The internal reporting channel duty in Slovenia

2023-02-22 (Art. 35: the fifteenth day after publication in the Official Gazette)

Art. 9(2): entities in the public and the private sector with 50 or more employees. Art. 9(3), a genuinely lower Slovenian threshold: entities with fewer than 50 but at least TEN employees must also establish an internal channel if their main registered activity is healthcare, or water collection, purification and distribution, wastewater management, waste collection and transport and treatment, recovery of secondary raw materials, environmental remediation or other waste management. Art. 9(4), no threshold at all for ministries, administrative units, government services, public agencies, the Office of the President, the State Attorney's Office, the Constitutional Court, the Court of Audit, the Human Rights Ombudsman, the Information Commissioner, the Commission for the Prevention of Corruption, the National Review Commission, the Advocate of the Principle of Equality, and self-governing local communities. Art. 9(5), private sector entities with fewer than 50 employees where other laws transposing EU acts, or directly applicable EU rules, listed in Parts I.B and II of the Annex to Directive 2019/1937 so require.

2023-12-17, Art. 33(2): private sector entities employing up to 249 employees had to establish the internal reporting channel in accordance with Art. 9 by 17 December 2023. Art. 33(1): public sector entities and private sector entities with 250 or more employees had 90 days from entry into force, i.e. by 23 May 2023.

Not required on the intake side, but an anonymous report that is received must be handled. ZZPri contains no duty to operate a channel that permits anonymous submission; Art. 9(1), which defines what establishing a channel requires, does not mention anonymity. Once an anonymous report has been received, the confidant may decline to handle it only on the Art. 11(1) and 11(2) grounds (not a natural person; not about breaches of rules applying in Slovenia acquired in the work environment; manifestly untrue; more than two years after the breach ended; handling not expedient because the breach had no or negligible consequences), and anonymity is not one of them. Arts. 11(5), 12(8), 5(5) and 9(16) presuppose anonymous reports being received, acknowledged, closed out, protected and counted.

Komisija za preprečevanje korupcije (Commission for the Prevention of Corruption, KPK), the residual external reporting body, the recipient of every obliged entity's annual statistics, the author of the consolidated annual report, and an offence authority (prekrškovni organ) under Art. 27. Art. 14 designates 24 external reporting bodies in total, allocated by subject matter, including Banka Slovenije, Agencija za trg vrednostnih papirjev, Agencija za zavarovalni nadzor, Javna agencija za varstvo konkurence, Javna agencija za varnost prometa, Agencija za komunikacijska omrežja in storitve, Agencija za javni nadzor nad revidiranjem, Finančna uprava RS, Tržni inšpektorat RS, Urad RS za preprečevanje pranja denarja, Informacijski pooblaščenec, Državna revizijska komisija, the labour, environment, health, food-safety, nuclear and radiation inspectorates, JAZMP, Slovenski državni holding, and the KPK itself.

Failure to establish the internal reporting channel is a "systemic offence" under Art. 29(1) point 1: a fine of EUR 2,000 to EUR 4,000 for a legal person, rising to EUR 3,000 to EUR 6,000 where the legal person qualifies as a medium-sized or large company under the Companies Act; EUR 1,000 to EUR 2,000 for a sole trader or self-employed person (Art. 29(2)); and EUR 300 to EUR 2,000 for the responsible person of the legal person, sole trader, state body or local community (Art. 29(3)). The same range applies to failing to describe the channel in the internal act and to failing to file the annual report with the Commission. Obstruction as such is not a separate offence; the heavy penalties attach to retaliation, Art. 31(1): EUR 5,000 to EUR 20,000, or EUR 10,000 to EUR 60,000 for a medium-sized or large company, EUR 3,000 to EUR 15,000 for a sole trader, and EUR 500 to EUR 2,500 for the responsible person. Threatening or attempting retaliation, and establishing the identity of the reporter, intermediary or related person, carry the Art. 30 range of EUR 2,000 to EUR 6,000. Art. 32 permits a fine above the statutory minimum in fast-track proceedings.

Only for intake, and this is the key commercial constraint in Slovenia. Art. 9(7): the obliged entity MAY designate an external service provider to RECEIVE reports ("zunanjega ponudnika storitve prejemanja prijav"); the entity and the provider agree how received reports are forwarded to the confidant or the administrative staff, and the provider may also give the reporter the statutory information; the provider must observe the Act's rules on protecting the reporter's identity and confidentiality. BUT Art. 9(6) requires the obliged entity to appoint the confidant (zaupnik) FROM AMONG ITS OWN EMPLOYEES ("izmed zaposlenih imenujejo zaupnika"), and under Arts. 10 to 12 it is the confidant who examines the report, decides whether to handle it, conducts the handling independently and free from instructions, and closes it with a report to management. So the channel and its intake can be operated externally; case handling cannot be outsourced.