Act No. 171/2023 Coll., on the Protection of Reporting Persons (the “Act“), entered into force on 1 August 2023 and brought institutional protection of whistleblowers into the Czech legal system. We present a summary of practical advice and recommendations for implementing an internal reporting system in an organisation.
This article is the next in a series on whistleblower protection in the Czech Republic, which you can follow here: https: //www.peytonlegal.cz/en/category/whistleblowing-2/.
Obliged entities
The selected obliged entities are obliged to have an effective internal reporting system in place as of 1 August 2023, while some of the obliged entities employing between 50 and 250 employees on the date of the Act’s entry into force have a longer deadline and the obligation to introduce an internal reporting system applies to them only as of 15 December 2023.
Among the obligatory entities subject to effectiveness regardless of the number of employees are also persons operating in the field of capital market business, insurance, persons obliged under the Act on Certain Measures against the Legalization of Proceeds from Crime and Terrorist Financing, investment companies, funds or other persons specified by the Act and municipalities with more than 10,000 inhabitants.
Process for implementing the internal notification system
The introduction of an internal notification system necessarily entails a certain degree of dedication on the part of selected employees of the organisation implementing the system.
We recommend focusing on the following six areas in particular:
- Choice of reporting forms and reporting system solutions
- Identification of the designated person
- Internal documentation – guidelines and templates
- Revision of current documentation
- Communication externally
- Internal promotion
Choice of reporting forms and reporting system solutions
The law allows whistleblowers to submit their reports orally or in writing. Written reports can be made both electronically and physically. Oral reports can be made in person or by speaking to the designated person by telephone or by sending a voice message. It is important to pay attention to the chosen technical design of the reporting system and the different ways of receiving reports.
In the case of an oral report, the designated person will be obliged to make a recording, audio recording or transcript of the notification to maintain transparency and recordability. However, the designated person must not make an audio recording without the consent of the notifier and, if consent is not granted, must ensure that a record of the notification is made with the requisites of a protocol pursuant to Section 18(2) of Act No 500/2004 Coll., Administrative Procedure Code, as amended.
The whistleblower shall also have the right to comment on the transcript or recording made and, if he makes such a comment, it shall be attached to the transcript or recording itself. In addition, if the whistleblower requests that the report be received in person by a designated person, the Act requires that the meeting must take place within 14 days, and even in such a case the identity of the whistleblower must be protected and the time and place of the meeting designedly chosen.
In any case, we recommend that organisations adopt a modern, comprehensive technical solution that ideally combines all the capabilities of the reports forms in one tool, while at the same time providing sufficient security guarantees for data and information management, such as the NNTB solution from FaceUp Technology (https://www.faceup.com/en).
Identification of the designated person
The obliged entity is obliged to designate a designated person, who shall be a natural person of good character, of full age and legal capacity. An important criterion is in particular the credibility of the person in question, and although there is no requirement under the Act as to the qualifications of the designated person, it is advisable to designate such a person who will be able to properly assess the validity of the notification and suggest possible measures to remedy or prevent the unlawful situation.
The obliged person must not be penalised for the proper performance of its duties and its duties include in particular:
- receive and assess the validity of the report;
- suggest possible measures to remedy or prevent the illegal situation;
- maintain confidentiality and act impartially in the performance of their duties;
- comply with the instructions of the obliged entity, unless they threaten or obstruct the performance of the activity.
In order to achieve the proper functioning of the internal reporting system, particularly in the case of conflict of interest, incapacity, etc., it is advisable to go down the route of designating more than one designated person, preferably a combination of staff and external persons who specialise in whistleblower protection issues and thus impose less administrative burden on the obliged entity. The best combination is then at least two designated persons, one internal and one external.
The obliged entity is also obliged to provide sufficient instruction on the rights and obligations of the person concerned, of which a record will be made. It is generally recommended to provide training with experts for the persons concerned to avoid misconduct and subsequent penalties.
Internal documentation
The proper functioning of the internal notification system is possible if designated internal regulations are implemented, setting out the rules of conduct in the situations provided for by the Act.
The primary document is then necessarily an internal regulation that sets out the rules of conduct to fulfil the obligations under the Act. Its structure should then be at least as follows:
- filing reports;
- receiving reports;
- assessment of reports;
- addressing reports and corrective actions;
- recording and archiving.
Another important documentation is the information documentation, which provides the necessary information to staff and potential whistleblowers about the notification process.
Especially for obliged entities with a larger number of employees, the whole process of implementation and subsequent use of the internal reporting system will be facilitated by the timely preparation of templates for forms, responses, minutes and records, which will make the activities of the designated person more efficient and less administratively demanding.
Last but not least, the necessary documentation for the processing of personal data should not be forgotten when dealing with reports and maintaining an internal reporting system.
Revision of current documentation
In addition to the creation of new internal documentation on this issue, the protection of whistleblowers requires an update of the existing documentation.
In order to avoid disputable situations, the following should be revised, for example:
- conditions of employment;
- organizational structure;
- the archiving and shredding rules, which must be adapted to take account of the compulsory registration of reports;
- data protection documentation;
- internal investigation processes;
- existing ethical or other lines; or
- employment documentation.
Communication externally
Obliged entities have a legal duty to provide information, which they fulfil by publishing the relevant information in a way that allows remote access, so that potential whistleblowers have the possibility of repeated and easy access.
The obliged entity shall ensure publication of the following information on:
- the method of filing a notification, including, for example, an instructional description of the procedure within the established internal notification system, but it will also alert the potential whistleblower to the possibility of filing a notification through the external notification system at the Ministry of Justice of the Czech Republic;
- identification of the designated person or persons, including contact information through which anyone can contact the person concerned in relation to whistleblower protection issues; and
- the opinion of the obliged entity on the possibility of excluding the receipt of reports from persons permitted by the Act, in particular self-employed persons and employees of the obliged entity’s suppliers.
Publication by the obliged entity may take various forms, but most often it will be on the obliged entity’s website. In addition to this form, the obliged entity may choose another solution, such as an intranet or other information system.
Internal promotion
In order to ensure the correct and effective functioning of the entire notification process, or internal notification system, the cooperation of whistleblowers, in particular employees, is necessary, which means sufficient information and training for organisations.
A good place to start is initial training of designated persons and any other form of familiarisation with the topic of whistleblower protection by all staff, potential whistleblowers or persons concerned.
It is possible to use video tutorials, informative e-mails or summary documents, but it is always good to remember that these should be easily accessible and user-friendly for employees, thus achieving proper internal promotion and thus necessarily the effective functioning of the internal notification system.
Possible impacts of non-compliance
Implementing internal reporting systems is key to achieving compliance with the Act and also avoiding potential negative impacts.
Failure to have a proper and well-publicized internal reporting system in place may lead whistleblowers to make their reports through the so-called external reporting system operated by the Ministry of Justice. As a last resort, the notification may also be published (made public) while maintaining the protection of the whistleblower.
The organisation is also at reputational and value risk, where non-compliance with the Act can mean a reduction in the value of the organisation, a loss of employee confidence and ignorance of internal issues within the organisation.
In extreme cases, the organisation may also receive fines of up to CZK 1,000,000, which may follow an inspection by the Ministry of Justice or the Labour Inspectorate.
Conclusion
In view of the above, it is necessary and advisable to act quickly and pay due attention to the issue of whistleblower protection and, if your organisation is an obliged entity under the Act, to implement an internal reporting system.
At PEYTON legal we are at your disposal in connection with the whistleblower protection.
Mgr. Jakub Málek, managing partner – malek@plegal.cz
Mgr. Tomáš Maux, junior lawyer – maux@plegal.cz
Tereza Benešová, legal assistant – benesova@plegal.cz
31. 08. 2023