Act on the protection of whistleblowers

Whistleblower

A whistleblower is an individual who reports or publicly discloses information about a breach of the law obtained in a work-related context. He or she may be, inter alia, an employee (also a temporary one), entrepreneur, shareholder or partner, but also an intern, volunteer or trainee.

The whistleblower is subject to statutory protection from the moment of reporting or public disclosure, providing that the whistleblower had reasonable grounds to believe that the information that is the subject of the report or public disclosure is true at the time of reporting or public disclosure and that it constitutes infringement information.

Personal data which make it possible to establish the identity of a whistleblower are not subject to disclosure to unauthorised persons, except with the whistleblower’s express consent. The law provides for an exception in this matter, according to which this rule will not apply if the disclosure of the whistleblower’s data is a necessary and proportionate obligation under the law in connection with investigations carried out by public authorities or pre-trial or judicial proceedings carried out by courts, including in order to guarantee the right of defence of the reported person.

Exemptions

The Act contains a number of exemptions, including that it does not apply to selected types of information covered by:

• provisions on the protection of classified information and other information that is not subject to disclosure by law for reasons of public security,
• professional secrecy of the medical and legal professions,
• the confidentiality of judicial deliberations,
• criminal proceedings – as regards the secrecy of pre-trial proceedings and the secrecy of court hearings.

Prohibition of retaliation

No retaliatory action or attempted or threatened retaliatory action may be taken against a whistleblower. By retaliatory action, the Act means both direct and indirect work-related acts or omissions that are caused by a report or public disclosure, respectively, and that breach or are likely to breach the whistleblower’s rights or cause or are likely to cause unreasonable harm to the whistleblower, including the unwarranted initiation of proceedings against the whistleblower.

If the work was, is or is to be provided on the basis of an employment relationship, no retaliatory action may be taken against the whistleblower, consisting in particular of: transferring him/her to a lower work position, harassment, reduction of work remuneration or unjustified referral for medical examinations, including psychiatric examinations. Retaliation for making a report or making a public disclosure is also considered to be an attempt or threat of such measures. The burden of proof is on the employer, he has to prove that the action taken, is not retaliatory. Similar principles also apply where work or services have been, are being or are intended to be provided on the basis of a legal relationship other than an employment relationship forming the basis for the provision of work or services or the performance of functions or duties.

Protection measures

A whistleblower who has been retaliated against will be able to claim damages of no less than the average monthly salary or the right to compensation. In this matter, there has also been a marked change. In the original version of the draft, the compensation was to be no less than twelve times the monthly salary.

The Act expressly marks that the report or public disclosure may not give rise to liability, including disciplinary liability or liability for damages for violation of the rights of others or legally defined obligations. The condition is that the whistleblower has reasonable grounds to believe that the reporting or public disclosure is necessary to disclose a breach of the law. However, if liability proceedings are instituted, the whistleblower may apply for discontinuance. Furthermore, the law expressly stipulates that one cannot waive the rights defined by law or accept liability for damage caused by making a report or public disclosure.

Provisions of employment contracts and other acts, on the basis of which the employment relationship is created or which shape the rights and obligations of the parties to the employment relationship, to the extent that they directly or indirectly exclude or limit the right of notification or public disclosure or provide for retaliatory measures, shall be invalid. Likewise, provisions in other contracts and other acts on the basis of which work or services are provided, goods are delivered or sales are made, to the extent that they directly or indirectly exclude or restrict the right to make a report or public disclosure or provide for retaliatory measures, shall also be invalid.

The law also extended protection to a person who has suffered damage due to a whistleblower knowingly reporting or disclosing untrue information to the public. He or she is entitled to compensation or damages for violation of personal rights.

Internal notifications

Legal entities with 50 or more workers, are obliged to establish an internal procedure for reporting and following up on breaches of the law (“Internal Reporting Procedure”). By legal entity, the Act means both private and public entity. According to the Act, the status that is being taken into account is a status of the 1 January or 1 July of the relevant year.

The threshold of at least 50 employees does not apply to legal entities performing activities in the fields of financial services, products and markets, anti-money laundering and counter-terrorist financing, transport safety and environmental protection, which fall within the scope of application of certain European Union legal acts contained in the annex to the Directive on the protection of whistleblowers. Accordingly, entities such as Small Payment Institutions and National Payment Institutions, for example, will be obliged to implement an internal notification procedure regardless of the number of persons employed.

In addition, the Act stipulates that an entity with fewer than 50 workers, as well as a municipalities with fewer than 10 000 inhabitants to which the provisions of the chapter on internal notification do not apply, may establish such a notification procedure.

The procedure should be subject to prior consultation with the company trade union organisation, or company trade union organisations if there is more than one company trade union organisation in the legal entity, or with selected representatives of persons working for the legal entity, selected according to the procedure adopted in the legal entity, if there is no company trade union organisation in the legal entity. Consultations should last no less than 5 days and no more than 10 days from the date of the legal entity’s submission of the draft internal notification procedure. The internal notification procedure shall enter into force 7 days after it has been made known to the persons performing the work in the manner adopted in the legal entity. The procedure so established should be presented to the job applicant with the start of recruitment or pre-contractual negotiations.

The law specifies both mandatory and optional elements of the internal procedure. Obligatorily, the internal procedure should specify:

• the internal organisational unit or person authorised to receive internal reports,
• the means by which a whistleblower may communicate internal reports (which should include, at a minimum, the possibility to report orally or in writing),
• an impartial internal organisational unit or person authorised to follow up,
• the procedure for dealing with whistleblowing information reported anonymously,
• the obligation to confirm to the whistleblower the acceptance of an internal report within 7 days of its receipt,
• an obligation to follow up with due diligence,
• a maximum time limit for feedback to the whistleblower, not exceeding 3 months from the date of acknowledgement of an internal report,
• clear and easily accessible information on how to make an external report to the Ombudsman or to public authorities and, where appropriate, to European Union institutions, bodies or agencies.

The legal entity should ensure that the procedure for internal notifications and the associated processing of personal data prevents unauthorised persons from gaining access to the information covered by the notification and protects the confidentiality of the identity of the whistleblower and the persons identified in the notification. The protection of confidentiality should apply to information from which the identity of such persons can be directly or indirectly identified.

External notifications

The whistleblower also has the possibility to make an external notification without first making an internal notification. Either the Ombudsman or a public body is entitled to receive such a report.

To this end, the Ombudsman and the public body shall establish appropriate procedures for the acceptance of external reports (and the public body shall also take follow-up action), taking into account, in particular, the procedure for handling information about breaches of the law reported anonymously.

At the whistleblower’s request, the public authority competent to take follow-up action shall issue a certificate confirming that the whistleblower is subject to the protection specified in the law.

Both the Ombudsman and the public authority should place on their website in the in a separate, easy-to-find section, information containing, inter alia: contact details enabling external reporting, conditions for protection, procedure, as well as confidentiality rules.

Public disclosure

A whistleblower making a public disclosure of a breach of law is also protected, provided that certain conditions are met.

However, the provisions on public disclosure do not apply if the communication of the infringement of the law was made directly to the press and the Act of 26 January 1984 applies. – Press Law (Journal of Laws 2018, item 1914).

Criminal provisions

New prohibited acts have also been introduced under the Act, including:

• preventing or substantially impeding another person from making a report,
• taking retaliatory action against a whistleblower, a person assisting in making a report or a person associated with a whistleblower,
• disclosing the identity of a whistleblower, a person assisting in making a report or a person associated with a whistleblower in contravention of the law,
• making a report or public disclosure knowing that a breach of the law has not occurred,
• failing to establish or establishing, in material breach of the statutory requirements, a procedure for internal reporting (adjudication in this respect will follow the provisions of the Petty Offences Procedure Code).

Entry into force

The Act was promulgated in the Journal of Laws on 24 June 2024. This means that the new provisions enter into force on 25 September 2024. However there are some exceptions, such as:

• Article 5(4) of the Act concerning the public authority competent to receive external reports of breaches of the law by the secret service,
• Article 25(1)(8) of the Act concerning the content of the internal notification procedure for making notifications to either the Ombudsman or public authorities and, where appropriate, to institutions, bodies or organisational units of the European Union,
• the provisions of Chapter 4 on external notifications.

The mentioned provisions shall enter into force 6 months after the date of promulgation of the Law, on 25 December 2024.

Act on the protection of whistleblowers - what do we deliver?

• establishement of a model procedure for reporting and following up on violations of the law (“Internal Reporting Procedure”),
• operationalisation of the whistleblowing procedure,
• modification of other documentation, including in the area of personal data protection, to ensure compliance with the Act.

DLK information