§ 1

An external report can be made without an internal report, as referred to in the Internal Reporting and Follow-up Procedure. An external report can be made to the Ombudsman or a public authority, and in relevant cases, to institutions, bodies, or organizational units of the European Union. An external report can be made particularly when the whistleblower has reasonable grounds to believe that the violation of the law may pose a direct or obvious threat to the public interest, especially when there is a risk of irreversible damage, or making an internal report would expose the whistleblower to retaliatory actions, or when making an internal report is unlikely to effectively counteract the violation due to specific circumstances, such as the possibility of evidence being hidden or destroyed, the possibility of collusion between the person responsible and the perpetrator of the violation, or the involvement of the responsible person in the violation. A report made to the Ombudsman or a public authority, bypassing internal reporting, does not deprive the whistleblower of the protection provided by the Whistleblower Protection Act. The Ombudsman and public authorities are independent data controllers regarding the personal data provided in the external report accepted by these bodies. The Ombudsman and public authorities publish essential information for whistleblowers on their websites in the Public Information Bulletin.

§ 2

The initial verification of an external report by the Ombudsman involves determining whether the report concerns information about a violation of the law and identifying the public authority competent to take follow-up actions. If the external report concerns information about a violation of the law, the Ombudsman promptly, but no later than 14 days from the day the report was made, forwards the report to the public authority competent to take follow-up actions. The Ombudsman informs the whistleblower about the forwarding of the external report. The information includes at least the identification of the public authority to which the report was forwarded and the date of forwarding. The Ombudsman refrains from forwarding the external report if it does not concern information about a violation of the law. The Ombudsman informs the whistleblower of the decision to refrain from forwarding the external report, providing the findings from the initial verification of the report. When refraining from forwarding the external report, the Ombudsman may inform the whistleblower that the information covered by the report may be considered in a procedure provided for in separate regulations, particularly as the subject of a civil lawsuit, a notification of a suspected crime, an administrative court complaint, a complaint, application, or petition, or may be presented to the relevant authorities for consideration in another procedure. Such information does not affect the admissibility of any legal remedy filed later, the deadlines, or the outcome or manner of concluding the proceedings. The information provided to the whistleblower includes guidance in this regard. The Ombudsman may dismiss the external report if a previous external report on the same matter was not forwarded to the public authority competent for follow-up actions, or if the external report does not include significant new information regarding violations of the law compared to a previous external report. The Ombudsman informs the whistleblower about the dismissal of the report, providing a justification, and in the case of subsequent reports, dismisses them without informing the whistleblower.

§ 3

The public authority:

• accepts the external report;
• conducts an initial verification of the external report to determine whether it concerns information about a violation of the law and whether it concerns violations in a field within the authority’s scope of action, and if not, to determine the public authority competent for follow-up actions;
• reviews the external report if it concerns violations of the law in a field within the authority’s scope of action;
• forwards the external report promptly, but no later than 14 days from the day the report was made, and in justified cases, no later than 30 days, to the public authority competent for follow-up actions if the report concerns violations outside the authority’s scope of action, and informs the whistleblower;
• takes follow-up actions with due diligence;
• provides feedback to the whistleblower.

The public authority may refrain from follow-up actions if the external report does not contain significant new information compared to a previous report on the same matter by the same or another whistleblower. The authority informs the whistleblower of its decision not to take follow-up actions, providing a justification, and in the case of subsequent reports, dismisses them without informing the whistleblower.

§ 4

An external report can be made verbally or in writing. The provisions of Article 26(2-8) of the Whistleblower Protection Act of June 14, 2024, apply accordingly. An external report in document form can be made:

• in paper form, to the correspondence address indicated by the Ombudsman or the public authority receiving the report;
• in electronic form, to the email address, electronic mailbox address, or address for electronic delivery indicated by the Ombudsman or the public authority receiving the report, or via an internet form or application designated by the public authority for making electronic reports.

§ 5

The communication channels established by the Ombudsman and public authorities for receiving external reports:

• are independent of the communication channels used in the regular activities of these authorities;
• ensure the completeness, confidentiality, and integrity of the data, including protection from unauthorized access;
• allow the information to be stored in a permanent manner to enable further investigative actions.

Communication channels used by the Ombudsman and public authorities for purposes other than receiving external reports may also be used for this purpose, provided they meet the conditions specified in section 1.

§ 6

The Ombudsman and public authorities guarantee that the procedure for receiving external reports and the processing of personal data related to receiving reports:

• prevent unauthorized persons from accessing the information covered by the report;
• ensure the protection of the confidentiality of the whistleblower’s identity and the person concerned by the report.

The confidentiality protection mentioned in section 1 point 2 applies to information that could directly or indirectly identify the whistleblower’s identity or the identity of the person concerned by the report.

§ 7

The Ombudsman authorizes selected employees of the Office of the Ombudsman to:

• receive external reports, conduct their initial verification, and inform the whistleblower;
• provide interested parties with information about the procedure for receiving external reports.

The public authority authorizes selected employees of the office serving that authority to:

• receive external reports, conduct their initial verification, take follow-up actions, and process personal data related to these actions;
• communicate with the whistleblower to provide feedback and, if necessary, request explanations or additional information related to the submitted information;
• provide interested parties with information about the external reporting procedure.

§ 8

No retaliatory actions, attempts, or threats of such actions can be taken against a whistleblower. A whistleblower subjected to retaliatory actions has the right to compensation in an amount no less than the average monthly wage in the national economy for the previous year, announced for pension purposes in the Official Journal of the Republic of Poland “Monitor Polski” by the President of the Central Statistical Office, or the right to satisfaction. A person who has suffered damage due to the whistleblower knowingly making a false report or public disclosure of false information is entitled to compensation or satisfaction for the violation of personal rights from the whistleblower who made such a report or disclosure. The rights provided for in this chapter cannot be waived, nor can one assume responsibility for damage resulting from a report or public disclosure. This does not apply to assuming responsibility for damage resulting from the conscious reporting or public disclosure of false information. The provisions of legal acts referred to in Article 9 § 2 of the Labor Code of June 26, 1974, insofar as they directly or indirectly exclude or limit the right to report or disclose information publicly or provide for retaliatory actions, do not apply. The provisions of employment contracts and other legal acts on which employment relationships are based, or which shape the rights and obligations of the parties to the employment relationship, insofar as they directly or indirectly exclude or limit the right to report or disclose information publicly or provide for retaliatory actions, are invalid. The provisions of contracts and other legal acts under which work or services are provided, goods are delivered, or sales are made, other than those mentioned in section 6, insofar as they directly or indirectly exclude or limit the right to report or disclose information publicly or provide for retaliatory actions, are invalid.

§ 9

Making a report or public disclosure cannot be the basis for liability, including disciplinary or liability for damage resulting from the violation of others’ rights or obligations established by law, especially concerning defamation, violation of personal rights, copyright, data protection, or confidentiality obligations, including trade secrets, taking into account Article 5 of the Act, provided that the whistleblower had reasonable grounds to believe that the report or public disclosure was necessary to reveal the violation of the law in accordance with the Act. In the case of legal proceedings related to the liability mentioned in section 1, the whistleblower may request the dismissal of such proceedings. Obtaining information subject to a report or public disclosure, or access to such information, cannot be the basis for liability, provided that such obtaining or access does not constitute a prohibited act.

§ 10

Both the Ombudsman and public authorities maintain registers of external reports and are data controllers of the personal data collected in the register of external reports. An entry into the register of external reports is made based on the external report.