As part of our Compliance Alerts series, last week we discussed the topic “Am I a Whistleblower? ”
This week we want to answer the important question of what a person who qualifies as a whistleblower can report.
In accordance with the draft national law and Directive (EU) 2019/1937 of the European Parliament and of the Council of 23 October 2019 (the so-called Whistleblower Protection Directive), a whistleblower may report violations . What are these violations under the Directive?
Definition of violation
The Whistleblower Protection Directive defines the concept of breaches in Article 5, specifying that “breaches” means acts or omissions that:
→ are unlawful and concern Union acts and areas falling within the material scope referred to in Article 2 of the Directive (discussed below)
or
→ are contrary to the object or purpose of the provisions contained in Union acts and in the areas covered by the material scope referred to in Article 2 of the Directive
– the government draft bill on the protection of persons reporting violations of the law uses the concept of “violation of the law”, which is defined as an act or omission:
→ illegal
or
→ aimed at circumventing the law.
The Directive's provisions, while linguistically somewhat different from the proposed national provisions, retain the same meaning. They apply not only to conduct (action or omission) that directly violates a specific legal provision, but also to conduct that may not appear to be illegal but is intended to "slip through" the law.
Subject of the infringement report
What is the scope of the subject matter defined by Article 2?
The list is quite extensive – according to this provision, it covers infringements of EU law in the following areas :
- public procurement;
- financial services, products and markets;
- preventing money laundering and terrorist financing;
- product safety and compliance with requirements;
- transport safety;
- environmental protection;
- radiological protection and nuclear safety;
- food and feed safety;
- animal health and welfare;
- public health;
- consumer protection;
- protection of privacy and personal data;
- security of networks and IT systems;
- financial interests of the European Union;
- the European Union's internal market, including competition and state aid rules and corporate taxation.
A similar list is included in Article 3, Section 1 of the Polish draft act. The act clearly and justifiably defines a broader scope of "infringement of law" than the scope of Directive 2019/1937 being implemented.
The difference between the EU Directive and the Polish draft act is that the Directive addresses infringements of EU law (the specific EU legal acts whose infringements may be reported are listed in the annex to Directive 2019/1937), while the draft act addresses legal provisions in general, so whistleblower protection will apply to reporting all infringements of law in the areas of national law corresponding to those listed in the Directive (i.e., indicated above). The statutory definition of an infringement of law will not therefore be limited to cases where, in a given area of law, the infringement is regulated exclusively by a specific provision of EU law or a national law implementing it.
The proposed national regulations also provide for restrictions on violations of public procurement law – as discussed later in the article.
It should be emphasised, however, that the Directive only establishes common minimum standards of protection for persons reporting breaches of EU law, so national provisions have a certain freedom to extend this protection under national legislation.
Can a whistleblower report other violations?
It seems that the intention of the Polish legislator is to extend this minimum protection resulting directly from the Directive, as Article 3, Section 1 of the government bill includes a provision according to which an employer may additionally establish reporting of other violations in the workplace than those indicated in the above catalogue, including those relating to the internal regulations or ethical standards in force at that employer .
The catalogue of areas of violations that a whistleblower can report is therefore relatively broad and may be further expanded by a specific employer in a given workplace.
When will whistleblower protection not work?
It should be emphasized, however, that the draft act also contains a proposed negative catalogue regarding the protection of the whistleblower submitting the report (Article 5 of the draft act).
According to it, the provisions of the Act do not apply:
→ to the protection of classified information
→ to the secrecy related to the exercise of the profession
→ to the secrecy of judicial deliberations
→ to criminal proceedings
→ if information about the infringement of the law was reported on the basis of separate provisions, in particular as a complaint or notification of a possible crime
→ if the infringement of the law violates exclusively the rights of the reporting person or the infringement of the law is reported solely in the individual interest of the reporting person
→ to the perpetrator of the infringement of the law, if under the provisions of the law this person benefits from exemption from liability or leniency in connection with their conduct after committing the infringement of the law, in particular voluntary disclosure of the infringement of the law or cooperation with law enforcement authorities or other competent authorities
→ to infringements of the law in the field of public procurement in the fields of defence and security – i.e. when a contract awarded by a public contracting authority or a sectoral contracting authority, the subject of which is:
• supplies of military equipment, including all its parts, components, subassemblies or software,
• supplies of sensitive equipment, including all its parts, components, subassemblies or software,
• construction works, supplies and services related to the security of facilities at the disposal of entities executing contracts in the fields of defence and security or related to the equipment referred to in letters a and b, and all its parts, components and subassemblies related to the life cycle of this product or service,
• construction works and services intended exclusively for military purposes, sensitive construction works or sensitive services.
The draft provision indicates the separate nature of reporting a violation of the law under the terms specified in the Act in relation to other legal measures (provided for in other provisions), the scope of which may potentially cover even information about a violation that is identical in content (e.g. a notification of a crime or a complaint) .
The provisions of the Act will therefore not apply when information about a violation of the law is reported on the basis of separate provisions, in particular as a complaint or notification of a possible crime.
The act of reporting information about a violation of the law under the Directive does not constitute a means of protecting the rights of the reporting party. Whistleblowers report violations that pose a threat to the public interest – their actions play a key role in disclosing and preventing violations and protecting the public good.
The purpose of the draft act is not to establish an additional, individual means of defending the rights or interests of an individual who has been harmed in any way by a violation of the law, but to strengthen the legal protection of persons acting in the public interest .
For this reason, the provisions of the draft Polish Act will not apply if the reported infringement violates only the rights of the reporting person or if the infringement is reported solely in the individual interest of the reporting person (i.e. it is undertaken solely in one's own case) .
This does not mean, however, that the reporting party will not be protected by the Directive and the Act if they report an infringement that also affects their rights. This protection is excluded in situations where the report concerns " solely the rights of the reporting party" or is made "solely in the individual interest .
Whistleblower protection therefore applies when the breach also affects the reporting person personally, but he or she is not the only person affected by the breach (in the case of breaches with a more widespread scope of impact, for example concerning safety, health or environmental protection).
Legal basis:
• Directive (EU) 2019/1937 of the European Parliament and of the Council of 23 October 2019
• Draft Act on the protection of persons reporting violations of the law
This alert is for informational purposes only and does not constitute legal advice.
author:
