Whistleblowing, i.e. the reporting of legal violations and unethical practices in organisations, has become one of the most discussed topics in the context of corporate ethics and compliance. In Poland, however, the legal situation on this issue remains unclear, which raises many questions and challenges for companies and institutions. Is Poland ready to implement European directives on whistleblower protection? What are the main challenges faced by Polish companies? And most importantly, can whistleblowing become a tool for building transparency and ethics in business? This is discussed in an interview with Rafał Barański of braf.tech.
Brandsit: The legal situation when it comes to whistleblowing is quite unclear. What stage are we currently at?
Rafał Barański, braf.tech: Directives of the European Parliament and of the Council (EU) 2019/1937 on the protection of whistleblowers, the so-called Whistleblower Protection Directive, according to the guidelines should be implemented into the Polish legal order by a special law by 17 December 2021. However, this did not happen, although the beginning was promising, as the first draft of the law was created in autumn 2021. Since then, 7 versions of the law have been published, the last one at the end of May this year, which was then submitted to the Standing Committee of the Council of Ministers. So a certain stage has been completed and there is a chance that there will be no major changes to the law and that it will go to the parliament in the autumn. On the other hand, the parliamentary elections are ahead of us, and other, more pressing problems may also arise after the holidays. The EU authorities are also slowly losing patience and, after official warnings, have now referred Poland and seven other countries to the Court of Justice of the European Union.
As far as the provisions of the law are concerned, in the opinion of lawyers it is not perfect – rather showing a minimalist approach to whistleblowing. Certain issues have been pushed to the background, e.g. anonymous reporting from whistleblowers or the expansion of the catalogue of regulations whose violations can be reported, such as workers’ rights, bullying, discrimination, etc. And although the national law does not prohibit the inclusion of these issues in the internal procedures of private companies, I believe that few entities will introduce such provisions at home. The law focuses on issues that are important in terms of the public interest, rather than the welfare of the individual employee. The Polish Act is also likely to apply immediately to private entities with between 50 and 249 employees. The EU directive allowed for a longer vacatio legis for this group, but the deadline is already 17 December 2023. It can therefore be assumed that the new legislation, when it comes into force in the autumn, should immediately be implemented by all organisations – private companies 50+, all companies in the financial sector and companies and institutions under state control.
Brandsit: What are the main whistleblowing challenges faced by Polish companies?
Rafał Barański, braf.tech: There are several such challenges on different levels.
The first is the lack of implementation of whistleblowing procedures by most of the entities that will soon be covered by the legislation, which is due to the lack of a Polish law. Admittedly, some legal analyses claim that public entities should apply the provisions of the EU directive directly when it comes into force, but this has not happened. Smaller entities, on the other hand, are often unaware that such a directive exists and of the obligations it entails. This heralds a great deal of confusion when the law comes into force. The issue does not really concern the largest private companies, often multinationals, with whistleblowing procedures, as this is required by various separate regulations, e.g. the AML Act, regulations in other foreign markets or even internal corporate governance rules.
“If an organisation looks at whistleblowing through the lens of a benefit, a way to better catch internal problems and address them, it can only gain.”
The second point is that the lack of a clear legal status gives a false sense that the organisation has plenty of time to adapt to the new regulations. However, it does not have to be that simple and quick. One has to analyse what is required of the company, how to create procedures, what features the contact channel for whistleblowers should have. It is a process that requires the right competence and time. If an organisation does not have a legal or compliance department, and smaller entities often do not, this can prove to be a challenge beyond their capabilities. It is then worth seeking help, for example from a law firm or consulting company specialising in whistleblowing. However, such decisions should not be delayed. The later we get down to it, the greater the pressure will be, the higher the prices for services will be and the more difficult it will be to access them. This was also the case with the implementation of the RODO regulations.
The third aspect that I think will be a challenge is the approach to whistleblowing. On the one hand, as if it were a problem or another requirement for the company. On the other hand, to the whistleblowers themselves, because nowadays it is common in society and even in the media to refer to them as whistleblowers. Meanwhile, whistleblowing is in fact a tool to reduce the risk of image and financial loss or one that serves to build an image of an organisation acting ethically and transparently. In any company, abuses can occur in various fields. If an organisation looks at whistleblowing as a benefit, a way to better catch internal problems and address them, it can only gain. We have had several cases in history of major scandals – at Enron, Volkswagen or Facebook – where whistleblowing reports were trivialised and which contributed to major financial, reputational and even bankruptcy losses.
“We have had several cases in history of major scandals – at Enron, Volkswagen or Facebook – where whistleblower reports were trivialised.”
Brandsit: What are the key elements of an effective whistleblowing system that every company should consider?
Rafał Barański, braf.tech: A whistleblowing system consists of two things – procedures and a communication channel for whistleblowers. In a nutshell, the procedures must take into account all aspects arising from the regulations, e.g. the processing of personal data, its security, the scheme of conduct from the moment the report is received, through the follow-up and post-closure. The communication channel must also meet certain criteria, such as allowing for two-way communication with the whistleblower, either to provide feedback to the whistleblower or to obtain additional information or to ensure the protection of the whistleblower’s privacy in accordance with the RODO. An organisation may use several different communication channels at the same time, although I am of the opinion that this is not necessary, as an electronic channel in the form of a special application, such as our whiblo application, meets all the requirements and is the most practical. It is worth noting the practical considerations – ease of implementation, especially when we are talking about cloud-based SaaS solutions, securing data in accordance with RODO and resilience of protection against various threats, accessibility for the majority of employees, as currently more than 90 per cent of working Poles use a smartphone. From the point of view of streamlining the process of collecting and managing notifications, the app will also be the most convenient solution – certain actions can be automated (e.g. notifications), those in charge of the whistleblowing process can easily generate reports, receive reminders about deadlines, and it is easier to secure access to notifications from third parties. The benefits are many.
However, before we approach the creation of procedures or a channel, it is necessary to first analyse the provisions of the Act, check the current procedures, as these may already exist in the company, and appoint people responsible for implementing the system and then operating the process. In turn, once our whistleblowing system is in place, an important and required step is to communicate the changes within the organisation and educate employees in this regard.
Brandsit: Can you talk about the most significant cases of whistleblowing that have taken place in Poland?
Rafał Barański, braf.tech: There are many such situations in Poland every year. However, only a few make it into the media space or are not referred to as such. The first example from the shore – penalties for non-compliance with RODO regulations, which are imposed by the Office for Personal Data Protection, are often the result of reports submitted by whistleblowers to this body. Of the situations that have seen the light of day, I can mention, for example, the information from last year about the manipulation of the WIBOR index – the testimony of an anonymous whistleblower was included in a lawsuit against one of the banks in Poland. An interesting case from last year is also the whistleblower submissions to the Chief Inspector of Environmental Protection, which concerned the poisoning of the Oder River. As we remember, there was then a leak of personal data sent by one employee of the institution in the content of an email. Obviously, there was no breach of whistleblower protection laws at the time, because there were no such laws yet, but there was a breach of RODO. Had the Office had a better secured process, e.g. through an appropriate application, such a data leak would only have been possible as a result of a deliberate action.
“A whistleblowing system consists of two things – procedures and a communication channel for whistleblowers.”
Brandsit: What are the anticipated changes or trends in whistleblowing in Poland for the coming years?
Rafał Barański, braf.tech: First of all, we should wait for the final shape of the act and its implementation into the Polish legal order. Whether they will be flawless, whether the external notification procedures will actually function and whether the designated authorities will act efficiently in this respect is another matter, which we will find out in some time. Similarly, the implementation of the regulations, especially by the smaller, private entities whose regulations will be in force – a lot of confusion, last-minute implementation and delays can be expected. The same happened with RODO.
A certain global trend that will also be visible in our country, especially thanks to the largest companies, is the role of whistleblowing in ESG strategy, which is not only related to environmental initiatives, but also to social responsibility and corporate governance. As I have already mentioned – whistleblowing is precisely a tool that supports in building the image of a transparent, ethically acting, responsible organisation. The idea, of course, can be used for show, but the premise is very valid. By listening to the voice of various internal and external stakeholders, we are able to detect various problems and correct our mistakes.
