On 12 April 2022, the Ministry of Family and Social Policy published a new draft law on the protection of whistleblowers (the "Whistleblowers Act"), in which the authors partially addressed the demands made in the procedure of agreement and public consultation.

The following is a summary of the key changes from the October 2021 draft, which we wrote about in particular here .

A whistleblower anew

Following the model of the implemented Directive (EU) 2019/1937 of the European Parliament and of the Council of 23 October 2019 on the protection of whistleblowers (the "Directive"), the authors of the draft law abandoned the definition of a whistleblower as a person primarily in an employer-employee relationship within the meaning of Polish labour law.

The new definition of a whistleblower does not differentiate between the forms of work provided or the nature of the legal relationship between the whistleblower and the legal entity in which the irregularity was committed, if the whistleblower learned about the irregularity in a broadly understood context related to work (provision of services, performance of a function).

The change is not purely editorial and has important consequences for the legal position of whistleblowers and their access to intra-organisational whistleblowing tools, as discussed in more detail below.

Anonymous submissions outside the scope of the Act

The Directive left it up to member states to choose how to address whistleblowers who anonymously report violations of the law. The previous draft of the Whistleblowers Act delegated this issue further, subjecting it to the individual decision of the specific entities implementing whistleblowing procedures.

In the current wording, the drafters decided to completely exclude anonymous reports from the regime of the Whistleblowers Act. This means that both private entities and public bodies operating whistleblowing channels will be able to leave anonymous reports unprocessed. We note, however, that if the identity of a whistleblower who originally acted anonymously is subsequently disclosed, from that moment on he or she should be treated equally with other whistleblowers at least as far as protection against retaliation for his or her reporting is concerned and he or she will be entitled to analogous claims for any damage suffered in connection with the reporting.

Amendments concerning the prohibition of retaliation

The Act on Whistleblowers describes more broadly and precisely the prohibition of retaliatory actions against a whistleblower provided for in the Directive. The minimum requirements still derive from the Directive, but employers can expand this catalogue to include mobbing, discrimination, harassment and sexual harassment. The current wording of the Whistleblowers Act describes, among other things, the prohibition of actions involving any coercion, intimidation or exclusion, or the prohibition of causing "other intangible harm", including damage to reputation, especially on social media. Attempts or threats of such actions are also to be classified as retaliatory actions.

It should be noted at this point that the prohibition of such actions could already be derived from the wording of the Directive itself, but the drafters of the Polish act decided to make it more precise.

Making a notification may not give rise to:

• terminating, rescinding or terminating without notice a contract to which the whistleblower is a party, in particular regarding the sale or supply of goods or services,
• imposing an obligation or denying, restricting or withdrawing an entitlement, in particular a concession, permit or abatement,

unless the person who took such action proves that he or she had objective and duly justified reasons.

The new draft Whistleblowers Act has changed the rules concerning civil liability in connection with possible retaliatory actions. Under it, a whistleblower will be able to claim compensation from the employer or the other party to a legal relationship for retaliatory actions in the full amount. On the other hand, if it is the whistleblower who knowingly reports untrue information - the victim of such action will be able to seek compensation from the whistleblower in the amount of at least the average remuneration in the enterprise sector applicable on the date of reporting or public disclosure.

Internal notifications anew

In the new draft of the Whistleblowers Act, the following changes have been made to the Internal Procedure (previously the Internal Notification Rules):

• the internal procedure no longer includes follow-up action to verify information on infringements and the measures that may be taken if an infringement is detected;
• the Act no longer suggests voluntary indication of the types of infringements for which the employer would encourage them to be reported internally as the first step;
• it is indicated that the procedure may include the (optional) establishment of a system of incentives for using the internal procedure.

The notification channels have also been changed. Under the current draft, it will be possible to choose oral, paper or electronic means.

The rules on how to make a telephone or oral notification have been clarified. A telephone notification is to be documented in the form of:

• a searchable recording of the conversation, or
• a complete and accurate transcript prepared by the unit, person or entity responsible for receiving the reports.

A report made orally and over a non-recorded telephone line is to be documented using an accurate record of the conversation by the unit, person or entity responsible for receiving the report. The reporter has the right to check the correction and approve the transcript or the record of the conversation by signing it.

Direct meetings (at the whistleblower's request) with the whistleblower's consent should be documented in the form of a recording or minutes.

The obligation to implement an internal procedure will apply to private entities for which at least 250 persons provide work. It may be doubted whether this definition covers only "traditional" employees (employed under an employment contract) or also includes temporary employees and persons on civil law contracts. It should be noted here that the explanatory memorandum to the Act on Whistleblowers directly uses the term "employee" and thus seems to narrow this definition - this will undoubtedly need to be clarified at a later stage of legislative work.

The Whistleblowers Act sets a specific deadline for the consultation of the internal procedure - it is supposed to last between 7 and 14 days.

Data protection in connection with internal notifications

The new draft Whistleblowers Act regulates in more detail the issue of protection of personal data of a whistleblower. According to the new wording of the provisions, personal data and other information allowing to identify the whistleblower will be disclosed only if the whistleblower indicates so. It should be stressed, however, that the necessity to keep the whistleblower's identity confidential will not have an absolute character.

The new rules provide for a derogation from the need to keep a whistleblower's identity confidential when such disclosure is a necessary and proportionate obligation under Union or national law in the context of investigations or judicial proceedings carried out by national authorities, including for the purpose of ensuring the rights of defence of the reported person. One of the arguments in favour of such a solution is that the person against whom an accusation is made should also be protected. The risk of stigmatisation of the person concerned arises in connection with the acts alleged against him.

It is worth emphasising that the disclosure of a whistleblower's identity is subject to a number of safeguards, in particular the necessity to notify the whistleblower in writing or electronically about the planned disclosure of his identity together with an explanation of the reasons for such a decision, unless such a notification could jeopardise the related investigation or court proceedings.

Regulation (EU) 2016/679 of the European Parliament and of the Council of 27 April 2016 on the protection of natural persons with regard to the processing of personal data and on the free movement of such data and repealing Directive 95/46/EC (General Data Protection Regulation) ("GDPR"), includes in its scope of application personal data covered by the Whistleblowers Act. Therefore, a legal entity, the Ombudsman or a public authority processing data on the basis of the premise of Article 6(1)(e) GDPR will process data only to the extent necessary to fulfil the purposes of the Act, and personal data irrelevant to the analysis of the notification should not be collected or, if collected, should be deleted immediately.

The new draft Whistleblowers Act provides for certain exceptions from the information obligation regulated by the provisions of GDPR. As a rule, the legislator provides for a longer deadline for informing the data subject about the source of obtaining his/her personal data, i.e. not later than within 3 months from the date of completion of follow-up activities, provided that the provision of information about the source of data does not contradict the principles of personal data protection of the person who is the source of such information.

The new draft also introduces a statutory data retention period. Personal data processed in connection with the Ombudsman's acceptance of a notification will be retained for a period:

• 12 months from the date of transmission of the notification to the public authority competent for follow-up,
• whereas personal data processed in connection with the receipt of a notification and follow-up by a legal entity and a public authority will be kept for a maximum period of 15 months after the conclusion of the follow-up.

The new draft, however, still lacks a broader perspective on the protection of personal data of all parties involved in the process - for example, there are no solutions protecting the rights of the person accused of an infringement or protecting the data of witnesses. The draft also fails to answer the question of how to exercise the rights of persons whose data have been obtained under the whistleblower protection procedure.

Adjusted criminal penalties

An important change for entrepreneurs is the mitigation of criminal sanctions for violating the provisions of the Whistleblowers Act and their differentiation according to the gravity of a given violation.

In place of the previous uniform sentence of imprisonment of up to 3 years, the Whistleblowers Act provides for the following criminal jeopardy for each type of offence:

• obstructing a whistleblower making a notification - fine or restriction of liberty;
• obstructing a whistleblower by use of violence, threat or deceit - punishable by a fine, restriction of liberty or imprisonment for up to 2 years;
• taking a single retaliatory action against a whistleblower, a person associated with them or assisting them in making a report - punishable by a fine, restriction of liberty or imprisonment of up to 2 years;
• taking two or more retaliatory actions - imprisonment for up to 3 years;
• breach of the obligation to keep confidential the identity of the whistleblower, of a person associated with him or assisting in making a report - penalty of a fine, restriction of freedom or imprisonment of up to one year;
• knowingly making a false report - penalty of a fine, restriction of freedom or imprisonment for up to 3 years;
• failure to establish or establishment of a defective internal notification procedure - a fine.

Other substantial changes

In addition to systemic changes, the authors of the draft introduced new "spot solutions" to the Whistleblowers Act, which are presumably a response to questions raised in the course of public consultations. The most important of these include:

• Clarification of the distinction between private and public entities, which to a different extent are bound by obligations to establish internal notification channels. According to the new wording of the Whistleblowers Act, public entities are entities that meet the definition of an obliged entity (public sector entity) within the meaning of Article 3 of the Law on Open Data and Re-use of Public Sector Information.
• Clarifying that irregularities giving rise to a notification include, in addition to unlawful acts affecting the financial interests of the European Union, analogous infringements affecting the financial interests of the State Treasury.
• A clear indication that the whistleblower's identity may be disclosed without his or her consent - following written notice if possible - when necessary in the course of pre-trial or court proceedings, in particular when required to satisfy the reported person’s right of defence.

More time to prepare the organisation

As requested by representatives of the private and public sector giving their opinion on the draft, the transition period during which these entities will have the opportunity to prepare their organisation for the requirements of the Whistleblowers Act has been extended.

In the case of an obligation to adopt an internal procedure by:

• private entities for which at least 250 persons work;
• private entities active in the fields of financial services, products and markets, anti-money laundering and anti-terrorist financing, transport safety and environmental protection, as listed in the Whistleblower Directive, regardless of the scale of employment;
• public entities - regardless of the scale of employment,

these entities will have a total of 3 months to implement appropriate solutions in accordance with the procedure provided by the law.

As regards smaller private entities employing between 50 and 249 people, in turn, the previous 17 December 2023 deadline to adopt analogous procedures remains in force.