Whistleblower protection and reporting channels in Slovakia

Yes, the area of whistleblower protection is currently regulated by Act no. 54/2019 Coll. on the protection of whistleblowers and amendment of certain laws (“Act on protection of whistleblowers”). 

The amendment containing the transposition of the EU Whistleblower Protection Directive (“Amendment”) should be effective from 1 July 2023 with some parts not coming into force until 1 September 2023.

Given that Slovak legislation is ahead of the curve in this regard, the proposed amendment introduces the following key changes (subject to alterations adopted within the inter-ministerial evaluation procedure):

• a definition of ‘whistleblower’ in the context of employment relations;
• an extension of the obligation to implement the internal notification system to employers who provide financial services, transport safety services or environmental services, regardless of the number of employees;
• increased duties for employers with respect to the internal whistleblowing system;
• the disclosure of anti-social activities by the notifier will not constitute a breach of the professional secrecy obligation;
• an increase in the amount of fines e.g. for non-compliance with the obligation to establish an internal whistleblowing system (up to EUR 500,000).

Yes, local law requires private entities to establish an internal whistleblowing system. Under the current legislation, private entities that 1) employ at least 50 employees, or 2) provide financial services, transport safety services, or environmental services (regardless of the number of employees) are obliged to designate a responsible person for internal reporting.

The legal risks for failing to establish a whistleblowing system are mainly fines administered by the Whistleblower Protection Office. The Amendment introduced substantially increases the fines for breaching the Act on protection of whistleblowers. A company breaching the obligations imposed by the Act on protection of whistleblowers (including the appointment of the person responsible for the internal reporting) can face fine of up to EUR 100,000. The maximum amount can be doubled in case of repeated breaches over the previous two years. 

Yes, there are such mandatory requirements, however they are not directly contained in the Labour Code, but directly in the Act on protection of whistleblowers (please see our answer to question number 2 and 3). The current legislation only specifically regulates, that the identification of the responsible person and the form of reporting must be published and accessible to all employees in the usual and commonly available form and that at least one method of reporting must be accessible at all times. 

Further, the Act on the protection of whistleblowers stipulates that all relevant aspects must be regulated by an internal directive. Besides details on the method and form for submissions of the whistleblower reports/information, the internal directive must also regulate details on the verification process of the reports and the authorization of the responsible person, protection of the confidentiality of the whistleblower, evidence of the whistleblower reports, the notification of the whistleblower about the result of the verification process and the processing of the personal data contained in the whistleblower report, measures taken to eliminate deficiencies found during an investigation of whistleblowing reports and on communication to the whistleblower about them and measures taken against the prevention of whistleblowing reporting.

Only to a certain extent. Under the current legislation, when establishing a whistleblowing system, all employees must be informed about the person responsible for internal reporting in a commonly accessible form. In other words, all employees must be aware of the basic whistleblowing procedure in respect of their employer (please see our answer to question 4).

The employees may disclose irregularities/misconduct externally, if statutory conditions under the Act on the protection of whistleblowers for such disclosures are met (e.g. the whistleblower was not informed about the results of an internal investigation on time, there is reasonable concern of immediate or obvious threats to the public interest).

Besides the framework of the Act on the protection of whistleblowers, the employee must comply with all other legal requirements set by the Labour Code. According to the Labour Code, the employee is obliged to maintain confidentiality about facts which he learned during the course of employment and which cannot be disclosed to other persons. The duty of confidentiality does not apply to the reporting of crimes or other anti-social activities.

In addition, the obligation to report certain crimes directly stems from the Criminal Code. The Criminal Code stipulates that whoever does not report facts indicating that the crime of money laundering, financing of terrorism, an unusual business operation or any of the crimes of corruption has been committed, even if a confidentiality obligation arises from their employment, profession, position or function, shall be punished by imprisonment for at least 2 up to 8 years.

The Criminal Code also defines as a criminal offense the Non-Prevention of a Crime and the Failure to Report a Crime. This means that whoever fails to prevent or report a criminal offense for which the Criminal Code stipulates the penalty of imprisonment for more than 10 years or fails to prevent or report the commission of any of the crimes of corruption in person, through a competent person, authority, police or law enforcement authorities, shall be punished by imprisonment for up to 3 years.

Yes, the whistleblower protection legislation actually deals with protection of the whistleblower in respect to such actions of the employer in depth. From the moment the employer is informed of the status of the employee as a protected whistleblower, the employer may not perform labour law actions (including dismissal) against the employee without prior consent of the Whistleblower Protection Office. Consent is not required if the employer grants a request of the employee such as a pay increase or bonus holiday days. Further, if the employer applies for consent of the Whistleblower Protection Office to conduct an action against the protected whistleblower (including dismissal), the burden of proof in respect of non-existence of a causal connection between the report made by the whistleblower and the action taken against him lies with the employer.

Moreover, even without having the status of a protected whistleblower, the whistleblower can ask the Whistleblower Protection Office for suspension of employment law action (e.g. dismissal) taken against the whistleblower. The whistleblower must do so within 15 days from the day when the whistleblower learned about the employment law action. The suspension is effective for 30 days.

In general, the whistleblowing systems need to comply with the GDPR and the Slovak Act on data protection. That means that the legal basis for the data processing needs to be determined as provided in Art. 6 and Art. 9 of the GDPR. It is also necessary to adhere to the data protection principles such as the principle of data minimisation provided in Art. 5 of the GDPR, and also to comply with the Art. 13 and 14 of the GDPR which regulates transparency requirements, and in addition to prepare a privacy notice addressed to employees. Further, the processing must comply with other data subjects’ rights covered by Art. 12 – 22 of the GDPR.

In addition, the obligation to implement such data processing in the records of processing activities provided by Art. 30 of the GDPR and to conduct a data protection impact assessment covered by Art. 35 of the GDPR must be considered.

The outsourcing of whistleblowing reporting channels is possible based on the contract with the employer. The person outside of the entity of the employer can: 1) receive, confirm delivery, and investigate whistleblowing reports (applicable for employers with fewer than 250 employees); or 2) receive and confirm delivery of whistleblowing reports (applicable for employers with more than 250 employees). This does not affect the obligation of an employer to have an internal whistleblowing officer (the Slovak term is “responsible person”) who can be 1) an employee, or 2) a member of a statutory body.