According to the European Commission's interpretative opinion on the Directive, group reporting systems can only be shared by companies employing up to 249 employees.
If companies have up to 249 employees, the Directive states that they may share resources for investigating reports with their parent company, but the following conditions must be met, as interpreted by the European Commission:
- The whistleblower must be able to report at the subsidiary level, i.e. the subsidiary's internal reporting channels must be active and functional.
- The whistleblower must be informed of who at the parent company will have access to the reports for the purpose of investigating; the whistleblower always has the option of refusing the parent company's investigation of the report and requesting an investigation of the report in the subsidiary's reporting system.
- The responsibility for maintaining the confidentiality of the report, for providing feedback to the whistleblower and for taking corrective action in relation to the breaches always remains with the subsidiary.
If a company has more than 249 employees, it cannot share the reporting system.
However, the option of outsourcing offers some possibilities for sharing (i.e. the Czech company could theoretically outsource the obligations to the parent company), whereas the above limits resulting from the Commission's opinions do not apply to outsourcing. Nevertheless, outsourcing has a number of practical disadvantages, especially when outsourcing to a foreign parent company. For example, the competent person always has obligations and responsibilities under Czech law, the internal reporting system must comply with the requirements set out by Czech legislation, issues in the area of personal data protection (GDPR), especially in relation to data transfer to third countries, etc.).