In October 2019, the Council of the European Union formally adopted a new Directive for the Protection of Whistleblowers, requiring both private and public organisations to create safe channels for reporting across a wide range of areas, including public procurement, financial services or money laundering. Member States will have two years to transpose the Directive into their national laws. The new rules will equally affect the design of internal compliance programmes which form a pre-requisite for exculpation under the Czech Act on Corporate Criminal Liability.

Protection of whistleblowers in the EU

The Directive is the first attempt to create a uniform and comprehensive legal framework for the protection of whistleblowers across the EU. Until now, whistleblower policies have been adopted only by ten Member States, varying in their scope and degree of protection. As a study carried out for the European Commission in 2017 showed, the costs for the lack of any safeguards to protect whistleblowers from retaliation in the EU are high – between €5.8 to €9.6 billion each year.

As of 2021, the Directive will impose a number of obligations in relation to the protection of whistleblowers who report violations of EU law, such as tax fraud, money laundering or data protection breaches. Companies with 250 employees or more will be required to introduce efficient internal reporting channels (e.g. online system, mailbox, post, telephone hotline) which are designed, set up and operated in a secure manner that ensures the confidentiality of the whistleblower’s identity. Companies with 50-249 employees, or more than €10 million in annual turnover, will have a further two years for compliance.

Once received, all whistleblower complaints must be securely stored for evidentiary purposes and followed up internally by a company employee or an external service provider. Additionally, the designated person is obliged to confirm the receipt of the complaint to the whistleblower within seven days and provide them with a status report on the investigation within a further three months. Should the company fail to fulfil these obligations, the whistleblower may approach the national authorities or EU institutions and use external reporting channels for disclosure.

The Directive explicitly prohibits retaliation and introduces a series of special safeguards to protect whistleblowers as well as affiliated third persons from dismissal, suspension, discrimination, intimidation or other forms of reprisals at work. Member States must primarily ensure that reporting persons have adequate access to information about the whistleblower channels, and means of protection against retaliatory measures as well as related remedies. Furthermore, whistleblowers will be entitled to legal aid in criminal and cross-border civil proceedings or other legal assistance as provided under national law.

Compliance programmes in the Czech Republic

In the Czech Republic, the Whistleblower Directive will equally have an impact on the conditions for exemption from criminal liability of legal entities. Under the Act on Corporate Criminal Liability, companies may avoid prosecution for attributable criminal offences if they exercise all possible efforts, which may be rightfully required from them, to implement effective preventive measures.

So far, the Czech Ministry of Justice has not adopted any official methodology, specifying the conditions for exculpation of legal entities. Non-binding guidelines published by the Prosecutor General’s Office in August 2018, however, recommend a series of measures that companies may adopt to prevent, detect and adequately react to any allegations of criminal conduct, including whistleblower hotlines.

The Czech Republic belongs to the group of Member States where legal rules on whistleblower protection are completely absent. With the relevant national bill being currently on hold, the new Directive will fill the gaps in the Czech legal system and provide a detailed guidance on the design of effective whistleblower programmes. While companies that fail to comply with the requirements of the Directive will be subject to administrative penalties, they will not automatically lose the opportunity to be exculpated from criminal charges under the Act on Corporate Criminal Liability. On the other hand, the absence of a comprehensive whistleblower system could seriously undermine their defence in potential criminal proceedings.