Whistleblower Protection Act

On 7 June 2023, the President of the Czech Republic signed the Government Bill on Whistleblower Protection, which will enter into force on 1 August 2023.

The law implements the Directive of the European Parliament and of the Council on the protection of persons who report breaches of Union law. The Act introduces new obligations for some entities regarding the protection of people who report certain breaches (whistleblowers).

It will apply, among others, to companies (employers) to ensure that whistleblowers among their employees, cooperating self-employed people, and members of governing bodies are protected. Despite amendments and calls from NGOs, the law will not provide protection for anonymous whistleblowers.

The purpose of the law is to protect people who suspect illegal conduct has taken place in the company and decide to report it. Under the Act, it will be possible to report all crimes and administrative offences for which the maximum penalty is set at least CZK100,000.

Whistleblowers will then be protected from retaliation (eg dismissal), have the right to keep their identity confidential and will have the right to be informed about how their report will be handled.

In general, there will be an obligation to notify the whistleblower within seven days of the report being made and to follow up on the report within 30 days of it being submitted, with the possibility of extending the deadline in exceptional cases. The law also aims to establish an internal reporting channel to simplify the entire reporting process.

Reporting channel

The implementation of this system is a key obligation of the new legislation. This obligation applies to a number of entities, including all employers who will have at least 50 employees on 1 January of a given calendar year. The system management can be outsourced to a third party – but this will not apply to entities required to implement the reporting system under the AML regulations (eg banks and other financial institutions).

Employers with fewer than 250 employees will be able to share the system with another entity. This will be typical for group companies for example.

Small and medium-sized employers will have to implement a reporting system by 15 December 2023. But employers with at least 250 employees will have to set up their internal system separately at a local level and the system must be active when the new legislation comes into force (ie 1 August 2023). This shorter deadline will also apply to obliged entities under the AML regulation.

Competent person

Another key obligation is to designate a person, who can be either internal or external, whose main task will be to receive and assess the validity of reports, propose remedial action to the obliged entity and maintain the confidentiality of all facts that come to light in the course of their duties, even after their duties have ceased. The competent person is also required to keep an electronic register of all reports, each of which must be kept for five years.

Penalties

Failure to comply with the obligations is punishable by a fine of up to CZK1 million for obliged entities and up to CZK50,000 in the case of a whistleblower knowingly submitting a false report.

If you’d like more detailed information on the new legislation or would like assistance with the internal reporting channel or the activities of the designated person, please do not hesitate to contact us.