Whistleblower series

Like some countries in Europe, the Czech Republic has no laws that directly regulate corporate internal investigations.

Instead, other laws indirectly but profoundly impact how a Czech company should conduct an in-house inquiry, such as the Labour Code and laws governing data protection. Of these laws, data protection regulations, centred around the EU's General Data Protection Regulation (GDPR), is arguably the most important.

According to Jakub Kabát, an Associate in CMS Prague, before drafting any internal investigation policies, a company is advised to fully understand how Czech data and employees’ privacy protection regulations might impact such a procedure. An internal investigation, no matter the alleged crime, will always affect the privacy of one or more individuals.

This fact, states CMS Prague's Kabát, is the central conflict at the heart of conducting corporate investigations in the Czech Republic: balancing the need to protect the personal privacy of individuals with a company's interest in protecting its property and assets while at the same time complying with all aspects of the Czech Labour Code and data privacy laws.

To this end, the company should perform a "balancing test" and determine whether the company’s interest in, for example, protection of its property overrides an employee's right to privacy. If the test reveals that the threat to the company demands the collection of evidence, the investigation can proceed. (This test, however, should be recorded since the justification for the investigation and the decision-making leading to its creation may be challenged later).

In terms of worker rights, the Labour Code also provides a wide assortment of protections to employees (i.e. personnel who have employment contracts with their firms). Labour law, however, does afford the same recognition to company executives, who usually are not attached to their companies via employment agreements, although executives enjoy the same privacy and data-protection rights as any other person.

In terms of internal investigations, executives and employees may possess different legal rights, but experts recommend that companies use the same investigative methods no matter the suspect.

Generally, all investigations include the following procedures: an inspection of any electronic information or messaging pertaining to the alleged misconduct (e.g. emails, messaging, text messages); interviews with all suspects and witnesses; and occasionally other investigative techniques such as surveillance (e.g. via video surveillance). Once again, in regard to the latter, any surveillance techniques considered must conform with the GDPR and the Labour Code.

Furthermore, in regard to the collection of evidence, employees must be informed that their personal data may be collected in the event of an internal investigation. (Companies are advised to place this information as a boilerplate clause in all employment agreements or privacy policies to ensure that staff members fully understand).

In fact, the major challenge in conducting an internal investigation in the Czech Republic is collecting evidence as a means of protecting a company's assets and property while still complying with data and personal-privacy regulations.

It must also be remembered that according to both EU and Czech regulations, personal data applies to all information that can identity an individual, such as their email address or something as banal as a vehicle registration number. Hence, during an investigation, any evidence that contains this type of seemingly insignificant personal information must be collected and processed with care.

Basically, further to the goal of protecting personal privacy, a Czech internal investigation should be designed to adhere to the legal principle of "lawfulness, fairness and transparency". In short, the investigation should have a clearly defined mandate. Only evidence pertaining to the investigation's target should be collected. The evidence should be definitive and stored for only a specific period of time. Not only should all evidence be kept secure, the entire investigation must be held in strict confidentiality.

Data protection, however, is not a company's only concern when conducting an internal investigation. The query must also comply with the Czech Labour Code.

From an employer's points of view, the Labour Code forbids employees from using company resources (e.g. email accounts, phones, laptops) for personal use and allows the company to monitor whether employees obey this general prohibition. By cautioning employees not to use work equipment for personal use, employers can help safeguard employee privacy.

Czech labour law does allow for other types of monitoring, such as video surveillance of work areas. But for this surveillance to be implemented, there must be a concrete reason (e.g. risk of theft of company supplies) and the video surveillance should be limited to this specific threat. In short, such surveillance, if deemed necessary, must be conducted in an appropriate and proportional manner.

In addition, employees must be informed about the surveillance.

Although the Labour Code doesn't directly regulate inspections, such as the examination of email records or computer hard drives, such one-off examinations appear to be affected by the same rules governing worksite surveillance. Hence, these inspections should always be conducted in a measured way, and only if there is a valid reason to do so.

Ultimately, all reasons would stem from the employer receiving a report or evidence of misconduct. The most effective method of receiving this information is through a Whistleblower. Hence, companies are advised to create their own Whistleblower channels so that anyone witnessing wrongdoing can report it in a way that allows for the protection of his identity.

Currently, Czech law does not directly regulate Whistleblowing, although there are some provisions for this type of reporting in bank and finance regulations. Whistleblowing, however, is indirectly governed by a series of other laws: the Labour Code's obligation for "general prevention" of misconduct on the part of employees; the Criminal Code's requirement that some crimes must be reported; and the Czech Republic's anti-money laundering provisions.

Any Whistleblower system implemented at a company must protect the individual making the report. To ensure strict confidentiality, a company can use a third party, such a law firm, to set up and manage the Whistleblowing system.

The Czech Republic has drafted legislation in the past to regulate Whistleblowing, which failed to win parliamentary support. Currently, Czech lawmakers are drafting a Whistleblowing bill that would contain the key requirements of the EU's Whistleblowing Directive, which requires member states to pass a law before December 2021.

According to the EU Directive, local legislation must allow for two types of reporting channels: internal systems within private companies of more than 50 employees and external channels. In the Directive, ensuring the safety and confidentiality of the Whistleblower is paramount.

After potential misconduct has come to light – either from a Whistleblower or an internal audit – a company should carefully consider whether an investigation is permissible in light of GDPR and Labour Code regulations. If a particular employee has been implicated in a complaint, it should be verified whether he was informed about the possibility of an investigation (i.e. whether the potential for an investigation was included in his employment contract or elsewhere, such as in the company’s privacy policy).

If an investigation is called for and an employee was aware of the possibility of an investigation, the company's first decision may be to suspend the employee temporarily in order to remove him from the work environment so that his presence does not adversely affect the inquiry.

Once an investigation is underway, an appropriate forensic tool may be the interview. Both the suspect and any witnesses can be interviewed, but once again Czech law is mute on how interviews should be conducted. Nevertheless, it is recommended that Czech companies keep certain interview protocols.

For example, minutes should be taken of the interview session, which the interview subject should review and sign to confirm the transcript's accuracy. (An investigation cannot make an audio or visual recording of an interview without the subject's explicit consent). Interviews should be conducted in a question and answer format with the intention of gathering facts surrounding the case. Under no circumstances should interviewers attempt to force a subject into "confessing to a crime". In fact, the Labour Code provides a list of sensitive topics, such as past criminal records and the pregnancy status for women, which an interviewer is prohibited to ask about if the subject matter is not relevant regarding the type of work performed by the employee being interviewed.

In addition to interviews, an internal investigation may need to collect evidence from the suspect's electronic correspondence.

If a company allows employees limited personal use of company communication equipment, investigators must take great care to avoid inspections of private emails. Distinguishing between professional and private mail can be done by considering the email address used, the identification of the sender, the information in the subject line of the mail, the salutation employed at the top of the email and whether certain keywords connected with the investigation appear in a given message.

If a company has forbidden the use of company equipment for private use, employees must understand that the assumption of privacy is lower and all emails found on the company server can be considered as work-related and accessed by the investigation (unless it is clearly a private message).

In terms of company-owned hardware, such as Smartphones, laptops and computer drives, companies are entitled to inspect the contents. In these searches, the same privacy protocols must be observed. If a company decides to allow employees limited access of company equipment for personal use, the company should draft rules governing this usage, such as requiring each employee to create a specific folder where personal information can be stored. During searches, an investigation can only open files that are work-related.

In terms of the make up of investigation team, companies can appoint officials from its compliance and HR departments to conduct any inquiries. But firms can also contract third parties to oversee the process. CMS, for example, offers a service for conducting an investigation, collecting documentary evidence, and passing this evidence on for analysis, as well as possessing software capabilities to conduct keyword searches of drives and communication servers.

Lastly, when the investigation is concluded, companies have an option of compiling a final report or protocol. Since Czech law does not require companies to produce such a report, a company – based on the results of the investigation – may decide not to do so, such as if the allegations reported by a Whistleblower turned out to be unfounded.

If the investigation discovered wrongdoing that the company must act upon (with the risk of being later challenged in court), the firm is advised to issue a report and judgment that fully describes the investigatory process, evidence collected and justification for the judgment.

The final report should be presented to the suspect who should be given the opportunity to respond to the final conclusion. Companies should be aware that this report may be used as evidence in any future court action.

In terms of sanctions, if an employee is found guilty of wrongdoing, the company has several options. Employees guilty of damaging company property can be asked to provide compensation. (This can only be done in compliance with the Labour Code, which places restrictions on employee liability in these situations).

In cases of misconduct, disciplinary action may be required. For minor misconduct, a company can issue a warning letter that can be placed in the employee's file. If the misconduct is more serious, termination of employment may be called for.

In most cases of termination, employees can be fired with notice. In highly serious cases, however, immediate termination can be ordered. In all instances of employee termination, the Czech Labour Code sets down specific procedures and requirements that must be followed.

As stated, the Labour Code does not to apply to company executives. In these cases, executives found responsible for property damage can be asked to pay compensation. In instances of serious abuse, the executive can be relieved by way of a "recall from office".

Clearly, ahead of the passage of specific Whistleblower legislation in the Czech Republic, Czech companies do have options when confronted with reports of misconduct or wrongdoing in the workplace. By following carefully considered procedures, companies can ensure that any allegations of misconduct are addressed in a way that complies with data-protection laws and the Labour Code, and protects a company from future court challenges.