The draft Whistleblower Protection Act (document no. UC 101) implements the European Parliament and Council Directive (EU) 2019/1937 of October 23, 2019, on the protection of persons who report breaches of Union law (Official Journal of the EU L 305 of November 26, 2019, p. 17). This is the so-called Whistleblower Directive.

As of the time of writing this article, more than a year has passed since Poland was required to implement the EU Whistleblower Directive into national law (the deadline was set for December 17, 2021). Importantly, on February 15, 2023, the European Commission referred the case against Poland to the Court of Justice of the European Union for failing to adopt the necessary legislation.

Why is this important? Member States, according to the directive, must ensure that whistleblowers in both the public and private sectors have effective channels for confidentially reporting breaches of EU laws. In addition, there is a need to establish a robust system of protection against retaliatory actions, such as termination of employment, denial of promotion, or reduction in the whistleblower’s salary. This applies to both internal (within the organization) and external (to relevant public authorities) reports.

• The whistleblower reports an external violation to the public authority responsible for the area related to the report, e.g., consumer protection issues should be reported to UOKiK.
• In case of difficulty identifying the appropriate public authority, the whistleblower can submit the report to the National Labour Inspectorate (PIP), which will forward it to the relevant entity.
• Unregulated external reports will be handled under the Code of Administrative Procedure (KPA).
• The list of authorities accepting external reports includes the Police and the Prosecutor’s Office. Reports of suspected crimes should be directed to regional police commanders. Reports concerning breaches of EU interests will be directed to the Prosecutor’s Office.
• Internal reports can be directed to regional chambers of audit.
• Whistleblowers can request a certificate confirming their status as a whistleblower.
• Obstructing a report and retaliatory actions are punishable by criminal sanctions – a fine, restriction of liberty, or imprisonment for up to two years.
• Entities accepting reports are required to store personal data related to the report for 15 months.

The Whistleblower Protection Act covers violations of laws related to public procurement, services, products, and financial markets; product safety and compliance with requirements; transport safety; environmental protection; animal health and welfare, and more. A whistleblower can be any individual who reports or publicly discloses information about a violation of the law obtained in the context of their work, such as an employee, partner, or a member of the armed forces or services.

The content of the Whistleblower Protection Act can be found here: Draft Act on the Protection of Persons Reporting Violations of the Law.

Five versions of the draft Whistleblower Protection Act have been published on the Government Legislation Centre’s website within one year. The draft law is expected to come into force two months after its announcement for entities employing over 249 people, while for those employing between 50 and 249 people, it will be implemented by December 17, 2023.

Unfortunately, the final version of the Polish law is still not available, but we can observe a speeding up of the legislative process. Interestingly, the version from December 20, 2022, was marked as the final draft, but after numerous critical comments, the legislator decided to make further changes, and just a month later, another version was released. The draft from January 10, 2023, has now received a recommendation from the Committee for European Affairs for further work, which is a positive signal.

While we still do not know the exact date of the law’s entry into force, we do know that the whistleblower regulations impose several new obligations on companies, which is why Polish entrepreneurs are closely monitoring further updates to the draft. It is important to be familiar with not only the assumptions of the draft itself but also the assumptions of the EU directive.

Important: Polish companies should not wait passively for the legislation of the Whistleblower Protection Act. This is the perfect time to prepare the organization for the new obligations and requirements of the law.

Although the draft law is still in the process of being created, the assumptions of the upcoming regulations are already known. This means that Polish companies do not have to wait for the Polish law and can (or rather should) start preparing now. This is important because it allows valuable time to be gained, which can be used to implement the necessary solutions enabling whistleblowers to report violations.

Let us remind you that the main assumption of the draft law includes the creation of a confidential reporting channel for violations. This is related to the designation of a person responsible for verifying reports, adhering to deadlines (for example, the confirmation of receipt of a report should take place within seven days from its receipt); the obligation to inform about the status of the report, keeping a register of reports, and also creating a procedure that will allow and facilitate the initiation of an investigation into violations. We should not forget to create and implement a reporting regulation.

As can be seen, the obligations placed on the employer are quite well defined, especially if we follow the provisions of the EU directive itself. Although some companies already have confidential channels for anonymous reporting, the whistleblower protection law often requires them to be updated and adjusted to the new reality. How can you ensure compliance with the requirements? The best approach is to entrust the matter to external experts who will create the appropriate system – this is what we do at PBSG. Below, we present the scope of work to prepare the organization for the implementation of whistleblower protection systems within the company.

• Analysis and assessment of the existing procedures, tools, and documentation within the organization regarding the reporting of irregularities.
• Creation of new procedures and internal reporting channels, including the reception and verification of reports.
• Assistance in adapting current tools to new requirements and in implementing reporting procedures for violations within the organization.
• Automation of processes using modern software such as erisk for comprehensive risk management. This tool can be successfully used for handling internal violation reports.
• Training of employees and management on the requirements of the directive. Increasing their awareness of responsibilities and procedures for handling reports.

In addition to consulting services that include analysis, procedure creation, and implementation along with automation, we also offer expert workshops that will prepare companies for new obligations and help implement the correct procedures. The workshops are held within the ERM Zone, and participation in them is free of charge.