Whistleblower protection and reporting channels in Serbia

Yes, there is Serbian Law on Protection of Whistleblowers ("Official gazette of RS", no. 128/2014). It entered into force on December 4, 2014, but its application started on June 5, 2015.

Under the Law on the Protection of Whistleblowers, employers, in general, must set up an internal whistleblowing procedure. The legal framework does not provide extensive guidelines for the internal whistleblowing procedure, but rather allows the employers to set up an internal procedure in line with their own organizational structure and the needs and nature of their own business.

The Law, however, does not differentiate between private and public entities, defining in Art. 2 that an "Employer" may be an authority of the Republic of Serbia, territorial province or local self-government unit, holder of public authorities or a public service, or legal entity or entrepreneur which employs one or more persons.

The Law prescribes penalties for employers who fail to fulfil the statutory requirements (see question 4). Such penalties may amount from 50,000 up to 500,000 RSD for the employer, whereas a penalty for a responsible person within the employer may range from 10,000 up to 100,000 RSD.

Serbian Labour Law does not deal with whistleblowing systems or the rights of whistleblowers. The relevant law in the matter at hand is the aforementioned Law on the Protection of Whistleblowers. 

Under the Law, an employer is, inter alia, obligated to:

• deliver to each employee a written notice on their rights under the Law (protection of anonymity, protection due to being wrongly designated as a whistleblower, protection of whistleblower’s personal data, judicial protection, compensation for damage, protection against retaliation, etc.);
• appoint a person authorized to receive the information and to conduct proceedings with regards to whistleblowing;
• regulate the procedure on whistleblowing by an internal act and publish it in a visible place and on the website of the employer (this applies only to employers with more than ten employees).

No.

No, under certain prescribed conditions, an employee may disclose irregularities externally. As a matter of fact, the Law differentiates between internal, external and public whistleblowing. While the internal whistleblowing presumes disclosure of information to the employer, external whistleblowing is the disclosure of information to an authorized body. However, public whistleblowing, without prior notification to the employer or the authorized body, as disclosure of information in the media, via the Internet, at public gatherings or in any other way by which the notice can be made available to the public, is only allowed under special conditions. 

However, the Law provides for different treatment in relation to classified data. If the information contains classified data, the whistleblower is obliged to contact the employer first, while the information referring to a person authorized to act upon the information is submitted to the head of the employer. Similarly, if the information refers to the head of the employer, the information must be disclosed to the authorized body. If the employer has not acted upon the information containing classified data within 15 days, or if it has not responded or has not taken appropriate measures within its competence, the whistleblower may contact the authorized body. The Law underlines that if information contains classified data, the whistleblower may not disclose it to the public (unless otherwise provided by law).

Yes, the Law provides for the protection of a whistleblower from retaliation, by prohibiting the employer from placing the whistleblower in a less favourable position. The employer may not place the whistleblower in a less favourable position as a result of the whistleblowing, especially if such a less favourable position relates, among the rest, to: 1) employment; 2 2) termination of employment; 3) salary and other employment benefits.

The data protection legal framework in Serbia consists of the Law on Data Protection and several bylaws. The Law on Data Protection for the most part resembles the provisions of the EU General Data Protection Regulation (GDPR). Data processing requires a legal basis as laid down under this law.

As per the Law on the Protection of Whistleblowers, a person authorized to receive the information (as well as any other person who learns about the data) is obliged to protect the whistleblower's personal data or the data that may reveal the whistleblower's identity, unless the whistleblower agrees to disclose such data in accordance with the law regulating the protection of personal data. A person authorized to receive the information must also inform the whistleblower that his/her identity may be revealed to the competent authority if the actions of that authority would not otherwise be possible and inform him about protection measures available to the parties in criminal proceedings. If it is necessary to reveal the identity of a whistleblower in the course of the proceedings, a person authorized to receive the information must inform the whistleblower about it before revealing his/her identity. Anyhow, the whistleblower's personal data must not be revealed to the person referred to in the disclosure, unless otherwise prescribed by a specific law.

No. Neither the Law on the Protection of Whistleblowers nor any other Law contains provisions regarding the joint whistleblowing system of various entities in different jurisdictions.