The primary objective of the Directive, which came into force on 16 December 2019, is the harmonisation among all EU Member States of the minimum standards set to guarantee the so-called "whistleblowers," including the obligation for those covered by the legislation to adopt secure reporting channels that allow whistleblowers to make reports while maintaining the utmost confidentiality of their identity.

As we previously reported, European member states had to implement the Whistleblowing Directive by 17 December 2021, and the European Commission started 2022 the infringement procedure for non-compliant states.

Finally, on 24 January 2023, the Dutch Senate approved the Whistleblowers Protection Act, which replaced the 2016 Whistleblowers Authority Act. It introduces new, more protective measures towards so-called 'whistleblowers,' also including a person who reports breaches of Union (European) law and violations of the employer's internal rules, such as codes of conduct and company regulations. 

It expands the circle of protected persons, including self-employed and temporary workers and persons who assist the reporter and handle the internal report.

It also prohibits retaliation against whistleblowers, and the employer must prove that any eventual disadvantage has nothing to do with the report. Moreover, whistleblowers can report it directly to competent authorities, such as the Whistleblowers Authority, the Personal Data Protection Authority, or the Financial Markets Authority. 

It provides stricter requirements for the employer's internal reporting procedure.

The law already applies to employers with at least 250 employees, while medium-sized employers between 50 and 249 employees have until 17 December 2023 to adapt or establish their internal reporting procedure.

In Italy, the Legislative Decree No. 24 of 10 March 2023, transposing Directive 2019/1937 on whistleblowing, was published in the Official Gazette on 15 March 2023. 

The main novelty is the extension of the obligation to activate an internal whistleblowing channel (before reserved for entities required to adopt organisational models according to Legislative Decree 231/2001) to private entities that have employed an average of at least 50 employees with permanent or fixed-term employment contracts in the last year. 

However, this obligation, for companies that have employed an average of up to 249 employees in the last year, will take effect from 17 December 2023.

The decree extended the list of those protected to all employees, self-employed and potential employees, former employees, employees on a probationary period, and 'facilitators' (i.e., those who aid the worker in the reporting process).

The protection consists in the prohibition of revealing their identity without their consent, even in the context of disciplinary proceedings against the accused person, as well as the prohibition of retaliation (conduct, acts, or omissions, even if only attempted or threatened, carried out because of the report and which cause or are likely to cause unjust harm).

Employers must activate an internal reporting channel, appoint and train internal persons in charge of managing the reporting channel and draw up and publicise a procedure for all employees on the prerequisites and modalities for activating the reporting channel.

The provisions of the decree take effect on 15 July 2023.