Whistleblower Protection

Under Polish law, the provisions regarding whistleblower protection, in accordance with the requirements of the Directive (EU) 2019/1937 of the European Parliament and of the Council of 23 October 2019, were to be implemented into the Polish legal system by 17 December 2021.

However, the draft Act on the Protection of Persons Reporting Legal Violations has stalled at the consultation and review stage. The adoption of the law is still a long way off. Nevertheless, it is worth paying attention to this topic, particularly in the context of compliance policies.

Scope of Application
Theoretically, the obligation to apply whistleblower protection provisions applies to employers with fifty or more employees. However, implementing such measures is advisable for organizations of all sizes.

Why Should Employers Establish Procedures for Whistleblower Protection?

- Safeguarding the company’s reputation.

- Ensuring organizational compliance with applicable law.

- Providing clear internal operational rules.

- Promoting an ethical organizational culture.

Key Provisions of the Draft Whistleblower Protection Act
A whistleblower is a person who reports or publicly discloses information about a legal violation obtained in a work-related context. Such a reporter is protected, provided they have reasonable grounds to believe that the information being reported is true at the time of disclosure.

Personal data of the whistleblower shall not be disclosed without the explicit consent of the reporter.

No retaliatory actions may be taken against the whistleblower. A whistleblower who suffers adverse treatment due to reporting irregularities is entitled to compensation not less than the minimum wage.

Reports are classified as internal (within the organization) or external.

Internal Reporting Obligations
Employers with more than fifty employees are required to establish internal reporting regulations, defining the internal procedure for reporting legal violations and taking follow-up actions. Employees must be informed of the internal reporting regulations before commencing work.

Internal reporting regulations should, in particular, specify:

1. The internal entity authorized by the employer to receive reports.

2. Methods for submitting reports.

3. Whether the internal procedure allows for anonymous reporting.

4. An organizationally independent entity authorized to undertake follow-up actions, including verifying the report and communicating with the reporter, requesting additional information, and providing feedback.

5. The obligation to confirm receipt of the report within seven days unless the reporter has not provided an address for confirmation.

6. The obligation for the authorized entity to undertake follow-up actions with due diligence.

7. Follow-up actions undertaken by the employer to verify information about legal violations and the measures that may be applied if a violation is confirmed.

8. The maximum timeframe to provide feedback to the reporter, not exceeding three months from confirmation of receipt, or, if confirmation is not issued, three months from the expiration of seven days after the report submission.

9. Clear and unambiguous instructions for submitting external reports to public authorities and, where applicable, to EU institutions, bodies, or organizational units.

External Reporting
The central authority for receiving external reports is the Polish Ombudsman (Rzecznik Praw Obywatelskich).

External reports may be anonymous or allow for identification of the whistleblower. A contact address must be provided. Reports can be submitted orally, on paper, or electronically.

If both internal and external reporting proves ineffective, the whistleblower may rely on public disclosure protection under the Act. Public disclosure does not always have to be preceded by internal or external reporting, e.g., if the violation poses a direct or obvious threat to the public interest, particularly where there is a risk of irreversible harm, or if external reporting would expose the whistleblower to retaliation.

Criminal Provisions
The Act also contains criminal provisions. Penalties apply to anyone who:

• Hinders the reporting of violations,

• Retaliates against a whistleblower,

• Violates the obligation to maintain whistleblower confidentiality, or

• Submits or discloses false information.

Importantly, criminal liability may also arise from failing to implement an internal reporting procedure or for non-compliance of such a procedure with the provisions of the Act.