EU member states, including Poland, are obliged to adapt their laws to the EU regulations. This also applies, without exception, to Directive (EU) 2019/1937 of the European Parliament and of the Council of 23 October 2019 on the protection of persons who report breaches of Union law, known as the EU Whistleblower Directive. The European Union has set a deadline of 17 December 2021 for its implementation. Despite the more than two years having passed, Poland has still not enacted appropriate regulations implementing the EU Whistleblower Directive.
The newly elected government has given the implementation of the EU Whistleblower Protection Directive high priority. The Polish Act on the Protection of Persons who Report Breaches of Law is expected to be passed in the first quarter of 2024. If this happens businesses employing at least 50 employees as well as all public-sector entities will be obliged to implement appropriate protective procedures in a relatively short time.
In addition, legal entities operating in the field of financial services, financial products and markets as well as anti-money laundering and countering the financing of terrorism, transport safety and environmental protection, will be required to establish an internal procedure for reporting breaches of law regardless of the number of people performing or providing work.
Who is a whistleblower?
A whistleblower is any person who reports irregularities in the functioning of a company. Therefore, a whistleblower is not only an employee of the entity to which the report relates, but also, for example, a former employee, intern, volunteer, partner, co-worker, person performing work or task for the entity – a contractor, subcontractor or supplier, practically almost every person who comes into contact with a given company.
What you can flag up to your employer?
Whistleblowers will be able to report breaches of law in areas such as transport safety, environmental protection, personal data protection, public health, food safety, or consumer protection. The employer may also state in its internal regulations that the breach of law may concern areas other than those listed in the Act, such as mobbing, discrimination or bribery. Employers are allowed some leeway in this regard.
Whistleblower under special protection?
Upon receipt of the report, the employer will not be able to take any retaliatory measures against a whistleblower (e.g. dismiss the employee or withhold their promotion due to the fact that they reported a branch of law or refuse to grant a salary rise). In addition, the employer is obliged to ensure the confidentiality of the reporting person’s data.
Whistleblowers will qualify for protection provided for in the regulations only if they had reasonable grounds to believe that the information subject to report or public disclosure was true at the time of reporting or making a public disclosure and that such information constituted a breach of law.
What does the enactment of the Whistleblower Act mean for employers?
The enactment of the Whistleblower Act will mean that employers covered by the provisions of the Act will be obliged to adopt regulations for reporting breaches of law, create reporting channels, keep a register of reports, and follow up by initiating investigation or internal enquiry.
The bill provides for three reporting channels. The first is the internal channel – created within the employer’s organisation. The second is an external channel through which a breach can be reported to the public authority. The last channel is a public disclosure through the internet, radio or television.
The legislator put the main emphasis on internal reporting. It will be the employer’s responsibility to provide employees with an appropriate internal reporting channel. Employees should be able to report irregularities orally, in writing (e.g. to a dedicated e-mail address) or using a specially prepared form. The regulations must also specify from whom (who can be a whistleblower) and by whom reports will be received.
Upon receipt of the report, the employer should follow-up to clarify the report. The report’s verification method should be specified in the regulations adopted by the employer.
In addition, the employer should prepare appropriate documents authorising persons to conduct investigations into the reported irregularities and ensure that the adopted solutions meet the requirements for the protection of whistleblowers’ personal data.
The employer should also keep a record of all reports.
When will the Whistleblower Protection Act come into force?
The draft law on whistleblowers is to be adopted by the Council of Ministers by 31 March 2024 at the latest. Therefore, the act should appear in the Journal of Laws within less than two months! The deadline for entry into force of the new regulations has been shortened to one month. This means that entities that are required to implement a whistleblower protection procedure and lawful reporting channels will only have one month to do so.
Of course, it cannot be ruled out that the draft law on whistleblowers will undergo further amendments, in which case the business should follow the legislative process on an ongoing basis.
