A new Polish draft law has officially introduced "the whistleblower"

A new comprehensive analysis by Marta Trzeciak and Karolina Misiak, solicitors at Ostrowski i Wspolnicy Law Firm, delves into the recent revisions of the Polish draft law on Whistleblowers, shedding light on key amendments and highlighting areas requiring further enhancement. Their evaluation provides a detailed examination of the latest developments in whistleblower protection legislation in Poland.

On March 6, 2024, the Ministry of Family, Labour, and Social Policy in Poland introduced a new bill. One notable change is the revised title of the bill. Previously known as the Law on the Protection of Individuals Reporting Violations of the Law, it is now simply named the Law on the Protection of Whistleblowers. This adjustment marks a positive development by simplifying the terminology and solidifying the term “whistleblower.” However, this alteration is primarily cosmetic. What substantial modifications have been incorporated into the latest version of the draft?

The draft legislation has been submitted to the Standing Committee of the Council of Ministers for prompt review. Notably, a similar request for expedited consideration was made in January 2024. During that period, numerous stakeholders advocated for significant revisions to the content of the draft. Responding to these calls for change, the Ministry engaged in discussions in February with various stakeholders, including representatives from different ministries and the authors of the social draft law, such as the Stefan Batory Foundation. The outcome of these consultations is the recently published draft legislation.

Key revisions in the latest Polish draft law on whistleblowers

1. Expanding the range of infractions

The primary aim of the legislation is to clearly delineate the specific areas in which whistleblowers can disclose information. Previous versions of the law featured a catalogue that closely mirrored the one outlined in the Directive. This catalogue encompassed infringements related to topics such as public procurement, services, financial products and markets, and consumer protection. The only inclusion by the Polish legislators was reports of violations concerning the financial interests of the State Treasury of the Republic of Poland or a local government entity.

The most recent iteration of the bill broadens this scope to encompass additional areas. Whistleblower reports can now pertain to: human rights and freedoms, citizen affairs, corruption, human trafficking, and labour laws.

Expanding the range of subjects covered by the Act signifies a noteworthy change with substantial implications. Particularly, the addition of labor law violations is likely to capture the attention of employers, potentially leading to an increase in whistleblower reports, particularly regarding incidents of bullying or discrimination. Violations concerning freedoms and rights, as well as human and civil rights, have the potential to be widely interpreted. In practice, one can anticipate that any disclosures not falling under the other specified categories will fall under this expanded scope.

2. The moment the whistleblower is granted protection

The newly introduced bill clearly outlines that a whistleblower receives protection starting from the moment of notification or public disclosure. Moreover, the explanatory memorandum of the bill clarifies that the specific date of receiving the report will hold no significance in this regard.

3. Handling of anonymous submissions

In the initial January draft, the regulation concerning anonymous submissions was lacking, with the discretion for a legal entity to accept or reject such submissions vaguely presented only in the bill’s explanatory memorandum, creating considerable uncertainty on the matter.

In the most recent draft, it is expressly stated that a legal entity has the choice to accept or decline anonymous reports. Defining the protocol for addressing anonymous reports has been made a compulsory component of the internal reporting procedure. The draft legislation further specifies that if a violation report is submitted anonymously:

• If a legal entity chooses to accept such notifications, the provisions of the Act will be applicable, with minor exceptions.
  
  
• If a legal entity opts not to accept anonymous notifications, the provisions will not be enforceable.
  
  

This clarification now definitively places the decision regarding anonymous submissions in the hands of the legal entity. This is a necessary modification that brings much-needed clarity to the realm of anonymous reporting within the Act.

4. Minimum compensation for retaliation against whistleblowers

In the latest draft of the legislation, the lawmakers have made it a point to explicitly define a minimum level of compensation that whistleblowers are entitled to in cases of retaliation against them.

Previous versions of the drafts simply mentioned that the whistleblower should receive compensation “in full.” However, the current iteration of the Act specifies that in such instances, the whistleblower is guaranteed compensation at a rate no less than twelve times the average monthly salary within the national economy in the preceding year. This figure is to be officially published for pension purposes in the Official Journal of the Republic of Poland, known as ‘Monitor Poland,’ by the President of the Central Statistical Office. This specified average is to be effective from the second quarter of each year and is applicable for a duration of one year. The compensation is intended to address any financial losses suffered by whistleblowers as a result of their courageous actions.

5. Threshold of 50 individuals

In the previous version of the draft law, legal entities were mandated to accept internal reports if “at least 50 persons perform or provide work” within the organization.

The most recent draft offers further clarification on this matter: the requirement to accept internal disclosures will now extend to legal entities where ‘at least 50 persons are engaged in paid work as of 1 January or 1 July of a given year’.

• Consequently, this adjustment will necessitate monitoring the employment status twice annually, precisely on 1 January and 1 July.
  
  
• The term ‘persons engaged in paid work’ appears to carry a more specific connotation than ‘persons performing or providing work’.
  
  
• Moreover, the bill specifies how this numerical threshold should be calculated: “The count of 50 individuals engaged in paid work for a legal entity includes both employees in full time equivalent units and individuals performing work under arrangements other than employment relationship, without those engaging others for such tasks, regardless of their employment status.”
  
  

However, despite the refinements such as changing the language from ‘persons performing or providing work’ to ‘persons engaged in paid work’ and enhancing the precision of the counting criteria, the practical challenge of determining the 50-person threshold remains unresolved. Ambiguities may persist in practice concerning whom to include in this count, such as temporary employees or partners.

6.  Extension of the Vacatio Legis in the Polish whistleblower protection law

The vacatio legis of the Act has undergone numerous revisions throughout the development of the Whistleblower Protection Act. The evolution of the entry into force of the Act has been marked by a series of adjustments, making it challenging to condense the details into a brief summary. Recent modifications have focused on prolonging the vacatio legis period.

In the initial January draft, it was proposed that the Act would become effective one month after its promulgation, with an additional timeline set for the implementation of an internal reporting procedure, which was required to be established within one month of the Act coming into force. This setup allowed for a total grace period of two months to establish the necessary procedure following the publication of the Act in the Official Gazette.

The most recent iteration of the Bill suggests that the provisions of the Act will be enforced three months following its promulgation. Notably, the sections concerning external notifications are slated to go into effect six months after the Act’s promulgation.

The decision to extend the vacatio legis period garners a favorable assessment. However, it is recommended that a uniform deadline be established to ensure consistency across internal and external notification requirements. Although a three-month grace period represents a significant extension compared to previous iterations, it is worth noting that some earlier versions of the legislation had astonishingly short vacatio legis periods, with one specifying a mere 24-hour window for the implementation of internal notification procedures after the law’s promulgation.

Enhancing personal data protection provisions in the new Polish whistleblower draft law

Conversely, the latest iteration of the whistleblower law fails to reflect the advancements made in the realm of personal data protection. We have consistently emphasized the need to enrich the provisions of previous drafts to fortify the safeguarding of both whistleblowers and individuals affected by the disclosures. This sentiment was echoed by the President of the Protection of Personal Data in a communication dated February 24, 2024, stressing the importance of integrating key facets of personal data protection into the new draft. Specifically, the President highlighted the following considerations:

• Specify in the draft the extent of personal data required to identify the whistleblower and the implicated party
  
  
• Define within the provisions of the proposed Act (as opposed to internal regulations of entities) the legal foundation for processing personal data, outlining the purpose, scope, and method of data processing
  
  
• Clarify the constraints of information disclosure to data subjects by excluding the necessity to divulge the data source in compliance with Article 14(2)(f) of the General Data Protection Regulation (RODO) and to refrain from fulfilling the data subject’s request under Article 15(1)(g) of Regulation 2016/679 that demands all available information on the data source
  
  
• Establish safeguards in the law to uphold the rights of additional individuals whose data is involved in a whistleblowing report, and introduce a legal definition for “third party identified within the report”
  
  
• Standardize the data retention period for personal data maintained by the Ombudsman
  
  
• Authorize an external entity to receive internal reports
  
  
• Revise Article 28(2) of the Bill to enable an external entity to act on behalf of the administrator per the proposed provisions
  
  

Regrettably, the aforementioned concerns have not been integrated into the most recent draft of the whistleblower bill. Consequently, there remains an imperative to enhance the clauses pertaining to personal data protection, a matter of paramount significance for both whistleblowers and those impacted. The legislation is explicitly devised to prevent reprisals against whistleblowers, underscoring the critical need to safeguard their data. Addressing these critical aspects also bolsters the integrity of investigations triggered by the filing of a report.

Our evaluation

Based on the Ministry’s declarations, we were anticipating more extensive revisions to the bill, a comprehensive revamp. However, the current version includes only a few or perhaps a dozen alterations. Consequently, the most recent draft engenders a sense of dissatisfaction, as many of the recommendations provided on the earlier version of the Act have not been incorporated. Still pending are issues such as operating within capital groups and concerns pertaining to the specifics of the internal reporting procedure, which are likely to pose challenges during its proper formulation.

Ostrowski i Wspolnicy Law Firm will continue to closely monitor the developments concerning the legislation on whistleblower protection in Poland. We encourage you to stay informed by following our blog, where we provide regular updates on the progress in this domain.

Want to know more? Keep reading the Whistlelink blog to find out more about the latest news and corporate best practices!

Would you like to learn more about a whistleblowing service and safe internal reporting channels? You can learn more about Whistlelink’s all-in-one solution here or book a free demo of our system!