Recently, the protection of whistleblowers has become a very popular topic among employers. This is related to the entry info force on 25 September 2024 of the Act of 14 June 2024 (Official Journal of 2024, item 928, as amended), hereinafter referred to as the Act. The Act in question implements the provisions of the Directive (EU) 2019/1937 of the European Parliament and of the Council of 23 October 2019 on the protection of persons who report breaches of Union law into the Polish legal order.

1. Who is a whistleblower?

The concept of a whistleblower is crucial for the Act. It is defined by Article 4 of the Act. It results from this provision that a whistleblower is an individual who reports or publicly discloses information about a violation of the law obtained in a work-related context. Therefore, a whistleblower can’t be a legal person or a defective legal person.

According to the Act, a signalist may be:

  1. an employee;
  2. a temporary worker;
  3. a person providing work on a basis other than an employment relationship, including under a civil law contract;
  4. an entrepreneur;
  5. a proxy;
  6. a shareholder or an associate;
  7. a member of a body of a legal person or of an organisational unit without legal personality;
  8. a person performing work under the supervision and direction of a contractor, subcontractor or supplier;
  9. an intern;
  10. a volunteer;
  11. a trainee;
  12. an officer within the meaning of Article 1(1) of the Act of 18 February 1994 on retirement benefits for officers of the Police, Internal Security Agency, Intelligence Agency, Military Counterintelligence Service, Military Intelligence Service, the Central Anti-Corruption Bureau, Border Guard, Marshal Guard, State Protection Service, State Fire Service, Tax and Customs Service and Prison Service, as well as their families (OJ 2023, items 1280, 1429 and 1834);
  13. a soldier within the meaning of Article 2, point 39, of the Act of 11 March 2022 on Defense of the Fatherland (OJ 2024, items 248 and 834) (Article 4(1) of the Act).

According to Article 4(2) of the Act, a whistleblower is also a natural person who has reported or publicly disclosed information about a violation of the law obtained in a work-related context before entering into an employment relationship or other legal relationship constituting the basis for the provision of work, services, either for performing function in or for a legal entity, or for the performance of service in a legal entity, either after their cessation.

It should be noted that in order to obtain whistleblower status, it’s extremely important that the information concerning the violation of the law is obtained ″in a work-related context″. This term should be understood as past, present or future activities related to the performance of work on the basis of an employment relationship or another legal relationship constituting the basis for the provision of work, services, or for performing function in or for a legal entity, either for the performance of service in a legal entity, within a framework of which information concerning a violation of the law was obtained and there is a possibility of experiencing retaliatory actions (Article 2(5) of the Act). If the report was made without a work-related context, the notifier isn’t a whistleblower and the provisions of the Act don’t apply to him/her, and in particular, he/she can’t benefit from the protection granted to whistleblowers.

2. Infringement of law

Article 3(1) of the Act defines an infringement of law as an act or omission that is unlawful or intended to circumvent laws, concerning:

  1. corruption;
  2. public procurement;
  3. services, products and financial markets;
  4. prevention of money laundering and terrorist financing;
  5. product safety and compliance;
  6. transport safety;
  7. environmental protection;
  8. radiation protection and nuclear safety;
  9. food and feed safety;
  10. animal health and welfare;
  11. public health;
  12. consumer protection;
  13. protection of privacy and personal data;
  14. security of network and IT systems;
  15. financial interests of the State Treasury of the Republic of Poland, a local government unit and the European Union;
  16. internal market of the European Union, including public law rules of competition and state aid, as well as corporate taxation;
  17. constitutional freedoms and rights of man and citizen – occurring in the relations of an individual with public authorities and not related to the areas indicated in points 1-6.

A legal entity has the possibility to introduce information about violations of internal regulations or ethical standards applicable within that entity in the internal reporting procedure (Article 3(2) of the Act).

The catalogue of reportable infringements of law doesn’t include labour legislation. During the legislative process, this category was deleted by the Senate’s amendment. This amendment is assessed differently by representatives of practice and doctrine.

3. Protection of the whistleblower

A whistleblower is subject to special protection. It begins when the whistleblower makes a report or public disclosure. The condition for granting protection is the whistleblower’s reasonable belief that the information being the subject of the report or public disclosure is true at the time of making the notification or public disclosure and constitutes information about an infringement of law.

The Act prohibits retaliatory actions againts a whistleblower, as well as attempts and threats to use such actions. In the case of a whistleblower who is an employee, retaliations may consist in particular of:

  1. refusal to establish an employment relationship;
  2. termination of employment relationship or its dismissal without notice;
  3. failure to conclude a fixed-term employment contract or an employment contract of an indefinite duration after the termination of an employment contract for a probationary period, failure to conclude another fixed-term employment contract or failure to comply an employment contract of an indefinite duration after the termination of a fixed-term employment contract – in the event that the whistleblower had a reasonable expectation that such a contract would be concluded with him/her;
  4. reduction of the amount of remuneration for work;
  5. withholding of promotion or omission from promotion;
  6. omission from granting work-related benefits other than remuneration or reduction of the amount of these benefits;
  7. transfer to a lower job position;
  8. suspension from the performance of occupational obligations or official duties;
  9. transferring the whistleblower’s current duties to another employee;
  10. unfavourable change of the place where the work is carried out or work schedule;
  11. negative evaluation of work results or negative opinion concerning work;
  12. imposing or applying a disciplinary measure, including a financial penalty, or a measure of a similar nature;
  13. coercion, intimidation or ostracism;
  14. harassment;
  15. discrimination;
  16. disadvantageous or unfair treatment;
  17. withholding participation in or omission from selection for participation in training to improve professional qualifications;
  18. unjustified referral for medical examinations, including psychiatric ones, unless separate provisions provide for the possibility of referring an employee for such examinations;
  19. actions to make it more difficult to find work in a given sector or industry in the future on the basis of an informal or formal sectoral or industry agreement;
  20. causing financial loss, including economic one, or loss of income;
  21. causing other non-material damage, including infringement of personal rights, in particular of the good name of the whistleblower (Article 12(1) of the Act).

The employer bears the burden of proof that the actions taken against the whistleblower aren’t retaliatory.

A whistleblower against whom retaliation has been committed may seek redress for the damage. Compensation is due in an amount not lower than the average monthly salary in the national economy in the previous year (Article 14 of the Act). Moreover, a person who takes retaliatory actions against a whistleblower, as well as against a person assisting in making a report or that one associated with the whistleblower may be punished with a fine, restriction of liberty or even imprisonment of up to 2 years. In the event that the perpetrator has acted persistently, he/she is threatened by imprisonment of up to 3 years (Article 55 of the Act).

4. Internal reporting procedure – a new obligation

The imposition of an obligation on legal bodies to introduce an internal reporting policy constitutes a novelty arising from the Act. This is a document specifying the rules according to which internal notifications are to be made in a legal entity.

As a general rule, the obligation to implement the internal reporting procedure rests with the legal entity for which at least 50 persons is engaged in paid employment as at 1 January or 1 July of a given year (Article 23(1) of the Act). When determining the employment status, employment contracts should be counted in full-time positions, while other contracts in terms of quantity.

Regardless of the number of employed persons, the obligation to introduce the procedure arises in relation to a legal entity conducting activities in the field of financial services, products and markets, as well as counteracting money laundering and terrorism financing, transport safety and environmental protection (Article 23(3) of the Act).

The obligation to introduce procedure was excluded with respect to organisational entities of the municipality or of the powiat with a population of less than 10 000 (Article 23(5) of the Act).

Legal entities employing fewer than 50 persons, as well as organisational entities of the municipality or of the powiat with a population less than 10 000, may voluntarily introduce an internal reporting procedure into their organisation (Article 24(2) of the Act).

5. Introduction of internal reporting procedure

The establishment of an internal reporting procedure requires that the legal entity consults with:

  • a company trade union organisation or company trade union organisations (in the event that there is more than one company trade union organisation in the entity), either
  • representatives of persons working for the legal entity, selected in the manner adopted in the legal entity, if there is no company trade union organisation operating in it.

Consultations should last no less than 5 days and no longer than 10 days from the date of submission of the procedure design by the legal entity.

The text of the procedure, established as described above, should be made known to the persons performing work in the manner adopted in the legal entity. Only after 7 days from the date of announcement, the procedure enters into force.

It results from the above that all persons performing work in the legal entity, regardless of its legal basis, should become familiar with the content of the internal reporting procedure. Moreover, the legal entity is obliged to provide information concerning the procedure to the person applying for a job at the beginning of recruitement or negotiations preceding the conclusion of a contract.

6. Content of the internal reporting procedure

The internal reporting procedure should comply with the requirements specified by the Act. It’s possible to distinguish mandatory elements and optional procedures. Mandatory elements of the procedure include:

  1. identification of the internal organisational unit or person within the orgnisational structure of the legal entity, either external entity, authorised to receive internal reports;
  2. determination of the channels for transmitting internal reports (e.g. by telephone, electronic means of correspondence, traditional mail);
  3. identification of the organisational unit or person authorised to take follow-up actions;
  4. procedure for dealing with information about infringements reported anonymously;
  5. obligation to confirm the acceptance of the internal report to the whistleblower;
  6. obligation to take follow-up actions by the internal organisational unit or person authorised to follow-up;
  7. determination of a time limit for providing feedback to the whistleblower;
  8. information on making external reports to the Ombudsman or public authorities and – where appropriate – to institutions, bodies or organisational units of the European Union (Article 25(1) of the Act).

The internal reporting procedure may include (optional elements of the procedure):

  1. identification of infringement of law, concerning the internal regulations or ethical standards in force in the legal entity – in the event that the legal entity has provided for the possibility of reporting such violations;
  2. identification of risk factors corresponding to the business profile of the legal entity;
  3. information that an infringement of law may in any case also be reported to the Ombudsman or a public authority without using the internal reporting procedure;
  4. determination of an incentive scheme for the use of the internal reporting procedure (Article 25(2) of the Act).

7. Register of internal reports

The duty of the legal entity to keep a register of internal reports is inextricably linked to the obligation to introduce an internal reporting procedure.

The register should include the following data:

  1. notification number;
  2. subject of the infringement of law;
  3. personal data of the whistleblower and of the person concerned by the report, necessary to identify them;
  4. whistleblower’s contact address,
  5. date of reporting;
  6. information on follow-up actions taken;
  7. date of closing the case.

Entries in the register are made on the basis of internal notifications.

The legal entity is the controller of personal data collected in the register of internal reports.

Any data collected in the register of internal reports should be stored for a period of 3 years after the end of the calendar year in which the follow-up actions have been completed or after the termination of the proceedings initiated by these actions (Article 29(5) of the Act).

8. External reports

In addition to internal reports made within the legal entity, the Act distinguishes external ones. These notifications are made with regard to the Ombudsman or a public authority.

The Act doesn’t introduce the requirement that an external report be preceded by an internal one. In other words, external notifications can be made without prior internal report.

No later than 7 days after the receipt of a report, the Ombudsman or the public authority that has received an external report sends a confirmation of receipt of the notification to the whistleblower. The acknowledgement isn’t sent in the event that the whistleblower has clearly submitted a different request in this respect or the authority that received an external notification has reasonable grounds to believe that the confirmation of receipt of the report would threaten the protection of the confidentiality of the whistleblower’s identity.

It may happen that the Ombudsman won’t examine an external report which has been submitted to him/her. This occurs when the notification concerns an infringement of law in the fields indicated in Article 3(1)(1-6) of the Act. In such a case, the Ombudsman carries out an initial verification of the report and forwards it to the public authority competent to take follow-up actions. The Ombudsman receives and examines an external notification only if it concerns an infringement of law in the field identified in Article 3(1)(17) of the Act, and no other public body is competent to take follow-up actions. It’s also possible that an external report will be examined by a different public authority than the one to which the notification was submitted. Indeed, the public body verifies whether the report concerns infringements of law in the area of falling whithin the scope of its activities and, if not, it determines the public authority competent to take follow-up actions.

If a whistleblower make an appropriate request, the public body competent to take follow-up actions issues a certificate confirming that the whistleblower is subject to special protection. The attestation should by issued within one month of receiving the request for it.

The whistleblower should receive feedback within a period not exceeding 3 months from the date of receipt of the external report. Where appropriate, this deadline may be extended to 6 months from the date of receipt of the external notification. However, in such a situation, the whistleblower must be informed of the longer time limit for resolving the matter. The public authority is also obliged to inform the whistleblower of the final outcome of the explanatory proceedings initiated as a result of an external report.

The Ombudsman or a public authority forwards the information contained in the external notification without undue delay to the appropriate institutions, bodies or organisational units of the European Union in order to take follow-up actions.

9. Public disclosures

Public disclosure consists of making information about the infringement public. A whistleblower who has made such a disclosure is subject to protection in strictly defined cases:

  • the whistleblower has made an internal report and then an external one, and the legal entity and then the public authority don’t take any appropriate follow-up actions or provide feedback to the whistleblower within the timeframe for providing feedback – unless the whistleblower hasn’t provided a contact address to which such information should be forwarded;
  • the whistleblower has made an external report immediately (without an internal notification) and the public authority doesn’t take any appropriate follow-up actions or doesn’t provide feedback to the whistleblower within the timeframe for providing feedback – unless the whistleblower has failed to provide a contact address to which such information shall be forwarded;
  • the whistleblower has justified reasons to believe that:
    • the infringement may constitute a direct or obvious threat to the public interest, in particular where there is a risk of irreparable harm, either
    • making an external report will expose him/her to retaliatory actions, or
    • in the event that an external notification is made, there is a low probability of effective action against the infringement of law due to the specific circumstances of the case, such as the possibility of concealing or destroying evidence, the existence of collusion between the public authority and the infringer or the involvement of the public body in the violation.

In the event that information concerning the infringement of law is provided directly to the press, the provisions of the Act don’t apply. In such a case, the provisions of the Act of 26 January 1984 – Press Law (i.e. OJ 2018, item 1914, as amended) apply.

10. Legal notice

The study is a work within the meaning of the Act of 4 February 1994 on Copyright and Related Rights (OJ 2006, No. 90, item 631, consolidated text, as amended). Publishing or reproducing this study or its part, quoting opinions, as well as disseminating in any other way the information contained therein without the written consent of Crede sp. z o.o. is prohibited.

Ten post dostępny jest także w języku: Polski Français