The deadline for implementation of Directive (EU)
2019/1937 of the European Parliament and of the
Council of 23 October 2019 on the protection of
persons who report breaches of Union law (“Directive”)
by Member States expired on 17 December 2021.
However, the Polish Parliament has not yet managed to
enact the implementing regulations, which are still at the
drafting stage. The Directive focuses not only on the
rights of whistleblowers but also on the related
obligations of businesses. Initially the regulations will
apply to businesses with more than 249 employees on
their payroll. Smaller entities (50 to 249 employees)
will have more time to realign their internal procedures
with the new legislation, as it will not become effective
until 17 December 2023. The legislators have imposed
a number of requirements that employers are required
to meet to realign their businesses with the new
regulations.
The most significant of the obligations is to establish
suitable channels for whistleblowers to report breaches
of law. The channels need to meet certain conditions,
such as ensuring complete confidentiality of the process.
Establishing such channels also involves putting in place
rules and regulations on how to use them. The employer
is also required to notify its business partners of the
reporting channels.
Another important obligation is to designate individuals
responsible for receiving whistleblower reports. They must be impartial and maintain confidentiality during
the processing of the report. They will be the only
persons who will be aware of the identity of the
whistleblower (unless the whistleblower agrees to
disclosure of the information to others). The employer is
also required to inform the whistleblower of the
progress and outcome of the investigation.
Further, the employer is required to put in place a
register of reported breaches. The data entered in the
register have to be kept for a period of 5 years from
the breach report.
The Directive also stipulates for individual Member
States to provide for penalties applicable to
employers. The Directive merely states that the
penalties have to be effective, proportionate, and
dissuasive, leaving the rest to the national lawmakers.
Under the Polish bill, the penalized actions include:
- failure to establish or unsatisfactory
establishment of the reporting procedures, - causing hindrance to reporting,
- retaliation against whistleblowers,
- failure to keep whistleblower’s identity
confidential.
The above may result in up to 3 years of imprisonment.
Thus, as becomes evident, the new regulations on
whistleblowers do not merely focus on protecting
whistleblowers but also establish certain obligations
and impose penalties on the other party, i.e. the
employers. The extent to which the employers realign
their businesses with the new changes will determine the
effectiveness of the Directive and the number of reports
actually made. The obligations of employers are wide-
ranging and translate into numerous changes for them.
The process will probably be more difficult in the case
of smaller businesses, which is why one should applaud
the decision on extending the period for realignment
with the new legal regime until 17 December 2023.
Disclaimer: This publication has been prepared for clients and professional associates of Miller Canfield. It is intended to provide only a summary of certain recent legal
developments of selected areas of law. For this reason the information contained in this publication should not form the basis of any decision as to a particular course of action;
nor should it be relied on as legal advice or regarded as a substitute for detailed advice in individual cases. The services of a competent professional adviser should be obtained
in each instance so that the applicability of the relevant legislation or other legal development to the particular facts can be verified.