General context, key principles and hot topics
1 Identify the highest-profile corporate investigation under way in your country, describing and commenting on its most noteworthy aspects.
Based on publicly available information, the highest-profile corporate investigations in Italy focus on international corruption involving the most important Italian companies, infiltration of organised crime in the economic sector and investigations against corporate giants for tax evasion. Italian criminal counsels observe, in particular, the increased focus on regulatory topics, the higher number of dawn raids with a focus on the internal audit departments of companies, the frequent use of precautionary measures and a growing involvement in cross-border investigations.
2 Outline the legal framework for corporate liability in your country.
Although the Italian system has always recognised a civil and administrative liability for companies, it did not provide for criminal liability in relation to companies until 2001.
This criminal liability is triggered if criminal offences included in a compulsory list have been committed by persons holding representative, administrative or (de facto) managerial positions in the company, or by persons working under their control, provided that these persons have committed the crimes at least ‘also’ in the interests, or for the benefit, of the company, and the company cannot demonstrate that it has taken adequate measures to prevent the commission of such crimes (in particular, for not having implemented an adequate organisation model or an internal control system).
Foreign companies can also be held criminally liable for crimes committed in Italy, irrespective of whether the laws of the companies’ home country contain similar rules or not. A decision issued in 2020 by the Italian Supreme Court seems to extend the corporate liability to include foreign companies and crimes committed abroad for which there is Italian jurisdiction.
3 Which law enforcement authorities regulate corporations? How is jurisdiction between the authorities allocated? Do the authorities have policies or protocols relating to the prosecution of corporations?
Several law enforcement authorities regulate corporations in Italy, including the Prosecution Service and independent administrative authorities.
Although the Prosecution Service has exclusive jurisdiction on investigations in relation to criminal matters, the independent administrative authorities, which have investigative powers and the power to impose sanctions, only have jurisdiction in specific matters, provided for by law.
As there are several enforcement authorities, the policies and protocols in this regard can differ. However, it is important to highlight that authorities usually have specific protocols relating to co-operation and the exchange of information.
4 What grounds must the authorities have to initiate an investigation? Is a certain threshold of suspicion necessary to trigger an investigation?
Although the law does not provide for a threshold of suspicion necessary to trigger an investigation by certain independent administrative authorities, the public prosecutor shall immediately enter in the dedicated register any criminal data he or she receives or acquires and then start a criminal investigation. The duty of the public prosecutor to bring criminal action is compulsory (and not discretionary).
5 How can the lawfulness or scope of a notice or subpoena from an authority be challenged in your country?
Depending on the authority and type of notice, a company may challenge the lawfulness or scope of the notice or production order by way of an application to court.
As regards criminal proceedings, the lawfulness and the scope of a search warrant, and the production of documents or a seizure, may be challenged before the courts. However, subpoenas regarding summoning of witnesses are not challengeable themselves. Witnesses have a duty to testify in front of a judge.
6 Does your country make use of co-operative agreements giving immunity or leniency to individuals who assist or co-operate with authorities?
Italian law does not provide for a general application of immunity or leniency in recognition of co-operation with investigative authorities.
As regards criminal proceedings, Italian law has provided several case examples of leniency for specific offences, such as criminal organisation and drug trafficking, and – more recently – immunity (for example, with regard to fiscal-related offences in the case of a voluntary collaboration procedure).
Law No. 3 of 9 January 2019, Measures to Combat Crimes Against the Public Administration (as well as the Statute of Limitations for Crimes and the Transparency of Political Parties and Movements) has introduced a new cause of immunity concerning crimes against the public administration, aimed at exempting from punishment anyone voluntarily reporting the fact within a set amount of time and providing useful and concrete indications to ensure proof of the crime and to identify the others responsible.
7 What are the top priorities for your country’s law enforcement authorities?
The fight against national and international corruption has been a top priority for the Italian government and its law enforcement authorities (in particular, the National Anti-corruption Authority) for the past few years.
Tax evasion is also a key priority: towards the end of 2019 and into 2020, a set of new laws made the punishments for tax crimes more harsh, introduced an enlarged model of confiscation and provided for the vicarious corporate liability for companies.
Moreover, the coronavirus pandemic forced the authorities to focus on the compliance of companies on new legislation relating to health and safety, and to monitor the economic sector, to prevent both state economic aids being illegally assigned and the economic crisis being used as a shortcut for organised crime to expand its influence.
8 To what extent do law enforcement authorities in your jurisdiction place importance on a corporation having an effective compliance programme? What guidance exists (in the form of official guidance, speeches or case law) on what makes an effective compliance programme?
Compliance programmes in Italy are not mandatory but strongly recommended as they are necessary to avoid corporate criminal liability.
However, the adoption of a programme is not sufficient. Indeed, companies are requested to prove that (1) the compliance programme has also been efficaciously implemented before the commission of the crime, (2) the person who committed the crime has fraudulently eluded it, and (3) the supervisory body has sufficiently monitored the company’s activities. Over the years, trade associations and professional orders (such as Confindustria, ABI, CNDCEC or IRDCEC) have issued numerous sets of guidelines to help corporations in implementing an effective compliance programme.
Even if a corporation strictly follows the aforementioned guidelines, a judge could still hold that corporation criminally liable.
9 Does your country regulate cybersecurity? Describe the approach of local law enforcement authorities to cybersecurity-related failings.
During the past 20 years, a broad framework of laws has been developed (often as a result of international regulations). In particular, in 2018, Italy implemented the General Data Protection Regulation (GDPR), which concerns the protection of individuals with regard to the processing of personal data and the free movement of such data, and Directive (EU) 2016/1148, concerning measures for a high common level in the security of network and information systems across Europe (known as the NIS Directive).
Moreover, by means of Legislative Decree No. 125/2019, Italy has ratified Directive (EU) 2018/843, which deals, among other matters, with the proper use of crypto-value to prevent money-laundering.
Last, Law No. 133/2019 provides for a series of obligations on public and private entities that carry out activities of public interest, to ensure the safety of information, systems and networks. Administrative sanctions shall apply in the event of non-compliance.
10 Does your country regulate cybercrime? What is the approach of law enforcement authorities in your country to cybercrime?
Italian law provides for a wide range of offences to prevent cybercrime. Over the years, law enforcement authorities (in particular, the Prosecution Service and the Italian Data Protection Authority) have given substantial attention to cybercrime, having acknowledged that the insufficient investment in cybersecurity in Italy risks seriously affecting the country’s growth and development.
For example, the law punishes the conduct of hacking, phishing, infection of information technology systems with malware, possession of hacking tools, identity theft and electronic theft. Criminal offences have also been provided in the case of failure to comply with the security measures set out by the law and regulations issued by the Italian Data Protection Authority, unlawful data processing and any untrue or false statement sent to the Authority. Moreover, Law No. 133/2019 provides for a new crime (punished by up to three years’ detention) in respect of false information or omissions that could impede or influence the effectiveness of the cybersecurity procedures established by the Law.
With regard to corporations, Italian law provides for financial penalties and disqualification in relation to cybercrime (including the above-mentioned crime introduced by Law No. 133/2019) and illicit use of personal data.
Cross-border issues and foreign authorities
11 Does local criminal law have general extraterritorial effect? To the extent that extraterritorial effect is limited to specific offences, give details.
Italian criminal law provides that Italian courts have jurisdiction on all offences committed within the Italian territory; that is, when at least part of the prohibited conduct takes place in Italy, or the event of the crime occurs within the Italian territory. According to case law, even a phone call or an email (made or sent to an accomplice) is sufficient to establish Italian jurisdiction.
Italy does not have general extraterritorial jurisdiction, although there are specific cases in which it will exercise extraterritorial jurisdiction (e.g., bribery involving Italian public officials and market abuse on financial instruments admitted on an Italian regulated market, even if the offences are committed abroad). Moreover, extraterritorial jurisdiction could be raised – under certain conditions – by dint of the Italian nationality of the perpetrator or the victim, or even when a crime against the Italian state is committed.
12 Describe the principal challenges that arise in your country in cross-border investigations, and explain whether and how such challenges depend on the other countries involved.
The principal challenges in cross-border investigations derive from the need to identify which states have the relevant jurisdiction and then the full co-operation and coordination of actions between the state in charge of the investigations and the other states, or all the competent agencies and organisations involved (e.g., in Europe, Eurojust and Europol).
Co-operation is needed because of the existence of different laws and regulations in all the countries, mostly relating to privacy, professional privilege regimes and labour laws.
To facilitate coordination among (at least) the EU Member States regarding criminal matters and accelerate cross-border investigations, Directive 2014/41/EU of the European Parliament and of the Council regarding the European Investigation Order in criminal matters came into effect in July 2017.
There are also bilateral and multilateral agreements between Italy and states that are not within the European Union.
13 Does double jeopardy, or a similar concept, apply to prevent a corporation from facing criminal exposure in your country after it resolves charges on the same core set of facts in another? Is there anything analogous in your jurisdiction to the ‘anti-piling on’ policy as exists in the United States (the Policy on Coordination of Corporate Resolution Penalties) to prevent multiple authorities seeking to penalise companies for the same conduct?
Pursuant to the provisions of the conventions to which Italy is a party (given its status as a Member State of the European Union), the international principle of ne bis in idem (as provided for by Article 14.7 of the International Covenant on Civil and Political Rights, Article 50 of the Charter of Fundamental Rights of the European Union and Article 4 of Protocol No. 7 to the European Convention on Human Rights) can only be applied in the event of res judicata (final judgment). Therefore, there is no prohibition against two criminal proceedings on the same cause of action against the same person or corporation taking place at the same time in two European countries.
For future development, it is worth highlighting that in Mihalache v. Romania (8 July 2019), a Grand Chamber of the European Court of Human Rights stated that the public prosecutor’s order discontinuing criminal proceedings while imposing a fine on the applicant was a ‘final acquittal or conviction’. This triggers the application of the ne bis in idem principle, based on a series of criteria (determination as to the merits, availability of ordinary remedies, and expiry of the time limit within which those remedies are to be used) which are in line with those relied on by the Court of Justice of the European Union in similar cases.
At the EU level, Council Framework Decision 2009/948/JHA of 30 November 2009 (adopted by Legislative Decree No. 29 of 15 February 2016) provides for a mechanism of ‘consultation’ among the Member States with the aim of achieving a consensus on any ‘agreed’ solution so as to avoid parallel proceedings in different Member States.
At the international level, there is the principle of lis alibi pendens, but no specific rules aimed at settling the issue of proceedings that are pending simultaneously.
There are no measures in Italy that are comparable to the US ‘anti-piling on’ policy.
14 Are ‘global’ settlements common in your country? What are the practical considerations?
To date, there have been no global settlements involving Italy. However, Italian law does provide for a specific discipline regarding the execution of decisions of foreign states.
15 What bearing do the decisions of foreign authorities have on an investigation of the same matter in your country?
Decisions of foreign authorities do not impede Italian investigations from going forward (see question 13). Nevertheless, the Italian Criminal Code provides for final judgments issued by foreign authorities to be recognised in relation to specific aspects (such as reparation or recidivism). When there are international agreements for recognition in force between the parties, the Italian Code of Criminal Procedure provides for the possibility of enforcement in Italy, according to Italian law. Moreover, a 2010 law provides for a new type of mutual recognition of foreign criminal judgments, when they order a minimum of three years’ detention.
Economic sanctions enforcement
16 Describe your country’s sanctions programme and any recent sanctions imposed by your jurisdiction.
As a Member State of both the United Nations and the European Union, Italy is required to observe and enforce UN Security Council sanctions and EU restrictive measures. Further, the EU applies restrictive measures for the purposes of pursuing the specific Common Foreign and Security Policy objectives or UN Security Council Resolutions.
The restrictive measures imposed by the European Union can target the governments of third countries as well as non-state entities or physical or legal individuals; for example, embargoes on the sale of weapons, other specific or general trade restrictions (import or export bans), financial restrictions, travel restrictions (visa or travel bans), or other measures that may appear appropriate to the case in question.
Member States are obliged to undertake specific tasks regarding implementation of the measures. The Financial Security Committee is the authorised agency in Italy in charge of monitoring the system for the prevention and sanctioning of money laundering and the financing of terrorism.
An Italian law issued in 2018 aims to organise and simplify the authorisation procedures for the export of dual-use items and technologies.
17 What is your country’s approach to sanctions enforcement? Has there been an increase in sanctions enforcement activity in recent years, for example?
In recent years, the European Union has often made recourse to the imposition of sanctions or restrictive measures both autonomously and in compliance with the binding resolutions of the UN Security Council.
The Italian authorities do not show a strong interest in the execution of sanctions.
18 Do the authorities responsible for sanctions compliance and enforcement in your country co-operate with their counterparts in other countries for the purposes of enforcement?
At the European level, Member States co-operate with each other, for example as regards authorisation for European operators who intend to work in Member States affected by trade embargoes.
19 Has your country enacted any blocking legislation in relation to the sanctions measures of third countries? Describe how such legislation operates.
The European Commission adopted Council Regulation (EC) No. 2271/96 against the effects of the extraterritorial application of legislation adopted by a third country, and actions based thereon or resulting therefrom (the EU Blocking Regulation), which is directly enforceable in Italy. The measure forbids EU citizens from complying with third-country extraterritorial sanctions unless exceptionally authorised to do so by the European Commission. In August 2018, the Regulation was expanded to curtail the effects of the United States’ withdrawal from the Joint Comprehensive Plan of Action.
20 To the extent that your country has enacted any sanctions blocking legislation, how is compliance enforced by local authorities in practice?
As far as we are aware, the EU Blocking Regulation has not been subject to any binding judicial interpretation. Moreover, with the exception of the European Commission’s non-binding Guidance Note – Questions and Answers: adoption of update of the Blocking Statute, no further official guidance has been adopted at a local level by Italian authorities.
Furthermore, no cases have yet been brought before the national courts.
Before an internal investigation
21 How do allegations of misconduct most often come to light in companies in your country?
Allegations of misconduct could come to light in many ways, and could enhance the need to conduct an internal investigation.
First, an investigation could be triggered by a report by a whistleblower, made through (and according to) a company’s procedure. Furthermore, an internal investigation could follow the execution of investigative acts, carried out by the Prosecution Service or by an independent administrative authority (such as Bank of Italy, Consob or Ivass). Last, a corporate investigation could be specifically requested by the supervisory body, if anomalies have come to light in the execution of its activity. In the same way, even news spread by the media regarding alleged misconduct perpetrated by an executive or an employee – and the related possibility of the beginning of a criminal or regulatory investigation – could suggest an opportunity for a compliance check, made by internal or external auditors.
Following the adoption of legislation on whistleblowing, which provides for different measures to protect employees who report an offence within their organisation, whether in the private or public sector, it is expected that whistleblowing may become even more common.
22 Does your country have a data protection regime?
The main Italian legislation for the protection of personal data is the Privacy Code, which was amended to adapt it to the changes introduced by the GDPR. Moreover, there are several sector-specific pieces of legislation that could affect a data protection regime, such as the Statute of Workers, the Consumer Code and the Telemarketing Law, and legislation on whistleblowing.
23 To the extent not dealt with above at question 9, how is the data protection regime enforced?
The Data Protection Code provides for both administrative fines and criminal penalties.
The GDPR introduced an antitrust-type sanction regime with fines of up to 4 per cent of annual global turnover or €20 million, whichever is the greater. A limited number of breaches fall into a lower tier and so are subject to fines of up to 2 per cent of annual global turnover or €10 million, whichever is the greater. Regulators have a range of other powers and sanctions at their disposal.
In its last annual report, the Italian Data Protection Authority published some key figures concerning GDPR application in Italy. Accordingly, (1) 1,443 data breaches have been notified, (2) more than 8,000 complaints have been notified, and (3) 147 inspections have been ordered. With regard to sanctions, the Italian Data Protection Authority has applied stringent sanctions regarding aggressive telemarketing, one of which was for €27.8 million and another for €11.5 million to operators that used subscribers’ data without their permission.
24 Are there any data protection issues that cause particular concern in internal investigations in your country?
To be able to conduct effective internal investigations, it is certainly necessary to be aware of the potential conflicts between data privacy concerns and the need for gathering information that implies the processing of employees’ personal data. Personal data shall be processed lawfully, fairly and in a transparent manner, and collected for specified, explicit and legitimate purposes. The affected employees shall be informed about the subject and purpose of the investigation, and their rights under the data protection laws. In addition, in compliance with the principle of data minimisation, it shall be ensured that employees’ personal data is adequate, relevant and limited to what is necessary in relation to the purposes for which it is processed.
25 Does your country regulate or otherwise restrict the interception of employees’ communications? What are its features and how is the regime enforced?
According to local employment law and the Italian Data Protection Authority, a company is prohibited from mass control and unlimited storage of employees’ company emails.
Companies should adopt specific internal guidelines, for approval by trade unions and publicised internally, to enable the employer to carry out controls on employees’ internet files and emails, with specific reference to making employees aware of the fact that the employer may execute controls on such data during internal investigations.
Dawn raids and search warrants
26 Are search warrants or dawn raids on companies a feature of law enforcement in your country? Describe any legal limitations on authorities executing search warrants or dawn raids, and what redress a company has if those limits are exceeded.
If there are reasonable grounds to believe that the corpus delicti (the item on which, or through which, the offence has been committed or the profit made from the crime), or material items relating to the crime, are located on a company’s premises, a search of those premises could be ordered by the public prosecutor.
At the beginning of the search, the accused and the person who has current access to the premises shall be given a copy of the decree ordering the search, with the notice informing them of their right to be assisted by a trusted person.
In the case of seizure ordered by the judicial authority, the person from whom the objects have been seized and the person who would be entitled to their restitution may submit a request for the re-examination of the seizure decree. The request does not suspend the enforcement of the decision.
27 How can privileged material be lawfully protected from seizure during a dawn raid or in response to a search warrant in your country?
The law provides for a duty to hand documents and documentary evidence to the requesting judicial authority, except if the person who possesses them by virtue of function, job, service or profession declares in writing that they are covered by either public service or professional secret. The judicial authority shall proceed with the necessary ascertainment if it has reasons to doubt the legitimacy of the declaration and if it cannot proceed without gathering the documents. If the declaration is groundless, the judicial authority shall order the seizure, which can be challenged with a request for the re-examination of the seizure decree.
28 Under what circumstances may an individual’s testimony be compelled in your country? What consequences flow from such compelled testimony? Are there any privileges that would prevent an individual or company from providing testimony?
A witness is obliged to appear before the court, follow the judicial indications regarding the procedural needs and answer truthfully the questions addressed to him or her.
If a witness fails to appear, without legal impediment, the court may order his or her compulsory appearance and that he or she pays a fine and the costs arising from the failure to appear. However, if the witness is a foreign citizen, Italy will not be able to enforce the aforementioned sanctions, given lack of jurisdiction. To avoid this impasse, some mutual assistance treaties have been signed, which allow Italian enforcement authorities to ask for co-operation from the foreign authorities to ensure witness participation at the hearing.
Bear in mind that a witness is not obliged to testify on facts that could lead to self-incrimination. Moreover, the law provides for a right of abstention for the next of kin of the accused and for persons who invoke either public service or professional secret.
Whistleblowing and employee rights
29 Describe the whistleblowing framework in your country. What financial incentive schemes exist for whistleblowers? What legal protections are in place for whistleblowers?
A whistleblowing law, generally applicable to the private sector in Italy, came into force in December 2017. The protection scheme for whistleblowers provided by the law is applicable only when the company has adopted an organisational model for crime prevention. In all cases, the whistleblower’s identity is and must be kept strictly confidential.
There are no incentives provided for in relation to reporting individuals.
However, a whistleblower is protected from any retaliatory or discriminatory dismissal as a consequence of his or her reporting, and protection from a demotion or any other (direct or indirect) discriminatory or retaliatory measure as a consequence of the reporting.
30 What rights does local employment law confer on employees whose conduct is within the scope of an investigation? Is there any distinction between officers and directors of the company for these purposes?
In relation to internal investigations, the Italian legislator sought to regulate the scope and the limits of companies’ powers, to find a balance between the right of the corporation to protect its interests and assets and the protection of employees from any kind of abuse.
The Italian Workers’ Statute and the GDPR require the observance of certain formalities in conducting the investigations (for example, the employee deemed to have engaged in misconduct has to receive a complete report about the ongoing investigations, with regard to the procedure, the scope and the corporate functions involved; in checking the corporate tools – such as laptops or lockers – the principles of necessity, relevance and no excess provided for by the GDPR have to be respected) as well as in commencing a disciplinary proceedings against the employee who has been found guilty of the misconduct during the investigation.
There is no distinction for these purposes between officers and directors.
31 Do employees’ rights under local employment law differ if a person is deemed to have engaged in misconduct? Are there disciplinary or other steps that a company must take when an employee is implicated or suspected of misconduct, such as suspension or in relation to compensation?
All employees’ rights are safeguarded in the context of internal investigations. A difference can be noted, instead, in the ways in which an employer can terminate an employment contract, depending on the type of misconduct: (1) dismissal without notice for just cause (e.g., where there is a serious breach of the employment contract, such as gross misconduct); or (2) ordinary dismissal with notice based on either a subjective reason or an objective reason. In either case, a special disciplinary procedure must be followed. Under this procedure, the employer must promptly send the employee a letter describing the facts that would constitute a breach of the contract, wait for the employee’s reply (which must be received within five days) and finally send the employee a letter of dismissal, explaining why the employer cannot accept the employee’s justifications. If an employee is suspected of misconduct, but the company still needs to carry out an internal investigation to ascertain whether that suspicion is justified, precautionary suspension can be implemented until the end of the investigative procedure.
Suspension is not mandatory and does not deprive the employee of salary unless this is expressly provided for by the national collective contract of the particular sector or by the contract. Once the internal investigation is concluded, in a case of dismissal because of misconduct, the company could ask for the return of the undue salary that has been paid during the period of suspension. However, if the suspended employee has not been paid the due salary, he or she has the right to ask for the unpaid salary if, at the end of the investigation, he or she is found not to have committed the alleged misconduct.
32 Can an employee be dismissed for refusing to participate in an internal investigation?
There is no obligation for employees to take part in an internal investigation. However, from a disciplinary standpoint relating to a general duty of co-operation with the employer or specific provisions in a company’s policies, a refusal to participate may be relevant.
Commencing an internal investigation
33 Is it common practice in your country to prepare a document setting out terms of reference or investigatory scope before commencing an internal investigation? What issues would it cover?
A company is advised to begin each investigation with a carefully drafted action plan, which should identify the following:
- allegations of misconduct or concerns as reported by internal control bodies or whistleblowers, or resulting from media speculations or acts of a criminal or regulatory investigation);
- the functions and external parties who will manage and conduct the investigation;
- all the conceivable actions to be carried out (documentation to be analysed and individuals to be interviewed);
- the time frame for the investigation; and
- if an external counsel is appointed, how legal privilege will be maintained.
After a preliminary case assessment with the internal functions, the action plan should be drafted by the investigation team and must be approved by the governing body or, if the alleged misconduct is ascribable to the board of directors, by the audit committee.
34 If an issue comes to light prior to the authorities in your country becoming aware or engaged, what internal steps should a company take? Are there internal steps that a company is legally or ethically required to take?
There are generally no formal legal obligations on a company to conduct an internal investigation. However, conduct rules issued by regulators may mean an internal investigation is required under those rules, or at least strongly recommended.
When an issue comes to light, it is strongly recommended to take all necessary steps to stop the offending behaviour, if it is continuing, to protect and preserve all material that would be relevant and to adopt preventive measures to ensure that the offending behaviour cannot occur again (e.g., revising the compliance programme and the internal controls affected).
35 What internal steps should a company in your country take if it receives a notice or subpoena from a law enforcement authority seeking the production or preservation of documents or data?
This decision depends on the individual circumstances of the case and the nature of the request.
Under the Italian Criminal Code, it is illegal to interfere with an investigation by a law enforcement authority (for example, by destroying evidence). In addition, corporations have statutory obligations to preserve documents for certain periods (in general for 10 years). Therefore, it is advisable to give employees clear instructions to prevent documents or data that is subject to an order from a law enforcement authority from being destroyed.
From a strategic point of view, a company should evaluate opportunities for co-operation. In many cases, it is advisable to co-operate with the relevant authority, to prevent coercive measures and reputational damage. For example, if a specific object is sought by search, the judicial authority may require its delivery. If these types of objects are handed in, no search shall be carried out by the public prosecutor, unless it is believed that the search may be useful for the investigation.
36 At what point must a company in your country publicly disclose the existence of an internal investigation or contact from a law enforcement authority?
There is generally no requirement for privately held corporations – with no reporting obligations under the securities laws – to publicly disclose the existence of an internal investigation or contact from law enforcement.
However, listed issuers shall publicly disclose information of a precise nature, which has not been made public, relating to one or more issuers and which, if it were made public, would be likely to have a significant effect on the prices of those financial instruments. Therefore, these companies must consider whether the disclosure of an internal investigation or contact from law enforcement would be considered material.
37 How are internal investigations viewed by local enforcement bodies in your country?
There is currently no specific discipline that regulates internal investigations, and it is recommended that companies pay attention to a number of legal issues, such as data protection and employment law-related concerns, as well as the protection of whistleblowers and management of their reports.
Internal investigations could be approached by companies either as a reaction to an investigation started by the Prosecution Service to gather elements useful for the defence as part of criminal proceedings, or to co-operate with the enforcement authorities to discover misconduct and the wrongdoer. Moreover, internal investigations are encouraged to identify and, when possible, prevent the commission of improper behaviour that can trigger liabilities for corporations.
Additional caution should be taken when a judicial investigation is likely, for example speaking to potential witnesses could result in subornation (a crime, according to the Italian Criminal Code) or be seen as an attempt to obstruct the investigation.
38 Can the attorney–client privilege be claimed over any aspects of internal investigations in your country? What steps should a company take in your country to protect the privilege or confidentiality of an internal investigation?
Considering that communications between a company and its in-house lawyers do not attract legal privilege, as recently confirmed by Italian case law, it is advisable that internal investigations are carried out by an external defence counsel, not bound to the client by any employment relationship and appointed for the purpose.
To protect the documentation relating to an internal investigation, it is recommended that it be held at the premises of the lawyer (which cannot be inspected or searched, unless the lawyer is under investigation), labelling any related communications as ‘Privileged and Confidential’ and restricting the circulation of privileged documents both outside and within the company.
39 Set out the key principles or elements of the attorney–client privilege in your country as it relates to corporations. Who is the holder of the privilege? Are there any differences when the client is an individual?
Professional secrecy is usually invoked by the attorney, but in the primary interest of his or her client, who could be either a corporation or a person.
In the case of companies, privilege applies subject to two fundamental conditions; that the information was exchanged:
- for the purpose of legal assistance; and
- with an independent, external lawyer who is not bound to the client by any employment relationship and is a member of the Bar.
If the lawyer is assisted by other professionals – such as technical consultants or authorised private detectives – the privilege is extended to them.
40 Does the attorney–client privilege apply equally to in-house and external counsel in your country?
Although the attorney–client privilege applies in relation to external counsel, the professional activity of an in-house counsel is neither recognised nor regulated by any legal provision or statute. In-house counsel cannot be admitted to the bar (with some limited exceptions) and are thus deprived of all rights and privileges attached to independent lawyers who are members of the Italian Bar, including the protection afforded by professional secrecy.
However, some judgments recognise the possibility of invoking the attorney–client privilege when in-house counsel is defending the company in proceedings.
41 Does the attorney–client privilege apply equally to advice sought from foreign lawyers in relation to (internal or external) investigations in your country?
The law provides for the attorney–client privilege to avoid intrusions that could hinder the defence; therefore, this privilege should certainly extend to foreign lawyers, provided that they are admitted to their national bar and their title is recognised by the Italian system. However, to date, there is no precedent from an Italian court to confirm this reasoning with specific reference to lawyers. There are precedents that have extended the benefit of professional secrecy to foreign private investigators, provided that their title is recognised in the country where the proceedings are pending.
42 To what extent is waiver of the attorney–client privilege regarded as a co-operative step in your country? Are there any contexts where privilege waiver is mandatory or required?
There is also no general concept of waiving privilege under Italian law.
Public prosecutors consistently state that they cannot expect waiver of the attorney–client privilege and that waiver could not be considered a prerequisite to obtain credit for co-operation. Nevertheless, submitting privileged documents to authorities is in general regarded as a co-operative step that can result in a reduction of a fine by contributing to a positive overall assessment.
It is mandatory to discuss any initiative with the client. In fact, divulging a professional secret without justification (or using it for one’s own profit of that of a third party), and thereby procuring damage, is an offence.
43 Does the concept of limited waiver of privilege exist as a concept in your jurisdiction? What is its scope?
As previously stated, the Italian legal system does not provide for waiver of privilege (neither general nor limited). However, with reference to criminal proceedings, the jurisprudence has stated that the privilege between a client and an attorney may suffer limitation and restrictions if the lawyer is suspected or accused in criminal proceedings. Even if there is not an actual waiver, in these cases all the information becomes available to third parties by means of the gathering of that information in the trial dossier.
44 If privilege has been waived on a limited basis in another country, can privilege be maintained in your own country?
There is no direct legal effect in Italy for the fact that privilege has been waived in another country. However, waiving privilege in one country by submitting documents to third parties can result in a loss of privilege, considering, for example, that documents disclosed to non-protected persons could be seized if they have lost privilege.
In addition, co-operation between enforcement agencies would be likely to render the privilege theoretical.
45 Do common interest privileges exist as concepts in your country? What are the requirements and scope?
The concept of common interest privilege does not exist in Italy. However, as has already been stated, according to the law, all documents concerning the defence’s strategy and all the correspondence between the defending counsel duly appointed and the indicted or investigated person are privileged and cannot be gathered in the trial dossier.
Therefore, in practical terms, the documents and the correspondence in the possession of the attorney that also involves other lawyers and other accused, and which are related to the proceedings and the defence strategy of the client, have to be considered as privileged to protect the client’s rights of defence.
46 Can privilege be claimed over the assistance given by third parties to lawyers?
Privilege could be invoked by an attorney even if the defence activity is carried out with the assistance of third parties. It is possible to include third parties who are, among others, trainee lawyers, secretaries, authorised private detectives and technical consultants.
47 Does your country permit the interviewing of witnesses as part of an internal investigation?
Italian law allows witnesses to be interviewed during an internal investigation. Commonly, this kind of activity is carried out by an external counsel appointed for that specific purpose.
An employee is requested to co-operate with the investigation team with regard to any aspects connected to his or her role and tasks, and more broadly to any information he or she learned as part of the job. In the case of a former employee, an interview may be carried out only with the consent of the person required to be interviewed.
48 Can a company claim the attorney–client privilege over internal witness interviews or attorney reports?
As stated in question 47, in most cases it is preferable for the interviewer to be a lawyer, who acts in accordance with all the formalities provided for by the defence investigations provisions of the Italian Code of Criminal Procedure. This ensures that all the findings remain exclusively available to the defence counsel and the client.
However, it should be noted that attorney–client privilege does not apply with regard to a company’s in-house counsel.
49 When conducting a witness interview of an employee in your country, what legal or ethical requirements or guidance must be adhered to? Are there different requirements when interviewing third parties?
If an internal investigation is carried out with the prerogatives of preventive defence investigations, the external counsel – before the interview starts – has to give the interviewee all the warnings as provided for by the Italian Code of Criminal Procedure (such as their right to silence or not to give any statement). Moreover, the lawyer shall inform the employee about his or her role and the purpose of the interview, and shall stop the gathering of information if the interviewee makes statements revealing indications of guilt.
The aforementioned rules apply to both employees and third parties.
The Italian Workers’ Statute provides for specific rules to avoid any kind of abusive activity by the employer: for example, it is not permitted to investigate an employee’s personal views on politics, religion, memberships of trade unions and personal life. Moreover, during an interview, it is necessary to be careful to avoid any disciplinary violation (e.g., a written notice reporting the alleged wrongdoing in detail is required).
50 How is an internal interview typically conducted in your country? Are documents put to the witness? May or must employees in your country have their own legal representation at the interview?
The Italian Code of Criminal Procedure requires certain formalities to be followed. For example, in the first place, the lawyers give the witnesses a warning (as cited in question 49), then they ask the questions and listen to the answers, all of which is included in a report (in full or in summary). Finally, the report has to be signed by all the persons attending the interview.
Documents could be shown to the interviewee if it is necessary or helpful for the line of questioning.
Generally, it is not possible for an employee or an executive to be assisted by a lawyer during an internal interview. An employer’s request for co-operation by an employee, and the related duty to answer questions, derives from the existing working relationship. In the event that an employee is already the subject of a criminal investigation being conducted by the Prosecution Service, his or her right to defence allows for assistance from a lawyer. Similarly, if a disciplinary proceeding has already been triggered against an employee, the employee is entitled to have a lawyer.
Reporting to the authorities
51 Are there circumstances under which reporting misconduct to law enforcement authorities is mandatory in your country?
Generally, according to Italian law, there is no obligation for a private entity to report crimes to the competent authorities (only public officials have the duty to report what they become aware of within their professional activities). Moreover, a lawyer is not under any obligation to disclose incriminating evidence against a client.
However, there are specific laws that provide for this kind of duty in relation to certain crimes and specific individuals (e.g. the law on anti-money laundering and illicit funding provides for the duty on professionals and intermediaries to report suspected activities).
52 In what circumstances might you advise a company to self-report to law enforcement even if it has no legal obligation to do so? In what circumstances would that advice to self-report extend to countries beyond your country?
The decision to disclose the findings of an investigation could be encouraged by the positive effect that co-operation with the authorities could have on a judge when quantifying the penalty. Moreover, it can contribute to avoiding the application or determining the reduction of pretrial disqualifying sanctions pursuant to criminal corporate liability law.
No negative consequences are provided for by law in respect of a lack of co-operation. A company under investigation – or at trial – assumes the same position as the defendant, and therefore the privilege against self-incrimination (or right to silence) is granted. Nevertheless, the attitude shown by the company could lead to greater reputational risk and could be taken into consideration by the prosecutor in a request for precautionary measures against the corporation.
53 What are the practical steps you need to take to self-report to law enforcement in your country?
The steps to be taken depend on the specific case at issue and the authority involved, but in any event, there is no obligation to self-report. Moreover, Italian law does not provide for benefits deriving from the disclosure of information gathered through internal investigations, and therefore does not contemplate any limitation to the investigation activity and to the possibility for the prosecutor to file a request for committal to trial.
Therefore, from a criminal point of view, it is important to consider in each case whether self-reporting could help in the settlement with the public prosecutor and avoid the application of a disqualifying measure.
Responding to the authorities
54 In practice, how does a company in your country respond to a notice or subpoena from a law enforcement authority? Is it possible to enter into dialogue with the authorities to address their concerns before or even after charges are brought? How?
The response will depend on the type of notice received by a company and which authority has sent it. For example, in the case of a request for document production from the public prosecutor, the company will respond through its external legal counsel, which can also arrange a formal appointment with the authority to present the documentation collected. Meetings with the public prosecutor can be scheduled, but usually they are accompanied by the filing of a pleading.
In the case of a notice received by other enforcement authorities (e.g., chamber of commerce), under Law No. 689/1991, the company may submit a defence case, within 30 days of notification, asking to be heard.
55 Are ongoing authority investigations subject to challenge before the courts?
It depends on the kind of investigation.
Generally, a criminal investigation itself cannot be challenged before the courts, but individual measures taken as part of the process (e.g., seizure of documents) can, when unlawful.
The Italian Code of Criminal Procedure provides for the possibility to challenge a request by the public prosecutor to continue with the investigations after an initial term of six months has expired.
56 In the event that authorities in your country and one or more other countries issue separate notices or subpoenas regarding the same facts or allegations, how should the company approach this?
In general, it is a requirement to answer all requests received from the authorities. However, in criminal matters, there are now several instruments to strive for mutual co-operation and joint action teams, to prevent unnecessary duplication of effort, from both the private and the public sides.
57 If a notice or subpoena from the authorities in your country seeks production of material relating to a particular matter that crosses borders, must the company search for, and produce material, in other countries to satisfy the request? What are the difficulties in that regard?
If the material is under the control of a company (even by means of a parent company, therefore with a right to take possession, inspect or take copies of a subsidiary’s documents), it is required to look for and produce all the requested material, even if located in another country.
Nevertheless, it could be that the data protection legislation in the other country does not permit the removal or transfer of the data from that jurisdiction: the requesting authority will therefore seek help from mutual legal assistance with the foreign state.
A parent company could also raise a self-incrimination issue that impedes the delivery of data or documents.
Instead, if the document is not under the control of the company, but the holder is known, the company can ask for it or indicate to the authorities the identity of the holder, to ease the progress of the investigation and show a co-operative approach.
58 Does law enforcement in your country routinely share information or investigative materials with law enforcement in other countries? What framework is in place in your country for co-operation with foreign authorities?
As stated in question 12, there are several EU Directives and bilateral and multilateral agreements between Italy and countries that are not EU Member States to facilitate coordination between enforcement authorities.
As another example, Italian tax law enforcement authorities regularly exchange information based on conventions against double taxation signed with other states.
59 Do law enforcement authorities in your country have any confidentiality obligations in relation to information received during an investigation or onward disclosure and use of that information by third parties?
During criminal proceedings, the investigations are protected by secrecy, so the public prosecutor and enforcement authorities will not have to disclose information to third parties. However, some investigations are conducted within a mutual assistance regime, in which authorities co-operate and exchange all the data acquired in the respective country.
60 How would you advise a company that has received a request from a law enforcement authority in your country seeking documents from another country, where production would violate the laws of that other country?
The advice given will depend on the specific case: in fact, a comparison should be made between the benefits of co-operating with the authority in the company’s country and the legal risk of violating a rule in the other country. To achieve this, the company should thoroughly analyse the relevant rules, and request the legal opinion of a lawyer in that country. In cases of gross and evident violation, the best option would be to submit the opinion received to the public prosecutor and encourage a mutual assistance request directly from one authority to the other.
61 Does your country have secrecy or blocking statutes? What related issues arise from compliance with a notice or subpoena?
A request by an authority is usually a sufficient reason for the disclosure of data, according to the Italian Privacy Code, which was adopted in Italy in 2003 but modified to be consistent with the GDPR.
62 What are the risks in voluntary production versus compelled production of material to authorities in your country? Is this material discoverable by third parties? Is there any confidentiality attached to productions to law enforcement in your country?
Voluntary production can be regarded in a positive light by a judge, as can effective co-operation with the authorities. However, it can generally not be challenged before the courts. In criminal law, even if the investigative dossier is supposed to be protected by secrecy, the company should be conscious that, once a document has been handed to the public prosecutor, it is possible that it will be given to third parties.
Prosecution and penalties
63 What types of penalties may companies or their directors, officers or employees face for misconduct in your country?
Individuals could face financial penalties and detention, as well as seizure and ancillary penalties (such as disqualification).
In respect of vicarious criminal liability, Italian law provides for four types of penalties: financial penalties, disqualifying measures, seizure and publication of the judgment.
64 Where there is a risk of a corporate’s suspension, debarment or other restrictions on continuing business in your country, what options or restrictions apply to a corporate wanting to settle in another country?
Legislative Decree No. 50/2016, which adopted Directive 2014/24/EU on public procurement, prohibits companies found guilty (in the previous five years) of specific offences (e.g., corruption, fraud, money laundering, terrorism) from competing for government contracts throughout the European Union.
65 What do the authorities in your country take into account when fixing penalties?
According to the Italian Constitution, penalties cannot consist of any treatment that is inhumane and must have the aim of rehabilitation of the convicted individual.
Italian criminal law provides for specific criteria to fix a penalty.
With regard to individuals, the judge takes into account the seriousness of the crime deriving from several aspects (such as the nature of the offence, the modality of the action, the seriousness of the consequent damage, the intensity of the fraud, existing precedents, the subsequent conduct of the accused, and so on).
Corporations are punished with financial penalties based on a quota system, considering various factors: the seriousness of the deed, the degree of liability of the entity and the activity carried out by the entity to eliminate or diminish the consequences of the unlawful act and to prevent the commission of further unlawful acts. The judge also considers the economic and financial status of the entity. The amount of the financial penalty, therefore, is determined by multiplying the first factor (number of quotas) by the second (quota amount). Moreover, if the product or the profit is significant, the sanction could be increased by 10 times the amount of the product or the profit.
Resolution and settlements short of trial
66 Are non-prosecution agreements or deferred prosecution agreements available in your jurisdiction for corporations?
Italian case law states that the law on probation is applicable only to individuals. Neither non-prosecution agreements nor deferred prosecution agreements are provided for by Italian law.
It is possible for a corporation to settle a case in advance by means of a special proceeding known as an application of punishment upon request. In particular, the company may agree with the public prosecutor to request the court to impose a penalty (reduced by a maximum of a third), when:
- the employee, whose conduct triggers the corporate liability, settled the case by means of an application of punishment; or
- the only sanction applicable to the corporation is a financial one.
However, the agreement between the company and the public prosecution authority will be rejected by the judge if he or she feels a permanent disqualifying sanction is warranted.
67 Does your jurisdiction provide for reporting restrictions or anonymity for corporates that have entered into non-prosecution agreements or deferred prosecution agreements until the conclusion of criminal proceedings in relation to connected individuals to ensure fairness in those proceedings?
Neither non-prosecution agreements nor deferred prosecution agreements are provided for by Italian law.
However, proceedings for vicarious liability against a corporate entity are automatically merged with criminal proceedings for an underlying crime allegedly committed by an individual. Therefore, the judicial authority will be aware of the choice of the company in the case of, for example, an application of punishment upon request.
68 Prior to any settlement with a law enforcement authority in your country, what considerations should companies be aware of?
Prior to reaching a settlement with a law enforcement authority, a company should assess the strength of the prosecution and defence cases.
Adverse effects, such as damage to reputation, should be considered. According to Italian law, a settlement cannot be considered a confession of liability by the entity. However, an application of punishment shall be considered equal to a judgment of conviction, unless otherwise provided by the law.
International implications should also be considered, such as the effect the settlement could have in regard to ongoing investigations in other jurisdictions (e.g., whether the authority that has settled will disclose information and assist foreign authorities).
69 To what extent do law enforcement authorities in your country use external corporate compliance monitors as an enforcement tool?
External corporate compliance monitors are not used as an enforcement tool. However, in specific cases, the law provides for the appointment of a special commissioner (e.g., when a disqualifying measure should be applied, which results in the interruption of all corporate activities).
70 Are parallel private actions allowed? May private plaintiffs gain access to the authorities’ files?
Parallel civil actions are allowed. A civil action brought before the civil court may be transferred to criminal proceedings if, in the civil court, a judgment on merits has not been issued. If the action is brought against the accused in a civil court after joining the criminal proceedings as a civil party, or after a judgment of first instance is issued, civil proceedings shall be suspended until the delivery of a final criminal judgment. The plaintiff may have access to the public prosecutor’s dossier.
Publicity and reputational issues
71 Outline the law in your country surrounding publicity of criminal cases at the investigatory stage and once a case is before a court.
Under the Italian Code of Criminal Procedure, investigative acts carried out by a public prosecutor and the police are protected by secrecy until the accused is entitled to have knowledge of them and, in any case, not beyond the closing of preliminary investigations.
Therefore, publication in the press, or by any other means of communication, of the aforementioned documents or their content, even if partially, is not allowed.
The publication, in whole or in part, of documents that are no longer protected by secrecy is not allowed until preliminary investigations are concluded or the preliminary hearing is terminated. However, if the proceedings reach the trial stage, publication (in whole or in part) of the documents in the investigative dossier is not allowed prior to the delivery of the appeal judgment.
Nevertheless, publication of the content of documents that are no longer protected by secrecy is allowed.
72 What steps do you take to manage corporate communications in your country? Is it common for companies to use a public relations firm to manage a corporate crisis in your country?
Corporate communication is a delicate aspect of management, which should always be carefully evaluated by experts and approved by the legal office and external legal consultants. In fact, an incorrect press release by a company could have a detrimental effect on customers and on the strategy eventually chosen during a trial.
The biggest companies in Italy rely on both internal and external professionals for public relations.
73 How is publicity managed when there are ongoing related proceedings?
It is a general rule that the court should not be influenced by press reports surrounding a trial. Therefore, during criminal proceedings, a company should avoid public communications and, when unavoidable, should make only brief and factual statements that have been approved by their external legal consultants.
Duty to the market
74 Is disclosure to the market in circumstances where a settlement has been agreed but not yet made public mandatory?
Privately owned corporations with no reporting obligations under the securities laws are generally not required to publicly disclose the existence of a settlement.
However, listed issuers shall publicly disclose information of a precise nature, which has not been made public, relating to one or more issuers and which, if it were made public, would be likely to have a significant effect on the prices of those financial instruments. Therefore, these companies must consider whether the disclosure of a settlement would be considered material.
75 Do you expect to see any key regulatory or legislative changes emerge in the next year or so designed to address corporate misconduct?
To address corporate misconduct, there is an ongoing debate in Italy in relation to the possibility of making the implementation of compliance programmes mandatory, when requested to exclude corporate vicarious liability. Several law proposals aim to extend the crimes that could trigger the vicarious liability of corporations.
Moreover, there are increasing requests for the introduction of restorative justice to stimulate self-reporting by companies, in exchange for the possibility to reach a settlement with the enforcement authorities for the dismissal of a criminal case.
At a European level, considering that existing EU bodies lack the necessary powers to carry out criminal investigations for crimes against the EU budget, trust is placed in the European Public Prosecutor’s Office, which is currently being set up, with the aim that it should be operational at the end of 2020.
 Enrico Di Fiorino and Lorena Morrone are partners at Fornari e Associati.