Whistleblower protection and reporting channels in Croatia

Yes, there is a law on whistleblowing: The Act on the Protection of Persons Reporting Irregularities ("Official Gazette No. 46/2022").

Yes, both public and private entities employing at least 50 employees are obliged to establish an internal whistleblowing system. This obligation also exists for employers to which certain regulations apply (mostly in the area of financial services and anti-money laundering), regardless of the number of employees.

The entity can be held liable for misdemeanour (monetary fines range from EUR 1,333 to EUR 6,666 for entities and from EUR 133 to EUR 1,333 for responsible natural persons, depending on the exact omission). 

An entity is obliged to (i) adopt a policy regulating the internal reporting system, (ii) appoint a person in charge of internal reporting (and a deputy), (iii) protect the whistleblower from any harmful actions as well as undertake all necessary measures to stop such harmful actions and  any negative consequences they might have, (iv) protect the data received within the process, (vi) ensure there are procedures for keeping records on any reports received, and (v) undertake measures to remove any irregularities revealed.

Yes, a works council or a union representative (if there is no works council or, if the employer has neither, at least 20% of the employees) must be involved in suggesting who should be in charge of internal reporting and the employer is obligated to follow that suggestion. In addition, considering that a policy regulating the internal reporting system is important for the employees’ position, the employer is obliged to consult a works council (or a union representative if there is no works council) when adopting such a policy.

Reporting irregularities to the competent public authority (so called "external reporting"), i.e. to the ombudsman is possible, either after the report has been submitted through the internal reporting system, or directly.

The whistleblower can disclose irregularities directly to the public (known as "public disclosure") if (i) he/she submitts the report through internal reporting system and via external reporting first, but no appropriate actions have been undertaken within the legally prescribed deadlines, or (ii) the whistleblower has a justified reason to believe that the irregularity may pose an imminent or obvious threat to the public interest, there is a risk of retaliation in case of external reporting, or the chances of efficiently removing the irregularity are low, due to the specifics of the case.

A whistleblower must not be retaliated against for reporting irregularities. The law specifies what is meant by "retaliation": termination, inability to be promoted, decrease in salary, initiation of disciplinary proceedings, change of working hours, inability to participate in training, not offering indefinite term employment contract, etc.

Generally speaking, whistleblowing systems must comply with the requirements of the General Data Protection Regulation (GDPR); there are no specific requirements on this matter prescribed by the local law implementing the GDPR. To be lawful, the data processing activity needs to have a legal basis (as listed in Art. 6 GDPR, and Art. 9 GDPR if applicable) and comply with the other obligations and requirements under GDPR, such as the transparency requirements (as prescribed by Art. 13 and 14 GDPR) or data subjects’ rights (Art. 12 – 22 GDPR) and the data protection principles (Art. 5 GDPR), including the principle of data minimisation.

Some specific provisions on the processing of employees’ personal data are prescribed by the Labour Act. For example, a company may have to regulate the data processing by the employment bylaw, and additional formalities may be needed for data processing in companies exceeding 20 employees (e.g. the participation of the commissioner for data protection and the works council).

No, but it also does not prescribe or regulate such a possibility directly (it only states that employers that employ between 50 and 249 employees can share resources related to receiving reports and conducting the proceedings). Therefore, if an employer is obliged to establish a whistleblowing system and decides to have a joint one, it still needs to be compliant with the rules of Croatian law.