Dejan Jasnic · Co-founder & Compliance Lead, Trusty · 20+ years anti-fraud & compliance · ACFE Swiss Chapter Board
In October 2019, the Whistleblowing Directive was officially drafted, representing a significant advance in the labor field by imposing new obligations for the creation of internal whistleblowing channels in companies. This regulation seeks mainly to ensure that any employee has a mechanism to report possible infractions or irregularities within the organization, while protecting the confidentiality of the whistleblower.
Although the directive establishes common guidelines for the entire European Union, each country has had to implement it in a particular way, adjusting it to the specific characteristics of its business environment. In today’s article we analyze the transposition of the directive into Polish law.
The Whistleblowing Directive in Polish law
Thus, in Poland, this directive is transposed in the Ustawa o ochronie sygnalistów, a law published in the official gazette on June 24, 2024. But what is new in this law compared to the European directive? We have consulted with some Polish law firms to find out the main aspects of this regulation.
Who is protected by Polish law?
As stated in Article 4, the law considers employees, temporary personnel, persons performing work on a basis other than an employment relationship, employers, legal representatives, partners and shareholders, and even interns, volunteers and trainees, among others, to have the status of “whistleblower”.
Which companies are affected by the Law?
Article 23 of the law provides that such regulations shall apply to a legal entity for which at least 50 persons are employed in a gainful activity on January 1 or July 1 of a given year. This minimum quorum of 50 employees shall not apply to legal entities carrying out activities in the field of financial services, products and markets, the fight against money laundering and terrorist financing, transport security and environmental protection, which fall within the scope of European Union legal acts. In addition, it will also not apply to organizational units of a municipality or district with less than 10,000 inhabitants.
Which areas of protection are excluded from the Whistleblowing Directive?
This Law does not apply to information that is covered by rules on the protection of classified information and other information that is not subject to disclosure under legislation of general application for reasons of public security. Nor does it apply to professional secrecy in the medical and legal professions, to the secrecy of judicial deliberations, or to criminal proceedings as regards the confidentiality of investigations and court hearings held in camera. Likewise, it also does not apply to violations of the legislation on defense and security contracts.
What is the procedure for reporting violations?
This issue is regulated in Article 24 of the law, which provides that the legal entity must establish an internal procedure for reporting and monitoring violations of the law. Thus, an entity with fewer than 50 employees may establish an internal whistleblower procedure. However, prior to establishing the internal complaint procedure, the entity will have to consult:
1) To a trade union organization of the company or to the trade union organizations if there is more than one trade union organization in the legal entity, or
2) To representatives of persons working for the legal entity, selected in accordance with the procedure adopted by the legal entity, if there is no trade union organization of the company.
How long does the procedure take?
The aforementioned consultations shall last at least 5 days and no more than 10 days from the date of submission of the draft of the internal complaint procedure. Such internal complaint procedure shall come into force 7 days after it is made known to the persons performing work in the manner accepted by the legal entity.
The legal entity shall communicate to a person applying for employment on the basis of an employment relationship or other legal relationship that results in the provision of work or services or the performance of a function or service, information about the internal complaint procedure at the beginning
of the contracting process or pre-contractual negotiations.
What are the specific requirements of the internal complaint procedure?
The internal complaint procedure shall specify the following:
1) An internal entity or a person within the organizational structure of the legal entity, or an external body authorized by the legal entity to receive internal complaints;
2) The means for the transmission of internal complaints by the complainant together with his or her postal address or e-mail address;
(3) An impartial entity or person within the organizational structure of the legal entity responsible for follow-up, including verification of the internal complaint and further communication with the
whistleblower;
4) The procedure for handling information on violations reported anonymously;
5) The obligation to acknowledge receipt of the internal statement within 7 days of receipt, unless the complainant has not provided the contact address to which the confirmation should be sent;
6) A maximum period for feedback to the complainant, which must not exceed 3 months from the date of acknowledgement of receipt of the internal complaint or, if the confirmation referred to in point 5 is not provided, 3 months after 7 days have elapsed from the date of the internal complaint, unless the complainant has not provided the contact address to which the feedback must be provided;
7) Understandable and easily accessible information on how to make external complaints to the Ombudsman or to public authorities and, where appropriate, to the institutions, bodies, offices or agencies of the European Union.
How are the means of transmission of the complaints?
They can be oral or written.
? Written request: The written request can be made in paper or electronic format.
? Oral request: Oral notification may be made by telephone or electronic means of communication. An oral complaint made through a recorded telephone line or other system of
Recorded voice communication shall be documented with the consent of the complainant in the form of a recording of the conversation that allows for its retrieval, or a complete and accurate transcript of the conversation. In addition, an oral complaint made by means of a non-recorded telephone line or other non-recorded voice communication system shall be documented in the form of a record of the conversation, reproducing its exact course.
The complainant may verify, correct and challenge the transcript of the interview or the interview record by signing it. On the other hand, the complainant may request that the oral complaint be made at a face-to-face meeting organized within 14 days of receipt of such request.
How is the whistleblower protected?
The complainant will not be subject to retaliation or the attempt or threat of retaliation. Section 51 of the regulations states that a whistleblower who makes a public disclosure is protected if he or she makes:
1) an internal complaint followed by an external complaint, first to a legal entity and then to a public authority within the time limit established in the internal procedure for providing feedback, and then failure to provide appropriate follow-up or feedback within the time limit established by the external public authority procedure, or
2) an immediate external complaint and appropriate follow-up or feedback is not provided by the public authority within the timeframe established in its external procedure. A whistleblower who makes a public disclosure will also be protected when he or she has reasonable grounds to believe that:
1) the infringement may constitute a direct or manifest threat to the public interest, in particular when there is a risk of irreparable damage, or
2) external reporting may lead to retaliation against the whistleblower, or
3) if an external complaint is made, the infringement is unlikely to be effectively countered due to the specific circumstances of the case, such as the possibility of concealing or destroying evidence, the existence of collusion between the public authority and the infringer, or the involvement of the public authority in the infringement.
Data protection and confidentiality
Article 27 of the law determines that the legal entity shall ensure that the internal whistleblowing procedure and the processing of personal data related to the receipt of reports prevent unauthorized access to the information covered by the report and ensure that the confidentiality of the identity of the whistleblower, the affected person and the third party identified in the report is protected.
Only persons authorized in writing by the legal entity may be admitted to receive and verify internal reports, monitor and process personal data.
Authorized persons shall be obliged to maintain confidentiality with respect to information and personal data obtained in the context of receiving and verifying internal reports and in carrying out follow-up actions, even after the termination of the employment or other legal relationship in which they performed such work.
Can the complainant submit an external report?
Yes, the complainant may submit an external report without having previously submitted an internal report. External reports may be accepted by the Ombudsman or by a public authority.
The Ombudsman and the public authority shall be independently responsible in relation to personal data contained in an external report that has been accepted by those authorities. These figures will act in accordance with the provisions of articles 31 et seq. of the law.
In addition, according to Article 33, the public authority shall establish a procedure for the receipt and follow-up of external reports, which shall determine, in particular, the procedure for handling information on infringements reported anonymously. Pursuant to Article 35, for effective follow-up and feedback, the complainant shall provide a contact address. In addition, the external report may also be made orally or in writing.
? Written request: it can be made on paper, to the address for correspondence indicated by the Ombudsman or the public authority receiving the notification. Also electronically, to the e-mail address or electronic mailbox address, or to the electronic service address indicated by the Ombudsman or the public authority receiving the notification, or by means of a
online form or application designated by the public authority as competent to receive reports electronically.
The Ombudsman or public authority that accepted the external report shall, without delay, but no later than 7 days after receiving the report, send the complainant a confirmation of its acceptance, unless the complainant has expressly requested otherwise or the Ombudsman or public authority has reasonable grounds to believe that confirming receipt of the report would jeopardize the protection of the confidentiality of the complainant’s identity.
For their part, the Ombudsman or a public authority may ask the complainant, at their contact address, for clarification or additional information they may have in their possession. If the whistleblower objects or this could compromise the protection of the confidentiality of his or her identity, the
Ombudsman or a public authority shall refrain from requesting clarification or additional information.
Finally, the Ombudsman or a public authority shall, without undue delay, forward the information contained in the external report to the relevant institutions, bodies, offices or agencies of the European Union for follow-up, as provided for by such institutions, bodies, offices or agencies, where provided for in the relevant provisions.
What are the external reporting channels like?
This issue is regulated in Article 42 of the law. The communication channels adopted by the Ombudsman and a public authority for handling external reports should be independent of the communication channels used in the normal course of their activities.
In addition, they have to ensure data integrity, confidentiality and protection, including protection against access by unauthorized persons. Likewise, they must allow the information to be stored in a durable manner to enable subsequent research.
Other relevant issues regarding external complaints
The public authority shall, for each calendar year, prepare a report containing statistics on external complaints, including:
1) the number of external applications accepted;
2) the number of investigations and proceedings initiated as a result of accepted external complaints and the matrices on the results of such investigations;
3) estimated property damage, if any, and amounts recovered as a result of proceedings related to violations of the law that are the subject of the external complaint, if the public authority has such data in its possession.
In addition, the Ombudsman shall, on the basis of the reports of the public authorities, prepare a report for the calendar year in question and send it to the Sejm, the Senate and the European Commission no later than December 31 of the year following the year to which the report relates.
The report will be drafted on the Ombudsman’s website in the Public Information Bulletin.
The Council of Ministers, after consulting the Ombudsman, shall establish, by regulation, the model form for the report referred to in paragraph 1, taking into account the scope of the data required, the need to ensure that the information submitted is complete and transparent, and to simplify the aggregation of data.
How can the external complaint be made?
As provided in Article 48, the public authority shall include on its website, in the Public Information Bulletin, in a separate, easily accessible and implicit section and in a manner understandable to the complainant, in particular, information on:
1) the contact data enabling the external complaint to be made, in particular the postal address, e-mail address, address for electronic service, separate address for the electronic mailbox, Internet address where the form is located, or a telephone number, indicating whether conversations are recorded;
2) the conditions for the protection of the whistleblower;
3) the procedure to be followed in the event of an external complaint, including the form required to clarify the information that is the subject of the complaint or to provide additional information;
4) the deadline for feedback and the type and content of such feedback;
5) the confidentiality rules applicable to the external complaint.
What is the sanctioning regime and what are the penalties foreseen?
The penalties for not complying with the requirements of the regulations are regulated by article 54 of the law.
It states that anyone who, wishing another person not to make a report, prevents or significantly hinders that person from doing so, shall be subject to a fine, limitation of liberty, or
imprisonment of up to one year.
And if, in addition, violence, threats or deception against another person is used for this purpose, it shall be punishable by imprisonment for up to three years.
Likewise, anyone who retaliates against a whistleblower, a person assisting in the whistleblowing or a person associated with the whistleblower, shall be subject to a fine, restriction of liberty or imprisonment of up to two years. If the perpetrator of the act acts in a persistent manner, he shall be punished by imprisonment for up to three years.
Anyone who, contrary to the provisions of the Act, discloses the identity of the informant, of the person assisting in the report or of a person associated with the informant, shall be liable to a
fine, restriction of liberty or imprisonment of up to one year.
Whoever makes a complaint or a public disclosure knowing that there has not been a violation of the law, shall be subject to a fine, penalty of restriction of liberty or imprisonment of up to two years.
Whoever, being responsible for establishing the internal complaint procedure, contravenes the provisions of the Law, fails to establish it or establishes it in serious non-compliance with the requirements of the Law, shall be punished with a fine.
Set up your whistleblowing channel: If your organisation needs to comply with the Polish whistleblowing law, Trusty’s EU-compliant whistleblowing platform can have you operational in minutes. Learn more about the EU Whistleblowing Directive channel requirements.
Related reading: New Whistleblowing Law in Poland: Implications and Challenges for Polish Businesses and The vital role of whistleblowing channels in the fight against corruption.
Frequently asked questions
The Act of 14 June 2024 on the protection of whistleblowers (Ustawa o ochronie sygnalistów), published in the official gazette on June 24, 2024. It sets out who is protected, which entities must run an internal procedure, how reports are handled and the penalties for non-compliance.
Under Article 23, legal entities for which at least 50 persons perform gainful work on January 1 or July 1 of a given year. The threshold does not apply to entities active in financial services, products and markets, anti-money laundering and counter-terrorist financing, transport security and environmental protection.
Receipt must be acknowledged within 7 days, unless the reporter gave no contact address, and feedback must follow within 3 months of the acknowledgement. Before the procedure is adopted, the trade union or worker representatives must be consulted for at least 5 and at most 10 days, and the procedure enters into force 7 days after it is made known to staff.
Preventing or significantly hindering a report is punishable by a fine, restriction of liberty or imprisonment of up to one year, or up to three years where violence, threats or deception are used. Retaliation carries up to two years, or three if persistent. Disclosing a whistleblower's identity carries up to one year, a knowingly false report up to two years, and failing to establish a compliant internal procedure is punishable by a fine.
FROM 49 EUR PER MONTH
Trusty Whistleblowing: a reporting channel compliant with the EU Whistleblower Directive, live in minutes with no IT project. From 49 EUR per month, 7-day free trial.