Draft law on whistleblowers – sanctions for lack of procedures and reporting false information

The Ministry of Family and Social Policy presented a draft law on the protection of persons reporting violations of law, which implements the EU Directive on the protection of persons who report breaches of Union law (Directive 2019/1937), further referred to as the “Whistleblower Directive”. In addition to the provisions on the protection of persons reporting irregularities and violations, it also provides for measures which enable to impose sanctions on both employers and whistleblowers. What are the penalties for violating the new regulations?

Implementation of EU Whistleblower Directive – key facts

Before we discuss the criminal sanctions provided for in the draft, it is worth to know the key facts for the employers and whistleblowers.

Internal reporting channel – who and when must implement it?

Pursuant to the provisions of the new law, public and private sector employers with at least 50 employees will be required to enact internal regulations for reporting violations of law. The exception are entities from the financial sector (e.g. banks, investment funds, pension companies, insurance companies and brokerage houses) which have to enact internal reporting regulations obligatorily regardless of the number of employees. Employers with fewer than 50 employees will be able to voluntarily enact internal reporting regulations.

The internal regulations should, in particular, set forth the procedure for reporting irregularities and follow-up actions to be taken as a result of providing information, and are to apply two weeks after communicating them to employees.

Before the regulations come into force, however, they are subject to consultation with the trade union or employee representatives (if no trade union operates at the employer).

When the law on whistleblowers comes into force

The deadline for implementing the EU directive into the Polish legal system is 17 December 2021. The regulations on whistleblowers proposed by the Ministry are to enter into force 14 days from the date of announcement. For employers in the private sector, with at least 50 and less than 250 employees, the obligation to enact internal reporting regulations will be extended until 17 December 2023. It means that, generally, employers will have very little time to implement the regulations and prepare the necessary procedures. In the following section, we will explain what are the penalties for failure to comply with the new regulations.

Who will be the central authority to whom the disclosures can be addressed? 

Whistleblowers can address external disclosures without prior internal reporting. In Poland, the Ombudsman will be the central authority for filing external disclosures concerning irregularities. The disclosures will also be accepted by other public authorities (e.g. the President of the Office of Competition and Consumer Protection with regard to competition and consumer protection rules).

It is also worth recalling that disclosures made by whistleblowers may be anonymous (if the internal reporting regulations or the procedure for reporting violations of law to a public authority so provide).

See also: How to prepare your business for the implementation of whistleblower protection – view the recording of our webinar.

Draft law on whistleblowers – what are the sanctions and to whom they apply?

The draft law implementing the provisions of the EU Whistleblowers Directive into Polish law is still during the public and inter-ministry consultations, but the proposed provisions already raise a number of doubts among the employers, especially as the new obligations will apply to a wide range of private and public entities.

As mentioned earlier, the law makers propose too short a period of vacatio legis, and it becomes even more important for employers taking into account the criminal sanctions provided for in the draft.

Criminal sanctions for lack of reporting procedures for whistleblowers

The draft law contains a provision (Article 60) introducing a criminal sanction – a fine, restriction of liberty or imprisonment for up to three years – for failure to establish an internal procedure / channel for receiving reports of irregularities from whistleblowers or in a situation where the established procedure is inconsistent with the law.

And here another doubt arises, because the draft provisions do not specify the person in the organization who will be subject to criminal liability. One thing seems certain, though, namely that in this case, unlike the penalties for violating the provisions of the general regulation on the protection personal data, sanctions will be imposed on individuals managing the entity, and not the employing entity.

Penalty for whistleblowers for disclosing false information

The proposed provisions of the draft law also provide for penalties for whistleblowers who disclose / report false information. In this case, sanctions will be identical to those imposed on employers, i.e. a fine, restriction of liberty or imprisonment for up to three years.

However, it should be clarified what the law makers understand by reporting false information. These are situations in which a whistleblower intentionally reports false information / a lie, and not situations where, after verification, it turns out that the disclosed irregularity does not qualify as a violation of law.

The draft law also introduces provisions laying down criminal liability (the same as for a whistleblower) for acts such as:  

• obstructing the reporting,
• taking retaliation actions against the whistleblower,
• breach of the confidentiality obligation (disclosure of data concerning identity of the whistleblower).

Protection of whistleblowers – how can we help?

TGC Corporate Lawyers offer comprehensive support in the implementation of whistleblowers protection procedures.