The Whistleblower Protection Act (›HinSchG‹) is a "done deal". After the Federal Council initially refused to approve the government coalition's original bill, the Federal Council (›Bundesrat‹) and Federal Parliament (›Bundestag‹) reached a compromise in the Mediation Committee on May 9, 2023, which has since passed the Federal Parliament and Federal Council. The HinSchG is to come into force one month after promulgation in the Federal Law Gazette - as things stand at present, probably as early as mid-June 2023. One of the core elements of the HinSchG is the obligation on employers to set up and operate an internal point to receive reports from the workforce.
Who must implement the requirements of the Whistleblower Protection Act by when?
Every employer with 50 or more employees must set up an internal reporting point and corresponding reporting channels.
Companies with 50 to 249 employees must set up the reporting point by December 17, 2023.
For companies with generally 250 or more employees, the requirements will apply when the HinSchG comes into force, i.e., as things stand at present, probably as early as mid-June 2023. The same applies, irrespective of the number of employees, to companies in special sectors, including the financial services sector. These companies will already have to offer an internal reporting point in accordance with the requirements of the HinSchG in approximately one month.
What are the main requirements for the establishment and operation of the reporting point?
Reportable violations include criminal offenses and misdemeanors, as well as violations of various legal provisions (e.g., environmental protection, data privacy, or money laundering), provided the violations were committed by the employer or another entity with which the whistleblower had professional contact.
Whistleblowers must be given the opportunity to make reports orally or in text form.
There is no obligation to accept anonymous reports; however, the reporting points "shall" also process anonymous reports. This applies to both internal and external hotlines.
The reporting point must maintain the confidentiality of the identity of (i) the person making the report, (ii) the persons who are the subject of the report, and (iii) any other persons named in the report. Only in exceptional cases defined by law may information about these identities be disclosed to courts or law enforcement agencies, among others.
The documentation of the respective notification must generally be deleted three years after the conclusion of the proceedings. Longer retention is only permitted as long as this is necessary to fulfill requirements under the HinSchG or other legal provisions.
Whistleblowers are comprehensively protected against reprisals and other retaliatory measures.
What are the penalties for violations of the HinSchG?
If the internal reporting point is not set up and operated (in a timely manner), the company faces a fine of up to EUR 20,000 (the provision applies for the first time six months after the HinSchG is promulgated).
Violations of the HinSchG may result in fines of up to EUR 50,000 (in particular, if a report is obstructed, reprisals are taken, or the requirement of confidentiality is violated intentionally or recklessly).
Observe the co-determination rights of the works council!
In principle, the works council has a right of co-determination, since an internal reporting procedure is intended to regulate order in the company and monitor the behavior of employees. In addition, the works council will have a right of co-determination if technical equipment is used to design the internal reporting point which is able to monitor the performance and behavior of employees. This also applies if employers decide to outsource the internal reporting point to an external third party.
In addition, there are other possible co-determination issues relating to the staffing of the tasks associated with the establishment of a reporting system and the training of the persons involved in the tasks of the reporting system as set out in the draft law.
Design options for setting up the internal reporting office
Even if the acceptance of anonymous reports is not mandatory by law, opening the internal reporting channel also for anonymous reports will increase the acceptance and use of the whistleblowing system. This will provide an incentive for the whistleblower to initially use the internal reporting channel instead of an external one.
Employers can expand the scope of the whistleblower system, e.g. by allowing ›simple‹ legal or contractual violations to be reported as well. This increases the incentive to use the internal reporting channel and strengthens in-house compliance.
In particular, companies with 250 or more employees and companies in which a works council has been formed should - if they have not already done so - take immediate action now and start setting up the internal reporting point. Companies in which internal reporting points/channels already exist should also check whether these reporting points and channels, as well as the corresponding processes, comply with the requirements of the HinSchG.
If you need our assistance in setting up the internal reporting point, please feel free to contact us at any time.