The deadline for implementation of Directive (EU) 2019/1937 of the European Parliament and of the Council of 23 October 2019 on the protection of persons who report breaches of Union law (“Directive”) by Member States expired on 17 December 2021. However, the Polish Parliament has not yet managed to enact the implementing regulations, which are still at the drafting stage. The Directive focuses not only on the rights of whistleblowers but also on the related obligations of businesses. Initially the regulations will apply to businesses with more than 249 employees on their payroll. Smaller entities (50 to 249 employees) will have more time to realign their internal procedures
with the new legislation, as it will not become effective until 17 December 2023. The legislators have imposed
a number of requirements that employers are required to meet to realign their businesses with the new regulations.
The most significant of the obligations is to establish suitable channels for whistleblowers to report breaches of law. The channels need to meet certain conditions, such as ensuring complete confidentiality of the process. Establishing such channels also involves putting in place rules and regulations on how to use them. The employer is also required to notify its business partners of the reporting channels.
Another important obligation is to designate individuals responsible for receiving whistleblower reports. They must be impartial and maintain confidentiality during the processing of the report. They will be the only persons who will be aware of the identity of the whistleblower (unless the whistleblower agrees to disclosure of the information to others). The employer is also required to inform the whistleblower of the progress and outcome of the investigation.
Further, the employer is required to put in place a register of reported breaches. The data entered in the register have to be kept for a period of 5 years from the breach report.
The Directive also stipulates for individual Member States to provide for penalties applicable to employers. The Directive merely states that the penalties have to be effective, proportionate, and dissuasive, leaving the rest to the national lawmakers. Under the Polish bill, the penalized actions include:
- failure to establish or unsatisfactory establishment of the reporting procedures;
- causing hindrance to reporting, retaliation against whistleblowers;
- failure to keep whistleblower’s identity confidential.
The above may result in up to 3 years of imprisonment.
Thus, as becomes evident, the new regulations on whistleblowers do not merely focus on protecting whistleblowers but also establish certain obligations and impose penalties on the other party, i.e. the employers. The extent to which the employers realign their businesses with the new changes will determine the effectiveness of the Directive and the number of reports
actually made. The obligations of employers are wide-ranging and translate into numerous changes for them. The process will probably be more difficult in the case of smaller businesses, which is why one should applaud the decision on extending the period for realignment with the new legal regime until 17 December 2023..