In June 2023, the Czech Republic adopted the Whistleblower Protection Act implementing the relevant EU Directive with a two-year delay. The law came into force on 1 August 2023.
While large employers with 250+ employees were obliged to implement the so-called internal reporting system (IRS) by 1 August 2023, medium-sized employers with 50-249 employees still have time until 15 December 2023.
What needs to be done and what is at risk?
In particular, all employers with 50 or more employees must:
- Implement IRS,
- Appoint and train a competent person to receive and handle notifications,
- Publish the prescribed information on its website, and
- Ensure that other obligations related to the receipt and handling of notifications and the protection of whistleblowers are met.
No sophisticated technical platform is required to implement IRS, just an email and a phone. Failure to implement IRS can result in a fine of up to CZK 1,000,000. Employers may also face individual whistleblower claims for failure to provide the required protection.
Can the IRS be outsourced or shared?
Yes, the employer can choose between external and internal technical support for the IRS, and the performance of the designated person's function can also be outsourced. However, the ultimate responsibility always lies with the employer, and even an external contractor will certainly not relieve you of the burden of finding and transmitting information and related communications. Only employers with up to 249 employees may share the IRS. However, the sharing of IRS within a group without having its own IRS is problematic according to some statements of the European and Czech authorities.
Will our local or group ethics hotline no longer suffice?
In the vast majority of cases, the existing ethics hotline or similar mechanism for receiving notifications will not meet all the requirements under Czech law.
Especially in the case of a group solution, it is also very problematic to interfere with the setup of such a line and ensure that the specific Czech requirements are met. Therefore, it is often more efficient to introduce a parallel minimum IRS compliant with Czech law.
What is included in our implementation package and how long does it take to implement?
Based on our experience, we recommend a simple local and internal solution based on the minimum necessary implementation of the requirements of the Czech legislation, including the appointment of the appropriate employee(s) as the designated person. For this solution, we have prepared a minimum implementation package that includes the relevant whistleblowing policy, mandatory information to be published on the website, instruction and training for the designated persons and related supplementary GDPR documentation, including comprehensive legal support during implementation. Please allow ideally 2 weeks for the actual implementation.
By Radek Matous, Partner, and Barbora Safarikova, Senior Associate, Eversheds Sutherland
