Reporting channel for a public authority: a statutory duty, not a formality
In a public body a whistleblowing channel is not only a duty but also an exposure. An inspection will ask about the register, the deadlines and the authorisations. An email inbox meets the requirement on paper and cannot answer any of those questions.
The situation
A local government body must run an internal channel by law. The previous email inbox met the requirement on paper, but during an inspection nobody could show when a report had arrived or who had read it.
How it works
Every report carries a timestamp and every access to it leaves an entry in a log that cannot be altered. The system counts the seven-day and three-month deadlines itself and escalates as they approach. An inspection is shown a register, not an assurance.
- Audit log
- Statutory deadlines
- Legal compliance
In this scenario 4
What the Act says in this situation
Public entities are subject to the Whistleblower Protection Act on the same terms as private ones, with one exception: the provisions on internal reports do not apply to organisational units of a municipality or county with fewer than 10,000 residents (Article 23(4)). A municipality above that threshold must have a procedure in its office and in its units regardless of how many people work in them.
In a public authority the catalogue of breaches is wider than in a company: public procurement, the financial interests of local government units and constitutional rights and freedoms in relations with public authorities are added. A whistleblower is an official, an employee of a unit, a contractor under an agreement with the municipality and a councillor, in respect of information obtained in a work-related context.
A public body is also the data controller for the register of internal reports (Article 29) and answers to the President of the Personal Data Protection Office (UODO) for securing it.
What to watch when implementing
- Proof, not assurance. An inspection (the Regional Audit Chamber, the Supreme Audit Office, the National Labour Inspectorate for labour law) asks: when was it received, who acknowledged it and when, who had access, when was feedback given. The register must show this with dates that cannot be corrected after the fact.
- A case handler independent of the head of the unit. In a small office this is often the internal auditor or a person from another organisational unit of the municipality; the procedure may designate shared handling for several units.
- Reports from residents and contractors. Not every person reporting is a whistleblower within the meaning of the Act (a resident without a work-related context is not), but the channel should accept the report and allow it to be classified, rather than turn it away.
- Digital accessibility. A public entity has a duty of digital accessibility for the reporting page; the form must meet WCAG and have an accessibility statement.
Features that make the difference
- Tamper-proof audit log: every opening of a case with a date and a person; export for an inspection (compliance and permissions).
- Deadlines counted by the system with escalation to the secretary or the head of the unit (case handling).
- Authorisation repository with confirmation of receipt by the employee: the document an inspection asks for first.
- 3-year retention counted per case, with a reminder and deletion confirmed by a human.
- WCAG 2.2 AA accessibility of the reporting page, including keyboard and screen reader operation (implementation and channels).
Frequently asked questions
Does a municipal school have to have its own procedure?
If the municipality has 10,000 residents or more, yes, as an organisational unit of the municipality. The municipality may organise shared handling of reports for its units, but each unit establishes and announces the procedure itself, after consulting employee representatives.
Is a report from a resident a whistleblower report?
Only if the resident obtained the information in a work-related context, for example as a contractor under an agreement with the municipality or as a volunteer. An ordinary complaint from a resident is handled under the Code of Administrative Procedure. The channel can accept both kinds and let the case handler classify the case.
More on sanctions in the article Penalties for not having an internal reporting procedure.
From the knowledge base
- The Polish Whistleblower Protection Act: who it applies to and from when 50-person threshold on 1 January and 1 July, sectors with no threshold, small-municipality exemptions, who is a whistleblower and what the Act covers.
- The internal reporting procedure step by step What the internal reporting procedure must contain under Article 25, how to consult it in 5 to 10 days, when it takes effect and how to announce it.
- Statutory deadlines: 7 days, 3 months and a register kept for 3 years When the 7 days for acknowledgement and 3 months for feedback start, what if the whistleblower gives no address, 14 days for a meeting, 3-year retention.
- Penalties for not having an internal reporting procedure and for retaliation Fine for a missing or defective procedure, up to 3 years for obstruction and retaliation, a year for breaching confidentiality. Who is personally liable.
A procedure is a document. A channel is the system that carries it out.
sygnadesk counts the deadlines, keeps the register and protects the reporter’s identity the way the knowledge base describes. See how it would look in your organisation.