Whistleblowing is currently a hot topic in Poland. After nearly three years of delay, Poland has finally implemented the EU Whistleblowing Directive 2019/1937.
The Polish Whistleblower Law comes into force on September 25, 2024, and applies to all entities employing at least 50 people (with some exceptions). As a result, many organizations are now focused on setting up their internal reporting systems. A well-prepared plan is key to ensuring a smooth implementation process.
Decisions to Be Made
Entities required to comply with the new Polish Whistleblower Law must first address the following decisions:
- a) Who should be authorized to receive and follow up on reports of breaches? This role can be assigned to a department or an individual within the organization, with HR, Legal, and Compliance departments or their heads being natural choices. When designating these roles, it's advisable to assign functions to them rather than specific individuals to avoid frequent updates to authorizations.
- b) Should the process of receiving reports be outsourced to a third party? Outsourcing can be beneficial, particularly if the organization lacks the resources to manage the process effectively. In such cases, an outsourcing agreement should be prepared.
- c) Will anonymous reports of breaches be accepted and followed up on? If yes, the internal whistleblowing procedure must outline the steps for handling such reports. Accepting anonymous reports increases the likelihood that the organization will learn about breaches early, so consider this option carefully when designing your system.
- d) Should an incentive scheme be applied for using the internal reporting system?
- e) Should the organization allow reporting of breaches related to internal policies, ethical standards, or other areas (e.g., discrimination, mobbing) beyond those specified by the Polish Whistleblower Law? If so, these areas must be included in the internal whistleblower procedure, which should also link to the relevant policies, standards, and regulations.
Establish Internal Reporting Channels
The law requires organizations to provide at least verbal or written channels for internal reporting:
- a) Verbal reports can be made by phone or voice messaging systems, as well as during face-to-face or online meetings.
- b) Written reports can be submitted on paper (e.g., via traditional letters or physical complaint boxes) or electronically (e.g., through dedicated email addresses, website forms, or online platforms). If you are concerned about completeness, the last two methods allow you to include a set of relevant questions.
Reporting channels may be managed internally or provided by a third party. If opting for external tools (such as online platforms), ensure they guarantee the confidentiality and security of whistleblower information through, e.g., data encryption and strict access control. Additional helpful features include report management, automatic notifications, automatic creation of a report register, and a built-in system or chat for ongoing communication with the whistleblower. Consider whether the tool has a user-friendly interface, supports the entire report life cycle (from receipt to investigation and corrective action), allows anonymous reporting, and accommodates communication in multiple languages.
Prepare an Internal Whistleblower Procedure
Once the key decisions are made and reporting channels established, the next step is to prepare an internal whistleblowing procedure. The new Polish Whistleblower Law outlines the required content of this procedure. Aim to keep it concise and straightforward. The procedure should be reviewed in consultation with trade unions or employee representatives (note that it may be necessary to elect such representatives beforehand). The finalized procedure must be announced to the organization at least seven days before it comes into force.
Maintain a Register of Internal Reports
The Polish Whistleblower Law specifies the information that must be included in the register of reports and the retention period for this information.
Why is it important to have an effective internal reporting system?
An effective internal reporting system encourages whistleblowers to report issues internally rather than to public authorities or through public disclosures. Gaining early knowledge of breaches allows the organization to manage the situation internally, often avoiding legal, financial, and reputational risks. Additionally, such a system strengthens the ethical work environment. Therefore, investing in and promoting this system within the organization (e.g., by integrating it into the onboarding process and offering internal training) is highly beneficial.
By Ewa Swiderska, Lead Regional Counsel CEE
