Criminal Compliance Program as a Tool for Criminal Liability Exculpation of Legal Persons in the Czech Republic

Abstract

Criminal liability of legal entities has gained an inalienable place in the system of legal liability in most European jurisdictions, including the Czech Republic. Departing from the premise that it is a suitable supplement to the liability of a legal entity in the event of serious unlawful acts of natural persons from which the legal entity benefits, this article aims to characterize the position and role of this form of liability in the Czech legal system. Essentially, however, it seeks to determine under which circumstances it is possible for legal entities to be relieved of liability using an exculpatory clause. Based on a case study of the Czech Republic, it illustrates the added value of criminal compliance programs, which, if properly set up and implemented in practice and complemented by prevention, detection and response measures, play a decisive role in establishing such criminal exculpation. The article further finds that rules pertaining to ethical codes of conduct are in fact ‘elevated’ to the level of legal rules through compliance programs. Compliance, one of the components of Corporate Social Responsibility, thus becomes an expression of a legal obligation, i.e., the obligation to properly manage and control the corporation, which has important legal implications.

1. Introduction

Legal liability in the Czech Republic consists of a coherent system of both private and public law liability which does not differ substantially from the legal tradition of continental Europe. In 2012, following the pressure of the European Union (EU) and particularly the obligation to comply with its legislation on one hand, and a long discussion at expert level on the other, criminal liability of legal persons has been introduced in the Czech Republic. The purpose of this article is to characterize the position and role of this form of liability in the Czech legal system, and to determine under which circumstances it is possible for legal entities to be relieved of liability while having recourse to an exculpatory clause.

A key role in a legal entity’s likelihood to be exempted from criminal liability is played by a criminal compliance program, which, if set up correctly, can not only provide long-term protection against criminal sanctions for the legal entity concerned, but also lead to lower criminality of natural persons operating within a legal entity. It should be noted that the particularities of a given legal system, in this case the legal system of the Czech Republic, also imply a need for a specific approach to the development of a compliance program. Therefore, compliance approaches and guidelines from other countries can only be considered as a source of inspiration and guidance in certain areas of criminal activity (especially in regard to corruption), and not as an exhaustive summary. On the other hand, taking into account the similar focus and construction of criminal responsibility and exculpation, the transferability of our findings to their legal systems can be assumed, especially when it comes to the EU countries.

The criminal liability of legal entities in the Czech Republic and the possibilities of liability exculpation are, for the most part, addressed in contributions of legal experts (Jelínek 2017, 2019), as well as in the proceedings of thematically focused legal conferences (Kratochvíl and Löff 2003; Gřivna and Šimánová 2021). Reflections on current issues, including findings from practice, are reflected in Czech periodicals with a criminal focus. As far as deeper and more complex elaborations of the issue of criminal liability of legal entities are concerned, there are key monographs/commentaries prepared under the leadership of Fenyk et al. (2018), Jelínek (2019) or Šámal et al. (2018).

2. Legal Liability and Its Purpose

Legal liability is a key construct when it comes to legal regulation (Hurdík and Lavický 2010). Subjects of law must be aware that in the event of a violation of the law, they are subject to a statutory and state-enforceable penalty, or in other words, a sanction (Knapp 1998). In general, textbooks on legal theory come to a similar conclusion: legal liability consists of the obligation to bear a sanction in the event of a breach of a legal obligation (Gerloch 2017; Harvánek 2013). According to the authors’ assessment, Knapp’s account of the formulation is even more precise in that the sanction is linked to a “statutory fact” (Knapp 1998, p. 200). Legal liability is simply the consequence of the violation of a legal norm; if it is not sufficiently ‘legally normalized’, then it is difficult to sanction it.

The core of legal liability is private law liability and two forms of public law liability—criminal liability and liability for an offence. The concepts of private and public law torts are obviously different, which makes the links and differences difficult to identify. However, if we were to compare the liabilities in question, we would have to look for a common link. A starting point for the latter once again presents itself in Knapp’s reasoning: “in each of its conceptions, the notion of liability is in one way or another per definitionem related to a sanction that is attached to a fact” (Knapp 1983). The conceptual features of legal liability are thus the sanction (the obligation to bear the legal consequences) and the facts of the tort (the subject, the object and the objective aspect; possibly also the subjective aspect). However, it should be pointed out that in the area of tort law, in recent legislation the concept of liability is rather being linked to the fulfilment of a legal or contractual obligation than to the liability for its breach. In this case, the so-called prospective concept of liability is where liability is not a civil sanction but where a threat of a civil sanction is concerned (Melzer and Tégl 2013).

The purpose of legal liability fundamentally influences the construction of the various forms and interpretation thereof. One may agree with the analysis provided by Janeček (himself following the concept of justice by Aristoteles (1979, pp. 113–23)), who concludes that the purpose of protection (liability) in private law is to observe the principle of corrective justice (i.e., justice ‘between two people’), while public law protects distributive/society-wide justice (i.e., it provides the protection of “all those values that can be distributed among the citizens of an ordered state” (Aristoteles 1979, p. 118)). In other words, the purpose of private liability is mainly to compensate for damage, while the purpose of public liability is punishment for the violation of societal values. After all, this is in accordance with the categorization of legal responsibility already in times of the Ancient Rome, which distinguished ‘delictum privatum’ as a violation of an individual’s interest and ‘crimen’ as a threat to the whole community (Kincl et al. 1995). The essence of the matter remains unchanged even by a slightly different targeting of responsibility under administrative law, whose “primary task [is] the removal of obstacles or other means of facilitation of the smooth running of public administration” (Průcha 2014).

Therefore, private law liability can be implemented alongside one of the forms of public law liability as it pursues a different purpose (e.g., imprisonment for the offence of battery does not prevent the victim from claiming compensation for the damage), while the parallel application of different public law liabilities is either prohibited (liability for a criminal offence and an offence) or very problematic. Private and public law liability thus operate in what can be described as a complementary manner. To illustrate, for the crime of theft, criminal liability is to be considered as a narrower concept than the liability to bear the legal consequences of the criminal act—that is to say liability includes private law liability to compensate for the damage caused by the crime or the obligation to hand over the stolen item (Finger 1904).

An unlawful fact is characterized by the inconsistency of a given situation with the law. An act is unlawful in the sense that it is contrary to the legal order as a whole (e.g., there is no circumstance precluding wrongfulness of the act) (Kienapfel and Höpfel 2007). The contradiction is created either as a result of the actions of the subject of the law (acts or omissions) or as a result of circumstances independent of the subject of the law (unlawful condition). This alternative nature of the unlawful fact is the reason for the distinction of liability into subjective (for the act) and objective (for the unlawful condition) that tends to appear in legal recourse. Hart comments on this by asserting that strict liability is liability independent of fault, except perhaps for the requirement of the accused to control his own musculature (Hart 2010, p. 175).

Private liability is based on a subjective concept, namely the presumption of fault in the negligent form (§ 2912 of the Czech Civil Code). Particular factual circumstances deviate from this general concept, the fulfilment of which is possible even in the absence of fault (i.e., liability for an unlawful state of affairs, strict liability); in some circumstances with the possibility of liberation. However, these differences are getting blurred, even under the influence of EU tort law. The model for the definition of private law torts is put forward by the Principles of European Tort Law (PETL), which are based on three facts: liability for fault, liability for excessive risk (without fault) and liability for a third party (see Article 1(2) PETL). This is reflected in the fact that a breach of a duty imposed by law, whether or not as a result of fault, is covered by the concept of tort. The understanding of tort has thus shifted from the original view of tort as culpable conduct to the “area of sources of increased danger” (Tichý and Hrádek 2017, p. 52). Liability for breach of contract arises even without fault, with the possibility of liberation taking into account an extraordinary, unforeseeable and insurmountable obstacle arising independently of the will of the wrongdoer (Article 2913(2) of the Czech Civil Code), which can be justified by the fact that “the contractual obligation relationship is a closer relationship between those persons who have to keep their word” (Melzer 2011).

Criminal liability is quite clearly defined as liability for a criminal offence (or a judicially punishable offence), i.e., an act which fulfils the characteristics of a specific criminal offence listed in a particular provision of the Criminal Code. However, the unlawfulness of a criminal offence also has its material aspect (see Article 12(2) of the Criminal Code). The function of criminal law is to criminalize the most serious unlawful acts that threaten/damage the most important social goods. In other words, criminal liability/punishment acts as “(…) law’s most coercive and censuring technique” (Ashworth and Horder 2013, p. 33), in cases of substantive social harm. As Beccaria has pointed out, “we have seen the true scale of crimes. It is a shame to society… it is necessary that greater rather than lesser crime should be prevented, that that which is more offensive to society should be prevented than that which offends it less” (Beccaria 1893, p. 64). In our view, the formal-materialist conception of crime, which requires assessing the material aspect (social harmfulness) consistently within the framework of the statutory features of the crime is essentially correct (Kratochvíl 2019a). The circumstances of each case, which are not attributable to the statutory elements of a particular offence, and the characteristics of the offender are then applied exclusively in the imposition of punishment, not guilt (criminal liability).

The basis of legal liability is liability for an offence, i.e., “a socially harmful unlawful act which is expressly designated as an offence in the law and which exhibits the characteristics set out in the law, unless it is a criminal offence” (Section 5 of the Offences Act). In an analogous manner to a criminal offense, liability for a misdemeanor is determined not only by formal features (the definition of the misdemeanor in the law), but also materially (social harm).

After the reform, administrative liability has once again moved closer to criminal liability, which is in line with the interpretation of the term ‘criminal charge’ in the European Convention on Human Rights (Article 6(1) of the Convention), more or less covering both ‘crime’ and ‘offence’ as an umbrella term. After all, the autonomous concept of the notion of ‘criminal’ in the understanding of the European Court of Human Rights has been the starting point for academic discussion on a range of issues, including its various impacts on criminal procedural law, the rights of the injured party in criminal proceedings or mutual recognition in criminal matters in the context of the EU (Mitsilegas 2020; Ilic and Knezevic 2020). The issue here is not the systematic classification of an offence (under criminal or administrative law), but whether the nature and severity of the sanction corresponds to the area of criminal law (Lutz v. Germany 1987). It has its basis in the perspective of the complementarity of criminal and criminal administrative law, where the action of one is complemented by the action of the other (Kratochvíl 2019b).

Although the boundary between an offence and a criminal offence is clearly defined by law (see Section 5 in fine of the Offences Act), history has proved it is variable. Therefore, it depends on the legislation currently in force how high the ‘criminal liability threshold’ is set (Dyson 2015).1 The differences are thus “reliably (…) manifested only in the differently established jurisdictions to deal with them (administrative authorities, courts)” (Průcha 2014, p. 25). In essence, Kratochvíl seems to be right that there is an ‘organic combination’ of formal and material differences between a criminal offence and a misdemeanor (Kratochvíl 2019b, p. 225). Simply put, the differences are determined both by the definition in the law (administrative law or criminal law) and by the degree of social harmfulness (lower in the case of a misdemeanor, higher in the case of a criminal offence).

3. Criminal Liability in the Corporate Liability System

The subject of legal liability may be, in relation to a certain factual circumstance, a natural person or a legal person, or both; simply put, it is the person to whom a certain unlawful fact is attributed, i.e., on whom liability may be imposed. “The conduct of the wrongdoer or the conduct of a third party for whom the wrongdoer is liable or of a thing which he or she is under a duty to control, or when his or her actions are not relevant, is attributable to the wrongdoer” (Kratochvíl 2019b, p. 225). If there is no such entity, it may be concluded that no one is legally responsible. That is to say, “if a particular norm is not ‘attributable’, it means that a particular subject who is perhaps ‘sane’ with respect to another norm has no duty with respect to that particular norm”(Weyr and Horák 2015, p. 36). Attributability to a natural or legal person may then be conditioned or limited by other legal requirements (age of the natural person, nature of the legal person, etc.).

3.1. Private and Administrative Liability of a Legal Person

In the system of legal liability in the Czech Republic, which was established after the fall of the communist system, in addition to the private legal liability of legal persons, administrative legal liability was established, while there were no criminally liable legal persons.

In the case of private liability, the unlawful act is attributed either to the natural person or, if he or she acted on behalf of a legal person, to the legal person. This includes not only the members of the statutory body but also managers and rank-and-file employees or other persons. In the event of doubt, “the state of affairs as it appears to the public shall be decisive” (Article 166(1) of the Czech Civil Code). Simultaneous attributability of an unlawful act to both natural and legal persons does not take place, with the exception of joint liability for tort (see section 2915 of the Czech Civil Code). In essence, Weyr’s view that legal persons “are merely an artificial construction intended to illustrate the limitation of the individual liability of natural persons; the sentence that a legal person is liable (obliged) also expresses the negative rule that natural person (its members) are not liable or obliged” (Weyr and Horák 2015, p. 114) applies here.

If a natural person acting on behalf of a corporation breaches his or her duties, his or her (direct) liability to the corporation’s creditors may arise, thereby effectively substituting his or her liability for that of the represented legal person (see section 66 of the Czech Corporations Act and also section 99 of the Czech Insolvency Act).

A special feature is the private liability of a legal entity that has been established but has not yet come into existence, i.e., it does not have (full) legal personality. That is because the law allows acting on behalf of a legal entity before its establishment (i.e., registration in the public register), but the legal entity is only liable for such an act if it assumes the effects of the act within three months after its establishment (Section 127 of the Czech Civil Code). This so-called preliminary legal entity can therefore, in a sense, choose whether to be privately liable or to cede the liability to the natural person acting on its behalf. Until the legal entity notifies the third party, the third party performs and recovers the performance from the original contracting party—the founder. This is a similar principle to that of the cession of receivables.

In contrast, in the case of administrative liability for an offence, the simultaneous attribution to the legal person and the natural person acting on its behalf is realized when the natural person “has breached a legal obligation imposed on the legal person, in the course of the legal person’s activities, in direct connection with the legal person’s activities or for the benefit of the legal person or in its interest” (Article 20(1) of the Czech Offences Act). Thus, the liability of a legal person, unlike the liability of a (non-entrepreneurial) natural person, is in principle an objective liability. A legal person (and also a natural person engaged in business) is (objectively) liable for an unlawful act (Sections 20 and 22 of the Offences Act), with the possibility of liberation by making every effort to prevent the offence (Sections 21(1) and 23(1) of the Offences Act). However, it should be noted that the ‘legal obligation imposed on a legal person’, in contrast to criminal liability, somewhat narrows the attributability of an unlawful act of a natural person to a legal person (Beran 2018). On the other hand, in relation to a possible exemption from liability, the administrative liability is stricter accordingly, since the legal person has the burden of proof (Beran 2018, p. 214).

3.2. Criminal Liability of a Legal Person

For a long time, criminal liability of a legal person has been considered unacceptable, in accordance with the continental or at least Central European concept of criminal liability. For example, the German Penal Code of 1871 already rejected corporate criminal liability as a logical impossibility (but not civil liability) (Dubber and Hörnle 2014, p. 338). There were even some concerns as to whether the introduction of criminal liability of a legal person would in its effect be contrary to the principle of ne bis in idem (Van Bockel 2016, p. 13). What further fueled the hesitation whether to punish legal entities through criminal law was also the fear of unduly complicating the criminal proceedings—especially in the case of more complex proceedings conducted against powerful corporations (Braithwaite and Geis 1982). On the contrary, the introduction of criminal liability of legal entities was supported by the fact that the prevention potential has been far greater in the case of corporate criminality than in the case of traditional criminal activity of natural persons (Braithwaite and Geis 1982, p. 311). In any case, in regard to the European Union membership and the requirements of the now common legislation, which inter alia expresses the need for stricter punishment of legal persons when it comes to corruption, environmental degradation, economic crimes, etc., the attitude of the legal community has shifted. This may have been facilitated by the fact that criminal liability of legal entities has been considered an important element in the international fight against the so-called shadow economy (Medina and Schneider 2018). Soon after the turn of the millennium, a scholarly debate was slowly launched to determine the most appropriate form of criminal liability for legal persons (Kratochvíl and Löff 2003).

In principle, it was possible to choose one of three approaches—German, American or Anglo-French—or a combination of the aforementioned. Germany has maintained, in accordance with what the European law allows, the position of a kind of ‘sharpened administrative orders’ for legal persons, since it finds their criminal liability incompatible with the principle of personal ethical guilt at the core of the German criminal law (Dubber and Hörnle 2014, p. 338). However, the absence of a criminal sanction means that there is no element of a ‘moral message’ or ‘moral stigma’ (Herring 2020, p. 5). In the USA, there is very broad criminal liability of a legal person for the criminal acts of (ordinary) employees who acted in the course of their work and on behalf of the legal person (Hračovová et al. 2016; Anderson and Waggoner 2014). On a practical note, in recent cases, prosecutors have taken advantage of the so-called deferred prosecution agreements and non-prosecution agreements as alternatives to trial, thereby allowing the authorities to ensure that “corporate entities comply with investigations, enact compliance programs, and continue to follow laws and regulations” (Jimenez 2019). In the UK, on the other hand, criminal liability has been inferred, in the sense of the so-called identification principle, only for the acts of persons in the top management of the company who represented the will of the company (‘directing mind and will’). Similarly, in France, legal persons are punished for the acts of their organs and top representatives who have acted on their behalf. However, this has proved insufficient in relation to the sanctioning of a legal person with decentralized management (Hračovová et al. 2016). The offences committed by the regional management of the company could not be perceived as the will of the company, i.e., that this will had been delegated to them (Cronin 2018). In some cases, however, the identification principle is distorted, which can be considered, with regard to increased efforts to punish serious crimes more effectively and more widely, as a prevailing trend today. For example, the UK Bribery Act of 2010 allows for criminal liability to be attributed to a legal person in the case of corrupt conduct by an ordinary employee in the absence of anti-corruption measures: “A commercial organization will be liable to prosecution if a person associated with it bribes another person intending to obtain or retain business or an advantage in the conduct of business for that organization. As set out above, the commercial organization will have a full defense if it can show that despite a particular case of bribery it nevertheless had adequate procedures in place to prevent persons associated with it from bribing” (Section 7 § 33 of the UK Bribery Act).

The Czech version of criminal liability of legal persons, formulated in Act No. 418/2011 Coll., on Criminal Liability of Legal Persons and Proceedings Against Them, as amended (hereinafter TOPOZ), is in line with this trend and at the same time a kind of compromise between the American and Anglo-French models. As in most EU countries, the Czech Republic has opted for parallel (criminal) liability of natural and legal persons (Article 9(3) of the TOPOZ), which corresponds to the fact that the main purpose of this liability is to strengthen the internal measures preventing corporate crime (Mongillo 2012).

The establishment of criminal liability of legal persons is therefore as follows. A criminal offence, with the exception of the offences enumerated in Section 7 of the TOPOZ, is attributed to a legal person if it is committed in its interest or in the course of its activities, namely:

• by a statutory body or a member of a statutory body, by another person in a leading position (authorized to act for the company or performing management or control activities) or a person having influence on the management of a legal entity (§ 8 (1) (a), (b), (c) TOPOZ);
• by an employee or a person in a similar position in the performance of his/her duties (§ 8(1)(d) TOPOZ).

In the sense of the formal-material requirements of a criminal offence, a criminal offence by a (qualified) natural person is a necessary condition for the application of the criminal liability of a legal person, however, even without the condition of “priority establishment of the criminal liability of a qualified natural person” (Gřivna and Šimánová 2021). The alternatively established formal aspect of criminal liability—in its interest or in the context of its activities—raises some doubts as to the correctness of the formulation. The situation where a natural person acting on behalf of a legal person does not commit a criminal offence in the interest of the legal person, but nevertheless in the course of its activities, de facto means that he or she has committed such offence against the legal person’s interest (at the very least, he or she has damaged the name or property of the legal person by committing the offence as its representative). The case-law has therefore come to the right conclusion that a criminal offence committed by a natural person at the expense of a legal person, albeit in the course of its activities, cannot be regarded as fulfilling its criminal liability (Supreme Court of the Czech Republic 2016). To illustrate this point, the Italian law sets forth a more appropriate formulation by stipulating that a legal person is not responsible in the event that a natural person acted in his or her own interest or in the interest of third parties (Di Amato 2013, pp. 74–76). Another problem is the inconsistency of the wording ‘in the course of its activities’ with the Civil Code, which uses the term ‘in the performance of its tasks’ instead, thus naturally having a narrower scope. This in fact extends, in an impermissible way, the criminal liability of legal persons beyond private liability, contrary to the principle of subsidiarity of criminal repression (Gerloch 2017). It is therefore asserted that a more appropriate term to replace both of these alternative conditions would be the notion of ‘benefit’, which would reflect the fact that it is ultimately the property interest of the legal person that is at stake (Gerloch and Beran 2015). In this sense, inspiration could be drawn from Austrian law, where benefit means enrichment, the possibility of enrichment or cost/expenditure savings (Fabrizy 2016, p. 1099).

The aforementioned attributability of the offence to a legal person is in fact derived from the culpable (criminal) conduct of a natural person, unless the exculpatory conditions within the meaning of Section 8(2)(b) or (5) TOPOZ are met at the same time (see the following section). Given that the legal person is actually being reproached for not taking certain exculpatory measures, we agree with Fenyk’s belief that a more appropriate term than ‘attributability’ would be in fact ‘reprehensibility’ (Fenyk et al. 2018). It is beyond doubt that corporate criminal liability can then also be called ‘quasi-subjective’ (Fiala et al. 2021).

Beran points out that the criminal liability of legal persons in the Czech Republic is essentially based on the organic theory or ‘identification theory of legal persons’, that is, the concept is based on the premise that a legal person has its own will and therefore can act in a culpable way. He finds the latter to be contrary to the private law concept of liability based on the theory of fiction (according to which the act of a natural person is the act of a legal person), which is, in turn, the basis on which criminal liability should be based (Gerloch and Beran 2015). In this context, Jelínek submits that the fault of a legal person should be based on a culpable breach of the duty of professional care, and that the fault of a legal person is precisely the “negligence of due care” (Jelínek 2016). A unique approach has been adopted by Australia, whose form of criminal liability of a legal entity could be inspiring even in respect to exculpation: “the provisions in the Australian Criminal Code go a further step by enabling assessment of the internal environment of a company in terms of what was expected of employees or implicitly authorized, and by equating such findings of corporate culture with the intentions of the company” (Wilkinson 2003).

4. Establishment and Nature of the Exculpatory Measures

The provisions of Section 8 of the TOPOZ lay down the circumstances in which a legal entity may escape criminal liability. Section 8(5) of the TOPOZ formulates the general ground for establishing exculpation as the making of all “efforts that could reasonably be required of it to prevent the commission of the unlawful act”. A special ground for exculpation, which applies only to rank and file employees, is linked by section 8(2)(b) of the TOPOZ to the taking of measures by the managers, either under the relevant legislation or such “as may fairly be required of them”, in particular compulsory or necessary measures, control measures and measures necessary “to prevent or avert the consequences of the offence committed”.

As a result of a parliamentary initiative during the discussion of the amendment to the TOPOZ, i.e., Act No. 183/2016 Coll., the content of Section 8(5) of the TOPOZ overlaps non-conceptually with Section 8(2)(b) of the TOPOZ (Fenyk et al. 2018). However, let us leave aside the somewhat chaotically constructed exculpation as such and focus on the essence of the problem instead. It is clear from both alternatives to the establishment of exculpation that they presuppose sufficient preventive and detection measures. Logically, for detection measures to be seen as realistically intended, they must also be seen as reactive. Actually, prevention can be seen as a theoretical level and control/detection and reactionary/repressive measures can be seen as fulfilled “in the real life of society” (Chromý and Logesová 2018). This necessary linking of theory and practice so that the measures do not remain only ‘on paper’, is also reflected by the Supreme Court’s jurisprudence: “it is necessary to assess whether the measures adopted were viable, whether they were implemented, required, controlled and enforced, whether the measures were possible not only theoretically but also economically, whether the relevant persons were trained and whether the required procedures were applied in practice (…) However, the defendant did not ensure such effective functioning of the compliance rules; in the appeal, [the defendant] refers only to their formal existence, but does not indicate how compliance with them was ensured; on the contrary, [the defendant] merely states that the rules were not observed. In such a case, it cannot be concluded that the accused legal person made every effort to prevent the commission of the offence. It has only formally set the rules without ensuring compliance with them, which is not sufficient to exculpate it from criminal liability” (Supreme Court of the Czech Republic 2022).

Undoubtedly, the absence of these measures can be perceived as a ‘deficit in organization’ (wegen mangelhafter Organisation des Unternehmens). In this manner, the room for establishing exculpation is similar to that of most EU Member States—the court is the one to assess whether the measures are relevant in relation to the committed crime: “The demonstration of an effective corporate control system, that is an effective compliance program, may enable a corporation to exclude the liability of the entity in case of offenses committed by persons under the ‘direction or supervision’ of one of the persons who have a leading position within the entity” (Mongillo 2012). As the methodology of the Supreme Public Prosecutor’s Office rightly points out, the law does not specify a minimum standard, but this is because it is not possible. Namely, “to demand fairly” means that the establishment of exculpation must be assessed according to individual cases, i.e., “taking into account in particular the size of the legal entity, activities, products, the services it offers, the markets in which it does business, in light of the risks to which this legal entity is exposed” (Prosecutor General’s Office of the Czech Republic 2018).

Where the natural person whose conduct is attributed to the legal person is a member of the statutory body or a person in a senior position, establishing exculpation may be more rare (Šámal 2016). In the case of a limited liability company, where there is only a member and a managing director in one person, and there is no one else who can effectively and legally act in accordance with the above-quoted wording of the law, it seems impossible to exonerate liability.

The disputed issue here is the question to what extent the burden of proof which weighs heavily on the law enforcement authorities (see Article 2(5) of the Code of Criminal Procedure) extends to the obligation to prove that there is no exculpatory reason (Gřivna and Šimánová 2021). If the accused legal person states the existence of such a reason but does not ‘assist’ in proving it, a lack of evidence may block the proceedings. Careful consideration must then be given, depending on the specific situation, to whether to exclude criminal liability against the legal person in accordance with the principle of in dubio pro reo or to convict it. According to Pelc, “if certain facts relevant to the conclusion that the legal person has not made efforts within the meaning of section 8(5) of the TOPOZ remain unaddressed, the consequence is that the legal person cannot be found guilty” (Pelc n.d.). On the other hand, the Supreme State Prosecutor’s Office argues that “it is therefore up to the legal person to provide the relevant supporting documents for the reasonableness of the conclusion that all efforts have been made in accordance with section 8(5) of the TOPOZ” (Prosecutor General’s Office of the Czech Republic 2018).

In any case, the Supreme Court’s criticism towards the lower courts is justified in a particular case when it says: “It can be concluded from the foregoing that the courts of lower levels have completely given up on ascertaining the circumstances under which the actions of a specific natural person can be attributed to a legal entity. It is necessary to first establish that a specific natural person (even if we do not know his or her identity) in a specific position in relation to a legal entity within the meaning of § 8 paragraph 1 ZTOPO has committed a criminal offense that fulfils all its features (general, unlawful and typical, the sum of which constitutes the factual essence of the criminal act), i.e., it is also illegal and at the same time is in the interest of the legal entity or was committed within the framework of its activity (see preamble § 8 paragraph 1 ZTOPO), is attributable to the legal entity in the sense of § 8 paragraph 2 ZTOPO and at the same time, the legal entity has not released itself from responsibility for him according to § 8, paragraph 5 of the ZTOPO” (Supreme Court of the Czech Republic 2019).

5. Criminal Compliance—Personal Scope, Form and Content

Although the analysis of the possibilities of exempting a legal entity from criminal liability has revealed certain differences between the exculpation of ordinary employees (Section 8(2)(b) TOPOZ) and the generally formulated exculpation (Section 8(5) TOPOZ), it can be stated in principle that a thought-through compliance program will allow exculpation in either case. After all, this aligns with the idea that—in contrast to the threat of a high penalty, which is the threat to freedom, the requirements for the responsibility of a legal entity are maximized, thereby allowing it to exculpate from criminal liability in a sense of a “principled path that can grow freedom“ (Braithwaite 2022, p. 935). It is, however, worth taking into account Fenyk’s comment that exculpation within the meaning of Section 8(2)(b) TOPOZ does not explicitly require ‘all efforts’, so the measures must be proportionate and effective, but not exhaustive (Fenyk et al. 2018). Chromý and Růžička state that the requirement of ‘all efforts’ should be viewed in terms of the company culture, whether written or unwritten (Chromý and Růžička 2017). In any event, the scope of the measures should be “appropriate to the nature, size and type of the legal entity (…) and the type of its activities” (Logesová 2018).

It is not the purpose of this article to present the entire compliance management system, i.e., the definition and implementation of certain ethical and legal rules of the corporation (Náhlovská 2020), but to identify just that part of the compliance program that would preclude criminal liability of the legal entity, i.e., criminal compliance. In doing so, it must be remembered that legal and ethical requirements overlap, and it is their organically interconnected whole that is the essence of criminal compliance. Three aspects are important in determining the right compliance program: the personnel scope (i.e., which persons are covered), the form, and the content. The methodology of the Supreme State Prosecutor’s Office states that the exculpatory reason brings together considerations of function, substance, time, personnel, potency and procedure (Prosecutor General’s Office of the Czech Republic 2018). In this approach, it is possible to see an intersection with the aspects we have identified. Foreign or international principles and codes also provide a significant source of inspiration, especially in the area of corruption (OECD 2015), but their focus is not exhaustive for us.

The personal scope of the measures should be as broad as the attributability, i.e., the range of individuals whose conduct is attributed to the legal person. In other words, it should cover not only rank and file employees but also other representatives of the company, management personnel, including top management (although the possibility of exculpation of the latter category has, as already mentioned, its limits). At the same time, it can be recommended that the compliance approach should, as far as possible, also be enforced in relation to third parties, i.e., intermediaries, distributors, business partners and so on (Chromý and Růžička 2017). The statements of such third parties may then constitute an important means of evidence that the compliance program of the legal entity existed and was operational. The line of personal scope must be held across all measures. For example, a breach of a code of ethics found by an audit that also affects a member of senior management should subsequently be sanctioned, regardless of the status of the culprit. According to scholars, despite the fact that corporate crimes are ultimately committed by the legal entity’s members, it is the organizational context that plays a substantial role in practice. This illustrates that structural roots and measures in place—including specific compliance programs—may go deeper than individual responsibility (van Erp 2018).

The initial form of the preventive measures is a code of ethics. Leaving aside the aforementioned problem of the burden of proof and respect for the principle of nemo tenetur, we consider it necessary to publish the code of ethics on the website. Indeed, the lack of publication is a significant indication of its absence. Náhlovská argues, which can be accepted in principle, that in the event of publication of such a code, it is up to the law enforcement authorities to prove that it was not sufficiently effective (2020). If a code of ethics is to be firmly anchored, it must also be intertwined with other internal corporate regulations. It is undoubtedly not sufficient, as the Supreme Court has pointed out (see above), to formulate a code without keeping it up to date and actively disseminating and explaining it, preferably by means of training.

Of the content of the code of ethics, our interest lies in what has an impact on the criminal liability exculpation of a legal person. It is the content that is somewhat forgotten when discussing the required nature and scope of the exculpatory measures. Since the criminal liability of legal persons in the Czech Republic applies to a significant majority of criminal offences, it seems appropriate to put an emphasis on the content of the Code in those areas in which this liability should primarily apply, but also where it is actually being implemented. If we depart from the assumption that a properly functioning legal entity which does not intend to commit criminal activities, is interested in setting up the compliance program, the European legislation requiring effective punishment of corruption, information crime, illegal employment of foreign persons, money laundering (in this context, the EU’s efforts to pressure Member States into confiscating property, which may, of course, be in conflict with the presumption of innocence, are somewhat problematic (Allridge 2003, p. 45)) crimes against intellectual property and attacks against the environment becomes relevant (Šámal et al. 2018). From the overview given in Table 1, which shows the total number of persons prosecuted by the police (both natural and legal entities) and the number of convicted legal entities in specific areas, it is clear that the share of legal entities in the given criminal activity is quite negligible. However, this can be misleading as criminal activity is not always easily proved in case of a legal entity and thus not prosecuted as a result. Notwithstanding, criminal acts associated with a legal entity are usually more severe where damage or other adverse consequences are concerned. Particularly in the area of corruption, money laundering and crimes against intellectual property, the afore-mentioned neglect is thus only apparent.

Table 1. Number of prosecuted persons in total versus share of convicted legal persons in areas under review (Ministry of Justice of the Czech Republic n.d.; Police of the Czech Republic n.d.).

Criminal Activity of Convicted Legal Persons	Total Number of Criminally Prosecuted versus (/) Convicted Legal Entities in a Given Period
	2014	2015	2016	2017	2018	2019	2020
Information offences (§§ 230–232)	192/0	144/0	157/0	206/0	231/1	208/0	155/2
Corruption offences (§§ 256–257, 329–334)	128/2	198/0	62/5	60/6	91/0	59/0	55/2
Environmental offences (§§ 293–307)	28/1	22/1	10/0	6/0	24/1	28/1	17/0
Anti-money laundering offences (§§ 214–217)	279/0	220/0	147/1	125/0	141/0	174/3	114/6
Unauthorized employment of foreigners (§ 342)	0/0	0/0	2/0	1/0	7/0	3/2	1/0
Intellectual property offences (§ 268–270)	893/2	677/1	646/1	455/1	693/2	596/7	195/0

Empirical evidence illustrates, in the case of the Czech Republic, that the most frequent criminal activities are those in the area of tax and other mandatory payment crimes, fraud/credit fraud, accounting distortions and subsidy fraud. Table 2 summarizes the statistical data in relation to all the aforementioned categories in which legal entities were concerned.

Table 2. Criminal activity of the most frequently convicted legal entities (Ministry of Justice of the Czech Republic n.d.).

Criminal Activity of the Most Frequently Convicted Legal Entities	Period
	2014	2015	2016	2017	2018	2019	2020
Tax and benefit offences (§§ 240 a 241)	16	37	42	48	77	61	83
Fraud and credit fraud (§ 209 a 211)	9	26	31	32	26	40	38
Misrepresentation of accounting (§ 254)	2	4	8	19	21	16	29
Subsidy fraud (§ 212 a 260)	0	0	3	4	15	7	28

An interesting intersection of some of the intended and in practice sanctioned areas of crime can be seen in the 2015 OECD Principles of Corporate Governance, which states that in relation to “Anti-Bribery Convention, and other forms of bribery and corruption (…) compliance must also relate to (…) other laws that may be applicable include those relating to taxation, human rights, the environment, fraud, and money laundering” (OECD 2015). The International Chamber of Commerce’s anti-corruption rules are formulated in a similar manner (International Chamber of Commerce 2011).

Based on the above, the appropriate content components of a code of ethics can be formulated in the following way:

• prohibition of illegal use and hacking of competitors’ or business partners’ information systems;
• anti-corruption corporate culture (prohibition of accepting or offering bribes, their mediation, including benefit in the form of a quid pro quo, including within the relations within the legal entity);
• respect for the environment and, with regard to the activities of the legal entity, the formulation of potential risks to the environment;
• keeping records of employed foreigners, careful verification of their personal data, and related cooperation with state authorities;
• transparency in accounting and financial operations, which is reflected in proper bookkeeping and an accommodating approach to proving tax and similar obligations;
• compliance with payment morale towards business partners and the State;
• the provision of fully truthful and non-misleading information in applications for credit from financial institutions or in applications for grants from the State or the European Union funds;
• prohibition of illegal use of third party intellectual property, in particular software and trademarks.

It is our belief that, given the intersection with the OECD principles in particular, these components of the code of ethics could be generally usable and become a source of inspiration for exculpatory measures in other countries.

Bohuslav contends that a legal entity should assess the criminal law risks for itself (Jelínek 2017). While agreeing, on our part, we submit that this is precisely with regard to the subject of activity and in relation to the mentioned components. It would seem logical that certain areas would be given more emphasis in the code of ethics whereas others less, precisely in relation to the focus of the activity. The link between the code of ethics, as a theoretical expression of criminal compliance, and the practical level (detection and reaction) is represented by the provisions of the code, which refer to the control system and the sanctions in the event of non-compliance.

The form of detection measures presupposes, in the first place, the establishment of a control system that effectively detects unlawful misconduct. In terms of content, this means establishing fixed control procedures and designating responsible persons with appropriate powers. On the one hand, regular management audits should be carried out as a kind of extension of the legal obligation; on the other hand, random checks should not be absent either. The appropriate means would be to allow control from bottom-up, that is to set up a communication channel where suspected illegal activities can be reported, even anonymously. Ensuring that such reports can be made without being considered as a breach of the duty of loyalty or exposing the notifier to adverse reactions from the management or other employees can be seen as the institutionalization of whistleblowing (Hurychová and Sýkora 2018).

Reactionary measures are directly linked to detection, i.e., they are a kind of culmination of the detection of unwanted/illegal activity. Detection should not be ‘lost’ but should be adequately addressed. In principle, three forms of response measures can be imagined:

• holding the employee legally liable in the employment relationship;
• a recourse claim for damages against the wrongdoer;
• a claim for public liability.

The content of the labor law response and the claim for compensation against the employee are determined by the Labor Code and the Civil Code, so that it is not possible for the response to go beyond them. Rather, it is a question of consistent and fair action against all the guilty parties (in the sense of whatever the status of the person committing the offence may be, the offence will be assessed in the same, fair manner regardless of the status). However, it should be emphasized once again that the effectiveness of the code of ethics in the field of labor law will only be ensured when linked with internal company labor regulations. There is no legal obligation to report suspected offences in regard to the vast majority of criminal offences (see Section 368 of the Criminal Code), which provides room for reactive measures. Indeed, making a criminal report beyond the legal obligation serves as evidence that the compliance program in place is operational and meets the ‘all efforts’ requirement (Logesová 2018).

A finding of the absence or inadequate functioning of any of the aforementioned components of a compliance measure may then naturally be evidence of the continuing culpability of the legal entity. For example, a finding by law enforcement authorities that employees routinely committed violations and were not disciplined by the corporation is indicative of inadequate responsive measures. In other words, even if the compliance measures are not prima facie legally binding, it should be asserted that their violation leads to negative consequences for specific natural persons, manifested, for example, through the mean of personal bonuses or sanctions (Oladinrin and Ho 2016).

6. Conclusions

During the approximately ten years of its operation, the criminal liability of legal entities has gained an inalienable place in the system of legal liability of the Czech Republic. It appears to be a suitable supplement to the liability of a legal entity in the event of serious unlawful acts of natural persons from which the legal entity benefits. With regard to the principles of criminal law, we are convinced that a legal person should have the possibility to escape from criminal liability if it has made sufficient efforts to prevent the persons involved and operating within it from committing criminal activities.

Prevention, detection and response measures, if properly set up and implemented in practice, play a decisive role in establishing exculpation. At the heart of the measures and their ultimate starting point is a code of ethics; this is followed by a structured system of control and other measures for detecting illegal and unethical behavior. Lastly, this culminates with the imposition of appropriate sanctions in the areas of labor law, misdemeanor and criminal law. In addition to the necessary linking of the different forms of measures, it seems justified for the measures to be transparent, published and fairly applied. If these conditions are met, it is likely that the issue of who bears the burden of proof and whether the legal person has the burden of proving the existence and effectiveness of the exculpatory measures will be resolved in the standard criminal evidentiary procedure.

A criminal compliance program is a mix of measures that have both legal or ethical implications and yet, in the aggregate, may lead to the criminal non-liability of a legal person. In that sense, they have an obvious impact on the field of law. It is clear from the foregoing that the formulation of and compliance with ethical rules (and the associated sanction in the event of a breach) is in fact ‘elevated’ to the level of legal rules through the compliance program. An interesting phenomenon occurs here, where compliance, one of the components of Corporate Social Responsibility, becomes an expression of a legal obligation, i.e., the obligation to properly manage and control the corporation. In the event of a breach of this obligation, criminal sanctions are then implemented. Being at the heart of the compliance program, the code of ethics is the actual cornerstone of exculpatory measures. Accordingly, the above-formulated components of the code of ethics could serve as a model or a source of inspiration for other legal provisions, especially in those countries where exculpation and criminal liability of legal entities are constructed in a similar way as a result of harmonization through the EU legislation. In this sense, it is therefore our belief that the criminal law-based compliance program formulated within this article, i.e., its personal scope, form and context, and namely the appropriate set-up of parameters pertaining to the code of ethics, compliance check and adequate response in the event of a violation, as applied to the criminal legal environment of the Czech Republic, contributes to the scholarship concerning the possible role of compliance in relation to the criminal liability of legal entities as such.

It is asserted here that a compliance program set up in this particular manner is in fact more universal than most other programs which mainly revolve around corruption, and is more usable in practice. Ultimately, of course, it comes down to preventing the owners’ profits from being jeopardized, since criminal penalties are naturally a threat to their assets in the first place.