The Act on Protection of Reporting Persons (the “Act“) became final and was published in the Collection of Laws on 20 June 2023. The Czech Republic has thus fulfilled its obligation to implement Directive (EU) 2019/1937 of the European Parliament and of the Council of 23 October 2019 (the “Directive“) into its legal order, although it has done so with considerable delay, as the transposition deadline for the implementation of the Directive expired on 17 December 2021.
This article is a follow-up to our already published article Protection of Whistleblowers – New Obligations for Employers, which focuses on the general basic obligations under the Act for so-called obliged entities, especially the obligation to establish an internal reporting system and to appoint a designated person. In this article, we provide the reader with a detailed introduction to the rights and obligations of the designated person responsible for compliance with the statutory obligations on the part of obliged entities, which primarily include ensuring effective protection of whistleblowers from retaliation and the operation of an internal reporting system. Link to the article here.
Who can be a designated person?
In accordance with the provisions of Section 10(1) of the Act, only a natural person who has no criminal record, is of legal age, and fully capable of exercising his or her legal capacity may be a designated person.
However, the obliged entity should also consider the professional and moral qualifications to perform the activity of this function. A person who is not capable of ensuring trustworthiness or proper performance of duties should not be appointed by the obliged entity as a designated person, as the confidence of the reporting persons in the designated person and the internal reporting system is crucial and can only be achieved if the designated person is impartial. The designated person shall certify this by means of an extract from the criminal record, which must not be older than 3 months, and the designated person shall at the same time be obliged to report to the obliged entity or to the person in charge of the internal reporting system that he or she has ceased to fulfil the condition of integrity, if any, within 10 days of the date on which this occurred.
If the designated person does not meet the above-mentioned statutory criteria, he or she shall be replaced without undue delay by the obliged entity by another suitable person to act as the designated person.
Internal or external designated person?
It can be expected that a significant number of obliged entities will want to appoint a designated person from among their existing staff who has knowledge of the company’s internal processes and situation. However, the designated person’s role brings with it several responsibilities, and the subsequent workload of the internally designated person-employee should be considered, as well as his or her potential availability in the event of indisposition, and the independence and impartiality of the designated person.
If the staffing capacity of the obliged entity is insufficient to select the designated person from among the staff and/or if the obliged entity wishes to ensure the highest possible independence of the designated person, it is possible to outsource the designated person (usually an attorney).
The advantage in such a case lies primarily in the guaranteed erudition of such a designated person, the absence of a conflict of interest, and the lower administrative burden because the designated person specialises in the agenda and has already the experience needed to assess the report correctly and therefore does not need to be trained to ensure qualification.
The optimal set-up may be to establish at least 2 designated persons, preferably a combination of an internal designated person and an external designated person so that the obliged entity can deal with potential conflicts of interest, professional indisposition and substitutability of the designated person and manage impartiality to ensure confidence in the reporting system.
In practice, the question also arises whether it is possible for the function of the designated person to be performed by a person who already acts as a Data Protection Officer (“DPO“) for the obliged entity. The functions of the designated person and the DPO have in principle a lot in common. The combination of these two functions in the person of a single employee is neither addressed nor prohibited by the Act and it is therefore entirely up to the obliged entity to decide what course of action to take. However, it is necessary to consider the potential conflict of interests in terms of the protection of personal data and the protection of the reporting persons (the subject of the report may also be a complaint against the unlawful processing of personal data of employees or other persons by the obliged entity).
Activities of the designated person
The obligations of the designated person derive directly from the provisions of the Act and may be further specified in internal regulations or in a contract concluded with such (usually external) designated person.
A key duty is to receive, assess the reasonableness of and deal with reports received (in this respect it may also be advisable that the designated person is a legally erudite person).
At the same time, the designated person must keep a record of the reports and maintain a list of them, including the date of submission, the identity of the reporting person and the person against whom the report was made, and the conclusion of the reasonableness assessment with the date. The reports in the record must be kept by a designated person for a period of 5 years from the date of their receipt.
If the report is found to be substantiated, the designated person shall be obliged to propose measures to remedy or prevent the established unlawful situation, the implementation of which shall be at the discretion of the obliged entity itself.
Compliance with the instructions by the obliged entity is, of course, a matter of course – it may therefore be recommended that obliged entities have internal documentation and regulations in place which set out in detail the patterns of behaviour between the designated person and the obliged entity.
Given the need for trust in the entire internal reporting system or in the designated person, one of the obligations is to act impartially with the necessary degree of professionalism. Accordingly, the designated person must maintain confidentiality and keep the identity of the reporting person confidential, even when the appointed person ceases to act as the designated person.
Procedure to be followed by the designated person after the report has been lodged
The reporting person must be given the opportunity to submit the report to the designated person in writing or orally and, if the reporting person so requests, in person, directly to the designated person. The law provides that the meeting between the reporting person and the obliged person must take place within 14 days.
The designated person must accept the report and inform the reporting person in writing of the acceptance within 7 days.
The next step is for the designated person to assess the reasonableness of the report, which the designated person must do within 30 days from the date of receipt of the report and inform the reporting person of the outcome within the same time limit. In special cases, the time limit may be extended twice by 30 days each time, and the reporting person must be informed in writing of the extension, including the reasons for it.
The final procedure shall depend on the validity of the report. If the designated person finds it justified, he or she must propose to the obliged entity a possible solution to prevent or remedy the unlawful situation, which in practice may mean, for example, the repeal of the defective internal regulation, the elimination of the damage caused or, in the extreme case, the filing of a criminal complaint. Otherwise, it shall inform the reporting person in writing of the unjustified or untrue nature of the report and shall also inform him or her of the possibility of submitting a report to a public authority if he or she disagrees with the conclusion of the designated person.
Liability of the person responsible for offences and criminal offences
An important topic in relation to designated persons is the responsibility of the designated person for offences and their sanctioning. Whether the function of the designated person is carried out directly by an employee or by an external natural person, the responsibility for breaches of his or her duties will be borne solely by the designated person, not by the obliged entity.
An offence punishable by a fine of up to CZK 20,000 may be committed by the designated person by failing to notify the loss of his or her integrity and to notify the outcome of the assessment of the validity of the report.
More serious offences are refusal to accept or assess the validity of the report, disclosure of information which could defeat or jeopardise the purpose of the report and disclosure of the identity of the reporting person, without his written consent. For these offences, the Act provides for a fine of up to CZK 50,000. In the case of intentional conduct, the fine is up to CZK 100,000.
In addition to liability for misdemeanours, the designated person may also be held liable, as a last resort, in particular for the commission of a criminal offence pursuant to the provisions of Section 368 of Act No. 40/2009 Coll., the Criminal Code, as amended (hereinafter referred to as the “Criminal Code“), if he or she fails to report the commission of an offence to which the obligation to report applies.
Conclusion and recommendations
The designated persons are one of the new institutes introduced by the Act and its correct selection is crucial for the fulfilment of the obligations of the obliged entity in relation to the protection of the reporting persons.
Regarding the effectiveness of the Act as of 1 August 2023, it is high time for the obliged entities to start searching for a suitably designated person and to prepare related internal legal documents specifying the duties of the designated person, including the necessary cooperation with the concerned employees. However, the selected obliged entities will have a longer time to comply with the Act. Obliged entities, except for contracting authorities and entities employing at least 50 and less than 250 employees on the date of entry into force of the Act, will be obliged to implement an internal reporting system (up to) 15 December 2023.
For reasons of fungibility and avoidance of potential conflicts of interest, we recommend that the obliged entities appoint at least two designated persons, preferably a combination of internal and external designated persons, and provide them with ongoing training on their rights and obligations related to the function of the designated person to avoid undesirable situations that could lead to sanctions.
We are at Your disposal if You need legal support on the topic of whistleblower protection.
Mgr. Jakub Málek, managing partner – malek@plegal.cz
Mgr. Tomáš Maux, junior lawyer – maux@plegal.cz
Tereza Benešová, legal assistant – benesova@plegal.cz
23. 06. 2023