New whistleblowing guidelines reviewed by the Italian Data Protection Authority

At a glance

• The Italian Data Protection Authority (Garante Privacy) reviewed two draft resolutions by the Italian Anti-Corruption Authority on whistleblowing guidelines.
• The proposals cover new internal reporting guidelines and updates to external reporting guidelines.
• The aim is to ensure whistleblowing channels are consistent, secure, and efficient.
• Key issues include email-related risks, mandatory data protection impact assessments with tech providers, retention periods, and shared channels with strict access controls.

The Italian Garante Privacy has examined two draft resolutions by the Italian Anti-Corruption Authority on whistleblowing; one introducing new internal reporting guidelines and another updating external reporting guidelines. Both aim to make reporting channels more consistent, secure, and efficient.

The guidelines were developed in close consultation with Garante Privacy to ensure full protection of whistleblowers’ identities, report content, and related personal data. Key considerations include mitigating risks linked to email use, conducting data protection impact assessments with technology providers, defining retention periods, and allowing shared reporting channels between entities where robust access controls are in place.