Whistleblower protection and reporting channels in Czech Republic

Yes. The Czech Whistleblower Protection Act (the “Act”) has been adopted and will become effective on 1 August 2023.

Yes, in addition to entities that are already obliged to have a reporting channel under special laws (e.g. entities in financial sector, obligated entities under the AML Act), the Act imposes the obligation to establish a whistleblowing system on all employers that have at least 50 employees as of 1 January of each calendar year. The deadline for employers that have 50 to 249 employees is 15 December 2023. Employers with at least 250 employees as of the effective date of the Act (i.e. 1 August 2023) will have to have an internal whistleblowing channel immediately on the effective date.

Employers who have fewer than 50 employees as of 1 January of the relevant year generally do not have to establish an internal reporting channel. However, doing so might be advisable in order to mitigate the risk of external reporting to the Ministry of Justice.

Some specific categories of employers (e.g. insurance and reinsurance companies, investment companies and self-managed investment funds) must establish a whistleblowing system irrespective of the number of their employees.
 

Failure to establish an internal whistleblowing channel is subject to a fine of up to CZK 1 million (approximately EUR 42,000).

In addition, failure to establish and operate a truly functional internal whistleblowing channel may make it impossible to absolve the company from criminal liability for acts committed by its employees or directors in a business-related context. It may also lead to whistleblowers making reports of potential violations to the Ministry of Justice or publicly disclosing their concerns, which may significantly hurt the company’s PR.

Companies are generally free to choose how they design their whistleblowing channel. To this end, the Act sets forth multiple requirements, which the internal whistleblowing channel must meet. For example:

• the internal channel must allow whistleblowers to make their reports (i) in writing, (ii) orally, and (iii) upon request, in person to individuals designated to assess the reports;
• only the designated persons can have access to whistleblowers’ reports;
• whistleblowers must be informed within specific deadlines about the receipt of their report and about the final assessment.

Companies must publish information about the manner in which a report can be made via the internal whistleblowing channel, together with additional mandatory information (e.g. the designated person’s contact details) in a way that allows remote access (typically on their websites) 

There are no special requirements for establishing the internal whistleblowing channel from the employment law perspective (e.g. consultation with employee representatives, co-determination).

No. Establishing a whistleblowing channel does not trigger any information or consultation obligation towards employees or their representatives.

No, whistleblowers can always use the external whistleblowing channel operated by the Ministry of Justice or inform the competent authorities directly. Under certain circumstances, whistleblowers can also disclose their concerns publicly. Public disclosures are reserved, in particular, for the most severe situations (e.g. imminent or obvious threat to public order and security, or threats to peoples' lives or health, etc.) or for situations when other whistleblowing channels do not work properly or the whistleblower can reasonably expect that filing a report would lead to retaliations.

Yes. Retaliation against a whistleblower is prohibited. Retaliation is an act or omission related to the whistleblower’s work or other similar activity that is triggered by the report and is harmful to the whistleblower and other protected individuals (e.g. people who helped the whistleblower discover the reported violations and collect evidence, the whistleblower’s colleagues or close persons). Retaliation includes dismissal, demotion, recall from a managing role, reduction in salary, transfer to another role, change of working hours, withholding of training, etc. 

To qualify for the protection, the whistleblower’s report (i) must fall within the material and personal scope of the Act and the whistleblower must follow the relevant reporting procedures, (ii) the report must be non-anonymous, and (iii) the whistleblower must reasonably believe that the reported information is true.

If a whistleblower alleges retaliation in a legal dispute, it is up to the defendant (e.g. the employer) to prove otherwise.

There are currently no other data protection requirements that go beyond the regulation laid down by the General Data Protection Regulation (GDPR). Based on the GDPR, the processing of personal data requires a valid legal basis, the processing must always be carried out in the least invasive way possible to minimise the impact on the data subject, and personal data irrelevant to a specific report must not be collected or must be deleted without delay. The GDPR includes many other obligations.

When a designated person is located outside the EU, it is necessary to review the process from a data protection perspective and to be in compliance with the GDPR.

No. The Act allows the obliged entities (except for public contracting authorities) of up to 249 employees each to share the internal whistleblowing channel. The number of employees as of 1 January of each calendar year is relevant to this threshold. If multiple entities from the same group are active in the Czech Republic, each of them must be considered separately.