Updated: 21.10.2024
The Polish Parliament finally passed the Whistleblowers Protection Act of June 14,2024 that comes into force on September 25,2024.
Whistleblower provisions finally implemented into Poland’s legal order
By September 25, 2024 employers with at least 50 hired people or operating in certain sectors i.e. financial services, products and markets and counteracting money laundering and terrorism financing, transport safety and environmental protection, are required to implement a whistleblower notification procedure.
So-called external notifications, according to new law must be implemented by December 25, 2024. The Polish Act is an implementation of Whistleblower Directive 2019/1937, that Poland should have implemented until December 16, 2021.
An obligation to assess the state of employment level twice a year
Employers are obliged to assess the state of employment level twice a year – on January 1 and July 1.
If they hiring 50 people (we count in: employees employed under an employment contract converted into full-time equivalents, persons employed under a mandate contract and persons employed under B2B contracts if they personally provide the services), they have to implement whistleblower notification procedure.
Ministry provides a different deadline for implementing internal procedures for whistleblowers – which term is binding?
In a statement released on August 6, 2024, the Ministry of Family Affairs, Labor and Social Policy, at the request of “Dziennik Gazeta Prawna”, clarified that employers have been granted an extended timeframe to implement internal reporting procedures in the workplace.
The Ministry said that the deadline for implementing the procedures does not expire on 25 September 2024, the date on which the whistleblower law comes into force. The Ministry of Family, Labour and Social Policy has indicated that the deadline for implementing the procedures is 1 January 2025, as this is when employers will be able to assess their employment status for the first time and determine whether they are required to implement the procedure in their organisation.
We note, however, that the Ministry’s interpretation is not a source of universally applicable law, and the deadline resulting directly from the Whistleblower Act is 25 September 2024. There is therefore a risk that if an employer complies with this later deadline, i.e. 1 January 2025, it will be considered an offence.
Whistleblowing system in Poland – key facts
| Employers obliged to introduce whistleblowing procedures | All employers over 50 people (this limit includes: employees employed under an employment contract converted into full-time equivalents, persons employed under a mandate contract and persons employed under B2B contracts if they personally provide services);
entities operating in the field of financial services, products and markets, as well as anti-money laundering and countering the financing of terrorism, transport safety and environmental protection, regardless of the number of people performing work |
| Deadline to introduce whistleblowing procedures | Employers 50+ hires, entities operating in the field of financial services, products and markets, as well as anti-money laundering and countering the financing of terrorism, transport safety and environmental protection – until September 25,2024 |
| Definition of whistleblower | an individual who reports or publicly discloses information about a violation of law obtained in a work-related context |
| Subject of reports: | Whistleblowing can be reported in the following areas: 1) corruption; 2) public procurement; 3) financial services, products and markets; 4) anti-money laundering and terrorist financing; 5) product safety and compliance; 6) transport safety; 7) environmental protection 8) radiological protection and nuclear safety; 9) food and feed safety 10) animal health and welfare; 11) public health 12) consumer protection 13) protection of privacy and personal data; 14) security of information and communication networks and systems 15) financial interests of the State Treasury of Poland, local government unit and the European Union; 16) the internal market of the European Union, including the public law principles of competition and state aid as well as corporate taxation; 17) constitutional freedoms and rights of a human being and a citizen – occurring in the relations of an individual with public authorities and not related to the areas indicated in the preceding points. |
| Prohibition of retaliation | Prohibition of any direct or indirect act or omission in a work-related context which is occasioned by a report or public disclosure and which infringes or is likely to infringe the rights of the whistleblower or causes or is likely to cause unjustified harm to the whistleblower |
| Acceptable forms of reporting violations: | Oral, written and electronic (e.g. Whistlelink) |
| Minimum requirements of the internal procedure: | 1) identification of the internal organisational unit or person authorised to receive internal reports; 2) modalities for internal whistleblowing by the whistleblower; 3) the procedure for dealing with anonymous reports if the entity chooses to deal with them 4) the obligation to acknowledge to the whistleblower the receipt of an internal report within 7 days of its receipt 5)the obligation to follow-up, with due diligence, with the internal organisational unit or person authorised to deal with reports 6) a maximum deadline for feedback to the whistleblower, not exceeding 3 months 7)comprehensible and easily accessible information on how to make external reports to the Ombudsman or public institutions |
| Anonymity | It is possible to accept and deal with reports from anonymous whistleblowers, but only if the entity concerned decides to do so and defines in the procedure how to deal with such reports. |
| Prohibition of retaliation | Prohibition of any direct or indirect action, or omission in a work-related context, which is caused by an internal report or public disclosure and which violates, or is likely to violate, the whistleblower’s rights, or causes, or is likely to cause, unwarranted harm to the whistleblower. Retaliation could be, for example, termination of employment, being overlooked for a raise or not being promoted. |
| Retention period | The data retention period is 3 years from the end of the calendar year in which the follow-up action was closed. |
Whistleblower
Definition: Whistleblower / Poland
The whistleblower upon the Act shall be understood as a natural person who reports or publicly discloses information about a violation of the law obtained in a work – related context; whistleblower can be, among others:
- an employee,
- a person providing work on a basis other than an employment relationship, including on the basis of a civil law contract,
- also a job applicant.
Anonymous whistleblowers (anonymous reporting)
The Act also protects anonymous whistleblowers. However, entities obliged to introduce internal whistleblowing procedure may decide if they are going to admit anonymous reports and how such reports would be processed.
Retaliation and liability
Prohibition of retaliation against a whistleblower
The Act extends the prohibition of retaliation to include attempts or threats to use such actions. The catalog of prohibited activities remains open – the act sets only the minimum, which has been extended to termination of employment contract or another contract, lowering remuneration, omitting in promotion, transfer to lower position, change of the place of work, coercion, intimidation, exclusion, mobbing, discrimination, harassment, causing financial loss, as well as causing other non-material damage, including reputational damage, especially in social media.
What is important, an employer is the one to prove that given action towards the employee is not a retaliation.
Whistleblowing and liability
A whistleblower against whom retaliatory actions have been committed is entitled to compensation in an amount not lower than the average monthly remuneration in the national economy in the previous year.
On the other hand, a person who has suffered damage due to the conscious reporting or public disclosure of false information by a whistleblower is entitled to compensation or compensation for violation of personal rights from the whistleblower who made such a report or public disclosure.
Who has the burden of proving retaliation?
In the event of taking any action described in the Whistleblowers Protection Act, or any other action taken by the employer that could potentially be acknowledged as retaliation, it is presumed that this is a retaliatory action. It is employer’s obligation to prove that the actions were taken for objective and duly justified reasons.
Whistleblowing procedure
What is the whistleblowing procedure?
The employer’s main obligation under the Whistleblower Protection Act is to develop an internal whistleblowing procedure and follow-up. An internal whistleblowing procedure is nothing more than a legal act adopted by an entity that establishes rules for accepting and dealing with internal whistleblowing in an organisation, e.g. a company. The rules adopted in an internal reporting procedure should meet the minimum statutory requirements for the content of such a document.
Mandatory consultation of the whistleblowing procedure
The implementation of the whistleblowing procedure requires consultation with trade unions or employee representatives who will represent both employees and contractors. The Act introduces the principle of consultation for a period of not less than 5 days and not more than 10 days.
Form of whistleblowing (reporting channels)
The Whistleblower Protection Act provides that internal notification may be made orally, in writing or electronically. An employer may have a dedicated automated line, email address or tool through which a whistleblower can notify a breach.
Our law firm has chosen the Whistlelink platform as its partner . Whistlelink is a secure tool for advanced breach reporting. Whistlelink offers secure, two-way communication with the whistleblower and is fully GDPR compliant. Importantly, the reporting channel can be customised to the user – in terms of features, interface, language, etc. A major advantage of the platform is that the system takes over certain responsibilities incumbent on entities, e.g. confirming to the whistleblower the acceptance of the report, which the application sends automatically.
We receive a notification from a whistleblower – what next?
An internal procedure should specify in a clear and transparent way what the procedure for handling notifications is. Amongst other things, the procedure should specify who is responsible for the receipt and initial verification of reports, whether it is permissible to handle anonymous reports, and what follow-up actions may be taken in case of a positive initial verification of a report.
The whistleblower should be informed about the acceptance and follow-up of the report, as well as the results of the investigation.
Protection of whistleblowers’ personal data
The Law on the Protection of Whistleblowers indicates that the whistleblower’s data, including his or her identity, is subject to strict personal data protection. Any detailed information enabling the identification of the whistleblower is also protected.
An exception to this rule is a situation where disclosure of the identity of the whistleblower is required by law in the context of proceedings conducted by public authorities. Disclosure of the whistleblower’s identity requires informing the whistleblower and explaining the reasons for disclosure.
Personal data processed in connection with the acceptance of a report shall be retained for a period of up to 3 years after one year from the date of completion of the follow-up action.
Incentives for whistleblowers
The Whistleblowing System Act indicates that the internal procedure put in place by the obliged entity may additionally set out a system of incentives for the use of the internal procedure.
This is not an obligatory element and its introduction and method of implementation are left to the discretion of the employer. The purpose of such a regulation is to avoid taking information about violations ‘outside’ the organisation and to encourage whistleblowers to report violations internally.
Archiving of reports
Each entity is obliged to keep an internal register of whistleblowing and to administer the data contained in the register. Such register should contain the number of the report, the subject of the breach, the personal and contact details of the whistleblower, the date of the report, information on follow-up actions taken and the date of closure.
Retention period for whistleblower reports
The mandatory retention period for the internal whistleblower register is 3 years after the end of one year from the date of closure of the follow-up action.
Criminal sanctions
The Whistleblower Protection Act introduces criminal liability sanctions for violating the law, e.g.:
- failure to establish an internal procedure or incorrect establishment of a procedure – a fine,
- committing retaliatory actions – fine, restriction of liberty up to 2 years, imprisonment up to 2 years,
- obstructing or attempting to obstruct reporting or public disclosure – a fine from 500 PLN to 1.080.000 PLN, restriction of liberty up to 2 years, imprisonment up to 1 year.
FAQ – Whistleblowing in Poland
What is the penalty for failure to implement whistleblower procedures?
Failure to establish whistleblowing procedures in a timely manner is punishable by a fine.
Who is required to implement whistleblowing procedures?
Any employer who employs over 50 people (includes: employees employed under an employment contract converted into full-time equivalents, persons employed under a mandate contract and persons employed under B2B contracts if they personally provide services) and entities operating in the field of financial services, products and markets, as well as anti-money laundering and countering the financing of terrorism, transport safety and environmental protection, regardless of the number of people performing work.
What is the deadline for implementing whistleblowing procedures in Poland?
Employers employing 50 + employees, entities operating in the field of financial services, products and markets, as well as anti-money laundering and countering the financing of terrorism, transport safety and environmental protection – until September 25, 2024.
Who is a whistleblower within the meaning of Polish law?
A natural person who reports or publicly discloses information about a violation of the law obtained in a work – related context, including, among others: an employee, a person providing work on a basis other than an employment relationship, including on the basis of a civil law contract, also a job applicant.
Is the employer obliged to consider the anonymous report of the whistleblower?
It is not mandatory, unless the entity decides to proceed anonymous reports.
What incentives for whistleblowers are mandatory?
The Polish whistleblowing act does not provide for mandatory incentives.
What forms of whistleblower reports are allowed?
Written, oral and electronic form- each reporting channel shall be secure and GDPR compliant.
How should reports be archived?
Entity introducing whistleblowing procedure is obliged to establish and manage internal reports register.
How long should whistleblower reports be kept?
3 years after the end of the year from the date of completion of the follow-up activities.
