2024 WLG Whistleblower Guide: Poland
Is there a law to protect whistleblowers? If so, which law?
Yes. The Polish Act on the Protection of Whistleblowers in Poland of June 14, 2024 ("the Act"), which implements the EU Whistleblowing Directive, entered into force on September 25, 2024.
Are companies legally obliged to introduce a whistleblowing system?
Yes. Companies are obliged to implement a whistleblowing system (for details, see the answer to question 3 below). Such an obligation is also imposed on organizational units of municipalities and counties with a population of at least 10,000, such as legal entities created by local government units, including companies, foundations, unions, etc.
If so, which companies must introduce a whistleblowing system (number of employees, turnover, sector)?
All companies with at least 50 employees are obliged to implement a whistleblowing system. The number of 50 employees of a legal entity includes full-time employees or persons who perform work for remuneration on a basis other than employment if they do not employ other persons for such work, regardless of the basis of employment. This employment threshold does not apply to companies obliged to implement a whistleblowing system under separate regulations, such as AML. Such an obligation to implement a whistleblowing system does not depend on sector or turnover.
What forms can a whistleblowing system take (written, verbal, email, electronic tool)?
The Act does not limit the reporting channels. The law requires that the whistleblowing system provides, at a minimum, for submitting written and oral reports. Verbal reports may be made by telephone or electronic communication, such as Microsoft Teams. Oral reports may also be made at the whistleblower's request in a face-to-face meeting. The written report may be submitted in paper or electronic form. The electronic form may consist of sending an email or submitting a report through a specific platform. The law does not limit the channels of reporting.
Which reports must be permitted?
The Act specifies the areas of law whose violation or suspected violation may be reported. These are corruption, public procurement, services, financial products and markets, anti-money laundering and terrorist financing, product safety and compliance, transport safety, environmental protection, radiological protection and nuclear safety, food, and food safety, animal health and welfare, public health, consumer protection, protection of privacy and personal data, security of information and communication networks and systems, the financial interests of the State, local authorities and the European Union, the internal market of the European Union, including the public law principles of competition and state aid and taxation of legal persons, constitutional freedoms and rights of man and the citizen arising in the relations of an individual with public authorities and not related to the above-mentioned areas.
This is a minimum standard set by the Act, but a whistleblowing system may also provide the possibility of reporting information on violations of internal regulations or ethical standards applicable within the organization.
Must anonymous reporting be guaranteed?
The Act gives companies discretion to choose their approach to anonymous reporting. The Act does not require companies to accept and process (verify) anonymous reports as part of their internal reporting procedures, but the procedures must indicate whether the company will accept anonymous reports.
Who must be able to provide information (only employees or also external third parties)?
According to the Act, a whistleblower is a person who reports or publicly discloses information about a violation of the law obtained in a work-related context, which means, among others, an employee, a person providing work on a basis other than employment (e.g. self-employed), trainees, but also a third party such as an entrepreneur providing services to the company. A whistleblower is also a person who makes a report prior to the establishment of an employment or other legal relationship that forms the basis for the provision of work or services, or after such a relationship has ended.
Can companies rely on one centralized hotline, or is it necessary to have one hotline for each subsidiary?
The Act regulates the receipt of reports and follow-up in different ways.
In general, the company may authorize an internal organizational unit or person within the organizational structure of the legal entity or an external entity to receive internal reports. However, the authorization of an external entity requires the conclusion of a written agreement to entrust the handling of the receipt of internal reports, the confirmation of the receipt of reports, the provision of feedback, and the provision of information on the internal reporting procedure, using technical and organizational solutions to ensure the compliance of these activities with the provisions of the Act. Moreover, although a company may outsource the receipt of reports to an external entity, the company is still responsible for complying with the provisions of the Act.
It is, therefore, permissible for companies to rely on a centralized hotline for the receipt of reports.
The Act states that the company may authorize only an internal organizational unit or person within the organizational structure to take follow-up actions, including internal investigations.
In addition, Polish private entities with at least 50 but not more than 249 employees may contractually establish a common procedure for receiving and verifying internal reports and conducting internal investigations, provided that the activities conducted are in compliance with the Act.
Polish capital groups may establish a common internal reporting procedure, provided that the activities performed comply with the provisions of the Act.
Can a whistleblowing system also be operated by an external body (e.g. consultant)?
Yes, but under the conditions stated in the answer to Point 8. An external body can only receive reports, but only an internal organizational unit or person within a company's organizational structure can be authorized to take follow-up action. Therefore, an external body may operate a whistleblowing system in terms of receiving reports.
Are sanctions imposed for failure to introduce a whistleblowing system?
Yes. Failure to establish the procedure or establishing it in material violation of the Act's requirements is treated as a petty offense, and an individual may be punished by a fine of between PLN 20 and 5,000.