Whistleblowing

At the time of reporting, and with particular reference to reports of violations as per Legislative Decree 24/2023, whatever the channel or method, the reporting person or complainant must have reasonable and well-founded cause to believe that the information on violations reported, publicly disclosed or denounced is true and comes within the scope of the legislation.
In order to enable the appropriate analysis and in-depth study to be carried out by the Responsible Parties, it is important that the report is timely in relation to the alleged violations communicated.

The report must be made using the channels provided (internal, external and public disclosure) according to the criteria indicated in the following paragraphs.

Whistleblowers are primarily required to report any violations or non-compliance with the Code of Ethics, internal legislation, the law, comprising the violations referred to in Legislative Decree 24/2023, including those relevant pursuant to Legislative Decree 231/01 and violations of organisation and management models, of which they are aware, using the IT platform Comunica Whistleblowing, which guarantees the security and protection of data and the confidentiality of information, by way of an advanced communication and database encryption system, in line with the provisions set forth by reference legislation.

This channel, which guarantees the confidentiality of the whistleblower’s identity, the secure storage of the documents transmitted and uploaded and the confidential handling of the analysis and management processes, ensures the protections envisaged by Legislative Decree 24/2023 and is therefore considered preferential compared to any other channel that may be used.

Through the Comunica Whistleblowing platform it is possible to make reports in writing, electronically and orally, through a voice messaging system, or request a direct meeting with the persons in charge of managing the report.

Once the report has been entered to the platform or the direct meeting has been requested, a unique identification code will be displayed that must be used to "dialogue" with the parties responsible for managing the report in a depersonalised manner and to remain constantly informed regarding the processing status of the report sent.

It is therefore necessary to correctly take note of the unique identification code of the report and keep it with care, because, in case of loss, the same can not be recovered or duplicated in any way and therefore will be required to make a new report.

Reporting parties interested in submitting a report through methods and channels other than the IT platform adopted by Acea and the Group’s subsidiaries, with the intention of keeping their identity confidential and benefiting from the protections provided in the event of retaliation suffered as a consequence of the report, must clearly indicate in the subject of the report or on the envelope that it is a confidential whistleblowing report. Otherwise, the report will be treated as an ordinary report.

Reports that are unrelated to possible non-compliance with laws, internal rules and Code of Ethics will not be given any consideration.

Go to the Comunica Whistleblowing platform

How to manage internal reports

Reports relating to alleged violations of the Code of Ethics, the Internal Control System or Legislative Decree 24/2023 on the part of Acea or the Group's subsidiaries are transmitted to the Ethics Officer, a collegial body responsible for the related management performed, for Acea and for the individual Group subsidiaries, as an external party.

The Ethics Officer is currently composed of:

• External member - Ethics Officer Coordinator;
• Head of Acea SpA Risk & Compliance;
• Head of Acea SpA Human Resources;
• Head of Acea SpA Internal Audit.
  

Find out more about the other tasks of the Ethic Officer.

Reports concerning significant unlawful behaviours pursuant to Legislative Decree 231/01 and violations of the organisation and management models on the part of Acea and the Group's subsidiaries are transmitted to the Supervisory Body of the Company to which the 231 violations refer, as an external party.

The 231 Supervisory Body is appointed by resolution of the Board of Directors of Acea and the Group's subsidiaries.
In the case of Reports that refer totally or partially to a person who is responsible for receiving or managing them, the person in question is excluded from the Reporting party and / or other parties involved or, in any case, abstains from participating in the analysis and investigations.

Any reports received by persons other than those indicated above must be returned to the competent parties within 7 days from the date of receipt, at the same time notifying the whistleblower.

The parties responsible for managing the reports identified above:

• notify the reporting person that the report has been received within 7 days of the date of receipt thereof;
• maintain a dialogue with the reporting person and may request the latter, where necessary, to provide additional information and documentation;
• diligently follow up on the reports received;
• carry out the investigations necessary to follow up on the report, including through hearings and acquisition of documents;
• give the reporting party feedback, meaning thereby the communication of information regarding the follow-up provided or intended to be provided to the report, within 3 months or, in the absence of such notice, within 3 months of the expiry of the period of seven days following submission of the report.
  

Characteristics and conditions of the report

To allow the useful performance of fact-finding activities, the report must be detailed.

The following must be clearly indicated:

• the circumstances regarding the time and place where the event concerned with the report occurred;
• a description of the event;
• personal details or other elements allowing identification of the person to whom the reported facts are attributed.
  

It is also useful to attach documents that can provide elements validating the facts being reported, as well as the indication of other parties potentially aware of the facts.

Generic and insufficiently detailed reports that do not allow an adequate investigation to be carried out, even by speaking to the whistleblower to acquire further elements useful for performing the checks, will be archived.  

External reports to the National Anti-Corruption Authority (ANAC) are allowed only insofar as the followingwhen certain conditions expressly set forthprovided for by the legislator in Legislative Decree 24/2023 are met below:

• no provision is made in the workplace for the activation of an internal company reporting channel or, even where mandatory, the same is not operational or, even if operational, does not comply with legal requirements;
• the reporting person has already made an internal report through company channels and the same has not been followed up, intending by follow-up the action taken by the person entrusted with management of the reporting annel to assess the existence of the reported facts, the outcome of the investigations and any measures taken;
• the reporting person has reasonable grounds to believe that if an internal report was to be made, it would not be effectively followed up or that such report might lead to a risk of retaliation;
• the reporting person has reasonable grounds to believe that the breach may constitute an imminent or manifest threat to the public interest.
  

At the time of reporting, the reporting person must have reasonable and well-founded reason to believe that the information on reported violations is true and falls within the scope of the legislation referred to in Legislative Decree 24/2023.

Reports must be made in the public interest or to safeguard the integrity of the entity to which they relate. In particular, these may not concern:

• disputes, claims or requests linked to the personal interest of the whistleblower or of the party who has filed a complaint with the judicial or accounting authority exclusively pertaining to their individual employment relationships, or concerning their employment relationships with hierarchically superior figures[1];
• reports of violations insofar as already mandatorily regulated by the European Union or national acts referred to in Part II of the Annex to Legislative Decree 24/2023 or by those issued at national level implementing the European Union acts referred to in Part II of the Annex to Directive (EU) 2019/1937, even though not specified in Part II of the Annex to this decree;
• reports of breaches in matters of national security, as well as contracts relating to defence or national security aspects, unless such aspects fall within the applicable secondary European Union legislation;
• significant unlawful conduct pursuant to Legislative Decree 231/01 and violations of organisation and management models (as per Article 2a), point 2) of Legislative Decree 24/2023) unless they refer to Group companies attributable to "public sector subjects" pursuant to Article 2 of Legislative Decree 24/2023;
• in general, violations of the rules and principles contained in the Code of Ethics of Acea and of the Group's subsidiaries, other than those attributable to the cases set forth by Article 2, paragraph 1 a) of Legislative Decree 24/2023 (for example, issues related to business ethics, harassment, discrimination, etc.).

The channel made available to ANAC also through the use of encryption tools, ensures confidentiality as regards the identity of the reporting person, the person involved and the person mentioned in the report, as well as the report content and related documentation.

[1] ANAC Guidelines ... "Excluding therefore, by way of example, reports concerning labour disputes, discrimination between colleagues, interpersonal conflicts between the reporting person and another worker”

At the time of reporting, the reporting person must have reasonable and well-founded grounds to believe that the information on reported breaches is true and comes within the scope of the legislation.

Reports must be made in the public interest or to safeguard of the integrity of the entity to which they relate.

Without prejudice to the conditions for external reporting, whistleblowers may directly make a public disclosure only insofar as:

• the reporting person has previously made an internal or external report through internal corporate channels or has made an external report directly and no response has been given within the established deadlines on the measures envisaged or taken to follow up on the reports;
• the reporting person has reasonable grounds to believe that the breach may constitute an imminent or manifest danger to the public interest;
• the reporting person has reasonable grounds to believe that external reporting may imply a risk of retaliation or may not be effectively followed up due to the specific circumstances of the particular case, such as those where evidence may be concealed or destroyed or where there is a well-founded concern that the party receiving the report may be colluding with perpetrator or involved in the breach in question.
  

• The identity of the whistleblower may not be disclosed to persons other than those able to receive or follow up on reports;
• The protection concerns not only the name of the whistleblower but also all elements of the report from which the identification of the whistleblower can be derived, even indirectly;
• The report is removed from access to administrative documents and the right of general civic access;
• The protection of confidentiality is extended to include the identity of persons involved and persons mentioned in the report pending conclusion of the proceedings initiated in connection with the report, subject to the same guarantees as those provided for the reporting person.

The safeguarding of confidentiality is also guaranteed in jurisdictional and disciplinary matters:

• with regard to criminal proceedings, the identity of the whistleblower is covered by secrecy in the manners and within the limits set forth by Article 329 of the Code of Criminal Procedure;
• in proceedings before the Court of Auditors, the obligation as regards confidentiality of investigations is envisaged until termination of the investigation phase;
• as part of the disciplinary procedure initiated by the Company against the alleged perpetrator of the reported conduct, the identity of the whistleblower cannot be revealed, whenever the dispute concerning the disciplinary charge is based on separate and further investigations with respect to the report, even if consequent to the same. In the event that the identity of the whistleblower is essential to the defence of the person against whom the disciplinary charge has been brought, this can only be revealed with the express consent of the whistleblower.

The internal reporting channel (Comunica Whistleblowing IT platform) adopted by Acea guarantees the confidentiality of the identity of the whistleblower and of the persons involved and mentioned in the report, also through the use of encryption tools.

In any case, the same confidentiality is guaranteed, even when the report is made through different methods as well as in cases where it reaches personnel other than the one in charge of processing, to whom the same is in any case transmitted without delay.

The processing of personal data relating to the receipt and management of reports is carried out by Acea and the Group's subsidiaries, as data controller, in compliance with European and national principles concerning personal data protection, providing appropriate information to the reporting persons and persons involved in reports, as well as adopting suitable measures to protect the rights and freedoms of data subjects.

Moreover, the rights referred to in Articles 15 to 22 of Regulation (EU) 2016/679 may be exercised within the limits set forth by Article 2-undecies of Legislative Decree no. 196 of 30 June 2003.

The protection of personal data is ensured not only for the reporting person or complainant but also for other parties to whom the safeguarding of confidentiality applies, such as the facilitator, the person involved and the person mentioned in the report as data subjects.

Internal reports and related documentation are retained for the time necessary to process the report and in any case for no more than 5 years following communication of the final outcome of the reporting procedure, in accordance with the confidentiality obligations set out in European and national legislation on personal data protection.

Retaliation means any behaviour, act or omission, even if only attempted or threatened, carried out as a result of the report, the complaint to the judicial or accounting authority or the public disclosure and which causes or is likely to cause unfair damage to the reporting person or to the person who directly or indirectly made the complaint, the same being construed as unjustified harm.

Acea prohibits and punishes any and all forms of retaliation or direct or indirect discrimination, for reasons directly or indirectly related to the report or complaint, against the reporting person or the person who filed the complaint.

Examples of retaliatory behaviours:

• dismissal, suspension or equivalent measures;
• relegation or non-promotion;
• change of duties, change of work location, reduction of salary, change of working hours;
• suspension of training or any restriction of access to the same;
• negative merit notes or negative references;
• the adoption of disciplinary measures or financial or other penalties;
• coercion, intimidation, harassment or ostracism;
• discrimination or other form of unfavourable treatment;
• failure to convert a fixed-term employment contract into a permanent employment contract, insofar as the worker had a legitimate right to expect such conversion;
• non-renewal or early termination of a fixed-term employment contract;
• reputational or other damage, particularly on social media, or economic or financial harm, including loss of economic opportunities and loss of income;
• inclusion in improper lists on the basis of a formal or informal sectoral or industrial agreement, which may make it impossible for the person to find future employment in the sector or industry;
• early termination or cancellation of the contract for the supply of goods or services;
• cancellation of a licence or permit;
• a request to undergo psychiatric or medical examinations.

To enjoy the protection provided by Legislative Decree 24/2023, the following must apply:

• at the time of reporting or submitting a complaint to the judicial or accounting authority or public disclosure, the reporting person or complainant had reasonable grounds to believe that the information on the violations reported, publicly disclosed or denounced was true and related to the provisions of Legislative Decree 24/2023, or to behaviour, acts or omissions that harm the public interest or the integrity of Acea and the Group's subsidiaries;
• the report or public disclosure was made based on the provisions of Legislative Decree 24/2023.

The alleged retaliation, even if only attempted or threatened, must be communicated exclusively to ANAC, which has the task of ascertaining whether the same is consequent to the report, complaint or public disclosure made.

For the purpose of managing the retaliatory communications ANAC, insofar as within its sphere of competence, may use the collaboration of the Inspectorate of Public Administration and the National Labour Inspectorate.

The declaration of invalidity regarding retaliatory acts is the responsibility of the judicial authority.

Protections are not guaranteed insofar as, even with first instance judgment, the existence is ascertained of criminal liability on the part of the reporting person for the crimes of defamation or slander or in any case for the same crimes committed with the complaint to the judicial or accounting authority, or civil liability of such person, for the same reason, in cases of wilful misconduct or gross negligence; in such cases, a disciplinary sanction may be imposed on the reporting person or complainant.