Support Centre

You have out of 5 free articles left for the month

Signup for a trial to access unlimited content.

Start Trial

Continue reading on DataGuidance with:

Free Member

Limited Articles

Create an account to continue accessing select articles, resources, and guidance notes.

Free Trial

Unlimited Access

Start your free trial to access unlimited articles, resources, guidance notes, and workspaces.

Poland: Ministry of Family and Social Policy publishes updated whistleblowing bill

The Ministry of Family and Social Policy published, on 12 April 2021, an updated bill, as issued on 6 April 2022, on the protection of persons who report violations of the law, following public consultation on the original bill as introduced by Małgorzata Podrażka. The updated bill is published alongside a justification document, a Regulatory Impact Assessment ('RIA'), a reference table, and a table outlining the compatibility of the bill with the Directive on the Protection of Persons who Report Breaches of Union Law (Directive (EU) 2019/1937) ('the Whistleblowing Directive'). In particular, the updated bill introduces some changes from the original bill, which include the below:

  • The scope of application is extended to cover individuals outside of an employer-employee relationship. Specifically, Article 4(2) of the bill provides that the bill applies to persons reporting or disclosing information about a breach of law obtained in a work-related context, for instance through the provision of services or the performance of a function or supply of goods, or where the legal relationship has already ceased. This, according to the compatibility table, reflects the approach adopted by the Whistleblowing Directive.
  • In contrast to the original bill, the updated bill does not contain any provisions on the processing of anonymous reports of whistleblowers by legal entities in the private or public sector and competent authorities, however it provides that, if the information has been anonymously reported to a legal entity or public authority or disclosed to the public, and the identity of the reporting person has subsequently been disclosed resulting in the latter suffering retaliatory measures, Chapter 2 of the bill applies, which addresses protection measures against retaliation.
  • The list of what shall be regarded as retaliation under Chapter 2 of the bill has been expanded to include mobbing and damage to reputation especially in the context of social media, among others.
  • The provisions relating to the internal procedure, previously 'internal notification rules', have been made more precise, providing more clarity on the submission of oral reports made via recorded telephone lines, and a non-recorded telephone line or other unrecorded voice communication system.
  • Introduction of data retention periods. Specifically, Articles 8(1) of the bill provides that personal data processed in connection with the acceptance of the notification shall be stored by the Ombudsman for Human Rights for a period of 12 months from the date of submitting the notification to the public authority competent to take follow-up measures, while Article 8(2) of the bill provides that personal data processed in connection with the acceptance of the notification and the taking of follow-up actions shall be stored by the legal entity and public authority in question for no longer than 15 months from the date of completion of the follow-up actions.
  • The criminal penalties have been adjusted in accordance with their severity. Specifically, according to Chapter 6, whoever uses a total of more than two retaliatory measures may be imprisoned for up to three years, whereas whoever uses violence, threats, or deception may be subject to a fine, restriction of liberty, or imprisonment of up to two years.

You can read the updated bill here, download the justification document here, the compatibility table here, the reference table here, and the RIA here, and track the progress of the bill here, all only available in Polish.