At the end of June 2023, the Whistleblower Protection Act came into force, implementing the European Union Directive on the protection of whistleblowers into Czech law. It should be noted at the very beginning, that the Act expands the areas to which reported infringements may relate compared to the Directive.
Whistleblower protection is therefore provided not only to whistleblowers of possible infringements of EU regulations governing the areas listed in the Directive (e.g. financial services, AML, tax area, environmental protection, consumer protection or transportation safety), but also to whistleblowers of conduct that has the characteristics of a criminal offence, that has the characteristics of an offence for which the law sets a fine of at least CZK 100,000 or that violates other legal provisions.
The purpose of this Act is to regulate the procedure for filing and assessing reports of unlawful acts and to provide the necessary protection for whistleblowers, i.e. natural persons who have learned information about possible unlawful acts in connection with their work or similar activities. Such similar activities may be, for example, self-employment, volunteering, professional practice or internships. Protection under this Act is available to a whistleblower who has made a report through an internal reporting system, has made a report to the Ministry, or has published a report under certain conditions.
The aforesaid protection of whistleblowers consists in the prevention of so-called retaliatory measures. The above-mentioned protection also applies, for example, to a person close to the whistleblower or to a person who has provided assistance to the whistleblower in discovering the information contained in the notification. As regards retaliatory measures, the law does not provide for any fixed list and therefore only lists the most common retaliatory measures that can be envisaged, such as notice to leave job, dismissal from service, out-of-service placement or termination of service, imposition of disciplinary measures or disciplinary punishment, or transfer or reassignment to another job or service.
The law also introduces an obligation for certain private and public law entities to establish an internal reporting system, including for all employers with more than 50 employees. The decisive date for determining the number of employees is 1 January of the relevant calendar year. An obliged entity with no more than 249 employees may delegate the establishment of an internal notification system to another person, or may share it with another obliged entity or use the system already established by another obliged entity. Obliged entities with 250 or more employees will be obliged to establish their own full internal reporting system without the possibility to use, for example, an existing group system within the concern.
According to the law, the internal notification system is to be handled by the so-called competent person. The competent person can only be an unblemished natural person appointed by the obliged entity from among its employees or contracted externally for this purpose. In particular, the competent person is obliged to receive and assess the reasonableness of a notification submitted through the internal notification system, to propose to the obliged entity measures to remedy or prevent an unlawful situation following a submitted notification, to act impartially in its performance and to maintain confidentiality of the facts of which it has become aware in the performance of its activities.
Failure to comply with their obligations under this Act may result in a fine of up to one million crowns for the obliged entities if, for example, they allow the whistleblower to be subjected to retaliation, fail to designate a competent person or fail to ensure the possibility to submit a notification through the internal notification system. Due to the very short period of time between the entry into force and the entry into force of the Act, obliged entities, with the exception of public contracting authorities, employing at least 50 and less than 250 employees on the date of entry into force of the Act, are obliged to introduce an internal notification system by 15 December 2023.