Reporting Channels

The draft bill stipulates three possibilities through which a whistleblower can report:

• Internal channels (within the company/entity)
• External channels (such as to an Ombudsman, or to the relevant public authorities)
• Public disclosure (e.g. reporting in the press)

Entities (both private companies and public bodies) that employ at least 50 individuals will be required to establish an internal channel for notifications of any violations of the law.

This number of 50 individuals includes not only employees, but also individuals employed on a basis other than an employment contract, for example a B2B contract.

The internal channel should address the following:

1. the internal organisational unit or person within the legal entity's structure, or an external entity authorised to receive internal reports,

2. the communication methods for reporting internally,

3. the unit or person within the legal entity's structure authorised to verify the notification,

4. the procedure for handling anonymous notifications,

5. the obligation to confirm the acceptance of the internal notification to the whistleblower within seven days of its receipt,

6. the obligation to take subsequent action,

7. the maximum time limit for providing feedback to the whistleblower (not exceeding three months),

8. clear and easily accessible information as to how to make external reports to an Ombudsman or to public authorities and, where applicable, to European Union institutions.

Who is a whistleblower?

A whistleblower is an individual who reports irregularities related to the functioning of a company.

The catalogue of individuals who can become whistleblowers is broad and includes employees, temporary employees, people providing work on a basis other than an employment relationship including on the basis of a private law contract or a B2B contract, entrepreneurs, proxies, shareholders, partners, members of a body of a legal entity, interns, and many others.

What can a whistleblower report?

The subject of a whistleblower notification can be violations of the law, or unlawful activities concerning, among other things:

• Employment law
• Services, products, and financial markets
• Corruption
• Protection of customers
• The internal market of the European Union
• Protection of privacy and personal data
• Public procurement
• Product safety and compliance

Consultations

The implementation of an internal notification procedure has to be consulted with the company's trade union, or with the employee representatives if there are no trade unions within the company.

Prohibition of retaliation

The draft bill introduces a prohibition on retaliation against a whistleblower which means that, among other things, the following actions against a whistleblower will be prohibited:

• Terminating an employment contract or failing to renew one where the whistleblower had the reasonable expectation that one would be signed
• Intimidation or exclusion, mobbing, discrimination, or unfair treatment
• A reduction in salary, or a failure to receive an expected promotion
• A negative performance appraisal

Penalties

The draft bill stipulates the criminal sanctions for preventing or obstructing a whistleblower, retaliating against a whistleblower, revealing the identity of a whistleblower, making false reports, or failing to establish an internal reporting procedure or establishing one in violation of the law. The penalties for the aforementioned acts state fines, a restriction of liberty, or detention sentences of up to three years.

Data protection

The draft bill states certain obligations related to the protection of personal data collected in the course of the reporting process, in particular with respect to the non-disclosure of personal data, the obligation to keep personal data for certain periods and to delete said data after retention periods have expired, the exclusion of the obligation to provide information about the source of the data to data subjects (with certain exceptions), or the obligation to maintain the confidentiality of personal data collected within the internal reporting channel.

Practical consequences

The obligation to open the possibility to report suspected infringements of law within an organisation will be a brand new phenomenon in Poland, especially for medium-size companies and public bodies. This will inevitably trigger a large number of notifications and each such report would need to be scrutinized in detail. In some instances this will require starting a fully-fledged internal investigation, sometimes involving the application of dedicated forensic technology and interviews with employees or business partners.

This in turn will create many new legal challenges, e.g. with regard to the processing of personal data and its protection, or potential interference with competition law issues or proceedings, in particular with leniency applications which in Poland can be submitted not only by companies, but also by managers (former or present) acting on their own account.

Therefore, the new law on the protection of whistleblowers not only requires the implementation of internal notification procedures, but above all the preparation of an entire organisation to handle more complex and more serious cases with the appropriate due diligence.

The new regulations will come into force three months after their publication in the Journal of Laws. The provisions on external reporting, on the other hand, will come into force six months after their publication.