When disclosure becomes legal – new developments in "Whistleblowing" laws
The legal protection of whistleblowers is poor – at present, there are just a handful of statutory provisions that do not apply in all cases and nor do they offer any systematic protection (e.g. § 138 Criminal Code (Strafgesetzbuch), § 17 Act on Occupational Health and Safety (Arbeitsschutzgesetz), §§ 84 et seq. Works Constitution Act (Betriebsverfassungsgesetz), §§ 13 and 27 General Equal Treatment Act (Allgemeines Gleichbehandlungsgesetz). In the future, we can hope for some improvement based on new European provisions.
Whistleblowing – The Terminology
Whistleblowing is when somebody, normally an employee, discloses actual or alleged abuse or wrongdoing within the company by making critical statements, submitting complaints or filing a report. A distinction must be made between internal and external whistleblowing. Internal whistleblowing is when the employee provides information about the abuse or wrongdoing to their superiors, the compliance officer or an employee representative. External whistleblowing is when the employee makes the abuse or wrongdoing public, e.g. provides the information to the public prosecutors’ office or the press, after being unable to successfully remedy the matter internally. From a legal perspective, external whistleblowing is problematic, especially in light of consequences that the employee may fear the whistleblowing will have on his or her employment, such as the receipt of a written warning and/or the termination of their employment contract due to conduct.
Labour Law case law
The case law of the Federal Labour Court (BAG) on whistleblowing is based primarily on the jurisprudence of the European Court of Human Rights (Judgment of the ECHR of 21 July 2011 – in Case No. 28274/08). Under the ECHR case law, whistleblowing is generally covered by the freedom of expression established in Article 10 of the European Convention on Human Rights. Still, this requires a weighing of the opposing interests, provided that the whistleblower has first sought to clarify the matter internally and made the information available to the public only as a last resort. Under the aspect of proportionality, the disclosure is then assessed as to whether the information was provided in good faith and the whistleblower was convinced that it was in the public interest to disclose the information or whether the information was disclosed, for example, as “revenge”.
EU Trade secrets directive
On 5 July 2016, Directive (EU) 2016/943 on the protection of undisclosed know-how and business information (trade secrets) against their unlawful acquisition, use and disclosure (EU Trade Secrets Directive) entered into force. The primary aim of the directive is to establish effective protection of trade secrets throughout the EU. The Directive contains only one article on whistleblowing, which establishes exemptions that allow for whistleblowing.
Act on the protection of trade secrets (GeschGehG)
On 26 April 2019, the “Act on the transposition of Directive (EU) 2016/493 on the protection of business secrets against their unlawful use and disclosure” (Gesetz zur Umsetzung der Richtlinie (EU) 2016/943 zum Schutz von Geschäftsgeheimnissen vor rechtswidrigem Erwerb sowie rechtswidriger Nutzung und Offenlegung) entered into force, which is based on the EU trade secrets Directive and also contains the Act on the Protection of Trade Secrets (GeschGehG). The Act serves to protect business secrets from unlawful acquisition, use and disclosure. The GeschGehG was controversial, even before it was adopted. The draft bill faced significant criticism, in particular, that it did not do enough to protect whistleblowers. This criticism led to amendments, including the redesign of the (sole) provision on whistleblowing:
In order not to create the appearance that a whistleblower is primarily acting illegally, the provision, which had been previously drafted as a grounds of justification, was changed to be an exemption, whereby whistleblowing does not constitute illegal action under the law in certain situations. While the draft bill also required that the whistleblower have the intention of protecting the general public interest, in the adopted act, the action only has to be “suitable” to protect the public interest. This change is designed to avoid the need for an assessment of the employee’s attitude but still ensure that good intentions alone are not enough but that the whistleblower must at least have had sufficient opportunity to report the misconduct.
The balancing of interests, required by the case law of the BAG and the ECHR, still has to be performed. The new law also makes it clear that the rights and obligations under the employment contract remain unaffected: in particular, the law should not be used to frustrate any understandings set out in the employment contract. In addition, former employees may, in principle, continue to use any know-how and experience, which was lawfully gained while working for the company, once they leave the company, even if this knowledge overlaps with a trade secret owned by their former employer.
New EU Directive on the protection of whistleblowers too
On 16 April 2019, the European Parliament also adopted a Directive on the protection of persons reporting on breaches of Union law (2018/106/COD). Once it has been adopted by the Council and published in the EU Official Journal, Germany will have two years to transpose this “Whistleblower Directive” into national law. This directive establishes safe ways for infringements to be reported and makes it more difficult to take any retaliatory measures against whistleblowers. In any case, the protection offered by the directive applies only when the whistleblower has uncovered an infringement of EU law, such as tax fraud, money laundering or offences in relation to public tenders, as well as infringement of EU rules on product and road safety, environmental protection, public health and consumer and data protection. The EU Member States may choose to extend the scope of protection offered by the Directive to cover infringements of national law.
Under the directive, whistleblowers have a choice of how to report the infringement: they can use internal or external channels. Apart from that, a three-step notification system generally applies (1. Business, 2. Authority, 3. Public). Depending on the circumstances in the case, the whistleblower may skip a step: whistleblowers will not be punished, for example, if they make their criticism public when their original attempt to report the matter internally yielded no reaction. It is also possible to provide the information directly to the public without a previous attempt to report the matter internally when there is a direct risk to the public, when the whistleblower expects that retaliatory measures will be taken against him or her or when reporting the infringement to the authorities is not an option because the authorities are not able to provide any remedy.
Companies with more than 50 employees have to take measures to protect whistleblowers and establish clear whistleblower channels and notification procedures.
Repressive measures are expressly prohibited and protective measures are introduced so that whistleblowers may not be illegally dismissed, demoted, intimidated or even violently attacked. Those that support whistleblowers are also protected, such as intermediaries, colleagues or relatives. The Member States must make comprehensive and independent information about reporting channels and alternative procedures, free advice, and legal, financial and psychological support available to whistleblowers.
Outlook/tips for practice
Unfortunately, the new GeschGehG also fails to provide any information about the decisive legal issues related to the protection of whistleblowers (such as the design of safe and secure notification procedures within companies or the reach of permissible reports by employees). However, companies should now start to take suitable non-disclosure measures because trade secrets will only receive protection if such measures are taken: specific confidentiality and non-disclosure clauses, for example, could be involved.
It is hoped that the “Whistleblower Directive” will improve the legal situation, in particular on the form of notification system required, even if this Directive first has to be implemented into German law. There is some suspense especially surrounding the question of whether Germany will choose to extend the scope of protection for the disclosure of infringements of EU law to also cover the disclosure of infringements of national law. In light of these changes, companies should prepare to establish internal whistleblower systems or to reassess and improve existing internal notification procedures. Such systems are the only way to reduce the risk that whistleblowers will – legally – reveal their information directly to the public. Accordingly, you should carefully follow how these laws are implemented over the next few years to make appropriate and necessary adjustments to your internal systems.
Dr Sarah Reinhardt-Kasperek
Lawyer, Licensed Specialist for Labour Law