Reporting channels

The Act stipulates three possibilities through which a whistleblower can report:

• Internal channels (within the company/entity)

• External channels (such as to an Ombudsman, or to the relevant public authorities)

• Public disclosure (e.g. reporting in the press)

Employers that employ at least 50 individuals are required to establish an internal channel for notifications. This number of 50 individuals includes employees (calculated on a full time basis), but also individuals providing work on a basis other than an employment contract, including on the basis of a private law contracts, in particular, a mandate contract and a B2B contract.

The internal channel should address the following:

• the internal organisational unit or person within the legal entity's structure, or an external entity authorised to receive internal reports,

• the communication methods for reporting internally,

• the unit or person within the legal entity's structure authorised to take subsequent action,

• the procedure for handling anonymous notifications,

• the obligation to confirm the acceptance of the internal notification to the whistleblower within seven days of its receipt,

• the obligation to take subsequent action,

• the maximum time limit for providing feedback to the whistleblower (not exceeding three months),

• clear and easily accessible information as to how to make external reports to an Ombudsman or to public authorities and, where applicable, to European Union institutions, bodies or organisational units.

Who is a whistleblower?

A whistleblower is an individual who reports irregularities obtained in connection with a work-related context.

The catalogue of individuals who can become whistleblowers is broad and includes employees, temporary employees, people providing work on a basis other than an employment relationship including on the basis of a private law contract or a B2B contract, entrepreneurs, proxies, shareholders, partners, members of a body of a legal entity, interns and volunteers.

What can a whistleblower report?

The subject of a whistleblower notification can be violations of the law, or unlawful activities concerning, among other things:

• Anti-money laundering

• Services, products, and financial markets

• Corruption

• Protection of customers

• The internal market of the European Union

• Protection of privacy and personal data

• Public procurement

• Product safety and compliance with requirements

Consultations

The implementation of an internal notification procedure has to be consulted with the company's trade union, or with the representatives of individuals working for an employer if there are no trade unions within the company.

Prohibition of retaliation

The Act introduces a prohibition on retaliation which means that, among other things, the following actions against a whistleblower will be prohibited:

• Terminating an employment contract or failing to renew one where the whistleblower had the reasonable expectation that one would be signed

• Intimidation or exclusion, mobbing, discrimination, or unfair treatment

• A reduction in salary, or a failure to receive an expected promotion

• A negative performance appraisal

Penalties

An employer who, despite the obligation to establish an internal reporting channel, fails to do so or establishes an internal reporting channel that does not comply with the Act - is liable to a fine.

The Act stipulates the criminal sanctions for preventing or obstructing a whistleblower, retaliating against a whistleblower, revealing the identity of a whistleblower, as well as making false reports. The penalties for the aforementioned acts state fines, a restriction of liberty, or detention sentences of up to three years.

Data protection

The Act states certain obligations related to the protection of personal data collected in the course of the reporting process, in particular with respect to the non-disclosure of personal data, the obligation to keep personal data for certain periods and to delete said data after retention periods have expired, the exclusion of the obligation to provide information about the source of the data to data subjects (with certain exceptions), or the obligation to maintain the confidentiality of personal data collected within the internal reporting channel.

Practical consequences

The obligation to open the possibility to report suspected infringements of law within an organisation will be a new phenomenon in Poland, especially for medium-size companies and public bodies. This will inevitably trigger a large number of notifications and each such report would need to be scrutinized in detail. In some instances this will require starting a fully-fledged internal investigation, sometimes involving the application of dedicated forensic technology and interviews with employees or business partners.

This in turn will create many new legal challenges, e.g. with regard to the processing of personal data and its protection, or potential interference with competition law issues or proceedings, in particular with leniency applications which in Poland can be submitted not only by companies, but also by managers (former or present) acting on their own account.

Therefore, the Act on the protection of whistleblowers not only requires the implementation of internal notification procedures, but above all the preparation of an entire organisation to handle more complex and more serious cases with the appropriate due diligence.