ACT on the Protection of Whistleblowers
Date:
JOURNAL OF LAWS
OF THE REPUBLIC OF POLAND
_______________________________________________________________________
Warsaw, 24 June 2024
Item 928
ACT
of 14 June 2024
on the protection of whistleblowers 1,2
Chapter 1
General provisions
Article 1. This Act regulates:
1) the requirements for extending protection to whistleblowers who report or publicly disclose information on breaches of law;
2) protection measures for whistleblowers who report or publicly disclose information on breaches of law;
3) rules for setting out an internal procedure of reporting information on breaches of law and taking follow-up action;
4) rules for reporting information on breaches of law to a public authority;
5) rules for public disclosure of information on breaches of law;
6) responsibilities of the Commissioner for Human Rights with regard to reporting breaches of law;
7) responsibilities of public authorities with regard to reporting breaches of law and taking follow-up action.
Article 2. Whenever reference is made in this Act to:
1) follow-up action – it shall be understood as an action taken by a legal entity or public authority in order to assess the accuracy of the information contained in the report and to address the reported breaches, in particular by launching an investigation, audit or administrative proceedings, prosecution, action for recovery of funds or closure of the procedure carried out as the internal procedure of reporting breaches of law and taking follow-up action and or as the procedure of receiving external reports and taking follow-up action;
2) retaliation - it shall be understood as any direct or indirect act or omission which occurs in a work-related context, is prompted by reporting or public disclosure and infringes or may infringe the rights of the whistleblower or causes or may cause unjustified detriment to the whistleblower, including by undertaking unfounded proceedings against the whistleblower;
3) information on a breach of law - it shall be understood as information, including reasonable suspicion, about an actual or potential breach which occurred or is likely to occur in the legal entity in which the whistleblower participated in a recruitment process or other pre-contractual negotiations, or in which the whistleblower works or worked, or in another legal entity with which the whistleblower is or was in contact in a work-related context, and about attempts to conceal such a breach;
4) feedback - it shall be understood as information provided to the whistleblower about the action envisaged or taken as follow-up action, as well as the reasons thereof;
5) work-related context - it shall be understood as past, current or future activities related to the performance of work under an employment relationship or any other legal relationship constituting the basis for the performance of work or services or the exercise of a function or service in or for a legal entity, as part of which the report about the breach of law has been received and retaliation may be experienced;
6) public authority - it shall be understood as a supreme or central government administration body, regional body of the central government, local government body, other state authority or other entity that performs public administration duties by virtue of law and is competent to take follow-up action in the areas set out in Article 3(1);
7) person concerned by the report - it shall be understood as a natural person, a legal person or an organisational unit that has no legal personality but has legal capacity pursuant to an act of Parliament, that is referred to in the report or public disclosure as a person to whom the breach is attributed or with whom that person is associated;
8) facilitator - it shall be understood as a natural person who has assisted the whistleblower in making the report or public disclosure in a work-related context and whose assistance should not be disclosed;
9) person associated with the whistleblower - it shall be understood as a natural person who may experience retaliation, including a co-worker or a person close to the whistleblower within the meaning of Article 115(11) of the Act of 6 June 1997 - Penal Code (Journal of Laws of 2024, item 17);
10) legal entity - it shall be understood as a private entity or a public entity;
11) private entity - shall be understood as a natural person who is self-employed, a legal person or an organisational unit without legal personality, that has legal capacity pursuant to an act of Parliament, or an employer, if they are not public entities;
12) public entity - it shall be understood as an entity referred to in Article 3 of the Act of 11 August 2021 on open data and reuse of public sector information (Journal of Laws of 2023, item 1524);
13) legal proceedings - it shall be understood as proceedings under generally applicable law, in particular criminal, civil, administrative or disciplinary proceedings, proceedings regarding infringement of the public finance discipline, or proceedings under internal regulations issued with the aim to enforce the provisions of generally applicable law, in particular proceedings regarding mobbing;
14) public disclosure - it shall be understood as the making of information on a breach of law available in the public domain;
15) report - it shall be understood as an oral or written internal report or external report made in accordance with the requirements set out in the act;
16) internal report - it shall be understood as an oral or written communication of information on a breach of law to a legal entity;
17) external report - it shall be understood as an oral or written communication of information on a breach of law to the Commissioner for Human Rights or a public authority.
Article 3 (1). A breach of law is an act or omission that is unlawful or intended to circumvent the law and that concerns:
1) corruption;
2) public procurement;
3) financial services, products and markets;
4) prevention of money laundering and terrorist financing;
5) product safety and compliance;
6) transport safety;
7) environmental protection;
8) radiological protection and nuclear safety;
9) food and feed safety;
10) animal health and welfare;
11) public health;
12) consumer protection;
13) protection of privacy and personal data;
14) security of information and communication networks and systems;
15) financial interests of the State Treasury of the Republic of Poland, local governments and the European Union;
16) internal market of the European Union, including public-law competition, State aid and corporate tax rules;
17) constitutional human and civil rights and freedoms – existing in relations of individuals with public authorities and not related to the areas set out in points 1 to 16.
(2) A legal entity may additionally provide, as part of the internal reporting procedure, for the possibility to report breaches of internal regulations or ethical standards that are in force in the entity and that have been adopted by the entity pursuant to generally applicable law and are consistent with it. In such an event, the provisions of Chapters 4 and 5 shall not apply.
Article 4 (1). A whistleblower is an individual who reports or publicly discloses information on a breach of law, acquired by him or her in a work-related context, including:
1) employee;
2) temporary employee;
3) person who performs work on grounds other than the employment relationship, including under a civil law contract;
4) entrepreneur;
5) commercial proxy;
6) shareholder or partner;
7) member of a body of a legal entity or an organisational unit that has no legal personality;
8) person who performs work under the supervision and management of a contractor, subcontractor or supplier;
9) trainee;
10) volunteer;
11) apprentice;
12) officer within the meaning of Article 1(1) of the Act of 18 February 1994 on retirement pensions for officers of the Police, the Internal Security Agency, the Intelligence Agency, the Military Counterintelligence Service, the Military Intelligence Service, the Central Anti-Corruption Bureau, the Border Guard, the Marshal Guard, the State Protection Service, the State Fire Service, the Customs and Revenue Service and the Prison Service and their families (Journal of Laws of 2023, items 1280, 1429 and 1834);
13) soldier within the meaning of Article 2(39) of the Act of 11 March 2022 on Defence of the Homeland (Journal of Laws of 2024, items 248 and 834).
(2) This Act shall also apply to natural persons referred to in paragraph (1) in cases of disclosure by them of information on a breach of law, acquired in a work-related context prior to the establishment by them of the employment relationship or other legal relationship as grounds for the provision of work or services or the exercise of a function in or for a legal entity, or after the termination of such a relationship.
Article 5 (1). This Act shall not apply to information covered by:
1) regulations on the protection of classified information and other information not subject to disclosure under generally applicable law for reasons of public security;
2) professional secrecy of medical and legal professionals;
3) secrecy of judicial deliberations;
4) criminal proceedings - as regards the secrecy of pre-trial proceedings and the secrecy of an in camera hearing.
(2) This Act shall not apply to breaches of law concerning procurement in the areas of defence and security within the meaning of Article 7(36) of the Act of 11 September 2019 - Public Procurement Law (Journal of Laws of 2023, items 1605 and 1720) to which this Act does not apply, offset contracts concluded under the Act of 26 June 2014 on certain contracts concluded in connection with procurement of fundamental importance for the security of the State (Journal of Laws of 2022, item 1218) and other measures taken to protect fundamental or significant interests of the security of the State under Article 346 of the Treaty on the Functioning of the European Union.
(3) The provisions of Chapter 5 shall not apply to breaches of law relating directly to the performance, by the special services referred to in Article 11 of the Act of 24 May 2002 on the Internal Security Agency and the Intelligence Agency (Journal of Laws of 2024, item 812), of their statutory duties aimed at ensuring the national security.
(4) The public authority competent to receive an external report on a breach of law by the special services referred to in Article 11 of the Act of 24 May 2002 on the Internal Security Agency and the Intelligence Agency and to carry out the tasks referred to in Chapter 4 shall be the Prime Minister or the Minister - Coordinator of Special Services if appointed.
Article 6. The whistleblower, from the time of making the report or public disclosure, shall be subject to protection referred to in Chapter 2, provided that the whistleblower had reasonable grounds to believe that the information contained in the report or public disclosure was true at the time of making the report or public disclosure and constituted information on a breach of law.
Article 7 (1). A legal entity, the Commissioner for Human Rights and a public authority may receive reports made anonymously.
(2) In the event information on a breach of law has been reported to a legal entity, the Commissioner for Human Rights or a public authority or has been publicly disclosed in an anonymous form and, subsequently, the identity of the whistleblower has been revealed and the whistleblower has experienced retaliation, the provisions of Chapter 2 shall apply provided that the requirements set out in Article 6 have been met.
(3) In the event information on a breach of law has been reported in an anonymous form and the report has been received by a legal entity, the Commissioner for Human Rights or a public authority, this Act shall apply, with the exception of Article 32(3), (5) and (6), Article 34(1)(6), Article 37, Article 38, Article 40(1) second sentence, Article 40(2) and Article 41.
Article 8 (1). The personal data of the whistleblower, based on which his or her identity can be determined, shall not be disclosed to unauthorised persons unless the whistleblower has expressly consented thereto.
(2) The provision of paragraph (1) shall not apply where disclosure is a necessary and proportionate obligation under law in connection with investigations by public authorities or pre-trial or judicial proceedings conducted by courts, including in order to safeguard the rights of defence of persons concerned by the report.
(3) Prior to disclosure referred to in paragraph (2) the competent public authority or the competent court shall notify the whistleblower thereof by sending to him or her, in paper or electronic form, a statement of reasons for the disclosure of his or her personal data, unless such notification would jeopardise the related investigation or pre-trial or judicial proceedings.
(4) The legal entity or public authority, after receiving the report, shall process personal data to the extent necessary for receiving the report or taking follow-up action. Personal data which are not relevant for the handling of the report shall not be collected or, if accidentally collected, shall be deleted without undue delay. The deletion of such personal data shall take place within 14 days of finding it irrelevant for the case.
(5) The provision of Article 14(2)(f) of Regulation (EU) 2016/679 of the European Parliament and of the Council of 27 April 2016 on the protection of natural persons with regard to the processing of personal data and on the free movement of such data and repealing Directive 95/46/EC (the General Data Protection Regulation) (OJ EU L 119, 04.05.2016, p. 1, as amended3 ), hereinafter referred to as ‘Regulation 2016/679’, shall not apply unless the whistleblower fails to meet the requirements set out in Article 6 or has explicitly consented to the disclosure of his or her identity.
(6) The provision of Article 15(1)(g) of Regulation 2016/679 regarding the provision of information on the source of the personal data collected shall not apply unless the whistleblower fails to meet the requirements set out in Article 6 or has explicitly consented to the provision of such information.
(7) Personal data processed in connection with the external report received as well as documents relating to the report shall be retained by the Commissioner for Human Rights for 12 months following the end of the calendar year in which the external report was transmitted to the public authority competent to take follow-up action.
(8) Personal data processed in connection with an external report received or with the follow-up action taken as well as documents relating to the report shall be retained by the legal entity and the public authority for 3 years following the end of the calendar year in which the external report was transmitted to the public authority competent to take follow-up action or in which the follow up action ended or in which the proceedings triggered by the follow-up action ended.
(9) In the event referred to in paragraphs (7) or (8) the Commissioner for Human Rights, the legal entity and the public authority shall delete the personal data and destroy the documents relating to the report at the end of the retention period. The Act of 14 July 1983 on the national archival holdings and archives (Journal of Laws of 2020, item 164) shall not apply.
(10) The provision of paragraph (9) shall not apply where the documents relating to the report constitute a part of the file in pre-trial proceedings or proceedings before a court or an administrative court.
Article 9. This Act does not exclude the application of provisions concerning the right of employees to consult with trade unions, to be protected against unjustified detrimental action resulting from such consultation, the right of association and the right to conclude collective agreements.
Article 10 (1). This Act shall apply to the extent not regulated by the provisions of the normative acts established by the European Union institutions set out in Part II of the Annex to Directive (EU) 2019/1937 of the European Parliament and of the Council of 23 October 2019 on the protection of persons who report breaches of Union law (OJ EU L 305, 26.11.2019, p. 17, as amended 4), hereinafter referred to as ‘Directive 2019/1937’, and by the provisions implementing or enforcing those acts.
(2) This Act shall not exclude the application of separate provisions on special procedures for reporting breaches of law, including the examination of reports made anonymously on breaches of law.
Chapter 2
Prohibition of retaliation and whistleblower protection measures
Article 11. No retaliation, or attempts or threats of retaliation, may be taken with regard to a whistleblower.
Article 12 (1). Where work has been, is or is due to be provided under an employment relationship, no retaliation may be taken against the whistleblower, involving in particular:
1. refusal to establish the employment relationship;
2. termination of the employment relationship with or without notice;
3. failure to conclude an employment contract for a definite term or an employment contract for an indefinite term after the termination of the contract for a trial period, failure to conclude a subsequent employment contract for a definite term or failure to conclude an employment contract for an indefinite term after the termination of an employment contract for a definite term where the whistleblower had legitimate expectations that such contract would be concluded with him or her;
4. reduction in the amount of remuneration for work;
5. withholding promotion or passing over for promotion;
6. passing over for work-related benefits other than salary or wage or reduction in the amount of such benefits;
7. demotion;
8. suspension in the performance of employee or professional duties;
9. assigning the whistleblower’s existing duties to another worker;
10. disadvantageous change in the place of work or working time schedule;
11. negative performance assessment or employment reference;
12. imposition or administering of any disciplinary measure, including a financial penalty or any similar measure;
13. coercion, intimidation or ostracism;
14. mobbing
15. discrimination;
16. disadvantageous or unfair treatment;
17. withholding of participation or passing over for professional improvement training;
18. ungrounded medical referral, including psychiatric referral, unless separate regulations provide for the possibility of such referral;
19. blacklisting on the basis of a sector or industry-wide informal or formal agreement, which may entail that the person will not, in the future, find employment in the sector or industry;
20. causing financial loss, including loss of business and loss of income;
21. other intangible damage, including violation of the person’s moral rights, including reputational damage to the whistleblower.
(2) Retaliation for making a report or public disclosure is also deemed to include attempts or threats of resorting to any action referred to in paragraph (1) above.
(3) It shall be for the employer to prove that measure referred to in paragraph (1) or (2) is not retaliation.
Article 13 (1) If work or services were, are or are due to be provided on the basis of a legal relationship other than employment relationship but constituting the basis for the provision of work or services or the exercise of a function, the provisions of Article 12 above shall apply accordingly, unless the nature of the work or services provided or the function exercised render such action inapplicable to the whistleblower.
(2) If work or services were, are or are due to be provided on the basis of a legal relationship other than employment relationship but constituting the basis for the provision of work or services or the exercise of a function, no reporting or public disclosure may give rise to any retaliation or an attempt or threat thereof, including in particular:
1) termination of an agreement to which the whistleblower is a party, in particular one relating to the sale or supply of goods or the provision of services, or withdrawal from such an agreement or its termination without notice;
2) imposing an obligation to have, or refusing to grant, or limiting or withdrawing an entitlement, in particular a licence, permit or relief.
Article 14. A whistleblower who has experienced retaliation has the right to damages in an amount no lower than the average monthly remuneration in the national economy for the preceding year, as announced for retirement pension purposes in Monitor Polski Official Journal of the Republic of Poland by the President of Statistics Poland, or the right to compensation.
Article 15. A person who has suffered damages because of intentional reporting or public disclosure made by the whistleblower and containing false information, is entitled to seek damages or compensation for infringement of personal interests from the whistleblower.
Article 16 (1). The making of a report or public disclosure may not give rise to liability, including disciplinary liability or liability for damage caused by violating the rights of other individuals or the obligations set out in legal regulations, in particular regarding defamation, infringement of personal rights, copyright, personal data protection laws and confidentiality obligations, including business secrecy, provided that the whistleblower had reasonable grounds to believe that the report or public disclosure was necessary to disclose the breach in accordance with this Act.
(2) Where legal proceedings have been instituted in respect of the liability referred to in paragraph (1) the whistleblower may request that such proceedings be discontinued.
(3) Acquiring information that is the subject of a report, or publicly disclosing or accessing such information, may not constitute grounds for liability, provided that the acquisition of or access to such information is not prohibited.
Article 17. The rights set forth in this Chapter may not be waived, nor may liability be accepted for damage caused by the making of a report or public disclosure. This does not apply to accepting liability for damage caused by knowingly reporting or publicly disclosing information that was not true.
Article 18. The provisions of the legal acts referred to in Article 9(2) of the Act of 26 June 1974 - Labour Code (Journal of Laws of 2023, item 1465 and of 2024, item 878), insofar as they directly or indirectly exclude or limit the right to make a report or public disclosure or provide for the possibility of retaliation, shall not apply.
Article 19. The provisions of employment contracts and other instruments under which the employment relationship is established or the rights and obligations of the parties to the employment relationship are determined shall be null and void to the extent that they directly or indirectly exclude or limit the right to make a report or public disclosure or provide for the possibility of retaliation.
Article 20. The provisions of contracts and other instruments, other than those referred to in Article 19, under which work or services are provided, goods are delivered or sales are made shall be null and void to the extent that they directly or indirectly exclude or limit the right to make a report or public disclosure or provide for the possibility of retaliation.
Article 21 (1). The provisions of this Chapter shall apply accordingly to facilitators and persons associated with a whistleblower.
(2) The provisions of this Chapter shall apply accordingly to the legal person or other organisational unit that is a facilitator for the whistleblower or is associated with the whistleblower, in particular by being owned by the whistleblower or employing the whistleblower.
Article 22. The provisions of this Chapter shall apply accordingly in cases where the information on a breach of law has been reported to a competent institution, body or agency of the European Union in accordance with the procedure applicable to such reporting.
Chapter 3
Internal reporting
Article 23 (1). The provisions of this Chapter shall apply to legal entities for which gainful work is performed by at least 50 persons as of 1 January or as of 1 July of a given year.
(2) The group of 50 persons performing gainful work for a given entity shall include those employed under an employment contract and those performing paid work on a basis other than an employment contract, converted into full-time position equivalents, if no other persons are employed to perform this work.
(3) The threshold referred to in paragraph (1) shall not apply to legal entities that carry out activities in the field of financial services, products and markets, anti-money laundering and anti-terrorist financing, transport safety and environmental protection, which are covered by the applicability scope of the legislative acts of the European Union, set out in Parts I.B and II of the Annex to Directive 2019/1937.
(4) In the event of legal entities that are local governments, the obligations of legal entities, as set forth in this Chapter, shall be performed by organisational units of local governments, with the exception of Article 28 (5).
(5) The provisions of this Chapter shall not apply to organisational units of municipalities or counties with a population of less than 10,000.
Article 24 (1). The legal entity shall establish an internal procedure of reporting breaches of law and taking follow-up action, hereinafter referred to as the ‘internal reporting procedure’, in line with the requirements set out in this Chapter.
(2) Entities for which less than 50 persons perform gainful work and entities referred to in Article 23(5) may establish an internal reporting procedure.
(3) A legal entity shall establish the internal reporting procedure after consulting with:
1) the trade union organisation of the work establishment or the trade union organisations of the work establishment if there is more than one such organisation in the legal entity, or
2) representatives of persons who work for the legal entity, selected according to the procedure adopted by it, in the event the legal entity, as the work establishment, has no trade union organisation operating within it.
(4) The consultations referred to in paragraph (3) shall last no less than 5 days and no more than 10 days from the date on which a draft internal reporting procedure was made known by the legal entity.
(5) The internal reporting procedure shall enter into force 7 days after making it known, in the manner adopted by the legal entity, to persons who work for the entity.
(6) A person who seeks a job under an employment relationship or any other legal relationship constituting the basis for the performance of work or services or the exercise of a function or service in or for a legal entity shall be informed by the entity of the internal reporting procedure at the beginning of the recruitment process or pre-contractual negotiations.
Article 25 (1) The internal reporting procedure shall indicate:
1) the internal organisational unit or the person within the organisational structure of the legal entity, or the external entity authorised by the legal entity, authorised to receive internal reports;
2) the means to be used by whistleblowers to communicate their internal reports, together with the correspondence addresses or e-mail addresses of the whistleblower, hereinafter referred to as the “contact address”;
3) the impartial internal organisational unit or person within the organisational structure of the legal entity, authorised to undertake follow-up action, including verification of the internal report and further communication with the whistleblower, including requesting additional information and providing feedback to the whistleblower; this function may be performed by the internal organisational unit or person referred to in point 1 if they ensure impartiality;
4) the procedure of dealing with information on breaches of law reported anonymously;
5) the obligation to inform the whistleblower of the receipt of the internal report within 7 days thereof, unless the whistleblower has not provided a contact address to which such information should be transmitted;
6) the obligation to take diligent follow up action by the internal organisational unit or the person referred to in point 3;
7) the timeframe for providing feedback to the whistleblower, which does not exceed 3 months of the acknowledgement of the internal report or, if the acknowledgement referred to in point 5 has not been provided, 3 months of the expiry of 7 days of the receipt of the internal report, unless the whistleblower has not provided a contact address to which feedback should be provided;
8) comprehensible and easily accessible information on how to make external reports to the Commissioner for Human Rights or public authorities and, where applicable, to European Union institutions, bodies or agencies.
(2) The internal reporting procedure may optionally cover, in particular:
1) communication of breaches referred to in Article 3(2) if the legal entity has provided for the possibility to report such breaches;
2) indication of risk factors which take into account the nature of the activities of the legal entity and which may lead to specific breaches of law concerning, in particular, the breach of regulatory or other obligations set out in the law or the risk of corruption;
3) information that a breach of law may in any case be reported also to the Commissioner for Human Rights or a public authority, without using the internal reporting procedure;
4) information about the system of incentives for using the internal reporting procedure in cases where the breach of law can be effectively remedied within the organisational structure of the legal entity and the whistleblower considers that there is no risk of retaliation.
Article 26 (1). The methods of making internal reports, referred to in Article 25(1)(2), shall include at least the possibility to make an oral report or a written report.
(2) Oral reports can be made via telephone or by means of electronic communication within the meaning of Article 2(5) of the Act of 18 July 2002 on the provision of services by electronic means (Journal of Laws of 2020, item 344).
(3) An oral report made by way of a recorded telephone call or other recorded voice communication system shall be documented, with the consent of the whistleblower, in the form of:
1) recording of the conversation in a retrievable form, or
2) complete and accurate transcription of the conversation, made by the unit, person or entity referred to in Article 25(1)(1).
(4) Oral reports made by way of an unrecorded telephone call or other unrecorded voice communication system shall be documented in the form of a report on the conversation, containing a precise description of the conversation, drawn up by the unit, person or entity receiving the report, referred to in Article 25(1)(1).
(5) In the events referred to in paragraph (3)(2) or paragraph (4) the whistleblower may verify, correct and approve the transcript of the conversation or the report on the conversation by signing the transcript.
(6) On request of the whistleblower an oral report may be made during an in-person meeting held within 14 days of the receipt of the request. In such a case, with the consent of the whistleblower the report shall be documented in the form of:
1) recording of the conversation in a retrievable form, or
2) complete and accurate recording of the meeting, drawn up by the unit, person or entity receiving the report, referred to in Article 25(1)(1).
(7) In the event referred to in paragraph 6(2) the whistleblower may verify, correct and approve the recording of the meeting by way of signing it.
(8) A written report may be made in paper or electronic form.
Article 27 (1). The legal entity shall ensure that the internal reporting procedure and the processing of personal data relating to received reports prevent unauthorised persons from accessing information contained in the reports and ensure the confidentiality of the identity of the whistleblower, the person concerned by the report and any third party mentioned in the report. Confidentiality protection shall concern information that can be used in order to directly or indirectly reveal the identity of such persons.
(2) Only persons authorised in writing by the legal entity shall receive and verify internal reports, take follow up action and process personal data of persons referred to in paragraph 1. The authorised persons shall maintain the secrecy of the information and personal data they have accessed in connection with receiving and verifying internal reports and taking follow-up action, also after the termination of their employment relationship or other legal relationship within which such work has been performed by them.
Article 28 (1). The granting of authorisation to an external entity referred to in Article 25(1)(1) shall require concluding an agreement that delegates to the entity the duty to receive internal reports, acknowledge their receipt, provide feedback and provide information on the internal reporting procedure, with the use of technical and organisational solutions ensuring the compliance of those actions with the Act.
(2) The agreement referred to in paragraph (1) shall set out in detail the rights and obligations of the external entity in relation to the processing of personal data referred to, in particular, in Article 28 (3) of Regulation 2016/679.
(3) Private entities for which gainful work is performed by at least 50 persons but no more than 249 persons may, by way of an agreement, establish common rules on receiving and verifying internal reports and conducting investigations, provided that compliance of the performed activities with the Act is ensured. The provisions of Article 23 (1) and (2) shall apply accordingly.
(4) The conclusion of the agreement referred to in paragraphs (1) and (3) shall not waive the duty of the legal entity to comply with the obligations set out in this Chapter, in particular with regard to confidentiality, feedback and follow-up action.
(5) Local governments may establish a joint procedure of internal reporting, as part of the shared service referred to in Article 10a of the Act of 8 March 1990 on municipal government (Journal of Laws of 2024, item 609 and 721), Article 6a of the Act of 5 June 1998 on county government (Journal of Laws of 2024, item 107) and Article 8c of the Act of 5 June 1998 on voivodeship government (Journal of Laws of 2024, item 566), provided that it is separate and independent from the procedure of receiving external reports and taking follow-up action.
(6) The entities referred to in paragraph (3) shall be separate controllers of the personal data acquired in connection with receiving and verifying reports. A controller may not have access to personal data received by another controller.
(7) The provision of paragraph 6 shall not apply if it has been found, as a result of an investigation, that the controller competent for receiving the internal report or taking follow-up action is different than the controller who has received the internal report, or if at least two controllers are competent to receive it. Only the personal data necessary for taking follow-up action shall be made available to the controller.
(8) Private entities that are part of a capital group within the meaning of Article 4(14) of the Act of 16 February 2007 on competition and consumer protection (Journal of Laws of 2024, item 594) may establish a joint procedure of internal reporting, provided that compliance of the performed activities with the Act is ensured.
Article 29 (1). The legal entity shall:
1) keep the register of internal reports;
2) be the controller of personal data contained in the register of internal reports.
(2) The legal entity may authorise its internal organisational unit or a person referred to in Article 25(1)(1) or (3) to keep a register of internal reports.
(3) Entries in the register of internal reports shall be made on the basis of the internal reports.
(4) The register of internal reports shall indicate:
1) number of the report;
2) object of the breach of law;
3) personal data of the whistleblower and the person concerned by the report, necessary for their identification;
4) contact address of the whistleblower;
5) date of the report;
6) information on the follow-up action taken;
7) date of closure of the case.
(5) The personal data and any other information entered in the register of internal reports shall be retained for 3 years following the end of the calendar year in which the follow-up action ended or the proceedings initiated as part of the follow-up action ended.
Chapter 4
External reports
Article 30 (1). A whistleblower may make an external report without first making an internal report.
(2) An external report shall be accepted either by the Commissioner for Human Rights or by a public authority.
(3) The Commissioner for Human Rights and the public authority shall be separate controllers with regard to the personal data provided in external reports received by them.
Article 31 (1). The Commissioner for Human Rights shall:
1) establish the procedure of receiving external reports, that shall set out, in particular, the procedure of handling information on breaches of law reported anonymously;
2) receive external reports on breaches of law in the areas specified in Article 3(1)(1)-(16), carry out their preliminary verification and transmit them to the public authority competent to take follow-up action;
3) receive and consider external reports – in the event the report concerns a breach in one of the areas specified in Article 3(1)(17) and no other public authority is competent to take follow-up action;
4) ensure public access to information on the rights of whistleblowers and persons referred to in Article 21, on remedies against retaliation available to them, and on the rights of persons concerned by an external report, in particular by posting the information on the website of the Commissioner, in the Public Information Bulletin;
5) provide whistleblowers, persons referred to in Article 21 and persons concerned by an external report with advice within the scope referred to in point 4;
6) provide whistleblowers and persons referred to in Article 21 with information on the authorities which, within the scope of their duties, may undertake action in order to protect whistleblowers against retaliation, and, in relevant cases, provide support to whistleblowers in their contacts with such authorities, in particular by informing the competent authorities of the need to provide protection to a given whistleblower.
(2) The consideration by the Commissioner for Human Rights of external reports referred to in paragraph (1)(3) shall include the activities specified in Article 11, Article 12 and Article 13(1), (2) and (3) of the Act of 15 July 1987 on the Commissioner for Human Rights (Journal of Laws of 2023, item 1058 and of 2024, item 928).
Article 32 (1). The preliminary verification of an external report by the Commissioner for Human shall consist in determining whether the report relates to information on a breach of law and in identifying the public authority competent to take follow-up action.
(2) If the external report relates to information on a breach of law, the Commissioner for Human Rights shall transmit the report without delay, no later than within 14 days of the date on which the report was made, to the public authority competent to take follow-up action.
(3) The Commissioner for Human Rights shall inform the whistleblower that the external report has been transmitted. The information shall include at least the details of the public authority to which the external report has been transmitted and the date of its transmission.
(4) The Commissioner for Human Rights shall refrain from transmitting the external report if it does not contain information on a breach of law.
(5) The Commissioner for Human Rights shall inform the whistleblower of refraining from transmitting the external report and shall set out the findings of the preliminary verification of the report.
(6) When refraining from transmitting the external report, the Commissioner for Human Rights may inform the whistleblower that the information contained in the report is subject to consideration under separate regulations, in particular regarding civil lawsuit, notification of suspected offence, complaint to an administrative court, other complaint, application or petition, or that it may be submitted to competent authorities for consideration under other procedure. The provision of such information to the whistleblower shall not, in particular, affect the admissibility of any subsequent legal action, the time limits for action, the content of rulings or the outcome of proceedings. The information provided to the whistleblower shall include a statement in this regard.
(7) Transmitting a report as referred to in paragraph (2), or refraining from transmitting a report as referred to in paragraph (4) shall not constitute action referred to in Article 3(2)(4) the Act of 30 August 2002 - Law on proceedings before administrative courts (Journal of Laws of 2023, items 1634, 1705 and 1860).
Article 33. The public authority shall establish a procedure of receiving external reports and taking follow-up action, which shall determine, in particular, the procedure of handling information on breaches of law reported anonymously, hereinafter referred to as the “external reporting procedure”.
Article 34 (1). The public authority shall:
1) receive external reports;
2) carry out preliminary verification of external reports by way of determining whether a given report contains information on a breach of law and whether the breach falls within the scope of activity of the authority and if not, in identifying the public authority competent to take follow-up action;
3) consider external reports – if they concern breaches of law that fall within the scope of activity of the authority;
4) transmit external reports without delay, no later than within 14 days of the date on which the report was made or, in justified cases, no later than within 30 days, to the public authority competent to take follow-up action – where the report relates to a breach not falling within the scope of activity of the transmitting authority, and shall inform the whistleblower thereof;
5) take follow-up action with due diligence;
6) provide feedback to the whistleblower.
(2) The provisions of Article 32(4) to (6) shall apply accordingly.
(3) Where the information on a breach of law has been the subject of an external report and, simultaneously, of a filed complaint referred to in Article 227 of the Act of 14 June 1960 - Code of Administrative Procedure (Journal of Laws of 2024, item 572) or where it follows from the content of the received letter that an external report has been made, solely the provisions of this chapter shall apply.
(4) Where separate provisions do not make it possible to identify the authority competent to resolve the dispute as to the competence between public authorities with regard to the consideration of the external report and taking follow-up action, the provisions of Article 22 and Article 23 of the Act of 14 June 1960 - Code of Administrative Procedure shall apply accordingly.
Article 35 (1). In order to ensure effective follow-up action and feedback, the whistleblower shall provide a contact address.
(2) If a contact address has not been provided in the external report or if it is not possible to determine the address based on the data held:
1) the Commissioner for Human Rights shall not carry out the obligations referred to in Article 32(3) and (5), Article 37 and Article 40(1), second sentence;
2) the public authority shall not carry out the obligations referred to in Article 32(5), Article 37, Article 38, Article 40(2), second sentence and Article 41.
Article 36 (1). An external report may be made orally or in writing. The provisions of Article 26(2) to (8) shall apply accordingly.
(2) An external report in the form of a document may be made:
1) in paper form - to the correspondence address indicated by the Commissioner for Human Rights or the public authority receiving the report;
2) in electronic form - to the e-mail address, electronic mailbox address or electronic delivery address indicated by the Commissioner for Human Rights or the public authority receiving the report, or a dedicated online form or an application indicated by the public authority as the application designated for making electronic reports.
Article 37. The Commissioner for Human Rights or the public authority that has received the external report shall promptly transmit to the whistleblower, no later than within 7 days of the receipt of the report, an acknowledgment of its receipt, unless the whistleblower has explicitly requested otherwise or the Commissioner for Human Rights or the public authority reasonably believes that that acknowledging receipt of the report would jeopardise the protection of the whistleblower's identity.
Article 38. At the request of the whistleblower the public authority competent to take follow-up action shall issue, no later than within one month from the receipt of the request, certification of the fact that the whistleblower qualifies for protection as set out in Chapter 2.
Article 39 (1). The Commissioner for Human Rights or the public authority may request the whistleblower, using the contact address provided by him or her, to provide clarification or additional information that may be held by the whistleblower. If the whistleblower refuses to provide the requested clarification or additional information or if their provision may jeopardise the protection of the whistleblower’s identity, the Commissioner for Human Rights or the public authority shall refrain from requesting the clarification or additional information.
(2) In justified cases the public authority may transmit the external report, for the purpose of conducting an investigation, to:
1) organisational units subordinate to or supervised by the public authority;
2) other organisational unit to which duties have been delegated under an agreement.
(3) The provisions of Articles 42-44 shall apply accordingly to the entities referred to in paragraph (2).
(4) The Commissioner for Human Rights or the public authority shall, without undue delay, transmit the information contained in the external report to the competent institutions, bodies or agencies of the European Union for the purpose of taking follow-up action in accordance with the procedures adopted by those institutions, bodies or units, if so provided in separate regulations.
Article 40 (1). The Commissioner for Human Rights may leave the external report unprocessed if the Commissioner has refrained from transmitting the earlier external report to the public authority competent to take follow-up action, or if the external report on the matter already raised in the earlier report by the same or another whistleblower does not contain any meaningful new information on a breach of law, compared to the earlier external report. The Commissioner for Human Rights shall notify the whistleblower that the report has been left unprocessed and shall state the reasons thereof, and in the case of a subsequent report, shall leave it unprocessed without notifying the whistleblower thereof.
(2) The public authority may take no follow-up action if the external report on the matter already raised in the earlier report by the same or another whistleblower does not contain any meaningful new information on a breach of law, compared to the earlier external report. The public authority shall notify the whistleblower of not taking any follow-up action and shall state the reasons thereof, and in the case of a subsequent report, shall leave it unprocessed without notifying the whistleblower thereof.
(3) In the cases referred to in paragraphs (1) and (2), such fact together with the statement of reasons shall be registered by the Commissioner for Human Rights or the public authority in the register referred to in Article 45 or Article 46.
Article 41 (1). The public authority shall provide the whistleblower with feedback within 3 months of the receipt of the external report.
(2) In duly justified cases, the public authority shall provide the whistleblower with feedback within 6 months of the receipt of the external report, having informed the whistleblower thereof before the expiry of the time limit referred to in paragraph (1).
(3) The public authority shall also inform the whistleblower about the final outcome of investigations triggered by the external report.
Article 42 (1). The communication channels established by the Commissioner for Human Rights or the public authority for receiving external reports:
1) shall be independent of the communication channels used for usual activities of these bodies;
2) shall ensure completeness, confidentiality and integrity of data, including its protection against unauthorised access;
3) shall enable durable storage of information to allow further investigations to be carried out.
(2) The communication channels used by the Commissioner for Human Rights and the public authority for purposes other than receipt of external reports may also be used for the receipt of such reports if they meet the requirements set out in paragraph 1.
Article 43 (1). The Commissioner for Human Rights and the public authority shall ensure that the procedure of receiving external reports, the procedure of external reporting and the processing of personal data related to receiving the reports:
1) prevents unauthorised access to information contained in the reports;
2) ensures confidentiality of the identity of whistleblowers and persons concerned by the reports.
(2) The confidentiality protection referred to in paragraph (1)(2) shall apply to information based on which the identity of the whistleblower and the person concerned by the report may be directly or indirectly identified.
Article 44 (1). The Commissioner for Human Rights shall designate, from among employees of the Office of the Commissioner for Human Rights, persons authorised to:
1) receive external reports, carry out their preliminary verification and provide information to whistleblowers in accordance with Article 32(3), (5) and (6);
2) provide interested persons with information on the procedure of receiving external reports.
(2) The public authority shall designate, from among employees of the office providing service to the authority, persons authorised to:
1) receive external reports, carry out their preliminary verification, take follow-up action and process personal data related thereto;
2) contact whistleblowers in order to provide feedback and, if needed, to request clarification or additional information that may be held by them with regard to the report;
3) provide interested persons with information on the external reporting procedure.
(3) Persons referred to in paragraph (1) and (2) shall be designated based on their professional qualifications, in particular expertise in the field of personal data protection law and practices and the ability to perform the assigned tasks.
(4) Authorised employees of the Office of the Commissioner for Human Rights and of the office providing service to the public authority shall be bound by the duty of secrecy with regard to information and personal data acquired in connection with receiving and verifying external reports or taking follow-up action, also after their employment relationship has ended. Information constituting trade secret may be used solely for taking follow-up action.
(5) Authorised employees of the Office of the Commissioner for Human Rights and of the office providing service to the public authority shall undergo training in the area referred to in paragraph (1) and (2).
(6) If an external report has been received by an unauthorised employee of the Office of the Commissioner for Human Rights or of the office providing service to the public authority, the employee shall:
1) not disclose information which may lead to the identification of the whistleblower or the person concerned by the report;
2) immediately forward the report, without modification, to an authorised employee of the Office of the Commissioner for Human Rights or of the office providing service to the public authority.
(7) Paragraph (6) shall apply accordingly where an external report has been received by means of communication other than those set out in the procedure of receiving external reports or the external reporting procedure.
Article 45 (1). The Commissioner for Human Rights shall:
1) keep the register of external reports;
2) be the controller of personal data contained in the register of external reports.
(2) Entries in the register of internal reports shall be made on the basis of the internal reports.
(3) The register of external reports shall include:
1) number of the report;
2) object of the breach of law;
3) personal data of the whistleblower and the person concerned by the report, necessary for their identification;
4) date of the report;
5) public authority competent to take follow-up action, to which the report was transmitted and the date of its transmission;
6) the date on which the whistleblower was informed of the transmission of the report to the public authority competent to take follow-up action; and
7) information on not taking further action, in the event referred to in Article 40(1).
(4) Personal data and other information contained in the register of external reports shall be retained for 12 months following the end of the calendar year in which the external report was transmitted to the public authority competent to take follow-up action.
Article 46 (1). The public authority shall:
1) keep the register of external reports;
2) be the controller of personal data contained in the register of external report.
(2) Entries in the register of internal reports shall be made on the basis of the internal reports.
1) number of the report;
2) object of the breach of law;
3) personal data of the whistleblower and the person concerned by the report, necessary for their identification;
4) date of the report;
5) information on the follow-up action taken;
6) information on the issuance of the certification referred to in Article 38;
7) date of closure of the case;
8) information on not taking further action, in the event referred to in Article 40(2); s
9) estimated financial damage, and the amounts recovered following investigations and proceedings, related to the breaches reported, if the data is held by the public authority.
(4) The personal data and other information contained in the register of external reports shall be retained for 3 years following the end of the calendar year in which the follow up action ended or in which the proceedings triggered by the follow-up action ended.
Article 47 (1). The public authority shall draw up, for each calendar year, a report containing statistics on external reports, including:
1) number of external reports received;
2) number of investigations and proceedings triggered by the external reports and information on the outcome of the proceedings;
3) estimated financial damage, and the amounts recovered following investigations and proceedings, related to the breaches reported, if the data is held by the public authority.
(2) The statistics referred to in paragraph (1) shall not include personal data or information that constitutes trade secret.
(3) The report referred to in paragraph 1 shall be submitted by the public authority to the Commissioner for Human Rights by 31 March of the year following the reporting year.
(4) The Commissioner for Human Rights shall draw up, based on the reports by the public authorities, a report for the reporting calendar year and shall transmit it to the Sejm, the Senate and the European Commission by 31 December of the year following the reporting year. The report shall be published on the website of the Commissioner for Human Rights in the Public Information Bulletin.
(5) The Council of Ministers, having consulted the Commissioner for Human Rights, shall set out, by way of a regulation, the template of the report referred to in paragraph (1), taking into account the scope of the required data and the need to ensure its completeness and transparency and to streamline the data aggregation process.
Article 48 (1). The public authority shall publish on the website of the authority, in the Public Information Bulletin, in a separate easily identifiable and accessible section, in a form that is clear and easily accessible for whistleblowers, information regarding in particular:
1) the contact details for external reporting, in particular the postal address, e-mail address, electronic mailbox address, unique address for electronic delivery and address of the website where the electronic form is available, within the meaning of Article 3(25) of the Act of 17 February 2005 on computerisation of activities of entities that carry out public-sector duties (Journal of Laws of 2024, item 307), and the telephone number, indicating whether the telephone conversations are recorded;
2) the conditions for providing protection to the whistleblower;
3) the procedures applicable to external reports, including the manner of clarifying the information reported or providing additional information;
4) the deadline for providing feedback and the type and content of such feedback;
5) the confidentiality rules applicable to external reporting;
6) the rules of processing personal data referred to in Article 8 and the rules of processing personal data and information provided where data is collected from the data subject, regulated respectively in Article 5 and Article 13 of Regulation 2016/679, Article 13 of Directive 2016/680 of the European Parliament and of the Council of 27 April 2016 on the protection of natural persons with regard to the processing of personal data by competent authorities for the purposes of the prevention, investigation, detection or prosecution of criminal offences or the execution of criminal penalties, and on the free movement of such data, and repealing Council Framework Decision 2008/977/JHA (OJ EU L 119 of 4.5.2016, p. 89, as amended5 ) or Article 15 of Regulation (EU) 2018/1725 of the European Parliament and of the Council of 23 October 2018 on the protection of natural persons with regard to the processing of personal data by the Union institutions, bodies, offices and agencies and on the free movement of such data, and repealing Regulation (EC) No 45/2001 and Decision No 1247/2002/EC (OJ L 295, 21.11.2018, p. 39);
7) the nature of the follow-up action triggered by external reports;
8) the remedies and procedures for protection against retaliation and the availability of confidential advice for persons contemplating reporting;
9) the conditions under which whistleblowers are protected from incurring liability for a breach of confidentiality pursuant to Article 16;
10) an encouragement to use internal reporting procedure of the legal entity if the breach can be effectively addressed within the organisational structure of the entity and the whistleblower believes that there is no risk of retaliation;
11) the contact details of the Commissioner for Human Rights.
(2) The Commissioner for Human Rights shall publish on the website of the Commissioner, in the Public Information Bulletin, in a separate easily identifiable and accessible section, in a form that is clear and easily accessible for whistleblowers, information referred to, in particular, in paragraphs 1(1)-(3), 5, 6 and 8 to 11.
Article 49 (1). Having experience in the field of external reports, at least once every 3 years:
1) the Commissioner for Human Rights shall review the procedure of receiving external reports;
2) the public authority shall review the procedure of external reporting.
(2) The Commissioner for Human Rights and the public authority shall adjust the procedures referred to in paragraph (1), respectively, to the results of the review and to the experience of the public authority and other public authorities.
Article 50. To the extent not regulated in this Chapter, the provisions of Sections VII and VIII of the Act of 14 June 1960 - Code of Administrative Procedure shall apply respectively to the proceedings before public authorities.
Chapter 5
Public disclosure
Article 51 (1). A whistleblower making a public disclosure shall be protected if he or she:
1) has first made an internal report, followed by external report, and no adequate follow-up action has been taken by the legal entity within the timeframe for providing feedback, as indicated in the internal procedure and by the public authority within the timeframe for providing feedback, as indicated in the external procedure, and no feedback has been provided to the whistleblower, or
2) has directly made an external report and no adequate follow-up action has been taken by the public authority within the timeframe for providing feedback, as indicated in the internal procedure, and no feedback has been provided to the whistleblower
- unless the whistleblower has not provided a contact address to which such information should be transmitted.
(2) A whistleblower making a public disclosure shall also be protected if he or she has reasonable grounds to believe that:
1) the breach may constitute an imminent or manifest danger to the public interest, in particular where there is a risk of irreversible damage, or
2) in the case of external reporting, there is a risk of retaliation, or
3) in the case of external reporting, there is a low prospect of the breach being effectively addressed, due to the particular circumstances of the case, such as those where evidence may be concealed or destroyed or where an authority may be in collusion with the perpetrator of the breach or involved in the breach.
Article 52. In assessing whether the follow-up action has been appropriate, particular account shall be taken of the steps taken in order to verify the information on the breach, the appropriateness of assessing the information on the breach and the adequacy of the measures taken as a result of finding the breach, including, where appropriate, with the aim to prevent further breaches, and of the gravity of the breach.
Article 53. Article 51 and Article 52 shall not apply to cases where a person directly discloses information to the press, and instead the Act of 26 January 1984 - Press Law (Journal of Laws of 2018, item 1914) shall apply.
Chapter 6
Criminal law provisions
Article 54 (1). Whoever, in order for another person not to make a report, prevents or strongly hinders the reporting, shall be liable to a fine, restriction of liberty or deprivation of liberty for up to one year.
(2) If the perpetrator of the act referred to in paragraph (1) has used violence, unlawful threat or deceit against another person, the perpetrator shall be liable to the penalty of deprivation of liberty for up to 3 years.
Article 55 (1). Whoever takes retaliatory action against a whistleblower, a facilitator or a person associated with a whistleblower,
shall be liable to a fine, the penalty of restriction of liberty or the penalty of deprivation of liberty for up to 2 years.
(2) If the perpetrator of the act referred to in section 1 acts persistently, the perpetrator shall be liable to the penalty of deprivation of liberty for up to 3 years.
Article 56. Whoever, contrary to the provisions of the Act, discloses the identity of a whistleblower, a facilitator or a person associated with a whistleblower, shall be subject to a fine, the penalty of restriction of liberty or the penalty of deprivation of liberty for up to 1 year.
Article 57. Whoever makes a report or a public disclosure in the knowledge that there has been no breach of law,
shall be subject to a fine, the penalty of restriction of liberty or the penalty of deprivation of liberty for up to 2 years.
Article 58. Whoever, being responsible for establishing the internal reporting procedure, fails to establish such a procedure, contrary to the provisions of the Act, or establishes it with a substantial violation of the requirements arising under the Act,
shall be liable to a fine.
Article 59. Adjudication on cases regarding an act referred to in Article 58 shall be made in accordance with the Act of 24 August 2001 - Code of procedure in cases of petty offences (Journal of Laws of 2022, item 1124 and of 2023, item 1963).
Chapter 7
Amending and adjusting provisions and final provision
Article 60. The Act of 15 July 1987 on the Commissioner for Human Rights (Journal of Laws of 2023, item 1058) is amended as follows:
(1) in Article 1, paragraph 5 shall be added as follows:
‘5. The Commissioner shall carry out the duties set out in the Act of 14 June 2024 on the protection of whistleblowers (Journal of Laws, item 928)’;
2) in Article 19, paragraph 5 shall be added as follows:
‘(5) The Commissioner shall submit to the Sejm and the Senate, once every two years, a report on the implementation of the Act referred to in Article 1(5).’.
Article 61. In the Act of 5 August 2015 on free legal aid, free civic counselling and legal education (Journal of Laws of 2021, item 945), after Article 4, Article 41 shall be added as follows:
‘Article 41. Free legal aid and free civic counselling shall be available to persons who intend to report a breach of law within the meaning of the Act of 14 June 2024 on the protection of whistleblowers (Journal of Laws, item 928). The provisions of Article 4 shall not apply.’.
Article 62. The reports referred to in Article 47(1) and (4) for 2025 shall be drawn up by the public authority and the Commissioner for Human Rights for the period from the beginning of receiving external reports.
Article 63. (1) The first report referred to in Article 47(4) shall be submitted by the Commissioner for Human Rights to the Sejm, the Senate and the European Commission by 31 December of the year following the year in which this Act enters into force.
(2) The first report referred to in Article 19(5) of the Act amended by Article 60 hereof shall be submitted by the Commissioner for Human Rights to the Sejm and the Senate 2 years after the entry into force of this Act.
Article 64. This Act shall enter into force 3 months after its promulgation, except for Article 5(4), Article 25(1)(8) and the provisions of Chapter 4, which shall enter into force 6 months after its promulgation.
The President of the Republic of Poland: A. Duda
1 - This Act, within the scope of its regulation, t implements Directive (EU) 2019/1937 of the European Parliament and of the Council of 23 October 2019 on the protection of persons who report breaches of Union law (OJ EU L 305 of 26.11.2019, p. 17, OJ EU L 347 of 20.10.2020, p. 1 OJ EU L 265 of 12.10.2022, p. 1 and OJ EU L 150 of 9.6.2023, p. 40).
2 - This Act amends the following acts: the Act of 15 July 1987 on the Commissioner for Human Rights and the Act of 5 August 2015 on free legal aid, free civic counselling and legal education.
3 - The amendments to the Regulation are published in OJ L 127, 23.5.2018, p. 2 and OJ L 74, 4.3.2021, p. 35.
4 - The amendments to the Directive are published in OJ L 347, 20.10.2020, p. 1, OJ L 265, 12.10.2022, p. 1 and OJ L 150, 9.6.2023, p. 40.
5 - The amendment to the Directive is published in OJ L 127, 23.5.2018, p. 10.