Whistleblower protection: Poland nears completion of EU Directive implementation

Implementation of the Directive on whistleblowers

Poland is the last country to implement Directive (EU) 2019/1937 of the European Parliament and of the Council of 23 October 2019 on the protection of whistleblowers. Accordingly, on 25 April 2024, the Court of Justice of the European Union ruled on the delay in implementing the provisions of the Directive and ordered Poland to pay a penalty of €40,000 per day from the date of the judgment until the adoption of national regulations on the protection of whistleblowers. Poland must also pay a lump sum penalty of €7 million.

Current stage of legislative work

The Sejm has adopted the Law on the Protection of Whistleblowers, the law is now being processed by the Senate, after which it will await the President’s signature and its publication in the Journal of Laws. The deadline for the law to enter into force has been set at three months, which could still be in 2024.

What are the main features of the Law on the Protection of Whistleblowers’ Rights?

The Act regulates the conditions of coverage and protection measures for persons who report or publicly disclose information about violations of the law (whistleblowers), as well as the rules for establishing an internal procedure for reporting information about violations of the law and taking follow-up action.

What are the obligations and to whom do they apply?

Entrepreneurs for whom at least 50 persons are gainfully employed (regardless of the basis of employment) will be required to implement a whistleblowing procedure and follow-up.

What violations of the law can whistleblowers report?

A violation of the law, under the Act, is an act or omission that is unlawful or intended to circumvent the law relating to, inter alia, labour law, corruption, public procurement, environmental protection, consumer protection, security of networks and ICT systems, protection of privacy and personal data; and constitutional freedoms and rights of man and citizen. Groups Private entities belonging to a group will be able to establish a common internal reporting procedure, provided that the activities performed comply with the Whistleblower Protection Act.

Requirements for the internal notification procedure

The Act introduces a number of requirements that an internal procedure should meet, including 1. the person authorised to receive internal reports; 2. the means by which a whistleblower may communicate internal reports; 3. the person authorised to take follow-up action; 4. the procedure for dealing with information on violations of the law reported anonymously; 5. the obligation to confirm to the whistleblower the acceptance of an internal report within 7 days of its receipt, unless the whistleblower has not provided a contact address; 6. the obligation to take, with due diligence, follow-up action; 7. a maximum time limit for providing feedback to the whistleblower, not exceeding 3 months from the date of acknowledgement of the internal report or, if no acknowledgement is provided, 3 months from the expiry of 7 days from the date of the internal report, unless the whistleblower has not provided a contact address; 8. clear and easily accessible information on how to make external reports to the Ombudsman or public authorities and, where appropriate, to European Union institutions, bodies or agencies.

Importantly, the procedure for internal reporting should be consulted with company trade unions or employee representatives.

Sanctions

If the entities obliged to establish an internal reporting procedure fail to establish it or establish it with a significant violation of the requirements of the Act on protection of whistleblowers, then the responsible persons may be punished with a fine of up to PLN 5,000. In addition, the Act penalises preventing or seriously obstructing whistleblowers from making reports, which can result in a fine of up to more than PLN 1 million, restriction of liberty or imprisonment, depending on the gravity of the violation.A