Despite the fact that the Law on the Protection of Whistleblowers has already been in force in the Polish legal order since September 25, 2024, it is still the subject of numerous controversies and heated discussions. The provisions regulating criminal liability for violating the duty of protecting a whistleblower’s identity are particularly problematic. These regulations, although intended to provide full protection to whistleblowers, in practice raise many interpretive doubts.
Entrepreneurs who are responsible for implementing procedures to protect whistleblowers often ask questions about in what situations the conditions for criminal liability can be realized. Uncertainties include what actions or inactions can be considered as “disclosure of a whistleblower’s identity” and whether every disclosure is automatically considered as a criminal offense.
As a result, many entrepreneurs are concerned that, despite their best intentions and the implementation of appropriate procedures, they may face criminal liability. There is an emerging need to develop a unified interpretive approach to properly apply the law in practice and to minimize the criminal risks associated with the disclosure of whistleblower data. The law, although structured to protect whistleblowers, imposes obligations on entrepreneurs, the execution of which requires precision, diligence and understanding of the legislator’s intentions, which still remains a challenge for many entities.
WHAT DOES THE POLISH LAW ON THE PROTECTION OF WHISTLEBLOWERS SAY?
According to Article 56 of the Law on the Protection of Whistleblowers – whoever, against the provisions of the law, discloses the whistleblower’s identity, a person helping to make a report, or a person associated with a whistleblower, will be punished by a fine, restriction of liberty or imprisonment of up to one year.
The identity of a whistleblower, a person helping to make a report or a person associated with a whistleblower has guaranteed protection in a number of provisions contained in the text of the Law on Protection of Whistleblowers – Articles 8, 27, 37, 39, 43, 44.
WHO CAN OBTAIN AND PROCESS A WHISTLEBLOWER’S PERSONAL DATA?
As a rule, it is assumed that the identity of the said persons should be known by the smallest possible number of people. Knowledge in this regard should be in the possession of the administrator of the personal data of a particular workplace. The administrators of such data are the managers of a particular workplace, as well as those authorized to process personal data in connection with receiving and processing reports and taking follow-up action.
Persons designated to receive reports, process reports and take follow-up action must possess named authorizations to receive reports and process personal data obtained in connection with the whistleblower’s internal report.
These persons do not have to be mentioned by name in the internal procedure, it is enough to specify their position, alternatively the name of the department/internal unit within the organization.
Named authorizations must indicate:
- the person authorized to process personal data,
- the position occupied by him/her,
- the scope of the authorization,
- processing operations,
- the duration of the authorization,
- signature of the administrator of personal data, and
- specific statements by the authorized person regarding the responsibilities of processing the personal data of the whistleblower, the person helping to make the report, or the person associated with the whistleblower.
Incidentally, it should be mentioned that the processing of the personal data of the whistleblower or others by a person who has not been authorized to do so in writing by the administrator – constitutes a crime typified by Article 107 of the Law on Personal Data Protection.
VIOLATION OF ARTICLE 56 OF THE LAW ON THE PROTECTION OF WHISTLEBLOWERS
From the perspective of potential criminal liability for disclosure of identity, it seems crucial to ensure confidentiality at every stage of the reporting procedure. It is important that it be clear to the person receiving or investigating the report that the duty of confidentiality does not cease after:
- transmission of the complaint to the body handling the reports,
- completion of the investigation,
- termination of the person’s employment with the company where the whistleblower’s report was processed.
Confidentiality is also guaranteed by proper care of documents. Their movement must be limited.
On the surface, it may seem that the current wording of the mentioned Article 56 of the Law on the Protection of Whistleblowers does not clearly indicate who can commit the crime of disclosing the identity of a whistleblower, a person helping to make a report, or a person associated with a whistleblower.
In connection with the wording of “who” – it would be reasonable to assume that we are dealing with a general crime, since it is about any person who, no matter how, learned about the identity of a whistleblower, a person helping to make a report or a person associated with a whistleblower. It is impossible to agree with this. The provision further includes the premise “contrary to the provisions of the law.”
As indicated above – the persons receiving and processing reports and taking follow-up actions can only be individuals with a personal authorization to process the personal data contained in the report. Therefore, only these persons can commit the analyzed crime, which supports the fact that it is an individual crime.
WHAT ABOUT ARTICLE 266 § 1 OF THE CRIMINAL CODE?
Also, it’s hard to agree with the statement that disclosing the identity of a whistleblower, a person helping to make a report or a person associated with a whistleblower will at the same time fulfill the premises of the crime provided for in Article 266 § 1 of the Criminal Code, which is punishable by a fine, restriction of liberty or imprisonment for up to 2 years.
Article 266 § 1 of the Criminal Code provides for liability for the disclosure or use of information with which someone has become acquainted in connection with his function, work, public, social, economic or scientific activity, contrary to the provisions of special laws or an obligation he or she has assumed.
It should be assumed that Article 56 of the Law on the Protection of Whistleblowers includes in its description the elements included in Article 266 § 1 of the Criminal Code, specifying them in detail on the grounds of the Law on the Protection of Whistleblowers. Therefore, in the case of revealing the identity of a whistleblower, a person helping to make a report or a person associated with a whistleblower, it is reasonable to apply only the special provision, which is the aforementioned Article 56 of the aforementioned Act (consumption rule).
PUNISHABILITY OF THE CRIME AND STATUTE OF LIMITATIONS
When analyzing the punishability of the crime and its statute of limitations, it is necessary to refer to the general rules contained in the general part of the Criminal Code. The offense under Article 56 of the Law on the Protection of Whistleblowers is punishable by a fine, restriction of liberty or imprisonment for up to a year.
The fine is measured in daily rates – the number of rates when the offense is punishable by both a fine and imprisonment not exceeding one year is from 50 to 540, while the value of one rate is from PLN 10 to 2000. So the minimum fine can be 500 PLN and the maximum 1,080,000 PLN.
The penalty of restriction of liberty consists of the obligation to perform unpaid, controlled work for social purposes or the deduction of from 10 to 25% of the salary for work on a monthly basis for a social purpose designated by the court, and is imposed for a period from one month to two years.
According to Article 101 § 1 (5) of the Criminal Code, the punishability of the above-mentioned offense ceases when 5 years have passed since the offense was committed. However, according to Article 102 § 1 of the Penal Code, if criminal proceedings are instituted within the said five-year period, the punishability of the crime ceases with the expiration of 15 years from the time of its commission.
The analyzed crime is prosecuted by public indictment, without the need to obtain a request from the victim for prosecution. Preparatory proceedings in the form of an investigation are, as a rule, conducted by the police under the supervision of the prosecutor.
WHEN THE WHISTLEBLOWER’S IDENTITY IS NOT DISCLOSED?
In order to find out in what situations the identity of the persons listed in Article 56 of the Law on the Protection of Whistleblowers is not disclosed, it is necessary to refer to Article 8 of the said law.
Based on an analysis of the mentioned Article 8, it should be stated that the identity of the whistleblower and other persons can be disclosed without a simultaneous violation of Article 56 when:
- the whistleblower expressly agrees to such disclosure;
- the disclosure is a necessary and proportionate obligation under the law in connection with investigations by public authorities or preparatory or judicial proceedings conducted by courts, including in order to guarantee the right of defense of the reported person;
- in the course of ongoing follow- up actions, it turns out that the person making the report or public disclosure does not have the protection provided for a whistleblower – that is, the report was made in so-called bad faith.
In addition, entity or a public body has the right to disclose the identity of a whistleblower and other persons, even without their consent, if follow-up actions (investigations) have gathered information that justifies the decision to initiate external proceedings, such as criminal, delinquency, civil or administrative proceedings.
In the documents initiating the above-mentioned proceedings, such as a notification of the possibility of a crime, an indictment, a motion for punishment, a motion for the initiation of proceedings or a lawsuit, the personal data of the whistleblower may be disclosed if this is necessary to present the facts and support their claims with relevant evidence.
At the same time, a person accused of a delinquency or crime has the right, as part of his defense, to rely on information that may reveal the identity of the whistleblower or other persons, provided that this is reasonable and necessary for the exercise of his or her right of defense.
SUMMARY
The Law on the Protection of Whistleblowers introduces provisions to protect the identity of whistleblowers. Violation of this duty can result in criminal liability under Article 56 of the Law on the Protection of Whistleblowers. Penalties include a fine, restriction of liberty or imprisonment for up to a year, and prosecution is by public prosecution.
The identity of whistleblowers, whistleblower helpers and associated persons is under special protection. Only those with named authorizations may process data related to the report. Confidentiality must be maintained at every stage of the procedure.
It is worth remembering that not every disclosure of identity constitutes a crime. Disclosure of identity can legally occur in cases provided for in the Law on the Protection of Whistleblowers. Also, identity can be disclosed in documents initiating external proceedings (such as indictments or lawsuits). In addition, a person charged with a delinquency or crime has the right to refer to information regarding the identity of a whistleblower if it is justified by his defense.
The Law on the Protection of Whistleblowers, despite its protective intent, still leaves many questions of interpretation. It is crucial for businesses to implement procedures that minimize the risk of violations and ensure confidentiality in every aspect of the notification system.
Article is available in Polish here.
