Home

Internal

Global

Contatto

Rödl & Partner ha prestato la propria consulenza per il perfezionamento dell'acquisizione del Gruppo italiano FGV da parte di Hettich |

In tutto il mondo

Utilizziamo cookie tecnici per personalizzare il sito web e offrire all’utente un servizio di maggior valore. Chiudendo il banner e continuando con la navigazione verranno installati nel Suo dispositivo i cookie tecnici necessari ai fini della navigazione nel Sito. L’installazione dei cookie tecnici non richiede alcun consenso da parte Sua. Ulteriori informazioni sono contenute nella nostra Cookie Policy.

Polish Whistleblowers Act in the context of GDPR

published on 21 October 2022 | reading time approx. 3 minutes

Even though the deadline for transposition of Directive (EU) 2019/1937 of the European Parliament and of the Council of 23 October 2019 on the protection of persons who report breaches of Union law into Polish law expired on 17 December 2021, we are yet to see the Polish statute coming into force. We can only use the draft act at this stage.

Directive 2019/1937 requires organisations to implement whistleblowing procedures. No doubt, this will involve personal data processing of witnesses, violators and whistleblowers themselves. Starting from a report on a breach, through the investigation stage, and until files are submitted to competent state authorities. Depending on the type of case, the processing will involve ordinary personal data and sensitive data.

Directive 2019/1937 requires protection of identity of the whistleblowers as well as all alleged violators and third parties named in the report – throughout the procedure. In this respect, Directive 2019/1937 refers to GDPR directly. Therefore, personal data processing rules (Article 5 GDPR) and the bases for processing (Article 6 and 9) should be followed in such situations at all times.

The explanatory notes to the Polish Whistleblowers Bill list the following bases for personal data processing:

as regards ordinary personal data – Article 6(1)(e) GDPR (processing is necessary for the performance of a task carried out in the public interest or in the exercise of official authority vested in the controller. This proposal of the Polish lawmakers will allow limiting the controller’s information obligations);
as regards sensitive data – Article 9(1)(g) GDPR (processing is necessary for reasons of substantial public interest, on the basis of Union or Member State law which shall be proportionate to the aim pursued, respect the essence of the right to data protection and provide for suitable and specific measures to safeguard the fundamental rights and the interests of the data subject);
article 10 GDPR as regards processing of personal data relating to criminal convictions and offences.

When it comes to whistleblowers, Directive 2019/1937 stresses the principle of proportionality in the second sentence of Article 17 which says that personal data which are manifestly not relevant for the handling of a specific report shall not be collected or, if accidentally collected, shall be deleted without undue delay.

At the same time, for a whistleblowing system to be effective it must above all protect the identity of the whistleblowers – their personal data should remain confidential and be disclosed only with their consent. This Polish draft statute excludes the mandatory disclosure of the source of data about the data subject (Article 14(2)(f) GDPR).

Depending on the national legislation, completely anonymous reports may be permitted but the Polish draft statute stipulates that such anonymous reports do not have to be processed.

Importantly, even though the Polish Whistleblowers Act is still being worked on and the EU directives are generally not applicable directly, the relevant procedures in public entities have been recommended since 17 December 2021. As regards private organisations, they most certainly represent a good business practice and a lot of Polish companies have decided to implement such procedures already.

DATA PROTECTION BITES

Read all releases »

Contact

Contact Person Picture

Alicja Szyrner

Attorney at Law

+48 58 582 62 83

Invia richiesta

RÖDL & PARTNER POLAND

Discover more about our offices in Poland. Read more »