The Whistleblower Protection Act has been published in the “Journal of Laws” on Monday, 24th June. Therefore, we know the final shape of these regulations. The three-month deadline for implementing the internal procedure also runs from Monday.
The scope of the violation of the law reported by the whistleblower was reduced at the last minute by the provisions of the labor law. This means that the Act ultimately applies to violations of the law in the field of, among others: corruption, public procurement, AML, product safety and compliance, environmental protection, food safety, consumer protection, protection of privacy and personal data, financial interests of the State Treasury, local government units and the European Union, or the internal market of the European Union, including public-law corporate taxation.
It is worth noting that a whistleblower within the meaning of the Act is not only an employee, but also a person cooperating under a civil law contract, B2B, or a member of a body. Under certain circumstances, a job candidate may also be a whistleblower.
The basic principle of the Act is that no retaliation or attempts or threats of such actions may be taken against the whistleblower, and their identity should be duly protected.
From a practical point of view, one of the key elements is the need to adopt an internal reporting procedure. This obligation applies to an entity for which, as of 1 January or 1 July of a given year, at least 50 people are gainfully employed.
The number of 50 persons performing gainful employment for a legal entity includes full-time employees or persons performing work for remuneration on a basis other than an employment relationship, if they do not employ other persons for this type of work, regardless of the basis of employment. Entities with less employment may (but do not have to) adopt such a procedure.
According to the Act, the procedure is to specify in particular:
- an internal organisational unit/person or external entity authorised to receive internal reports;
- the ways in which the whistleblower submits internal reports;
- an (impartial) internal organisational unit/person, empowered to take follow-up actions (verification, further communication with the whistleblower, etc.);
- the procedure for dealing with information on breaches of the law reported anonymously;
- the obligation to confirm to the whistleblower that the whistleblower has received an internal report (generally a period of 7 days);
- the obligation to take follow-up action with due diligence;
- the maximum deadline for providing feedback to the whistleblower (up to 3 months);
- comprehensible and easily accessible information on how to make external reports to the Ombudsman or to public authorities.
The internal reporting procedure may also include other elements, such as identifying risk factors or defining a whistleblower incentive system.
The draft procedure is subject to consultations with the company’s trade union organization or representatives of persons performing work for the entity (selected in accordance with the procedure adopted by the legal entity).
Internal reports may be handled by an external entity. However, this requires the conclusion of a specific agreement.
Entities for which at least 50, but not more than 249 persons perform gainful employment may establish common rules on the receipt and verification of internal reports and conducting investigations on the basis of an agreement, provided that the activities performed comply with the Act.
On the other hand, entities belonging to a capital group (within the meaning of the Act on Competition and Consumer Protection) may establish a common internal reporting procedure, provided that the activities performed are in compliance with the Act.
Importantly, in addition to the procedural obligations, the entity in question maintains a register of internal reports and is the controller of personal data collected in the register of internal reports.
Failure to establish a procedure or establishing it in material violation of statutory requirements is an offence punishable by a fine.
