Background

Due to the fragmentation and inconsistency of whistleblower protection legislation across EU Member States, the EU adopted the Whistleblowing Directive on 23 October 2019. The Whistleblowing Directive sets minimum standards for the protection of whistleblowers in the EU, which has been in force since 16 December 2019. Member States were required to transpose it into national law by 17 December 2021.

In this regard, the Czech Republic failed to implement the Whistleblowing Directive within the implementation period. As a result, the Whistleblowing Directive has direct effect from 18 December 2021, although imposing obligations only on public entities (such as state and municipal authorities, public universities, public healthcare institutions, and publicly owned companies) rather than private enterprises. The Ministry of Justice issued guidelines on the Whistleblowing Directive's direct effect, which was last updated on 15 December 2021.

The first draft bill implementing the Whistleblowing Directive was presented in February 2021, but it failed to pass in the last parliamentary term. The new and updated Draft Bill was published on 29 April 2022 and, if enacted, is expected to come into force on 1 July 2023. The Draft Bill is more in line with the Whistleblowing Directive than the previous draft bill, reducing the strictness of the previous draft bill, although some differences from the Whistleblowing Directive remain.

The delayed implementation of the Whistleblowing Directive creates an undesirable two-tier system, in which employees of public entities enjoy protections granted by the Whistleblowing Directive, whereas employees of private entities must rely on the existing patchwork of protection, which is based mainly on the prohibition of discrimination and employee protection under Act No. 262/2006 Coll., Labour Code (as amended) ('the Labour Code') and Act No. 198/2009 Coll., Anti-Discrimination Act. This may discourage employees of private entities from reporting, even though many public entities have already established internal reporting channels (not just for their own employees, but also for contractors and their employees), and the Ministry of Justice operates an external reporting channel under the Whistleblowing Directive.

Draft Bill on the Protection of Whistleblowers

The current Draft Bill regulates:

• the conditions for submitting and assessing reports;
• the conditions for providing protection to persons who have reported; and
• the powers of the Ministry of Justice in relation to the protection of whistleblowers.

The Draft Bill mainly follows the structure of the Whistleblowing Directive, but differs from it in some key respects, which are presented in what follows.

Definition of whistleblower

The definition of a whistleblower is essentially the same in the Draft Bill as in the Whistleblowing Directive, but the Draft Bill specifies that the whistleblower must be a natural person (for instance, the subcontractor cannot be a whistleblower, but an employee of the subcontractor may be one). The protection is granted not only to employees (including civil servants and volunteers), but also to self-employed contractors, shareholders, members of executive or supervisory bodies within companies, subcontractors, suppliers, and their employees. The protection is extended also to former and future employees.

Although the protection against retaliatory measures is granted to all whistleblowers (the only condition is the existence of a work-related relationship between the whistleblower and the entity and good faith in truthfulness of the report), access to internal reporting channels must be provided only to employees, civil servants, and volunteers. Under the Draft Bill, each entity may choose whether to accept reports from other whistleblowers than its employees (or civil servants) and volunteers, and publish this information, together with contact details for the submission of reports and other mandatory information.

The same applies to anonymous reports. The proposed Draft Bill does not mandate whether to accept anonymous reports, but passes the choice on to companies themselves. Under the Draft Bill, each entity may choose whether to accept anonymous reports, and publish this information. The protection is granted also to anonymous whistleblowers, should their identity be later revealed.

Material scope

The material scope is broader in the Draft Bill than in the Whistleblowing Directive. In addition to breaches of the EU law in specified areas (such as data protection, consumer protection, public procurement, competition law, financial law, product safety and compliance, and environmental protection), the reports may include information about any criminal offence. The original proposal was even broader and included not just any criminal offence, but also any administrative offence, which would make it possible to report even minor infractions and thus possibly overload internal reporting channels.

Broadening the scope of reporting to include criminal offences is fully in line with the Whistleblowing Directive which makes it possible for Member States to enact rules which are more favourable for whistleblowers. Reporting the most serious infringements of law outside the scope of EU law can be welcomed (for instance, the material scope of the Whistleblowing Directive does not cover workplace harassment or discrimination), but it places relatively high professional demands on the competent person assessing the reports.

Internal reporting channels and internal investigation

The Draft Bill exempts companies with fewer than 50 employees (unless they are public contracting authorities or operate in one of the more exposed sectors, such as financial services, civil aviation, marine transport, or the offshore oil and gas sector) and municipalities with fewer than 10,000 citizens from the obligation to set up internal reporting channels. This makes full use of the exemptions allowed by the Whistleblowing Directive (unlike the previous draft bill, which set the threshold at 25 employees and 5,000 citizens).

The possibility to share the internal reporting system has been extended by the Draft Bill from private entities with 50-249 employees to municipalities (which may share the system only among themselves).

The Draft Bill further specifies requirements for the competent person who handles internal investigations. Such competent person must not only be impartial (as required by the Whistleblowing Directive) but must also meet integrity requirements and full legal capacity. Legal qualification is not required by the Draft Bill, but to competently assess reports, such qualification or access to adequate resources (including external legal advice, if necessary) should be provided.

Normally, the competent person may be liable for administrative offences related to the handling of reports and fined up to €4,000 in the event of a breach of the Draft Bill (usually, the company which appointed the competent person would be liable for the breaches). This fact may deter some employees from accepting the appointment as a competent person.

The competent person may only be a natural person, which means that this role cannot be outsourced for instance to a law firm or other specialist firm (an individual attorney or other independent contractor may still be appointed to be a competent person).

Compared to the Whistleblowing Directive, the Draft Bill reduces the time limit for investigating a report under the internal reporting system to 30 days, compared to the three months stated in the Whistleblowing Directive. However, the proposal foresees a possible extension of the time limit twice by 30 days, but the extension must be justified and notified to the whistleblower before the time limit expires. This applies only to internal reporting; the Ministry of Justice has three full months for the assessment of reports made via the external reporting channel.

Although it might be more favourable for the whistleblowers to have their reports assessed sooner, such reduction of the time limit for investigations places a significant burden especially on smaller entities without a dedicated legal or compliance department. The Draft Bill also does not provide justifications for different treatment of the Ministry of Justice.

Scope of protection of whistleblowers

The prohibited retaliatory measures under the Draft Bill broadly match with those under the Whistleblowing Directive.

The Draft Bill contains broader exemption from the contractual or statutory duty of confidentiality in cases of reporting compared to the Whistleblowing Directive. The statutory duty of confidentiality of medical and legal professionals remains untouched, but the whistleblower is expressly protected against the breaches of bank secrets, contractual confidentiality, the duty of confidentiality under Act No. 280/2009 Coll., Tax Code, or the duty of confidentiality under other legislation governing work or other similar activities.

The proposed Draft Bill amending other acts in relation to the adoption of the Draft Bill should also help whistleblowers in case of eventual civil lawsuits in two crucial ways. First, it makes it easier to seek interim measures to prevent likely harm. Second, it transfers the burden of proving that taking alleged retaliatory measures was objectively justified, proportionate, and necessary to the defendant.

Potential impact of the Draft Bill on companies

Once adopted, the Draft Bill will mean that most employers will be required to:

• establish an internal channel for secure reporting and communication with whistleblowers;
• establish processes for responding to reports and taking corrective and preventive action;
• appoint a person responsible for receiving and handling reports (i.e. a competent person);
• ensure proper assessment of the report and ensure that appropriate remedial action is taken in case of a justified report;
• ensure confidentiality of the identity of the whistleblower;
• avoid any retaliatory measures against the whistleblower; and
• keep records of notifications received and the secure disposal of data after the expiry of the archiving period, currently set at five years.

The prohibition of retaliatory measures extends to all employers, including those who do not have to establish internal reporting channels and appoint a competent person.

Failure to comply can result in a fine of up to €40,000 or 5% of the company's net turnover (or up to €16,000 or 3% of the company's net turnover in cases of less significant infringements).

Penalties may be imposed on other persons and entities than the employer. A penalty of up to €2,000 can be imposed on the person who knowingly makes a false report. Anyone who prevents a whistleblower from reporting may face a penalty of up to €4,000, and anyone who fails to prevent retaliation against a whistleblower may face a penalty of up to €8,000. A competent person may face a penalty of up to €4,000 in case of breach of their obligations.

The sanctions proposed under the Draft Bill are strict; the use of penalties calculated from the turnover has so far been limited to the area of competition law and, more recently, to data protection under the General Data Protection Regulation (Regulation (EU) 2016/679) ('GDPR'). It remains to be seen whether the Czech authorities will impose the maximum penalties for infringement of the Draft Bill.

Next steps

The Draft Bill needs to be finally approved by the Government and both chambers of the Parliament, and then signed into law by the President. The current Draft Bill is expected to come into force on 1 July 2023.

Although most entities still have a year before the new obligations take effect, they can be advised to set up internal whistleblowing procedures and to introduce an internal reporting system as soon as possible for several reasons; the first being that public entities and the Ministry of Justice already have set up reporting channels under the Whistleblowing Directive, and some private sector employees may use those channels to make reports affecting their employers (although without full legal protection).

More importantly, internal whistleblowing systems are increasingly considered a norm and may be required by customers and parent companies (especially in case of multinational groups) regardless of the applicable legislation. Internal reporting systems also allow the company to resolve problems from within and thus prevent reputational damage and harm resulting from continuing illegal practices. It also gives the company the possibility to maintain control over decision-making and prevent external interference.

Michal Nulíček Partner
[email protected]
Anna Cervanova Associate
[email protected]
Rowan Legal, Prague