Proposals to amend whistle-blower of legislation require amendments

The principles of data protection whistle-blowers and those affected by such notifications should result from the provisions of the Act, believes Mirosław Wróblewski, the President of the Personal Data Protection Office.

The President of the Personal Data Protection Office has reservations about the draft Act on the protection of whistle-blowers of 8 January 2024 resuming the legislative process, which was prepared by the Minister of Family, Labour and Social Policy. The President of the Personal Data Protection Office has forwarded its comments to Maciej Berek, Chairman of the Standing Committee of the Council of Ministers, as guidance for the government’s further work on these regulations.

Mirosław Wróblewski points out that the drafter did not decide to allow anonymous reporting of infringements of the law, since reporting requires providing data, but in another place of the drafted solutions it provided for the protection of persons who report infringements anonymously. In the opinion of the President of the Personal Data Protection Office, this is an inconsistency and regulations should be drafted uniformly shaping the rights and obligations of persons who report information on infringements of the law.

Another shortcoming of the proposed solutions is that the drafter did not specify the scope of data to be used for identification of persons reporting infringements of the law and persons affected by such reporting. In the opinion of the President of the Personal Data Protection Office, specifying the scope of data in the Act would unify the particular records in which these data will be entered. In addition, the very selection of data for identification should be determined taking into account the principle of data minimisation set out in the GDPR.  

The President of the Personal Data Protection Office also points out that data processing in relation to the implementation of the objectives of the draft Act on the protection of whistle-blowers should be regulated in its provisions and not in the content of intra-organisational acts. This also applies to the determination of the rules for the protection of whistle-blowers and other persons in the Act, and not in the regulations or orders. Such determination in statutory provisions would introduce an equal standard of protection of the identity of these persons.

All comments of the President of the Personal Data Protection Office on the draft Act on the protection of whistle-blowers can be read below in the file attached to the communication.

As the legislative process is not finalised yet, the President of the Personal Data Protection Office also hopes that the comments on the provisions on the processing of personal data will be taken into account by the drafters.