It has been more than half a year since the Czech Republic transposed the EU Whistleblowing Directive by introducing the Czech Whistleblower Protection Act (Act), effective as of August 1, 2023.
The main aim of the Act is to create secure internal reporting channels within which whistleblowers may report defined violations of the law of which they have become aware in connection with their work or other similar activities. For this reason, all employers with 50 or more employees, together with other specified persons, are considered obliged entities and, as such, are required to implement an internal reporting system (IRS).
As the whistleblowing legislation stems from an EU directive, multinational groups of companies tend to have their own global whistleblowing solutions. This may seem attractive, however, as legislation varies considerably from country to country across Europe, local implementation is inevitable, and as the obliged entity must ensure the report can be submitted in person, appointing a local Whistleblowing Officer is usually recommended. The differences include the violations that fall within the scope of reporting, the reporting process itself, the procedure of processing reports, the communication with the whistleblower, the time limits, whether there is anonymous reporting, and other issues. Failure to comply with local regulations may result in the liability of the obliged entity. Furthermore, in order to assess the reasonableness of the report properly, knowledge of local legislation is necessary.
In the Czech Republic, only obliged entities with 249 or fewer employees (including agency employees) are allowed to share an IRS. If an obliged entity has 250 or more employees, then it is required to have its own IRS and its own Whistleblowing Officer, even if it is part of a group. Special rules apply for obliged entities that are subject to AML regulations, such as financial institutions, law firms, etc.
A global solution usually includes internal policies the scope of which is broader than the Czech Act. This can cause complications in practice when a report is actually submitted. The Act contains an exhaustive list of violations which may be reported. The obliged entity is not obliged under the law to ensure the assessment of the reasonableness of the report, which is not included in this exhaustive list. However, if the obliged entity decides to extend this list, the question of whether the obliged entity will then be subject to the obligations under the Act in relation to the report submitted in this extended scope is not yet resolved. For the sake of safety, it is recommended to proceed with all reports that fall within the scope of the Act and the internal policies in compliance with the Act.
Under the Act, only the Whistleblowing Officer officially designated by the obliged entity can have access to the full contents of the report and the identity of the whistleblower(s). Other persons, such as HR team members, may have access only to anonymized or generalized parts of the report and only under the condition that such sharing is necessary for the investigation and assessment of the report.
Obliged entities are required to publish specific information about the IRS in a way that allows remote access. The term “remote access” can be interpreted simplistically to mean the internet. The most common and best solution is to provide this information on the obliged entity’s website. It is essential that this information be easily accessible to potential whistleblowers. The existence of an external reporting system operated by the Ministry of Justice of the Czech Republic must also be mentioned.
Control over compliance with the Act is carried out by the Ministry of Justice and the Labor Inspectorate. Inspections are already carried out by the Labor Inspectorate, focusing mainly on whether the obliged entity has: (i) a designated Whistleblowing Officer, (ii) adopted internal policies, (iii) ensured that whistleblowers are able to submit a report, (iv) published information about their IRS in a manner allowing remote access, (v) ensured that only the Whistleblowing Officer has access to the full content of the reports, (vi) already received a report – if so, related documentation on the assessment is required.
It is therefore necessary for obliged entities in the Czech Republic to ensure that they have duly implemented the Act.
By Barbora Urbancova, Partner, and Jakub Krivka, Associate, Peterka & Partners
This article was originally published in Issue 11.4 of the CEE Legal Matters Magazine. If you would like to receive a hard copy of the magazine, you can subscribe here.
