Whistleblowing is one of the tools for protecting the public interest with the aim of detecting and preventing illegal actions in public administration and business corporations. The term whistleblowing comes from the English "to blow the whistle", i.e. to blow the whistle or, in a figurative sense, to point out that the game is not being played according to the rules. It represents the possibility of an employee, a person in a similar employment relationship or another third party who has access to the organization's information (for example, a contractual partner, a job seeker, a cooperating self-employed person, a partner, a member of an elected body of the organization) to report possible illegal or unethical behavior that damages or threatens the public interest to an institution or body authorized to check or take action, without the whistleblower being exposed to the risk that a penalty in the form of a so-called retaliatory measure will be applied to him due to the filing of a report. By default, whistleblowing is part of compliance programs (ensuring compliance with legal regulations, regulatory requirements, contractual obligations and internal policies) of organizations. In practice, this term began to be used only in the 70s of the 20th century in Anglo-Saxon countries, but since then it has only gained in importance.
On 17/12/2021, the period during which the Czech Republic was obliged to transpose Directive (EU) 2019/1937 of the European Parliament and of the Council of 23/10/2019 on the protection of persons who report violations of Union law (hereinafter referred to as "Guideline"), regulating the issue of whistleblowing and the protection of whistleblowers at the EU level. The direct effect of this directive falls, for example, on municipalities with more than 10.000 inhabitants, the CNB, the SAO and others.
The legislative process by which the Czech Republic implemented the Directive lasted almost three years. A year and a half after the deadline set by the European Union for 17/12/2021, forced by a high fine in the order of tens of millions of crowns, the Czech Republic finally completed the legislative process as one of the last EU countries – only Poland and Estonia remained behind it. While whistleblowers in the Czech Republic are still waiting for legal protection, in Slovakia it has been adopted since 2014. Slovakia also approved an amendment to the Act on the Protection of Whistleblowers, and this amendment came into effect on 1 July 7. However, some provisions on obligations will not take effect until 2023 September 1.
The law approved by the Chamber of Deputies did not gain support in the Senate, but the president signed the law on 7/6/2023. The law came into force on 1 August 8.
Act No. 171/2023 Coll., on the protection of whistleblowers (hereinafter referred to asThe law") together with Act No. 172/2023 Coll., which amends some laws in connection with the adoption of the Whistleblower Protection Act in the Czech Republic, plays an important role in supporting ethics and transparency in the working environment. Czech legislation does not define the term whistleblowing itself, although the general public uses it in practice for the notification process and the protection of whistleblowers.
This article focuses primarily on the obligations that employers must comply with according to the Act. Given that a number of Slovak companies also operate in the Czech Republic, the article also discusses the main differences in the Slovak legal regulation of the given issue.
The law to the specified circle of employers (mandatory subjects) imposes the obligation to introduce internal notification system, through which they will whistleblowers authorized to do notification, whose reasonableness will be assessed by an impartial so-called person concerned, which will propose acceptance to the obliged entity measure, while the employer - the obliged entity is obliged to ensure that the whistleblower is not subject to the so-called retaliation.
The subject subject to the introduction of an internal notification system according to the Act is:
- Public contracting authority under the Public Procurement Act (with the exception of municipalities with up to 10 inhabitants, legal entities founded or established for the purpose of meeting the needs of the public interest and not having an industrial or commercial nature with up to 000 employees);
- A public authority exercising jurisdiction in the area of corporate income tax administration or the administration of levy for breach of budget discipline, in the area of civil aviation, in the area of maritime transport, the offshore oil and gas industry, the exploration and extraction of mineral resources from the seabed and on safety offshore oil and gas activities;
- Central counterparty or register of business data pursuant to Regulation (EU) No. 648/2012 of the European Parliament and of the Council of 4 June 6;
- Employers doing business in the field of financial services who are not an obligated person according to the AML Act (investment companies, investment funds, tied representatives to mediate consumer loans for housing, insurance companies, reinsurance companies and insurance intermediaries, reinsurance, occupational pension insurance institutions);
- Employers with more than 50 employees as of January 1 of the relevant calendar year.
If you are an employer with more than 250 employees, you must implement an internal notification system as of 1 August 8. The Czech legislator did not approve the postponement of the effectiveness of sanctions (as did, for example, neighboring Slovakia), and therefore theoretically the Ministry of Justice can check the fulfillment of all obligations under the new law from the first day the law comes into effect.
If you employ more than 50 but less than 249 employees, you have time to introduce internal notification system at the latest 15/12/2023. Even in this case, however, we recommend not to delay the introduction of a whistleblowing solution too much - the public reporting channel operated by the Ministry of Justice as the central state administration body for the protection of whistleblowers is already in operation at https://oznamovatel.justice.cz/chci-podat-oznameni/, email: oznamovatel@msp.justice.cz, or phone: 221 997 840 and can be used by all whistleblowers who have no other (corporate) alternative.
The new law must its notification systems also adapt the AML of mandatory entities, which already had their reporting systems in place according to existing legal regulations. The Law on the Protection of Whistleblowers does not include AML obligated persons among the obligated persons, but the accompanying amendment law, which was adopted at the same time as the Law on the Protection of Whistleblowers, requires them to adapt the existing reporting systems of the Law on the Protection of Whistleblowers while respecting the specifics of the AML legislation.
Obligations of organizations that are so-called mandatory entities:
- establish a channel for safe reporting and communication with whistleblowers,
- establish processes for responding to notifications and taking corrective and preventive actions,
- determine the so-called relevant person responsible for receiving and processing notifications, ensure the confidentiality of the identity of the notifier,
- keep electronic records of received notifications and securely dispose of the data after the archiving period has expired, i.e. 5 years.
Organizations are mandatory set up an internal notification mechanism, which will enable employees, persons in a similar employment relationship or third parties who have access to the organization's information (contractual partners, self-employed persons, partners, shareholders, etc.) to submit notifications in accordance with the Act. This mechanism should be easily accessible, anonymous and confidential so that whistleblowers feel safe when reporting (secure email, telephone line, voice mail, web platforms, provision of a neutral place for a personal meeting with the relevant person). It seems appropriate to embed the notification mechanism within the internal regulations available to employees and published on the website of the obliged entity in order to ensure access not only by employees but also by third parties who have access to the organization's information and can thus act as a whistleblower. It is also important to ensure that reports are properly investigated and appropriate action taken. The internal reporting system must allow both verbal and written notification, including the possibility of personal notification. When setting up the system and its operation, it is necessary to consistently address the protection of personal data, especially the identity of the notifier, the content of the notification and information on the processing of personal data in accordance with the GDPR. There may be some advantage to business corporations with up to 250 employees that are part of a corporate group sharing centralized reporting systems, provided that these enable the receipt and resolution of employee reports at subsidiary level, and provided that the subsidiary has its own designated appropriate person. However, the subsidiary's responsibility for fulfilling the terms of the Act remains unaffected.
The public whistleblowing channel operated by the Ministry of Justice represents an alternative for the whistleblower and will depend on the credibility, clarity and security of the organization's internal whistleblowing system, which form the whistleblower chooses.
The obliged entity shall determine relevant person or appropriate persons to receive and process notifications. The relevant person can only be a natural person who is blameless, of legal age and fully autonomous. It can be an employee of the obliged entity, but also a third, external person designated by the obliged entity. The exception is represented by entities required by the AML, for which the relevant person cannot be performed by an outsider. It is not possible to establish a department of the organization as the relevant person. It is essential that the designated relevant person is trustworthy, impartial and competent to perform the relevant person's activities.
The notification can be given orally or in writing, and if the notifier requests it, the relevant person is obliged to accept the notification in person within a reasonable period of time, but no later than 14 days from the day the notifier requested it. It is necessary to make a written or audio record of the oral notification. In the case of an audio recording, it is also necessary to record the notifier's consent to the audio recording. The relevant person is also obliged send the notifier a notification of receipt of the notification within 7 days of its receipt and is obliged to assess the reasonableness of the notice and in writing notify the notifier of the results of the assessment within 30 days from the date of receipt of the notification. In factually or legally complex cases, this period can be extended by up to 30 days, but no more than twice. The relevant person is obliged to inform the notifier in writing about the extension of the deadline and the reasons for its extension before it expires.
If, when assessing the reasonableness of the notification, the competent person discovers that it is not a notification according to the Act or that it is an unjustified notification, he will notify the notifier in writing without undue delay. If the notification is evaluated as justified, the relevant person will propose corrective and preventive measures and the obliged entity then decides on its acceptance. If it does not take this measure, the obliged entity can take other appropriate measures. The measures must represent an adequate reaction, measures must be taken to eliminate the defective condition and prevent the recurrence of the given situation. The proposed measure must not reveal the identity of the whistleblower. The law does not specify remedial measures, it can be, for example, the filing of a criminal report or the removal of a defective condition, the sanction of defective conduct, the recovery of damage caused by defective conduct, the change of the set internal processes of the obliged entity, the introduction of monitoring and control of compliance with internal rules and processes, employee training and communication internal and external management of the organization. Subsequently, the informant is notified again in writing.
The relevant person is then obliged to keep the notification submitted through the internal notification system and keep a record of the data on the received notifications in electronic form for a period of 5 years from the date of receipt of the notification. Only the appropriate person who is personally responsible for ensuring the confidentiality of the notifications has access to the stored notifications.
After receiving the notification, the competent person must also assess whether the reported behavior does not fulfill the elements of the factual nature of the crime. If the notification is based on relevant circumstances and is not manifestly false and unreasonable, the necessary measures must be taken. If this is not done, the whistleblower can also report the actual act of concealment. A person attempting to conceal the commission of a crime may in extreme cases also be a participant in the crime. If the notification is evaluated as unfounded, it is necessary to write a record in which all the steps taken and the scope of the internal investigation that led to the conclusion of unfoundedness will be recorded, as well as attach all related documents to the record. However, it is necessary to take into account that the whistleblower may file a criminal complaint, and therefore it is good to be prepared for this possibility. A whistleblower who makes a knowingly false report is not protected by the Act and may be guilty of defamation or false accusation. At the same time, he faces the threat of a fine of up to CZK 50.000.
The function of the relevant person has a number of similar aspects to the function of the personal data protection officer, and therefore, for reasons of capacity, it is offered to combine these functions into one person or department. In this case, however, it will be absolutely necessary to resolve the conflict of interests organizationally.
Notification – the law defines as communication information about a possible illegal act that has the characteristics of (i) a criminal act, (ii) a misdemeanor for which the law determines the rate of a fine, the upper limit of which is at least CZK 100.000, (iii) another illegal act, as defined by the Law and which occurred or is expected to occur with a person for whom the whistleblower directly or indirectly performed or performs work or another similar activity, or with whom the whistleblower was or is in contact in connection with the performance of work or another similar activity.
The law thus defines "work or other similar activity" relatively broadly - in addition to the performance of dependent work, it also includes the performance of the function of a member of a body of a legal entity, an internship or even volunteering, self-employment, contractual partner, partner, which simultaneously defines the circle of possible whistleblowers.
If the whistleblower makes a notification in accordance with the Act, the whistleblower is entitled to protection against so-called retaliatory measures. Where the nature of the notification requires it and the whistleblower has reasonable grounds to believe that the notification is necessary to detect wrongdoing, the whistleblower may breach bank secrecy, trade secrecy, contractual confidentiality or tax confidentiality in connection with the notification. However, criminal acts may not be committed by such actions. The duty of confidentiality of a lawyer, judge, notary public, prosecutor, executor or in the provision of health services or confidentiality in relation to classified information in criminal proceedings is unbreakable.
The notification must contain information about the name, surname and date of birth or other information from which it is possible to infer the identity of the informant, unless the Act provides otherwise. If the notification does not contain these details and if the identity of the informant is not revealed even additionally, protection against retaliatory measures cannot be provided to the informant. The obliged person is not obliged to investigate anonymous notifications, however, the relevant person will also record such notifications in the record of data on received notifications.
Retaliatory measures are defined by the Act as actions or omissions in connection with the whistleblower's work or other similar activity, which was triggered by the notification and which may cause harm to the whistleblower, such as (i) termination of the employment relationship, (ii) cancellation of the legal relationship established by an agreement on performance of work or agreement on work activities, (iii) dismissal from the position of a senior employee, (iv) reduction of wages, salary or remuneration or non-granting of personal allowance, (v) transfer or transfer to another job.
The Act stipulates that, in addition to the whistleblower, no other group of persons specified by the Act who, as a rule, provided assistance to the whistleblower in connection with making the report, may be subjected to retaliatory measures.
How does the Czech law deviate from the requirements of the Directive?
The most important deviations of the Czech Act from the Directive:
- Czech whistleblowers can report not only suspected violations of European regulations in defined areas, but also suspected of committing a crime or misdemeanor, for which the offender faces a fine of at least CZK 100.000.
- Czech internal notification systems they must be run by individuals – not departments. The legislator introduces the function of the so-called relevant persons, which, under a penalty of CZK 100.000, is responsible for receiving reports, for observing legal deadlines for communication with the informant, for protecting the identity of the informant, but also for facts contained in the report that could defeat the purpose of the investigation, for conducting the investigation, keeping legal records and proposing preventive measures or corrective measures.
- Czech obliged entities must establish channels that allow the notifier to submit a notification in writing, orally and, upon request, in person, while according to the directive it is sufficient to introduce oral or written notification.
- Protection also belongs to the whistleblower who although he filed an anonymous report, his identity will be revealed later.
The most important deviations in Slovak legislation
In Slovakia, whistleblowing is regulated in Act No. 54/2019 Coll., on the protection of whistleblowers of anti-social activity. Below are the most significant changes that differ from the Slovak legal system to the Czech one.
The first difference is the fact that all employers with more than 50 employees and public authorities with more than 5 employees must have an internal notification screening system in place. From September 1, 9, employers, regardless of the number of employees, must have an internal notification screening system if they provide services in the field of financial services, transport safety and the environment.
Another difference also lies in the adjustment of deadlines. In contrast to the Czech legislation, which stipulates the obligation of employers to keep records of notifications and anti-social activities within a period of 5 years, the Slovak legislation enshrined a period of three years. The Slovak regulation stipulates a period of 90 days for the employer to check and notify the result of the check. Although the Czech regulation stipulates a period of 30 days, this period can be extended by up to 30 days, at most twice. As a result, according to Czech legislation, the latest deadline is also 90 days.
Slovak legislation from September 1, 9 envisages fines of up to EUR 2023 or EUR 50.000 for employers with more than 100.000 employees. These are significantly higher fines than in the case of the Czech regulation, which sets the highest possible fine at CZK 250. In addition, the Czech regulation does not distinguish between the number of employees of the employer in terms of the amount of fines.
Furthermore, this amendment expanded the range of crimes that are considered serious anti-social activity. This includes all crimes with a maximum penalty rate exceeding 2 years. Czech legislation does not set any limits or other conditions for criminal offences.
Slovak legislation even established Whistleblower Protection Office (hereinafter ,,Office"), as an independent state administration body with nationwide jurisdiction, which protects the rights and legitimate interests of whistleblowers when reporting anti-social activity. This Office is supposed to protect employees who report corruption and wrongdoing, and also to educate employers to set up internal reporting processes effectively. In addition to the Office, notifications are also received by the public prosecutor's office or the administrative body responsible for administrative offense proceedings. The State Prosecutor's Office also accepts requests for protection when reporting serious anti-social activity, which is a criminal offence.
From the point of view of whistleblower protection, Slovak legislation establishes that the employer must first request consent from the Office if it wants to take legal action against the whistleblower or issue a decision in the employment relationship, for example consent to dismissal, etc. Violation of this obligation is sanctioned by a fine of up to EUR 100.000 .
There may also be a situation where the whistleblower does not file a report with the relevant authority or employer, but instead publishes the facts about anti-social activity. The condition is that this person must reasonably believe that filing a report would not lead to a proper investigation. This condition sounds very abstract and broad, so disclosure may be used more often than it should.
On the other hand, according to Czech legislation, the whistleblower can publish the notification in the event that he submitted the notification through the internal notification system and to the ministry or only to the ministry and appropriate measures were not taken within the legal deadline. The second possibility, when the notification can be published, occurs if the notifier has a legitimate reason to believe that the unlawful act mentioned in the notification may lead to an immediate or obvious threat to internal order or safety, life or health, the environment or other public interest, or to the occurrence of irreparable harm or has reason to believe that there is an increased risk of retaliation if notified to the Department.
Slovak law makes a distinction notification and qualified notification. The notification includes facts related to anti-social activity, which the person learned about in connection with the performance of his job, profession, position or function. A qualified notification is one that can contribute or has contributed to the clarification of serious anti-social activity and/or to the detection or conviction of the perpetrator. With a qualified notification, the protection provided is stronger and simpler for the notifier.
Slovak legislation, in contrast to the Czech one, also provides that the Office may, under certain conditions, notify the notifier who has made a qualified notification based on his request to provide remuneration up to fifty times the minimum wage. These are cases where an indictment has been filed in a criminal proceeding, a motion has been filed to approve a plea agreement and accept a sentence, a settlement has been approved, and criminal prosecution has been suspended or criminal prosecution has been conditionally suspended. These are also cases where the decision on the commission of an administrative offense became valid in the administrative proceedings. When deciding on the reward, the office should take into account the degree of merit of the whistleblower for clarifying serious anti-social activity, the identification of the perpetrator, the whistleblower's lost profit and the extent of the protected property.
Finally, the Slovak legislation introduces the institution of suspension of the effectiveness of a labor law act, where the notifier can request the Office to suspend the effectiveness of the labor law act, if he believes that in connection with the notification, a labor law act has been taken against him, with which he does not agree.
The Slovak legislation thus gives the impression that the internal notification mechanism within the employer gives way to notification to public institutions and is rather repressive in nature. In contrast, Czech legislation gives priority to notification within the employer's internal mechanism, enabling the assumption of responsibility, the adoption of corrective measures to mitigate the risk of repeated violations, and the possibility of filing a notification with the Ministry of Justice is rather secondary.
JUDr. Lucia Slobodová, Attorney
Mgr. Tereza Kacrová, Junior Associate
