We are a group of companies. Can the parent company or a single external provider receive reports from employees of all subsidiaries?

A group has a parent company and several subsidiaries in Slovakia and Czechia, several of which employ 50 or more people. Management wants a single reporting line and one team to receive and investigate reports for the entire group. Both Slovak and Czech legislation allow reports to be received externally. However, the law imposes the obligation to have an internal system on each employer separately, and what it may entrust to others depends on its size.

In Slovakia, a subsidiary must have its own responsible person

An employer to which Section 10(1) of Act No. 54/2019 Z. z. on the Protection of Whistleblowers applies appoints a responsible person within its organisation. It may entrust some tasks to another person:

The following quotation is reproduced in its original language:

Na základe zmluvy so zamestnávateľom môže v zamestnávateľovom mene prijímanie a potvrdenie oznámení vykonávať aj iná osoba, ktorá nie je jeho zamestnancom. Osoba podľa prvej vety môže vykonávať aj preverovanie oznámení v mene zamestnávateľa, ktorý nie je orgánom verejnej moci a ktorý zamestnáva menej ako 250 zamestnancov […]

§ 10 ods. 2 zákona č. 54/2019 Z. z.

The parent company or a provider may therefore receive reports and acknowledge receipt on behalf of a subsidiary. They may take over investigations only for a subsidiary with fewer than 250 employees. Under the final part of the same provision, this does not remove the subsidiary’s obligation to appoint its own responsible person. In its answers to questions from responsible persons, the Whistleblower Protection Office adds that responsibility for investigating reports remains with the employer, including through its internal responsible person. According to the Office, the subsidiary must issue its own internal rules under Section 10(9). It may incorporate the parent company’s rules if they do not conflict with Slovak law, but an addendum to the parent’s rules alone is insufficient.

The Act also addresses groups in relation to the independence of the responsible person. That person is bound only by instructions from the employer’s statutory governing body or the parent company’s statutory governing body, and the employer must ensure that the person’s other duties do not create a conflict of interest (Section 10(4)).

In Czechia: sharing for companies with up to 249 employees and entrusting operation to another person

Czech Act No. 171/2023 Sb. on the Protection of Whistleblowers allows an entity subject to the Act’s obligations to entrust the operation of its internal reporting system to another person. This does not affect the entity’s responsibility for compliance with its obligations (Section 8(2)). Entities subject to these obligations, other than public contracting authorities, that employed no more than 249 employees as at 1 January may also share a system or use another such entity’s system, provided they appoint a person to receive reports and acknowledge their receipt (Section 8(3) of Act No. 171/2023 Sb.). A Czech subsidiary with 250 or more employees therefore cannot share the group’s common system, but it may entrust the operation of its own system to the parent company or a provider. Only a natural person of good character who is of full age and has full legal capacity may serve as the designated person (Section 10(1)), and only that person may have access to the reports (Section 9(2), letter d)).

Both sets of rules are based on Directive (EU) 2019/1937. It permits a reporting channel to be operated by a third party (Article 8(5)) and allows private entities with 50 to 249 workers to share resources for receiving and investigating reports without affecting their obligations to maintain confidentiality, provide feedback and address the reported breach (Article 8(6) of Directive (EU) 2019/1937).

What to address when using a shared reporting line

For a shared channel, the following arrangements in particular must be made for each subsidiary:

• a subsidiary required to have a system publishes the reporting procedures and identifies its responsible or designated person (Section 10(5) of the Slovak Act, Section 9(2), letter b) of the Czech Act),
• reports are handled within the time limits under the law of the subsidiary’s country; in Slovakia, under Act No. 54/2019 Z. z. The question on the obligation to have an internal reporting system describes these time limits. In Czechia, the time limits under Section 12(2) and (3) of Act No. 171/2023 Sb. apply,
• the whistleblower’s identity is not disclosed even to the parent company’s management without the whistleblower’s written consent (Section 10(7) of the Slovak Act, Section 20(2) of the Czech Act),
• the contract with the parent company or provider addresses confidentiality, time limits, the subsidiary’s cooperation and the processing of personal data contained in reports; for that processing, it is necessary to determine whether the parent or provider acts as a processor under Article 28 of Regulation (EU) 2016/679 (GDPR).

We will design a model for the entire group and prepare internal rules for the subsidiaries and contracts for receiving and investigating reports. We can also perform the external person’s tasks ourselves to the extent permitted by law as part of our whistleblowing and reporting system service. The article DPO and the person responsible for whistleblowing explains the difference between this role and that of a data protection officer under the GDPR; the question one data protection officer (DPO) for a group of companies addresses a shared DPO for a group, and the question how long to retain reports addresses report retention.