This is an Insight article, written by a selected partner as part of GIR's co-published content. Read more on Insight

General context, key principles and hot topics

1Identify the highest-profile corporate investigation under way in your country, describing and commenting on its most noteworthy aspects.

Based on publicly available information, the highest-profile corporate investigations in Italy focus on international corruption involving the most important Italian companies, infiltration of organised crime in the economic sector and investigations against corporate giants for tax evasion. Italian criminal counsels observe, in particular, the increased focus on regulatory topics, increasing the number of dawn raids with a focus on the internal audit departments of companies, the frequent use of precautionary measures and a growing involvement in cross-border investigations.

2Outline the legal framework for corporate liability in your country.

While the Italian system has always recognised a civil and administrative liability for companies, only in 2001 did it provide for criminal liability in relation to companies.

This criminal liability is triggered if criminal offences included in a compulsory list have been committed by persons holding representative, administrative or (de facto) managerial positions in the company, or by persons working under their control, provided that these persons have committed the crimes at least ‘also’ in the interests, or for the benefit, of the company, and the company cannot demonstrate that it has taken adequate measures to prevent the commission of such crimes (in particular, for not having implemented an adequate organisation model or an internal control system).

Foreign companies can also be held criminally liable for crimes committed in Italy, irrespective of whether the laws of the companies’ home country contain similar rules or not.

3Which law enforcement authorities regulate corporations? How is jurisdiction between the authorities allocated? Do the authorities have policies or protocols relating to the prosecution of corporations?

Several law enforcement authorities regulate corporations in Italy, including the Prosecution Service and independent administrative authorities.

While the Prosecution Service has exclusive jurisdiction on investigations in relation to criminal matters, the independent administrative authorities, which have investigative powers and the power to impose sanctions, only have jurisdiction in specific matters, provided for by law.

As there are several enforcement authorities, the policies and protocols in this regard can differ. However, it is important to highlight that authorities usually have specific protocols relating to co-operation and the exchange of information.

4What grounds must the authorities have to initiate an investigation? Is a certain threshold of suspicion necessary to trigger an investigation?

While the law does not provide for a threshold of suspicion necessary to trigger an investigation carried out by some independent administrative authorities, the public prosecutor shall immediately enter in the dedicated register any criminal data he or she receives or acquires and then start a criminal investigation. The duty of the public prosecutor to bring criminal action is compulsory (and not discretionary).

5How can the lawfulness or scope of a notice or subpoena from an authority be challenged in your country?

Depending on the authority and type of notice, a company may challenge the lawfulness or scope of the notice or production order by way of an application to court.

As regards criminal proceedings, the lawfulness and the scope of a search warrant, and the production of documents or a seizure, may be challenged before the courts. However, subpoenas regarding summoning of witnesses are not challengeable themselves. Witnesses have a duty to testify in front of a judge.

6Does your country make use of co-operative agreements giving immunity or leniency to individuals who assist or co-operate with authorities?

Italian law does not provide for a general application of immunity or leniency in recognition of co-operation with investigative authorities.

As regards criminal proceedings, Italian law has provided several case examples of leniency for specific offences, such as criminal organisation and drug trafficking, and – more recently – immunity (for example, with regard to fiscal-related offences in the case of a voluntary collaboration procedure).

A new law (Law No. 3 of 9 January 2019, Measures to Combat Crimes Against the Public Administration, as well as on the Statute of Limitations for Crimes and the Transparency of Political Parties and Movements) has introduced a new cause of immunity concerning crimes against the public administration, aimed at exempting from punishment anyone voluntarily reporting the fact within a set amount of time and providing useful and concrete indications to ensure the proof of the crime and to identify the others responsible.

7What are the top priorities for your country’s law enforcement authorities?

The fight against national and international corruption has been a top priority for the Italian government and its law enforcement authorities (in particular, the National Anti-corruption Authority) for the past few years.

Tax evasion is also a key priority. As a result of the changing international situation, Italy developed a parallel domestic strategy aimed at combating tax elusion and tax evasion by means of the signing of bilateral agreements with well-known tax havens, the introduction of the crime of self-money laundering, and the possibility – for a limited amount of time – of voluntary disclosure.

Cyber-related issues

8Does your country regulate cybersecurity? Describe the approach of local law enforcement authorities to cybersecurity-related failings.

During the past 20 years, a broad framework of laws has been developed (often as a result of international regulations). In particular, Italy has recently implemented the General Data Protection Regulation (GDPR), which concerns the protection of individuals with regard to the processing of personal data and the free movement of such data, and Directive (EU) 2016/1148 concerning measures for a high common level of security of network and information systems across Europe (known as the NIS Directive).

Criminal offences have been provided in the case of failure to comply with the security measures set out by the law and regulations issued by the Personal Data Protection Authority, unlawful data processing and any untrue or false statement sent to the Authority.

9Does your country regulate cybercrime? What is the approach of law enforcement authorities in your country to cybercrime?

Italian law provides for a wide range of offences to prevent cybercrime. For example, the law punishes the conduct of hacking, phishing, infection of information technology systems with malware, possession of hacking tools, identity theft and electronic theft.

Over the years, the law enforcement authorities (in particular, the Prosecution Service and the Personal Data Protection Authority) have given substantial attention to cybercrime, having acknowledged that the insufficient investment in cybersecurity in Italy risks seriously affecting the country’s growth and development.

Cross-border issues and foreign authorities

10Does local criminal law have general extraterritorial effect? To the extent that extraterritorial effect is limited to specific offences, give details.

Italian criminal law provides that Italian courts have jurisdiction on all offences committed within the Italian territory (that is, when at least a part of the prohibited conduct takes place in Italy).

Italy does not have general extraterritorial jurisdiction, although there are specific cases in which it will exercise extraterritorial jurisdiction (e.g., bribery involving Italian public officials and market abuse on financial instruments admitted on an Italian regulated market, even if these offences are committed abroad).

11Describe the principal challenges that arise in your country in cross-border investigations, and explain whether and how such challenges depend on the other countries involved.

The principal challenges in cross-border investigations derive from the need to identify which states have the relevant jurisdiction and then the full co-operation and coordination of actions between the state in charge of the investigations and the other states, or all the competent agencies and organisations involved (e.g., in Europe, Eurojust and Europol).

Co-operation is needed because of the existence of different laws and regulations in all the countries, mostly relating to privacy, professional privilege regimes and labour laws.

To facilitate coordination among (at least) the EU Member States regarding criminal matters, Directive 2014/41/EU of the European Parliament and of the Council regarding the European Investigation Order in criminal matters came into effect in May 2017. There are also bilateral and multilateral agreements between Italy and other non-Member States.

12Does double jeopardy, or a similar concept, apply to prevent a corporation from facing criminal exposure in your country after it resolves charges on the same core set of facts in another? Is there anything analogous in your jurisdiction to the ‘anti-piling on’ policy as exists in the United States (the Policy on Coordination of Corporate Resolution Penalties) to prevent multiple authorities seeking to penalise companies for the same conduct?

Pursuant to the provisions of the conventions to which Italy is a party (given its status as a Member State of the European Union), the international principle of ne bis in idem can only be applied in the event of res judicata (final judgment). Therefore, there is no prohibition against two criminal proceedings on the same cause of action against the same person or corporation taking place at the same time in two different European countries. At the international level, there is the principle of lis alibi pendens, but no specific rules aimed at settling the issue of proceedings pending simultaneously.

At the EU level, Council Framework Decision 2009/948/JHA of 30 November 2009 (adopted by Legislative Decree No. 29 of 15 February 2016) provides for a mechanism of ‘consultation’ among the Member States with the aim of achieving a consensus on any ‘agreed’ solution so as to avoid parallel proceedings in different Member States.

There are no measures in Italy that are comparable to the US ‘anti-piling on’ policy.

13Are ‘global’ settlements common in your country? What are the practical considerations?

To date, there have been no global settlements involving Italy. However, Italian law does provide for a specific discipline regarding the execution of decisions of foreign states.

14What bearing do the decisions of foreign authorities have on an investigation of the same matter in your country?

The Italian Criminal Code provides for judgments issued by foreign authorities to be recognised in relation to specific matters, such as reparation. When there are international agreements for recognition in force between the parties, the Italian Code of Criminal Procedure provides for enforcement in Italy according to Italian law. Moreover, a 2010 law provides for a new type of mutual recognition of foreign criminal judgements, when they order a minimum of three years of detention.

Economic sanctions enforcement

15Describe your country’s sanctions programme and any recent sanctions imposed by your jurisdiction.

As an EU Member State, Italy follows its restrictive measures, including the Sanctions Regulation. Further, the EU applies restrictive measures for the purposes of pursuing the specific Common Foreign and Security Policy (CFSP) objectives. These measures are thus binding in Italy, and a breach can result in fines and imprisonment. Specifically, an Italian law issued in 2018 aims to organise and simplify the authorisation procedures for the export of dual-use items and technologies.

The Ministry of Economic Development is the government entity responsible for administrative penalties.

16What is your country’s approach to sanctions enforcement? Has there been an increase in sanctions enforcement activity in recent years, for example?

The Italian authorities do not show a strong interest in the execution of sanctions.

17Do the authorities responsible for sanctions compliance and enforcement in your country co-operate with their counterparts in other countries for the purposes of enforcement?

At the European level, Member States co-operate with each other, for example as regards authorisation for European operators who intend to work in Member States affected by trade embargoes.

18Has your country enacted any blocking legislation in relation to the sanctions measures of third countries? Describe how such legislation operates.

Italy has implemented the EU Blocking Regulation, listing all the administrative penalties applicable for breaches of the EU provisions. In particular, a fine of up to €92,962 may be imposed on any operator who is in breach of the provisions of the law, and a fine of up to €46,481.17 may be imposed on any operator who fails to comply with the duty of notification pursuant to the law.

19To the extent that your country has enacted any sanctions blocking legislation, how is compliance enforced by local authorities in practice?

As far as we are aware, the EU Blocking Regulation has not been subject to any binding judicial interpretation. Moreover, with the exception of the European Commission’s non-binding Guidance Note – Questions and Answers: adoption of update of the Blocking Statute, no further official guidance has been adopted at a local level by Italian authorities.

Furthermore, no cases have yet been brought before the national courts.

Before an internal investigation

20How do allegations of misconduct most often come to light in companies in your country?

Allegations of misconduct could come to light in many ways, but they arise most often through whistleblowers, internal audits and media reports. Following the recent adoption of legislation on whistleblowing, which provides for different measures to protect employees who report an offence within their organisation in both the private and public sectors, it is expected that whistleblowing may become even more common.

Information gathering

21Does your country have a data protection regime?

The main Italian legislation for the protection of personal data is the Privacy Code, recently amended to adapt it to the changes introduced by the GDPR. Moreover, there are several sector-specific pieces of legislation that could affect a data protection regime, such as the Statute of Workers, Consumer Code and Telemarketing Law, and legislation on whistleblowing.

22To the extent not dealt with above at question 8, how is the data protection regime enforced?

The Data Protection Code provides for both administrative fines and criminal penalties.

The GDPR introduced an antitrust-type sanction regime with fines of up to 4 per cent of annual global turnover or €20 million, whichever is the greater. A limited number of breaches fall into a lower tier and so are subject to fines of up to 2 per cent of annual global turnover or €10 million, whichever is the greater. Regulators will have a range of other powers and sanctions at their disposal.

One year after the GDPR came into effect, the Personal Data Protection Authority published some key figures concerning its application in Italy. Accordingly, since May 2018: (1) 946 data breaches have been notified, (2) 7,219 complaints have been notified, and (3) 48,591 companies have appointed a data protection officer. The first GDPR fine in Italy was issued in April 2019.

23Are there any data protection issues that cause particular concern in internal investigations in your country?

To be able to conduct effective internal investigations, it is certainly necessary to be aware of the potential conflicts between data privacy concerns and the need for gathering information that implies the processing of employees’ personal data. Personal data shall be processed lawfully, fairly and in a transparent manner, and collected for specified, explicit and legitimate purposes.

In addition, in compliance with the principle of data minimisation, it shall be ensured that employees’ personal data is adequate, relevant and limited to what is necessary in relation to the purposes for which it is processed.

24Does your country regulate or otherwise restrict the interception of employees’ communications? What are its features and how is the regime enforced?

According to local employment law and the Personal Data Protection Authority, a company is prohibited from mass control and unlimited storage of employees’ company emails.

Companies should adopt specific internal guidelines, for approval by trade unions and publicised internally, to enable the employer to carry out controls on employees’ internet files and emails, with specific reference to making employees aware of the fact that the employer may execute controls on such data during internal investigations.

Dawn raids and search warrants

25Are search warrants or dawn raids on companies a feature of law enforcement in your country? Describe any legal limitations on authorities executing search warrants or dawn raids, and what redress a company has if those limits are exceeded.

If there are reasonable grounds to believe that the corpus delicti (the item on which, or through which, the offence has been committed or the profit made from the crime), or material items related to the crime, are located on a company’s premises, a search of those premises could be ordered by the public prosecutor.

At the beginning of the search, the accused and the person who has current access to the premises shall be given a copy of the decree ordering the search, with the notice informing them of their right to be assisted by a trusted person.

In the case of seizure ordered by the judicial authority, the person from whom the objects have been seized and the person who would be entitled to their restitution may submit a request for the re-examination of the seizure decree. The request does not suspend the enforcement of the decision.

26How can privileged material be lawfully protected from seizure during a dawn raid or in response to a search warrant in your country?

The law provides for a duty to hand documents and documentary evidence to the requesting judicial authority, except if the person who possesses them by virtue of function, job, service or profession declares in writing that they are covered by either public service or professional secret. The judicial authority shall proceed with the necessary ascertainment if it has reasons to doubt the legitimacy of the declaration and if it cannot proceed without gathering the documents. If the declaration is groundless, the judicial authority shall order the seizure, which can be challenged with a request for the re-examination of the seizure decree.

27Under what circumstances may an individual’s testimony be compelled in your country? What consequences flow from such compelled testimony? Are there any privileges that would prevent an individual or company from providing testimony?

A witness is obliged to appear before the court, follow the judicial indications regarding the procedural needs and answer truthfully the questions addressed to him or her.

If a witness fails to appear, the court may order his or her compulsory appearance and that he or she pays a fine and the costs arising from the failure to appear.

A witness is not obliged to testify on facts that could lead to self-incrimination. Moreover, the law provides for a right of abstention for the next of kin of the accused and for persons who invoke either public service or professional secret.

Whistleblowing and employee rights

28Describe the whistleblowing framework in your country. What financial incentive schemes exist for whistleblowers? What legal protections are in place for whistleblowers?

A whistleblowing law, generally applicable to the private sector in Italy, came into force in December 2017. The protection scheme for whistleblowers provided by the law is applicable only when the company has adopted an organisational model for crime prevention. In all cases, the whistleblower’s identity is and must be kept strictly confidential.

There are no incentives provided for in relation to reporting individuals.

However, the whistleblower is protected from any retaliatory or discriminatory dismissal as a consequence of his or her reporting, and protection from any demotion or any other (direct or indirect) discriminatory or retaliatory measure as a consequence of the reporting.

29What rights does local employment law confer on employees whose conduct is within the scope of an investigation? Is there any distinction between officers and directors of the company for these purposes?

With the awareness that the employment relationship is imbalanced in favour of the employer, the Italian legislator sought to regulate the scope and the limits of companies’ powers, to protect employees from any kind of abuse. In relation to internal investigations, interviews with employees should be conducted carefully to avoid raising disciplinary challenges. Disciplinary proceedings against employees are specifically regulated by the law, requiring the observance of certain formalities, such as a written notice in which the alleged wrong­doings are properly detailed. Challenging a disciplinary violation in relation to interviews may render the subsequent disciplinary proceedings invalid.

There is no distinction for these purposes between officers and directors.

30Do employees’ rights under local employment law differ if a person is deemed to have engaged in misconduct? Are there disciplinary or other steps that a company must take when an employee is implicated or suspected of misconduct, such as suspension or in relation to compensation?

There are two ways in which an employer can terminate an employment contract: dismissal without notice for just cause (e.g., where there is a serious breach of the employment contract, such as gross misconduct) or ordinary dismissal with notice based on either a subjective reason or an objective reason. In either case, a special disciplinary procedure must be followed. Under this procedure, the employer must promptly send the employee a letter describing the facts that would constitute a breach of the contract, wait for the employee’s reply, which must be received within five days, and finally send the employee a letter of dismissal, explaining why the employer cannot accept the employee’s justifications.

Suspension, even in the case of misconduct, is not mandatory and does not deprive the employee of salary unless this is expressly provided for by law or by the contract.

31Can an employee be dismissed for refusing to participate in an internal investigation?

There is no obligation for employees to take part in an internal investigation. However, from a disciplinary standpoint relating to a general duty of co-operation with the employer or specific provisions in a company’s policies, a refusal to participate may be relevant. Furthermore, if an employee refuses to participate in such an investigation, the employer may carry out the disciplinary process without the employee’s engagement, having first given written notice of this to the employee.

Commencing an internal investigation

32Is it common practice in your country to prepare a document setting out terms of reference or investigatory scope before commencing an internal investigation? What issues would it cover?

When an external counsel, appointed for this specific purpose, carries out an investigation, it is important to prepare an investigation plan from the start of the activity. The plan sets out the scope, approach, the issues to be investigated, the investigation team and reporting lines, how legal privilege will be maintained and timing. Measures regarding securing data and necessary steps relating to communication and disclosure might also be outlined in the plan.

33If an issue comes to light prior to the authorities in your country becoming aware or engaged, what internal steps should a company take? Are there internal steps that a company is legally or ethically required to take?

There are generally no formal legal obligations on a company to conduct an internal investigation. However, conduct rules issued by regulators may mean an internal investigation is required under those rules, or strongly recommended.

When an issue comes to light, it is strongly recommended to take all necessary steps to stop the offending behaviour, if it is still ongoing, to protect and preserve all material that would be relevant and to adopt preventive measures to ensure that the offending behaviour cannot occur again.

34What internal steps should a company in your country take if it receives a notice or subpoena from a law enforcement authority seeking the production or preservation of documents or data?

This decision depends on the individual circumstances of the case and the nature of the request.

If authorities have issued a binding request, companies should co-operate, in general terms, unless there are indications that the request is not effective or if the privilege against self-incrimination may apply.

In the case of a non-binding request, it has to be decided based on the individual case whether co-operation appears to be advisable. For example, if a specific object is sought by search, the judicial authority may require its delivery. If such objects are handed in, no search shall be performed by the public prosecutor, unless it is believed that the search may be useful for the investigation.

35At what point must a company in your country publicly disclose the existence of an internal investigation or contact from a law enforcement authority?

There is generally no requirement for privately held corporations – with no reporting obligations under the securities laws – to publicly disclose the existence of an internal investigation or contact from law enforcement.

However, listed issuers shall publicly disclose information of a precise nature, which has not been made public, relating to one or more issuers and which, if it were made public, would be likely to have a significant effect on the prices of those financial instruments. Therefore, these companies must consider whether the disclosure of an internal investigation or contact from law enforcement would be considered material.

36How are internal investigations viewed by local enforcement bodies in your country?

There is currently no specific discipline that regulates internal investigations, and it is recommended that companies heed a number of legal issues, such as data protection and employment law-related concerns, as well as the protection of whistleblowers and management of their reports.

Internal investigations could be approached by companies either as a reaction to an investigation started by the Prosecution Service to gather elements useful for the defence as part of criminal proceedings, and to co-operate with the enforcement authorities to discover misconduct and the wrongdoer. Moreover, internal investigations are encouraged to identify and, when possible, prevent the commission of improper behaviour that can trigger liabilities for corporations.

Attorney–client privilege

37Can attorney–client privilege be claimed over any aspects of internal investigations in your country? What steps should a company take in your country to protect the privilege or confidentiality of an internal investigation?

Considering that communications between a company and its in-house lawyers do not attract legal privilege, as recently confirmed by Italian case law, it is advisable that internal investigations are carried out by an external defence counsel, not bound to the client by any employment relationship and appointed for the purpose.

To protect the documentation relating to an internal investigation, it is recommended that it be held at the premises of the lawyer (which cannot be inspected or searched, unless the lawyer is under investigation), labelling any related communications as ‘Privileged and Confidential’ and restricting the circulation of privileged documents both outside and within the company.

38Set out the key principles or elements of the attorney–client privilege in your country as it relates to corporations. Who is the holder of the privilege? Are there any differences when the client is an individual?

Professional secrecy is usually invoked by the attorney, but in the primary interest of his or her client, who could be either a corporation or a person.

In the case of companies, privilege applies subject to two fundamental conditions:

  • the information was exchanged for the purpose of legal assistance; and
  • the information was exchanged with an independent, external lawyer who is not bound to the client by any employment relationship and is member of the bar.

39Does the attorney–client privilege apply equally to in-house and external counsel in your country?

While the attorney–client privilege applies in relation to external counsel, the professional activity of an in-house counsel is neither recognised nor regulated by any legal provision or statute. In-house counsel cannot be admitted to the bar (with some limited exceptions) and are thus deprived of all rights and privileges attaching to independent lawyers who are members of the Italian Bar, including the protection afforded by professional secrecy.

However, some judgments recognise the possibility of invoking the attorney–client privilege when in-house counsel is defending the company in proceedings.

40Does the attorney–client privilege apply equally to advice sought from foreign lawyers in relation to (internal or external) investigations in your country?

The law provides for the attorney–client privilege to avoid intrusions that could hinder the defence; therefore, this privilege should certainly extend to foreign lawyers, provided that they are admitted to their national bar and their title is recognised by the Italian system. However, to date, there is no precedent from an Italian court to confirm this reasoning with specific reference to lawyers. There are precedents that have extended the benefit of professional secrecy to foreign private investigators, provided that their title is recognised in the country where the proceedings are pending.

41To what extent is waiver of the attorney–client privilege regarded as a co-operative step in your country? Are there any contexts where privilege waiver is mandatory or required?

There is also no general concept of waiving privilege under Italian law.

Public prosecutors consistently state that they cannot expect waiver of the attorney–client privilege and that waiver could not be considered a prerequisite to obtain credit for co-operation. Naturally, submitting privileged documents to authorities is in general regarded as a co-operative step that can result in a reduction of a fine by contributing to a positive overall assessment.

It is mandatory to discuss any initiative with the client. As a matter of fact, divulging a professional secret without justification (or using it for the profit of oneself or a third party), and thereby procuring damage, is an offence.

42Does the concept of limited waiver of privilege exist as a concept in your jurisdiction? What is its scope?

As previously said, the Italian legal system does not provide for waiver of privilege (neither general nor limited). However, with reference to criminal proceedings, the jurisprudence has stated that the privilege between a client and an attorney may suffer limitation and restrictions if the lawyer is suspected or accused in criminal proceedings. Even if there is not an actual waiver, in these cases all the information becomes available to third parties, by means of the gathering of that information in the trial dossier.

43If privilege has been waived on a limited basis in another country, can privilege be maintained in your own country?

Waiving privilege in another country has no direct legal effect on privilege claims in Italy. However, waiving privilege in one country by submitting documents to third parties can factually result in a loss of privilege, considering that documents disclosed to non-protected persons may lose privilege.

44Do common interest privileges exist as concepts in your country? What are the requirements and scope?

The concept of common interest privilege does not exist in Italy. However, as has already been stated, according to the law, all documents concerning the defence’s strategy and all the correspondence between the defending counsel duly appointed and the indicted or investigated person are privileged and cannot be gathered in the trial dossier.

Therefore, in practical terms, the documents and the correspondence in the possession of the attorney that also involves other lawyers and other accused, and which are related to the proceedings and the defence strategy of the client, have to be considered as privileged to protect the client’s rights of defence.

45Can privilege be claimed over the assistance given by third parties to lawyers?

The privilege could be invoked by the attorney even if the defence activity is carried out with the assistance of third parties. Among others, it is possible to include third parties who are trainee lawyers, secretaries, authorised private detectives and technical consultants.

Witness interviews

46Does your country permit the interviewing of witnesses as part of an internal investigation?

Italian law allows witnesses to be interviewed during an internal investigation. Commonly, this kind of activity is carried out by an external counsel appointed for the specific purpose.

47Can a company claim attorney–client privilege over internal witness interviews or attorney reports?

As stated in question 46, in most cases, it is preferable for the interviewer to be a lawyer, who acts in accordance with all the formalities provided for by the defence investigations provisions of the Italian Code of Criminal Procedure. This ensures that all the findings remain exclusively available to the defence counsel and the client.

However, it should be noted that the privilege does not apply with regard to a company’s in-house counsel.

48When conducting a witness interview of an employee in your country, what legal or ethical requirements or guidance must be adhered to? Are there different requirements when interviewing third parties?

Before the interview starts, the lawyer has to give the interviewee all the warnings provided for by the Italian Code of Criminal Procedure (such as their right to silence or not to give any statement). In addition, there are some rules of deontology that have to be observed (such as informing the witnesses who decide not to give any statements that they could be summoned by the public prosecutor, or before the court during the proceedings, where they also will have to answer the lawyer’s questions).

The aforementioned rules apply to employees as well as third parties.

The Italian Workers’ Statute provides for specific rules to avoid any kind of abuse from the employer: for example, no permission to investigate an employee’s personal views on politics, religion, memberships of trade unions and personal life. Moreover, during an interview, it is necessary to be careful to avoid any disciplinary violation (e.g., a written notice reporting the alleged wrongdoing in detail is required).

49How is an internal interview typically conducted in your country? Are documents put to the witness? May or must employees in your country have their own legal representation at the interview?

The Italian Code of Criminal Procedure requires certain formalities to be followed. For example, in the first place, the lawyers give the witnesses a warning (as cited in question 48), then they ask the questions and listen to the answers, all of which is included in a report (in full of in summary). Finally, the report has to be signed by all the persons attending the interview.

Italian law does not provide for the compulsory presence of the lawyer of the witness during the interview, except when the interviewee is a suspected or accused person in the same proceedings, in joint proceedings or for a joined offence. If that is the case, in order to interview, obtain a statement or gather information, the witness must be accompanied by a lawyer.

Reporting to the authorities

50Are there circumstances under which reporting misconduct to law enforcement authorities is mandatory in your country?

Generally, according to Italian law, there is no obligation for a private entity to report crimes to the competent authorities (only public officials have the duty to report what they become aware of within their professional activities). Moreover, a lawyer is not under any obligation to disclose incriminating evidence against a client.

However, there are specific laws that provide for this kind of duty in relation of certain crimes and specific individuals (e.g, the law on anti-money laundering and illicit funding provides for the duty on professionals and intermediaries to report suspected activities).

51In what circumstances might you advise a company to self-report to law enforcement even if it has no legal obligation to do so? In what circumstances would that advice to self-report extend to countries beyond your country?

The decision to disclose the findings of an investigation could be encouraged by the positive effect that co-operation with the authorities could have on a judge when quantifying the penalty. Moreover, it can contribute to avoiding the application or determining the reduction of pretrial disqualifying sanctions pursuant to criminal corporate liability law.

52What are the practical steps you need to take to self-report to law enforcement in your country?

The steps to be taken depend on the specific case at issue and the authority involved, but in any case, there is no obligation to self-report. Moreover, Italian law does not provide for benefits deriving from the disclosure of information gathered through internal investigations. Therefore, from a criminal point of view, it is important to consider in each case whether self-reporting could help in the settlement with the public prosecutor and avoid the application of a disqualifying measure.

Responding to the authorities

53In practice, how does a company in your country respond to a notice or subpoena from a law enforcement authority? Is it possible to enter into dialogue with the authorities to address their concerns before or even after charges are brought? How?

The response will depend on the type of notice received by a company and which authority has sent it. For example, in the case of a request for document production from the public prosecutor, the company will respond by means of its external legal counsel, which can also arrange an appointment with the authority, through its secretary, to present the documentation collected. Meetings with the public prosecutor can be scheduled, but usually they are accompanied by the filing of a pleading.

54Are ongoing authority investigations subject to challenge before the courts?

It depends on the kind of investigation.

Generally, a criminal investigation itself cannot be challenged before the courts, but individual measures taken as part of the process (e.g., seizure of documents) can, when unlawful.

The Italian Code of Criminal Procedure provides for the possibility to challenge the request by the public prosecutor to continue with the investigations after the first six-month term has expired.

55In the event that authorities in your country and one or more other countries issue separate notices or subpoenas regarding the same facts or allegations, how should the company approach this?

In general, it is a requirement to answer all requests received from the authorities. However, in criminal matters, there are now several instruments to strive for mutual co-operation and joint action teams, to prevent unnecessary duplication of effort, from both the private and the public sides.

56If a notice or subpoena from the authorities in your country seeks production of material relating to a particular matter that crosses borders, must the company search for, and produce material, in other countries to satisfy the request? What are the difficulties in that regard?

If the material is under the control of a company (even by means of a parent company, therefore with a right to take possession, inspect or take copies of a subsidiary’s documents), it is required to search and produce all the requested material, even if located in another country.

Nevertheless, it could be that the data protection legislation in the other country does not permit the removal or transfer of the data from that jurisdiction: the requesting authority will therefore seek help from mutual legal assistance with the foreign state.

A parent company could also raise a self-incrimination issue that impedes the delivery of data or documents.

57Does law enforcement in your country routinely share information or investigative materials with law enforcement in other countries? What framework is in place in your country for co-operation with foreign authorities?

See question 11.

58Do law enforcement authorities in your country have any confidentiality obligations in relation to information received during an investigation or onward disclosure and use of that information by third parties?

During criminal proceedings, the investigations are protected by secrecy, so the public prosecutor and enforcement authorities will not have to disclose information to third parties. However, there are time when investigations are conducted within a mutual assistance regime, in which authorities co-operate and exchange all the data acquired in the respective country.

59How would you advise a company that has received a request from a law enforcement authority in your country seeking documents from another country, where production would violate the laws of that other country?

The advice given will depend on the specific case: in fact, a comparison should be made between the benefits of co-operating with the authority in the company’s country and the legal risk of violating a rule in the other country. To achieve this, the company should thoroughly analyse the relevant rules, and request the legal opinion of a lawyer in that country. In cases of gross and evident violation, the best option would be to submit the opinion received to the public prosecutor and encourage a mutual assistance request directly from one authority to the other.

60Does your country have secrecy or blocking statutes? What related issues arise from compliance with a notice or subpoena?

A request by an authority is usually a sufficient reason for the disclosure of data, according to the Privacy Code, adopted in Italy in 2003, recently modified to be consistent with the GDPR.

61What are the risks in voluntary production versus compelled production of material to authorities in your country? Is this material discoverable by third parties? Is there any confidentiality attached to productions to law enforcement in your country?

Voluntary production can be regarded in a positive light by the judge, as can effective co-operation with the authorities. However, it can generally not be challenged before the courts. In criminal law, even if the investigative dossier is supposed to be protected by secrecy, the company should be conscious that, once a document has been handed to the public prosecutor, it is possible that it will be given to third parties.

Prosecution and penalties

62What types of penalties may companies or their directors, officers or employees face for misconduct in your country?

Individuals could face financial penalties and detention, or ancillary penalties (such as disqualification).

In respect of vicarious criminal liability, Italian law provides for four types of penalties: financial penalties, disqualifying measures, seizure and publication of the judgment.

63Where there is a risk of a corporate’s suspension, debarment or other restrictions on continuing business in your country, what options or restrictions apply to a corporate wanting to settle in another country?

One example of when settlement in another country could be impeded is when there is a disqualification – imposed in Italy – from all activities (which, therefore, includes financial transactions).

64What do the authorities in your country take into account when fixing penalties?

Italian criminal law provides for specific criteria to fix a penalty.

With regard to individuals, the judge takes into account the seriousness of the crime deriving from several aspects (such as the nature of the offence, the modality of the action, the seriousness of the consequent damage, the intensity of the fraud, existing precedents, the subsequent conduct of the accused, and so on).

Corporations are punished with financial penalties based on a quota system, considering various factors: the seriousness of the deed, the degree of liability of the entity and the activity carried out by the entity to eliminate or diminish the consequences of the unlawful act and to prevent the commission of further unlawful acts. The judge also considers the economic and financial conditions of the entity. The amount of the financial penalty, therefore, is determined by multiplying the first factor (number of quotas) by the second (quota amount). Moreover, if the product or the profit are significant, the sanction could be increased by 10 times the amount of the product or the profit.

Resolution and settlements short of trial

65Are non-prosecution agreements or deferred prosecution agreements available in your jurisdiction for corporations?

Italian case law states that the law on probation is applicable only to individuals, and non-prosecution agreements or deferred prosecution agreements are not provided by Italian law.

It is possible for a corporation to settle a case in advance by means of a special proceeding known as an application of punishment upon request. In particular, the company may agree with the public prosecutor to request the court to impose a penalty (reduced by a maximum of a third), when:

  • the employee, whose conduct triggers the corporate liability, settled the case by means of an application of punishment; or
  • the only sanction applicable to the corporation is a financial one.

However, the agreement between the company and the public prosecution will be rejected by the judge if he or she feels a permanent disqualifying sanction is warranted.

66Does your jurisdiction provide for reporting restrictions or anonymity for corporates that have entered into non-prosecution agreements or deferred prosecution agreements until the conclusion of criminal proceedings in relation to connected individuals to ensure fairness in those proceedings?

Non-prosecution agreements or deferred prosecution agreements are not provided by Italian law.

However, proceedings for vicarious liability against a corporate entity are automatically merged with criminal proceedings for an underlying crime allegedly committed by an individual. Therefore, the judicial authority will be aware of the choice of the company in the case of, for example, an application of punishment upon request.

67Prior to any settlement with a law enforcement authority in your country, what considerations should companies be aware of?

Prior to reaching a settlement with a law enforcement authority, a company should assess the strength of the prosecution and defence cases.

Adverse effects, such as damage to reputation, should be considered. According to Italian law, a settlement cannot be considered a confession of liability by the entity. However, an application of punishment shall be considered equal to a judgment of conviction, unless otherwise provided by the law.

International implications should also be considered, such as the effect the settlement could have in regard to ongoing investigations in other jurisdictions (e.g., whether the authority that has settled will disclose information and assist foreign authorities).

68To what extent do law enforcement authorities in your country use external corporate compliance monitors as an enforcement tool?

External corporate compliance monitors are not used as an enforcement tool. However, in specific cases, the law provides for the appointment of a special commissioner (e.g., when a disqualifying measure should be applied, which results in the interruption of all corporate activities).

69Are parallel private actions allowed? May private plaintiffs gain access to the authorities’ files?

Parallel civil actions are allowed. A civil action brought before the civil court may be transferred to criminal proceedings if, in the civil court, a judgment on merits has not been issued. If the action is brought against the accused in a civil court after joining the criminal proceedings as a civil party, or after a judgment of first instance is issued, civil proceedings shall be suspended until the delivery of a final criminal judgment. The plaintiff may have access to the public prosecutor’s dossier.

Publicity and reputational issues

70Outline the law in your country surrounding publicity of criminal cases at the investigatory stage and once a case is before a court.

According to the Italian Code of Criminal Procedure, investigative acts carried out by a public prosecutor and the police are protected by secrecy, until the accused is entitled to have knowledge of them and, in any case, not beyond the closing of preliminary investigations.

Therefore, publication in the press, or by any other means of communication, of the aforementioned documents or their content, even if partially, is not allowed.

The publication, in whole or in part, of documents that are no longer protected by secrecy is not allowed until preliminary investigations are concluded or the preliminary hearing is terminated. However, if the proceedings reach the trial stage, publication, in whole or in part, of the documents of the investigative dossier is not allowed prior to the delivery of the appeal judgment.

Nevertheless, publication of the content of documents that are no longer protected by secrecy is allowed.

71What steps do you take to manage corporate communications in your country? Is it common for companies to use a public relations firm to manage a corporate crisis in your country?

Corporate communication is a delicate aspect of management, which should always be carefully evaluated by experts and approved by the legal office and external legal consultants. In fact, an incorrect press release by a company could have a detrimental effect on customers, and on the strategy eventually chosen during a trial.

The biggest companies in Italy rely on both internal and external professionals for public relations.

72How is publicity managed when there are ongoing related proceedings?

It is a general rule that the court should not be influenced by press reporting surrounding a trial. Therefore, during criminal proceedings, a company should avoid public communications and, when unavoidable, should make only brief and factual statements that have been approved by their external legal consultants.

Duty to the market

73Is disclosure to the market in circumstances where a settlement has been agreed but not yet made public mandatory?

Privately owned corporations with no reporting obligations under the securities laws are generally not required to publicly disclose the existence of a settlement.

However, listed issuers shall publicly disclose information of a precise nature, which has not been made public, relating to one or more issuers and which, if it were made public, would be likely to have a significant effect on the prices of those financial instruments. Therefore, these companies must consider whether the disclosure of a settlement would be considered material.

Anticipated developments

74Do you expect to see any key regulatory or legislative changes emerge in the next year or so designed to address corporate misconduct?

To address corporate misconduct, there is an ongoing debate in Italy in relation to the possibility of making the implementation of ‘management and organisational control protocols’ mandatory, when requested to exclude corporate vicarious liability.

Moreover, with the adoption of Directive (EU) 2017/1371 on the fight against fraud to the European Union’s financial interests (known as the PIF Directive), corporate vicarious liability will be extended to apply to some tax offences.


1 Enrico Di Fiorino is a partner at Fornari e Associati.

Unlock unlimited access to all Global Investigations Review content