On June 24, a law on whistleblower protection was announced, implementing into Polish law the European Parliament and Council Directive (EU) 2019/1937 of October 23, 2019, on the protection of persons reporting breaches of Union law. After many years of waiting, we finally have Polish regulations on this matter. The new regulations will come into force on September 25, giving entrepreneurs little time to implement the appropriate procedures in their organizations.

Purpose and Scope of the Law

The law aims to provide effective protection for whistleblowers, i.e., individuals who, in good faith, report or publicly disclose information about legal violations obtained in connection with employment. Whistleblower protection is independent of the basis or form of work performed and covers both the private and public sectors. This means that a whistleblower can be not only an employee under labor law but also any other person associated with the organization (including in the past), such as members of governing bodies, entrepreneurs, proxies, shareholders, partners, collaborators (i.e., persons employed under civil law contracts or B2B contracts), employees of external entities, interns, trainees, and volunteers. The protection also extends to individuals reporting irregularities during the recruitment process or contract negotiations.

Scope of Legal Protection for Whistleblowers

Not all areas of reporting are covered by statutory protection, but the range of these areas is broad. They include, among others, corruption, public procurement, product safety and compliance, transport safety, environmental protection, food and feed safety, animal health and welfare, public health, consumer protection, privacy and data protection, network and information system security, and even constitutional freedoms and human and citizen rights. However, the law does not address violations related to labor law, such as bullying or discrimination. It is important to note that the statutory protection of whistleblowers sets a minimum standard, while organizations have the option to voluntarily extend the scope of reporting to include violations of internal regulations or ethical standards, particularly those arising from applicable codes of ethics.

A whistleblower is legally protected from the moment the report is made, with the confidentiality of the report and its content maintained. No retaliatory actions (or even attempts or threats of such actions), such as termination of employment, reduction of pay, withholding of promotion, or denial of bonuses or awards, may be taken against such a person. Moreover, an employer who takes such actions will be required to pay compensation (not less than the average monthly salary in the national economy for the previous year) or damages. On the other hand, a person who suffers damage due to the whistleblower's deliberate actions will have the right to compensation or damages for personal harm from the whistleblower.

Reporting Irregularities

The law provides two main channels for reporting irregularities: an internal reporting procedure and an external reporting procedure, with the whistleblower having the option to bypass the internal reporting procedure and report the violation directly to the Ombudsman or a public authority. Additionally, a whistleblower may disclose information about the violation to the public through public disclosure.

Internal reporting methods must include at least oral or written forms. Employers have the flexibility to introduce additional reporting channels, such as a special form, a mobile application, or an online channel for reporting violations. An oral report can be made via a recorded telephone line or other recorded voice communication system, as well as an unrecorded telephone line or other unrecorded voice communication system, and, at the whistleblower's request, during a direct meeting organized within 14 days of receiving such a request.

New Obligations for Entrepreneurs

The obligation to establish an internal reporting procedure rests with any entity that employs at least 50 people (as of January 1 or July 1 of the given year), in the case of employees calculated in full-time equivalents. This requires conducting consultations lasting from 5 to 10 days with trade unions or appropriate representation of workers. The procedure takes effect 7 days after being communicated to the workers in a manner accepted in the organization.

Entrepreneurs must, among other things, establish rules for receiving internal reports, designate units (within their organizational structure or external units) responsible for receiving reports and units processing these reports, and ensure whistleblower anonymity. They are also required to maintain records of internal reports and serve as data controllers of the personal data collected therein by law. The internal reporting procedure must determine whether anonymous reports will be accepted (the law does not impose such an obligation) and how such reports will be handled. It is worth noting that identity protection applies not only to persons reporting under their names but also to anonymous whistleblowers whose identity has been subsequently revealed or who may be identified in another way.

In addition to properly defining the internal reporting procedure, it is crucial to enforce these internal rules within the organization. Establishing a comprehensive whistleblower support system should enable faster and more effective responses to potential threats and problems within the organization, which, in turn, can positively impact the workplace atmosphere.

Statutory Penalties

The law provides for criminal liability for persons who prevent or hinder reporting, take retaliatory actions against the whistleblower, or disclose the whistleblower's identity, as well as for failing to establish an internal reporting procedure. On the other hand, whistleblowers face criminal liability for making a report or public disclosure despite knowing that the legal violation did not occur. It should be noted that failing to establish an internal reporting procedure or establishing it with significant violations of statutory requirements is classified as a misdemeanor, for which an entrepreneur may be fined.