The forgotten requirement
The internal channel must be activated 'having heard worker representatives or trade unions' (Art. 4 of Decree 24/2023, referring to Art. 51 of Decree 81/2015). The consultation is informative - no agreement is needed - but it must happen and be documented. Skipping it makes the procedure non-compliant regardless of the channel's technical quality.
The three points that matter
- Union consent is not required, but hearing them is: formally communicate (including by certified email) the activation or update of the channel, attaching the organisational act and setting a deadline for requesting a meeting. If no request arrives, the stage is complete.
- It also applies to updates: the guidelines specify that unions must be heard not only at first activation but also for substantial changes to the procedure. Anyone who changed platform or handler in recent months should check.
- The risk is twofold: an ANAC sanction for a non-compliant procedure, and a possible complaint to the data protection authority by the unions themselves, if they consider the process compromises the confidentiality of potential reporters.
What to do now, in practice
For clients subject to Decree 24/2023 (50+ employees, or bodies with a 231 compliance model): 1) retrieve documentary evidence of the union consultation carried out at activation: if none exists, remedy it now with a formal communication; 2) if the procedure was changed after activation, repeat the notice; 3) file the certified email, organisational act and minutes of any meeting with the whistleblowing documentation; 4) check the organisational act covers conflicts of interest of the handler and their replacement during prolonged absence.
Why it matters for your clients
It is the classic requirement nobody remembers because it is not about technology: you buy the platform, write the procedure, and forget the union step. For the DPO it is a quick check that shields the client from a formal challenge that is very easy to raise and just as easy to prevent. A scope note: whistleblowing under Decree 24/2023 is distinct from the privacy reporting channel to the DPO, which answers to its own purposes and rules.
Official source:ANAC - Guidelines on whistleblowing internal reporting channels; Legislative Decree 24/2023, Arts. 4 and 21Looking for a workspace for your DPO work?
DPO Workspace is built by a certified DPO. 30-day free trial.
Start free
