Whistleblower protection and reporting channels in Slovenia

Yes, the Reporting Persons Protection Act was adopted on 27 January 2023 and entered into force on 22 February 2023.

Yes, pursuant to the Act the following private entities are required to establish a whistleblowing system: (i) entities with 50 or more employees, (ii) entities with fewer than 50 employees but at least 10 employees if their main registered activity is in the field of health care or in the fields of water collection, purification and distribution, sewage management, waste collection, disposal and management, secondary raw materials extraction, environmental remediation and other waste management, (iii) entities with fewer than 50 employees where other laws transposing EU acts so provide.

Such an offence is punishable by a fine of between EUR 2,000 and EUR 4,000 for a legal person, and a fine of between EUR 3,000 and EUR 6,000 if the legal person is considered a medium-sized or a large company under the Companies Act.

In the process of determining the procedure for internal reporting, the entity must designate a trustee. The Reporting Persons Protection Act defines the tasks of the trustee as well as the handling of the report and its processing. The entities must also adopt a by-law describing the internal reporting procedure, the contents of which are determined in the Act, and provide easily and transparently accessible information on how to use the internal reporting channels and on the internal act describing the internal reporting procedure. 

The entities must also provide employees with information on the procedures for external reporting to external reporting bodies and, where applicable, to the institutions, bodies, offices, or agencies of the EU. The entities must report to the Commission for the Prevention of Corruption by March of the current year on the number of reports and the number of retaliatory measures that have been dealt with.

The Reporting Persons Protection Act does not contain specific requirements. However, since the by-law referred to in question 4 will regulate rights and obligations of the employees, Article 10 of the Employment Relationships Act should be taken into consideration when adopting the by-law. This means that the entity serving as employer will need to notify and obtain an opinion from the worker representative bodies.

A whistleblower can publicly disclose irregularities/misconduct, but he/she is entitled to protection under the Reporting Persons Protection Act only if the following conditions have been fulfilled: (i) he/she has first made a report through an internal or external reporting channel and no appropriate action has been taken to remedy the irregularities/misconduct within three months of the report, (ii) he/she has reasonable grounds to believe that the infringement may constitute an imminent or obvious threat to the public interest, in particular to life, public health and safety, (iii) where there is a risk of irreparable damage, (iv) where in the case of an external notification, a risk of retaliation measures exists, and (v) where the specific circumstances of the case make it unlikely that the infringement will be adequately addressed, in particular where evidence may be hidden or destroyed, or where the external notification body colludes with the infringer or is implicated in the infringement.

Yes, the Reporting Persons Protection Act contains a specific provision prohibiting retaliation against a whistleblower and lists a number of examples of retaliation, including dismissal. Additionally, the Act lists the protection and support measures available to the whistleblower. These include (i) prohibition of disclosure of the identity of the whistleblower, (ii) exclusion of liability of the whistleblower, (iii) judicial protection and interim injunctions in the event of reprisals, (iv) free legal aid, (v) unemployment benefits and (vi) psychological support.

The Act lists the legal persons to whom an external report can be made and who are also responsible for helping the whistleblower through protection and support measures. However, the legal persons receiving the report must always consult the Commission for the Prevention of Corruption in this case.

The Reporting Persons Protection Act contains a provision, which regulates the registration of the report and the processing of personal data related to it, and includes another provision prohibiting the disclosure of the identity of the whistleblower.

The General Data Protection Regulation (GDPR) and the Slovenian Personal Data Protection (ZVOP-2) must be complied with as well. For example, companies must comply with their information obligation under the GDPR. A whistleblowing system may also trigger the obligation to conduct a data protection impact assessment under Article 35 GDPR.

No, local law does not define or regulate such a possibility directly. The Act only states that certain public entities may establish a joint system and that private entities employing less than 250 employees can share resources related to receiving reports and conducting the proceedings.