Special Newsletter German Whistleblower Protection Act

Dear Reader,

The German Whistleblower Protection Act (HinSchG) has had a turbulent history: Since the end of 2019, the European Whistleblower Directive already requires the legal protection of whistleblowers. After Germany was in default with the implementation of the Directive and the European Commission had already initiated infringement proceedings in February 2022, a government draft of a whistleblower protection act was adopted in July 2022. This draft passed the German Bundestag (Federal Parliament) in December 2022, however, failed in the German Bundesrat (Federal Council) shortly afterwards. In a second attempt, the coalition attempted in March 2023 to divide the undertaking into two draft laws, one of which would not have required the approval of the German Bundesrat. After considerable criticism for this approach, the Conciliation Committee was convened, in which a compromise was reached. Subsequently, the draft passed the German Bundestag in the beginning of May 2023 and also received the approval of the German Bundesrat on May 12, 2023. Therefore, the Whistleblower Protection Act has finally come into force on July 2, 2023.

Our special newsletter presents the essential contents of the Act and answers the most important questions relating to the protection of whistleblowers. We hope you have an interesting read.

I. Objective of the Whistleblower Protection Act

The Act and its underlying EU Directive aim at a comprehensive legal protection of whistleblowers, i.e. of persons who give indications on grievances in companies. To achieve this, the Act contains a number of additional obligations for companies:

II. Establishment of Internal Reporting Offices

All so-called "employers" who have at least 50 employees must install and operate secure internal whistleblowing systems. These "employers" include according to the law "natural persons and legal persons under public or private law, (...) partnerships with legal capacity and (...) any other associations of persons with legal capacity". A transposition deadline until December 17, 2023 is granted to smaller companies with no more than 249 employees, however, all major employers must have a working whistleblowing system (internal reporting office) immediately as from the entry into force of this Act.

So-called external official reporting offices are also established, the whistleblowers, however, have the choice of whether they would like to contact these official reporting offices or the internal reporting systems of the companies. The Act prefers the internal reporting offices in this context since whistleblowers "should" preferably contact these internal reporting offices in any case if "effective action can internally be taken against the violation and they do not fear reprisals".

III. Requirements to the Internal Reporting Office

The tasks of the reporting office may be carried out by employees or working groups consisting of employees. However, external third parties, such as service providers or lawyers, may also be commissioned with establishing and operating the internal reporting office. It is also possible that several companies establish a joint reporting office, whereas this is only permitted to smaller companies with no more than 249 employees. In any case, the persons working in the reporting office must be independent and free from conflicts of interest and must have the necessary competence, whereas the requirements to this "competence", unfortunately, are not specified in more detail by the Act. In addition, the acting persons must be entrusted with the necessary powers, in particular, to receive and examine reports and to take follow-up measures (clarification of facts, compliance measures).

IV. Submission of Reports

The reporting systems to be established must enable whistleblowers to submit reports orally, in text form or also in person, if desired. One of the most controversial points in this context was the obligation originally foreseen to also facilitate the submission of anonymous reports. However, this was ultimately considerably mitigated in the Conciliation Committee: Now the internal reporting offices "should" also process reports submitted anonymously, however, there is no longer an explicit obligation to design the reporting system in itself in such a way that the submission of anonymous reports is also facilitated.

V. Dealing with Reports

To protect the whistleblowers, it must be ensured that only the responsible persons have access to the reports and their contents and treat them as confidential. This protection of the identity of the whistleblowers and also of all persons possibly affected by a report is essential for the acceptance of the reporting procedure. The identity of these persons may in principle only be known to the persons responsible for the processing of a report. Information on the identity of a whistleblower or persons, who are the subject of a report, may only be disclosed in exceptional cases, such as in criminal proceedings upon request of the law enforcement authorities.

If a notice is received, the reporting office must issue an acknowledgement of receipt to the whistleblower within seven days.
The reporting office must also examine whether the reported facts fall within the scope of application of the Act at all and, thus, within its responsibility: This is the case if the reported violation (or suspicion of a violation) refers to offences, to violations of provisions punishable by a fine or to violations of a number of national and European legal standards listed in the Act. This very far-reaching responsibility, however, was restricted in the Conciliation Committee to the extent that the reporting offices are only responsible for reports on violations which have occurred either with the employer, where the whistleblower himself is working or with another entity, with which the whistleblower was in professional contact (e.g. with a customer or service provider). Reports on violations outside any professional context, therefore, do not (or no longer) fall within the scope of responsibility of the reporting office. Nevertheless, such notices, for which no responsibility of the reporting office exists, must also be treated as confidential.

At the latest within three months, the whistleblower must be informed whether and if applicable which follow-up measures were planned or already taken and of the respective reasons for these measures. Such follow-up measures may be internal inspections and investigations, but also a referral of the whistleblower to other responsible offices, referring the procedure to a competent authority (such as in case of the report of an offence the Public Prosecutor) or simply the termination of the procedure for lack of evidence.

All incoming reports must be documented and kept for a period of three years after completion of the procedure.

VI. Protection of Whistleblowers

In addition to the protection ensured by confidentiality, the law also contains a prohibition of "reprisals" at the expense of whistleblowers. This definition of reprisal is defined in the law as an "act or omission in connection with professional activity which is a reaction to a report" and which puts the whistleblower "at an unjust disadvantage". In view of this broad definition, not only warning notices, dismissals or other disciplinary measures can be considered as reprisals, but also, for example, the withdrawal of competences or tasks, detrimental changes in working hours or place of work, refusal of training measures, etc.

This prohibition is combined with the whistleblower's right to compensation for any reprisals suffered. It is currently unclear who is meant to be the "perpetrator" of a reprisal. This term is neither defined in the law itself nor in the explanatory memorandum. The latter merely points out in a nebulous manner that the employer is "regularly the cause" of the reprisal. However, the wording could also refer to any person who has "carried out" or even "initiat-ed" the reprisal. This question will have to be clarified in practice by the courts.

VII. Reversal of the Burden of Proof

In order to make it easier for the whistleblower to prove, which would otherwise be difficult, that a professional disadvantage was actually a reaction to a report made and not based on other, purely factual reasons, the law provides for a reversal of the burden of proof: It is not the whistleblower who must provide this evidence, but the law establishes the presumption that adverse treatment of the whistleblower was a reprisal, i.e. a reaction to the whistleblower's report, so that the employer must exonerate himself and provide exculpatory evidence that the adverse treatment was precisely not in connection with a whistleblowing. This aspect was also mitigated at least a little in the Conciliation Committee - this legal presumption now only applies if the whistleblowers themselves invoke it, i.e. if they themselves claim or assert that they suffered the adverse treatment precisely because of a report they made. In practice, however, this should not be a real obstacle to the reversal of the burden of proof. Employers are therefore well advised to take precautions and to comprehensively document measures that could be understood as "reprisals" as well as the factual reasons for these measures in order to be able to provide evidence of exoneration if the worst comes to the worst.

VIII. Involvement of the Works Council

Finally, the participation rights of the works council must also be observed when implementing the Whistleblower Protection Act. The works council does not have a say in the establishment of the reporting office as such, as this is already mandatory by law for companies with at least 50 employees. However, if smaller companies wish to set up a reporting office voluntarily, this must be done with the involvement of the works council. In any case, the works council has a right of co-determination in the concrete design of the internal reporting office and the reporting channels to be set up, as the Whistleblower Protection Act leaves the employer room for manoeuvre here. The same applies if a duty of employees to report violations is to be established in the company beyond the voluntary principle of the Whistleblower Protection Act.

IX. Fines

If companies fail to comply with their obligation to set up an internal reporting office, they face substantial fines of up to EUR 20,000. Although the entry into force of this threat of a fine has been postponed to six months after the entry into force of the Whistleblower Protection Act itself, companies should set up their reporting offices as soon as possible, especially since any disagreements with the works council may cause further delays.

In addition, other violations of the Whistleblower Protection Act, such as preventing a report, disregarding the confidentiality requirement or taking a prohibited reprisal, are punishable by a fine of even up to EUR 50,000.

X. Conclusion

The new Whistleblower Protection Act creates numerous new obligations for companies with more than 50 employees on a regular basis. It is important to implement these promptly and to prepare for the new challenges presented. With regard to the remaining ambiguities, it is important that these are substantiated by case law and literature.

Dr Michael Matthiessen
Maike Pflästerer