How should we proceed when a request is made to disclose a report in connection with civil proceedings, e.g. in a case of defamation?

ANSWER

Please remember that both the whistleblower's identity and the identity of the person concerned by the report should remain confidential and be known only to persons who investigate the report and take further steps. This is what the Directive provides, and ultimately the Polish act implementing the Directive will presumably provide the same. It may of course happen that a report turns out to be unfounded, or even that the whistleblower deliberately misled the entity to which they reported breaches, e.g. due to an ongoing conflict between the whistleblower and the person concerned by the breach. It is therefore necessary above all to strive to ensure that the person concerned by the report does not obtain information about the whistleblower's identity.

However, when the person concerned by the report, who in their view has been defamed (Article 212 § 1 of the Criminal Code), asks the controller

to disclose documents enabling them to establish the whistleblower's identity, in my view a legal analysis should be carried out on each occasion as to whether, in the light of the criminal or civil proceedings that the person concerned intends to bring, it is permissible to provide such information that in principle should remain confidential.