work environment of the reporting person or complainant, for example, colleagues, former colleagues, collaborators), of the one who made a complaint to the Judicial or Accounting Authority or of the one who made a public disclosure and who are linked to them by a stable emotional bond (included in this category are persons who have a cohabitation relationship with the reporting person or a relationship of an emotional nature characterized by a certain stability both in terms of time and in terms of life sharing, even if this does not materialize with the sharing of the same dwelling) or kinship within the fourth degree;

c) to work colleagues of the reporting person or of the person who made a complaint to the Judicial or Accounting Authority or made a public disclosure, who work in the same work context as them and who have a habitual and current relationship with that person (these are those who, at the time of reporting, work with the reporting person and have relationships that are not merely sporadic, occasional, episodic, and exceptional but present, systematic and prolonged over time, characterized by a certain continuity such as to determine a relationship of “commonality”, of friendship between the parties);

d) to entities owned by the reporting person (cases in which a subject is the exclusive owner of an entity, whether in majority co-participation with third parties) or of the person who made a complaint to the Judicial or Accounting Authority or who made a public disclosure or for which the same persons work (entities where those who make a report, public disclosure or complaint work, even though they are not the owner. This refers, for example, to the situation in which the employee of a company that performs a supply service for the Company reports or denounces a violation occurred in the latter. The retaliation could be implemented not against the reporting person or complainant, but against the company in which he operates, through, for example, the early termination of the supply contract), as well as to entities that operate in the same work context of the aforementioned persons (among entities a dense network of relationships and interconnections can develop that are substantiated, for example, in agreements and collaborations, exchanges and confrontations. Therefore, regardless of the nature of the activities that the entities in question carry out, the latter are protected as, due to the connection and interrelation with the reporting person or complainant, they could suffer retaliatory measures following a report, complaint or public disclosure).

The reporting person must take care to report within the text that this is a report for which it is intended to keep one’s identity confidential and benefit from the protections provided in the event of possible retaliation.

3.4. Internal reporting channels

The Company has activated the following internal reporting channels:

• Whistleblowing Information Technology Platform in the footer of all pages of the company website https://www.sil-lastre.com and in the footer of all pages of the company intranet site http://silqnap/WordPress/ for all employees, which guarantees, through the use of encryption tools, the confidentiality of the identity of the reporting person, of the involved person and of the person otherwise mentioned in the report, as well as of the content of the report and of the related documentation possibly attached. The WhistleblowingPA computer platform is created through the SAFESPEAK software that attests to its compliance with the law on the management of reports. It guarantees the maintenance and updating of the platform and does not require technical interventions by internal or external subjects to the entity. Furthermore, Whistleblowing is an ACN qualified service. Only persons authorized to handle reports can access the platform. Furthermore, the platform also allows the sending of anonymous reports. The platform includes a guided procedure with specific questions and within which it is also possible to upload document and audio files.
• Direct meeting request with the Compliance Function for corruption prevention to be made through the platform.

In the case of anonymous reports, which can only be made through the use of the Whistleblowing platform, the Company ensures a management of the same consistent with the whistleblowing reports referred to in this procedure, guaranteeing the confidentiality of the content of the report, of the reported and the reporting person, in the case their identity is known, and the prohibition of acts of retaliation.

3.5. Management of the internal report

The management of internal reports is entrusted to the Compliance Function for corruption prevention. The subjects identified for the management of reports are required to comply with the indications that the legislator has placed

to ensure both an efficient and timely management of the report and the protection of reporting persons.

Who manages the reports:

• issues a notice of receipt of the report to the reporting person within seven days from the date of receipt;
• maintains interactions with the reporting person and requests from the latter, if necessary, integrations;
• diligently follows up on received reports (proper follow-up implies, firstly, an assessment of the existence of the essential requirements of the report to assess its admissibility and therefore be able to grant the reporting person the protections provided);
• provides feedback to the report within three months from the date of the notice of receipt.

With reference to the subjects in charge of managing the report, if a conflict of interest is identified with respect to the reported situation, they must refrain from handling the report. If the conflict of interest concerns the compliance function for corruption prevention, the report will be managed directly by the Supervisory Body.

3.6. The management of investigations

The report manager, within seven days of receiving the report, issues a receipt notice to the reporting person.

Where necessary, for example in the case where what is reported is not adequately detailed, requests additional elements from the reporting person. Once the admissibility of the report, as a whistleblowing report, has been assessed, initiates the internal investigation on the facts or reported conducts to assess their existence.

In particular, proper follow-up implies, firstly, in compliance with reasonable timeframes and data confidentiality, an assessment of the existence of the essential requirements of the report to assess its admissibility and therefore be able to grant the reporting person the protections provided. For the assessment of the aforementioned requirements, the subject managing the reports can refer to the same criteria used by the Authority. For example:

• manifest unfoundedness due to the absence of factual elements suitable to justify investigations;
• ascertained generic content of the illicit report such as not to allow the understanding of the facts or report of illicit acts accompanied by inappropriate or incongruous documentation.

A response to the investigation must be provided within three months from the date of the notice of receipt of the report or, in the absence of such notice (for example in the case of a report made in person), within three months from the expiry date of the seven-day term from the presentation of the report.

Once the admissibility of the report, as a whistleblowing report, has been assessed, the report manager initiates the internal investigation on the facts or reported conducts to assess their existence.

For the conduct of the investigation, the subject to whom the management is entrusted can start a dialogue with the whistleblower, asking the same for clarifications, documents, and further information, always through the dedicated channel in the computer platforms or in person, in the case of a report through direct meeting. Where necessary, it can also acquire acts and documents from other offices of the administration, avail itself of their support, involve third parties through hearings and other requests, always taking care that the protection of the confidentiality of the reporting person and the reported person is not compromised.

All subjects who process data, such as the staff of other offices possibly involved in the management of the report, must be authorized and adequately instructed regarding the processing of personal data.

With reference to the “feedback” to be provided within the three-month term, it is highlighted that the same can also be merely provisional, since information relating to all the activities described above that are intended to be undertaken and the progress of the investigation can be communicated. In this last case, once the investigation is completed, the results must still be communicated to the reporting person.

If, following the activity carried out, the report manager identifies elements of manifest unfoundedness of the report, it orders the archiving with adequate motivation, informing the reporting person, as well as the other internal bodies that had been informed of the receipt of the report.

If, on the other hand, he deems the report founded, he must communicate the outcome of the investigation to the Administrative Body or to the Chief Executive Officer, depending on their respective competences. It is not up to the subject in charge of managing the report to ascertain individual responsibilities of any nature, nor to carry out checks of legality or merit on acts and provisions adopted by the entity/administration subject of the report, under penalty of encroaching on the competences of the subjects appointed for this purpose.

The report manager must provide information to the reporting person on the progress of the investigation and the end of the latter, accounting for the measures provided or adopted or to be adopted to follow up on the report and the reasons for the choice made.

3.7. Activity following the end of the investigation

Once the report manager has communicated to the Administrative Body, or to the Chief Executive Officer, depending on their respective competences, the outcome of the investigation, they implement the most appropriate consequent actions. The decision could include, for example, one or more of the following actions:

• resolve, withdraw or modify the Company’s involvement in a transaction, contract, etc…;
• return or request the return of any improper benefit;
• take disciplinary measures against the staff members involved (in accordance with the National Collective Labor Agreement and the Company Disciplinary System);
• report the issue to the authorities.

3.8. Archiving

If the internal report is submitted to a subject other than the one identified and authorized by the administrator or entity, where the reporting person explicitly declares wanting to benefit from the protections in matters of whistleblowing or such intention is deducible from the report, the report is considered a “whistleblowing report” and must be transmitted, within 7 days from its receipt, to the competent internal subject, giving simultaneous notice of the transmission to the reporting person. Otherwise, it is considered as an ordinary report.

3.10. Conditions for making an external report

The reporting person can make an external report if, at the time of its presentation, one of the following conditions occurs:

a) lack of activation of an internal reporting channel; b) the reporting person has already made an internal report and it has not been followed up; c) the reporting person has well-founded reasons to believe that, if an internal report were made, it would not be effectively followed up or that the same report could determine the risk of retaliation; d) the reporting person has well-founded reason to believe that the violation may constitute an imminent or manifest danger to the public interest.

3.11. External reporting channels

The external report can be sent to ANAC. For details on the reporting channels activated and the management of reports, please refer to the content at the following link: https://www.anticorruzione.it/-/whistleblowing.

ANAC carries out the following activities:

• provides any interested person with information on the use of the external reporting channel and on the protection measures;
• notifies the reporting person of the receipt of the external report within seven days from the date of its receipt, unless explicitly requested otherwise by the reporting person or unless ANAC believes that the notice would prejudice the protection of the confidentiality of the reporting person’s identity;
• maintains interactions with the reporting person and requests from the latter, if necessary, integrations;
• diligently follows up on received reports;
• conducts the necessary investigation to follow up on the report, also through hearings and acquisition of documents;
• provides feedback to the reporting person within three months or, if there are justified and motivated reasons, six months from the date of notice of receipt of the external report or, in the absence of said notice, from the expiry of the seven days from receipt;
• communicates to the reporting person the final outcome, which can also consist of archiving or transmission to competent authorities or in a recommendation or in an administrative sanction.

ANAC also proceeds to send the reports concerning information on the violations that do not fall within its competence to the competent administrative or judicial authority, including the institutions, bodies, or organisms of the European Union, and gives simultaneous notice to the reporting person of the referral.

3.12. Complaint to the Judicial Authority

The possibility of turning to the competent national authorities, judicial and accounting, to report illicit conduct of which they have become aware in their work context is also recognized to reporting subjects.

If the whistleblower holds the status of public official or person charged with public service, even if he has made a report through the internal or external channels mentioned in the previous paragraphs, this does not exempt him from the obligation – by virtue of what is provided by the combined provisions of art. 331 of the Criminal Procedure Code and articles

361 and 362 of the Criminal Code – to report to the competent Judicial or Accounting Authority the criminally relevant facts and hypotheses of erarial damage.

It is remembered in any case that the objective scope of articles 361 and 362 of the Criminal Code, providing the obligation to report only crimes (prosecutable ex officio), is more restricted than that of the reports that can be made by the whistleblower who can also report other types of illicit acts.

The same rules on the confidentiality and content of reports must be respected by the offices of the Judicial Authorities to whom the complaint is made.

3.13. Confidentiality obligation

Reports cannot be used beyond what is necessary to adequately follow up on them.

The identity of the reporting person and any other information from which it can be directly or indirectly inferred, such identity cannot be revealed, without the express consent of the reporting person, to persons other than those competent to receive or to follow up on the reports. The latter must be expressly authorized to process such data pursuant to articles 29 and 32, paragraph 4, of Regulation (EU) 2016/679 and article 2- quaterdecies of the Code on the protection of personal data of Legislative Decree June 30, 2003, No. 196.

If the dispute is founded, in whole or in part, on the report and the knowledge of the reporting person’s identity is indispensable for the defense of the accused, the report will be usable for the disciplinary proceeding only in the presence of the express consent of the reporting person to the revelation of their identity. In this case, the reporting person must be notified by written communication of the reasons for the revelation of the confidential data.

The Company also ensures the confidentiality of the identity of the persons involved or mentioned in the report and extends to them the same guarantees provided in favor of the reporting person.

The report, as well as the attached documentation to it and that acquired and produced during the investigation, are excluded from the access provided by articles 22 and following of the law of August 7, 1990, No. 241, as well as by articles 5 and following of Legislative Decree March 14, 2013, No. 33.

The person involved in the report, also upon his request, can be heard on the reported facts. This procedure can also take place in writing through the acquisition of written observations and documents.

3.14. Processing of personal data

Every processing of personal data collected with the report, including communication between competent authorities, is carried out in accordance with Regulation (EU) 2016/679 and Legislative Decree 196/2003.

As required by article 13, paragraph 6 of Legislative Decree 24/2023, the Company has carried out a specific impact assessment on the protection of data deriving from the management of whistleblowing reports.

All subjects involved in the management of reports receive a specific authorization to process data as well as adequate training, as provided by articles 29 and 32 of Regulation (EU) 2016/679 and 2-quaterdecies of Legislative Decree June 30, 2003, No. 196.

External subjects that provide instrumental services to the management of reports (e.g.: providers of the computer platform) are designated as Data Processor pursuant to article 28 of Regulation (EU) 2016/679. Such subjects are required to provide guarantees regarding the adoption of adequate security measures in compliance with article 32 of Regulation (EU) 2016/679 as well as to ensure an adequate level of compliance with current provisions on processing, including the application of what is provided by Legislative Decree 24/2023 on the protection of the reporting person’s identity.

The European regulation on the protection of personal data provides that, in some specific cases, national law may limit the scope of the obligations of the data controller and the rights generally recognized to the data subjects by CHAPTER III of Legislative Decree 196/2003 and Regulation (EU) 2016/679.

In particular, article 13, paragraph 3 of Legislative Decree 24/2023 provides, within the scope of reports, a limitation of the rights of the data subjects pursuant to article 2-undecies of Legislative Decree 196/2003; this limitation applies when the exercise of such rights could result in an actual and concrete prejudice to the confidentiality of the identity of the reporting person and of the persons possibly involved/mentioned in the report itself.

Therefore, the reporting person can exercise the right of access to their data, rectification or integration, cancellation and limitation of processing with the methods specified in the information provided to the whistleblower.

The reporting person, pursuant to article 77 of Regulation (EU) 2016/679, also has the right to lodge a complaint with the Data Protection Authority, if he believes that the processing violates the aforementioned Regulation.

The exercise of the rights under articles 15 to 22 of Regulation (EU) 2016/679 may be delayed, limited, or excluded with timely and motivated communication when the exercise of such rights may result in an actual and concrete prejudice to the confidentiality of the reporting person’s identity as provided by article 2-undecies, letter f of Legislative Decree 196/2003 (in implementation of article 23 of Regulation (EU) 2016/679.

In such cases, the data subjects can exercise the aforementioned rights through the Data Protection Authority with the methods provided by article 160 of Legislative Decree 196/2003.

The processing of personal data related to the receipt and management of reports is carried out by the Company in compliance with the principles of articles 5 and 25 of Regulation (EU) 2016/679, providing adequate information to reporting persons and involved persons pursuant to articles 13 and 14 of the same Regulation (EU) 2016/679, as well as adopting appropriate measures to protect the rights and freedoms of the data subjects.

3.15. Conservation of documentation concerning reports

Reports and related documentation are stored for the time necessary for the processing of the report and in any case no longer than five years from the date of communication of the final outcome of the reporting procedure, in compliance with the confidentiality obligations provided by article 12 of Legislative Decree 24/2023 and the principle of articles 5, paragraph 1, letter e), of Regulation (EU) 2016/679.

3.16. Public disclosures

The reporting person who makes a public disclosure benefits from the protection provided by Legislative Decree 24/2023 if, at the time of public disclosure, one of the following conditions occurs:

• the reporting person has previously made an internal and external report or has directly made an external report, under the conditions and in the manner provided by Legislative Decree 24/2023 and no feedback has been provided within the terms provided by the legislation on the measures provided or adopted to follow up on the reports;
• the reporting person has well-founded reason to believe that the violation may constitute an imminent or manifest danger to the public interest;
• the reporting person has well-founded reason to believe that the external report may entail the risk of retaliation or may not be effectively followed up due to the specific circumstances of the concrete case, such as those in which evidence may be concealed or destroyed or in which there is well-founded fear that those who received the report may be colluded with the author of the violation or involved in the violation itself.

4. PROTECTION MEASURES

The Company ensures compliance with the protection measures provided in Chapter III of Legislative Decree 24/2023, indicated below.

4.1. Conditions for the protection of the reporting person

The protection measures provided in Chapter III of Legislative Decree 24/2023 apply to the persons indicated in paragraph 3.3. of this procedure when the following conditions occur:

a) at the time of the report or complaint to the judicial or accounting authority or public disclosure, the reporting person or complainant had well-founded reason to believe that the information on the reported violations, publicly disclosed or denounced, was true and fell within the objective scope referred to in paragraph 3.1 of this procedure;

b) the report or public disclosure was made based on what is provided by Chapter II of Legislative Decree 24/2023.

The reasons that led the person to report or denounce or disclose publicly are irrelevant for his protection.

Except as provided by article 20 of Legislative Decree 24/2023, when the criminal liability of the reporting person for the crimes of defamation or slander or anyway for the same crimes committed with the complaint to the judicial or accounting authority or his civil liability, for the same title, in cases of malice or gross negligence, the protections are not guaranteed and a disciplinary sanction is imposed on the reporting person or complainant.

The provisions of this paragraph also apply in cases of anonymous reporting or complaint to the judicial or accounting authority or public disclosure, if the reporting person has been subsequently identified and has suffered retaliation, as well as in cases of reporting submitted to the institutions, bodies, or competent organisms of the European Union, in accordance with the conditions of article 6 of Legislative Decree 24/2023. The Company ensures, therefore, the conservation of documentation relating to anonymous reports for no longer than five years from the date of receipt of the report, thus making it possible to trace them in case the reporting person communicates to ANAC that he has suffered retaliatory measures because of that anonymous report or complaint.

4.2. Prohibition of retaliation

The subjects referred to in paragraph 3.3 of this procedure may not suffer any retaliation.

Retaliation means any behavior, act or omission, even just attempted or threatened, carried out because of the report, complaint to the judicial or accounting authority or public disclosure and that causes or may cause to the reporting person or to the person who made the complaint, directly or indirectly, an unjust harm.

In the context of judicial or administrative proceedings or anyway of extrajudicial disputes aimed at ascertaining the behaviors, acts or omissions prohibited under this paragraph against the persons referred to in paragraph 5.2., it is presumed that the same have been carried out because of the report, public disclosure or complaint to the judicial or accounting authority. The burden of proving that such conducts or acts are motivated by reasons unrelated to the report, public disclosure or complaint lies with the person who carried them out.

In the case of a compensation claim filed with the judicial authority by the persons referred to in paragraph 5.2., if such persons demonstrate that they have made, pursuant to Legislative Decree 24/2023, a report, public disclosure or complaint to the judicial or accounting authority and have suffered harm, it is presumed, unless proven otherwise, that the damage is a consequence of such report, public disclosure or complaint to the judicial or accounting authority.

Below are some cases that constitute retaliation:

• dismissal, suspension or equivalent measures;
• demotion or non-promotion;
• change of functions, change of workplace, salary reduction, change of working hours;
• suspension of training or any restriction of access to it;
• negative merit notes or negative references;
• the adoption of disciplinary measures or other sanctions, even financial;
• coercion, intimidation, harassment or ostracism;
• discrimination or anyway unfavorable treatment;
• non-conversion of a fixed-term employment contract into an indefinite-term employment contract, where the worker had a legitimate expectation to such conversion;
• non-renewal or early termination of a fixed-term employment contract;
• damage, including to the reputation of the person, especially on social media, or economic or financial prejudices, including loss of economic opportunities and loss of income;
• inclusion in improper lists based on a formal or informal sector agreement, which may result in the impossibility for the person to find employment in the sector in the future;
• early termination or cancellation of the supply contract of goods or services;
• cancellation of a license or permit;
• the request for psychiatric or medical assessments.

4.3. Protection from retaliation

The subjects referred to in paragraph 3.3 of this procedure can communicate to ANAC the retaliations that they believe to have suffered. It is specified that those who have a qualified link with the reporting person, complainant or public discloser who suffer retaliation because of said connection (e.g. facilitator, etc..) are also included among the subjects that can communicate to ANAC. ANAC immediately informs the Department of Public Function at the Presidency of the Council of Ministers and any guarantee or disciplinary bodies, for the measures within their competence.

In order to acquire the necessary investigative elements for the ascertainment of retaliations, ANAC can avail itself, within their respective competences, of the collaboration of the Public Function Inspectorate and the National Labor Inspectorate, without prejudice to the exclusive competence of ANAC in terms of the evaluation of the elements acquired and the possible application of the administrative sanctions provided by article 21 of Legislative Decree 24/2023.

It is necessary that the reporting person provides ANAC with objective elements from which it is possible to deduce the consequentiality between the report, complaint, public disclosure made and the alleged retaliation.

Acts adopted in violation of article 17 of Legislative Decree 24/2023 are null and void. The persons referred to in paragraph 3.3 of this procedure who have been dismissed because of the report, public disclosure or complaint to the judicial or accounting authority have the right to be reinstated in the workplace, pursuant to article 18 of the law of May 20, 1970, No. 300 or article 2 of Legislative Decree March 4, 2015, No. 23, depending on the specific applicable discipline to the worker.

The judicial authority addressed adopts all the measures, even provisional, necessary to ensure the protection of the subjective legal situation brought into action, including compensation for damages, reinstatement in the workplace, the order to cease the conduct carried out in violation of article 17 of Legislative Decree 24/2023 and the declaration of nullity of the acts adopted in violation of the same article.

4.4. Support measures

The list of Third Sector entities that provide reporting persons with support measures is established at ANAC. The list, published by ANAC on its website, contains the Third Sector entities that exercise, according to the provisions of their statutes, the activities referred to in article 5, paragraph 1, letters v) and w), of Legislative Decree July 3, 2017, No. 117, and that have signed conventions with ANAC.

The support measures consist of information, assistance, and free consultations on the methods of reporting and on the protection from retaliation offered by national and European Union regulatory provisions, on the rights of the involved person, as well as on the methods and conditions of access to legal aid at the expense of the State.

4.5. Limitations of liability

The subject referred to in paragraph 3.3 of this procedure who reveals or discloses information on the violations covered by the secrecy obligation or relating to the protection of copyright or the protection of personal data or reveals or discloses information on the violations that offend the reputation of the involved person or reported, when, at the time of the revelation or disclosure, there were well-founded reasons to believe that the revelation or disclosure of the same information was necessary to reveal the violation and the report, public disclosure or complaint to the judicial or accounting authority was made according to what is provided by Legislative Decree 24/2023. When such hypotheses occur, any further liability, even of a civil or administrative nature, is also excluded.

Unless the fact constitutes a crime, the subject referred to in paragraph 3.3 (THE REPORTING PERSON) of this procedure does not incur any liability, even of a civil or administrative nature, for the acquisition of information on the violations or for access to the same. In any case, criminal liability and any other liability, even of a civil or administrative nature, is not excluded for behaviors, acts or omissions not related to the report, complaint to the judicial or accounting authority or public disclosure or that are not strictly necessary to reveal the violation.

5. ROLES AND RESPONSIBILITIES

Activity / Actions	Reporting Person	Compliance Function
Submission of the report	R
Drafting minutes in case of oral report or face-to-face meeting		R
Preliminary analysis of the report		R
Investigation and outcome of 231 reports		R
Investigation and outcome other reports		R
Preparation of minutes		R
Communications with the reporter		R

6. ARCHIVING, STORAGE AND TRACEABILITY

Document Title/Registration	Resp. Archiving	Storage mode	Storage time
Documents inherent in the reports	Compliance function	File	5 years after notification of the outcome of the report

7. ATTACHMENTS

No attachments present.