The so-called Whistleblowing Directive (EU) 2019/1937 must be transposed into national law by December 17, 2021. In the meantime, a corresponding draft bill (RefE) on the German Whistleblower Protection Act (HinSchG) is available.
Here, we answer the most important questions surrounding the future protection of whistleblowers and the obligations that companies will face. This article will be regularly updated with new developments in the legislative process.
- When does the new whistleblower protection apply?
The directive must be transposed into national law by December 17, 2021. If the deadline for transposition is missed, there are many indicators for the immediate applicability of the directive, at least vis-à-vis public employers. However, sanctions under labor law by private employers are also likely to be inadmissible due to the fact that fundamental rights of the Union are affected (Art. 11 CFR - freedom of expression).
However, it can be assumed that the final version of the HinSchG will be passed during this legislative period and will enter into force on December 17, 2021.
- Which employers are covered and from when?
The Directive and the RefE cover all employers under private and public law. However, only employers with usually at least 50 employees are obliged to set up internal reporting offices. Employers with generally 50 to 249 employees also have until December 17, 2023 to set up internal reporting units.
- Who benefits from whistleblower protection?
In particular, employees and civil servants (including judges and soldiers) are protected, but also members of executive bodies (board members, managing directors), trainees and persons similar to employees. In addition, the RefE currently still explicitly mentions "collective bargaining employees" - a superfluous duplication that should no longer appear in the final law.
- What is at the heart of the new whistleblower rights?
According to the draft bill, whistleblowers no longer need to contact the employer if they have discovered a violation of the rules (so-called internal reporting), but may directly contact the competent authority (so-called external reporting).
However, employers "shall" create incentives for whistleblowers to first contact the internal reporting office before reporting to an external reporting office, without, however, limiting or making it more difficult to make an external report. What kind of incentives these might be remains to be seen in practice - the whistleblower premium is on the horizon.
- What are the rules of the game for whistleblowers so far?
Until now, employees must first report discovered breaches of rules internally before they are allowed to turn to the competent authority without fear of sanctions under labor law. Exceptions apply if the matter involves a criminal offense committed by the employer or a serious criminal offense, if the whistleblower could be liable to prosecution himself or herself, or if a particularly important public interest is affected ("Heinisch" decision of the ECHR).
These principles developed by case law become invalid as of the entry into force of the HinSchG if a violation of the law is reported that falls within the scope of application of the law. Employees are therefore generally no longer required to report violations internally in advance.
- Which legal violations may be reported in the future?
According to the Directive, only infringements of certain Union law may be reported. The regulations and directives covered are listed in the annex to the Directive. In particular, they cover public procurement, financial markets, combating money laundering and terrorist financing, product safety, road safety, environmental protection, radiation protection, food safety, animal welfare, public health, consumer protection and data protection.
The draft extends the reportable catalog to the corresponding national rules and expands it (the Directive explicitly provides for an "opening clause" in Art. 2 (2)) to include all violations that are subject to criminal penalties or fines. This makes violations of an indefinite number of laws from all possible areas of law reportable; in labor law, for example, the late notification of the economic committee, to name just one example.
- What are the organizational requirements for employers?
Employers with generally at least 50 employees must set up internal reporting offices to which employees can turn to report violations. For certain companies, such as securities trading companies or credit institutions, the minimum threshold of 50 employees does not apply. If employers generally have no more than 249 employees, the internal reporting offices do not have to be established before December 17, 2023. The internal reporting offices must establish reporting channels that whistleblowers can use to report violations.
The internal reporting office must confirm receipt of the report to the whistleblower within seven days and inform the whistleblower of the follow-up measures it has taken after three months at the latest. Follow-up measures may include, in particular, the initiation of internal investigations, the submission of the report to the appropriate authority or the discontinuation of the matter due to lack of evidence.
- How are the internal reporting offices to be organized?
The internal reporting office can either be set up by the employer itself or a third party external to the company can be entrusted with this task. In addition, employers with generally no more than 249 employees may operate a joint internal reporting office or jointly commission an external third party.
We believe that especially smaller companies that just exceed the threshold of 249 employees (or 50 employees as of December 17, 2023), but also medium-sized companies as well as German subsidiaries of international corporations will outsource the internal reporting office. vangard | Littler cooperates with WhistleB[VR1] in order to relieve companies from the burden of having to establish their own internal reporting office.
- Are there sanctions if an internal reporting office is not introduced?
Neither the Directive nor the RefE provide for sanctions for employers who fail to set up an internal reporting office in breach of their duty. Apparently, it should be incentive enough for the establishment of an internal reporting office that this presumably makes it less likely that the whistleblower will go to the external reporting office.
This makes it clear that exempting small companies from the obligation to set up an internal reporting office is a fig leaf; because if it is true that whistleblowers are more likely to be deterred from going to the external reporting office as a result, many small companies will also voluntarily set up internal reporting channels.
Regardless of the size of the company, this shows that internal reporting channels are in the best interest of the company and their introduction should be considered without fail. Please do not hesitate to contact us!
- What do the external reporting offices look like?
External reporting offices are being set up both at the federal level and, albeit on an optional basis, at the state level, to which whistleblowers can turn. In addition, Bafin will act as a further external reporting office for the federal government when it comes to certain violations of capital market and securities law. The RefE even provides for another federal reporting office to which one can turn if one has discovered a violation at the other federal reporting offices. The RefE does not reveal the question, posed with a wink of the eye, of who is to be responsible for violations by this additional reporting office.
The external hotlines also operate reporting channels and are also supposed to provide potential whistleblowers with comprehensive and independent information and advice on existing remedies and procedures for protection against reprisals.
The external reporting bodies also confirm receipt of the report to the whistleblower within seven days and inform the whistleblower of any follow-up measures taken after three or six months at the latest.
- What does "disclosure" mean?
Disclosure refers to making information about violations available to the public, i.e. usually going to the press or social networks. While the whistleblower can choose between internal (vis-à-vis the company) and external (vis-à-vis the competent authority) reporting, he may only disclose a violation without sanction, i.e. make it accessible to the public, if either no response has been received to an external report within the respective period or if another of the exceptional cases mentioned in the RefE is given (immediate endangerment of public interests; threat of reprisals; no prospects of success for external reporting).
For the whistleblower, disclosure is highly risky in view of the exceptions that are open to interpretation. How, for example, will he assess whether an external report would have no chance of success? If he is wrong in his assessment, the HinSchG does not protect him from sanctions under labor law.
Employers must realize that they cannot ultimately prevent a disclosure by taking action themselves, because they have no influence on whether or not the external reporting office complies with the statutory deadlines. If employers suffer damage as a result, this is a case for state liability.
- How are whistleblowers protected?
Directive and RefE order a comprehensive protection of the whistleblower against "reprisals" as long as only the whistleblower had reasonable grounds to believe that the information he reported or disclosed was true and the (alleged) violation concerns a set of rules covered by the RefE. Reprisals are actions or omissions in connection with professional activities which are a reaction to a report or disclosure and as a result of which the whistleblower suffers or may suffer an unjustified disadvantage. This includes everything from a reprimand to the omission of a salary increase or a training trip to a warning and termination, but also, for example, the failure to continue employment without a time limit.
Caution: The RefE imposes a reversal of the burden of proof, according to which a disadvantage is considered a reprisal in the legal sense if it only occurs after a whistleblowing event. The employer must therefore prove that the whistleblower was transferred for other reasons, not promoted, not given a fixed term, etc.
The whistleblower is also entitled to damages if he is subjected to reprisals.
- Will the identity of the whistleblower remain anonymous?
Although confidentiality about the identity of the whistleblower is comprehensively protected in the RefE, at least external reporting offices are explicitly not required to investigate anonymous reports. However, there is no corresponding clarification for internal reporting offices, which is why it is sometimes argued that internal reporting offices must therefore also follow up on anonymous tips. However, the explanatory memorandum to the RefE makes a different point, and the directive does not require that anonymous tips be taken into account internally. It therefore remains to be seen what the final legal text will say about this.
It is obvious that taking anonymous internal reports into account can increase acceptance of and trust in the company's internal whistleblowing system. However, it also increases the risk of unsubstantiated denunciations. Companies may be willing to accept this, however, since the more attractive the internal reporting channels are, the less incentive there is to make external reports.
If you would like more information, please contact
Berlin: Tabea Frühinsfeld
Duesseldorf: Dr. Torben Weihmann
Frankfurt am Main: Dr. Frank Zaumseil
Munich: Dr. Esther Dehmel