The so-called Whistleblowing Directive (EU) 2019/1937 must be transposed into national law by December 17, 2021. The draft bill for a national Whistleblower Protection Act (HinSchG), which has been presented in the meantime, has just been taken off the political agenda after a heated debate within the government coalition. However, Germany cannot and will not allow itself to miss the timely implementation of the directive. A national implementation law is to be expected after the Bundestag elections at the latest - then as one of the first legislative acts of a new government coalition.
Here, we answer the most important questions surrounding the future protection of whistleblowers and the obligations that companies will face. This article will be regularly updated with new developments in the legislative process.
- When does the new whistleblower protection apply?
The directive must be transposed into national law by December 17, 2021. If the deadline for transposition is missed, there are many indicators for the immediate applicability of the directive, at least vis-à-vis public employers. However, sanctions under labor law by private employers are also likely to be inadmissible due to the fact that fundamental rights of the Union are affected (Art. 11 CFR - freedom of expression).
In the meantime, it is again questionable whether the HinSchG will be passed in its final version during this legislative period. Instead, it is quite conceivable that a national implementation law will not be passed by a new government coalition until after the Bundestag elections; however, the law could then presumably still enter into force in good time on December 17, 2021.
- Which employers are covered and from when?
The Directive covers all employers under private and public law. However, only employers with usually at least 50 employees are obliged to set up internal reporting offices. Employers with generally 50 to 249 employees also have until December 17, 2023 to set up internal reporting units.
It can be assumed that the HinSchG will adopt these thresholds exactly as they are.
- Who benefits from whistleblower protection?
In particular, employees and civil servants (including judges and soldiers) are protected, but also members of executive bodies (board members, managing directors), trainees and persons similar to employees.
- What is at the heart of the new whistleblower rights?
According to the draft bill, whistleblowers no longer need to contact the employer if they have discovered a violation of the rules (so-called internal reporting), but may directly contact the competent authority (so-called external reporting).
However, employers "shall" create incentives for whistleblowers to first contact the internal reporting office before reporting to an external reporting office, without, however, limiting or making it more difficult to make an external report. What kind of incentives these might be remains to be seen in practice - the whistleblower premium is on the horizon.
- What are the rules of the game for whistleblowers so far?
Until now, employees must first report discovered breaches of rules internally before they are allowed to turn to the competent authority without fear of sanctions under labor law. Exceptions apply if the matter involves a criminal offense committed by the employer or a serious criminal offense, if the whistleblower could be liable to prosecution himself or herself, or if a particularly important public interest is affected ("Heinisch" decision of the ECHR).
These principles developed by case law become invalid as of the entry into force of the HinSchG if a violation of the law is reported that falls within the scope of application of the law. Employees are therefore generally no longer required to report violations internally in advance. In addition, the motive test previously required under German law is no longer applicable; according to the recitals to the Directive, the whistleblower's motive plays no role.
- Which legal violations may be reported in the future?
According to the Directive, only infringements of certain Union law may be reported. The regulations and directives covered are listed in the annex to the Directive. In particular, they cover public procurement, financial markets, combating money laundering and terrorist financing, product safety, road safety, environmental protection, radiation protection, food safety, animal welfare, public health, consumer protection and data protection.
The draft bill, which was presented in the meantime but recently withdrawn, extended the reportable catalog to the corresponding national regulations and expanded it (the directive explicitly provides for an "opening clause" in Art. 2 Par. 2) to include all violations that are subject to criminal penalties or fines. This would make violations of an indefinite number of laws from all possible areas of law reportable; in labor law, for example, late notification of the economic committee, to name just one example. It is precisely this extension of the scope of application of the HinSchG that has given rise to the political dispute, in the course of which the RefE was ultimately withdrawn. It therefore remains to be seen to what extent the scope of the HinSchG will ultimately extend beyond that of the directive.
- What are the organizational requirements for employers?
Employers with generally at least 50 employees must set up internal reporting offices to which employees can turn to report violations. For certain companies, such as securities trading companies or credit institutions, the minimum threshold of 50 employees does not apply. If employers generally have no more than 249 employees, the internal reporting offices do not have to be established before December 17, 2023. The internal reporting offices must establish reporting channels that whistleblowers can use to report violations.
The internal reporting office must confirm receipt of the report to the whistleblower within seven days and inform the whistleblower of the follow-up measures it has taken after three months at the latest. Follow-up measures may include, in particular, the initiation of internal investigations, the submission of the report to the appropriate authority or the discontinuation of the matter due to lack of evidence.
- How are the internal reporting offices to be organized?
The internal reporting office can either be set up by the employer itself or a third party external to the company can be entrusted with this task. In addition, employers with generally no more than 249 employees may operate a joint internal reporting office or jointly commission an external third party.
We believe that especially smaller companies that just exceed the threshold of 249 employees (or 50 employees as of December 17, 2023), but also medium-sized companies as well as German subsidiaries of international corporations will outsource the internal reporting office. vangard | Littler cooperates with WhistleB in order to relieve companies from the burden of having to establish their own internal reporting office.
- Are there sanctions if an internal reporting office is not introduced?
The Directive does not provide for sanctions for employers who fail to set up an internal reporting office in breach of their duty. Apparently, it should be incentive enough for the establishment of an internal reporting office that this presumably makes it less likely that the whistleblower will go to the external reporting office.
This makes it clear that exempting small companies from the obligation to set up an internal reporting office is a fig leaf; because if it is true that whistleblowers are more likely to be deterred from going to the external reporting office as a result, many small companies will also voluntarily set up internal reporting channels.
Regardless of the size of the company, this shows that internal reporting channels are in the best interest of the company and their introduction should be considered without fail. Please do not hesitate to contact us!
- What do the external reporting offices look like?
On the basis of the recently withdrawn RefE, external reporting offices were to be established both at the federal level and, albeit on an optional basis, at the level of the Länder, to which whistleblowers could turn. In addition, Bafin should act as a further external reporting office of the federal government when it comes to certain violations of capital market and securities law. It remains to be seen what form this will ultimately take in political terms.
The external hotlines also operate reporting channels and are also supposed to provide potential whistleblowers with comprehensive and independent information and advice on existing remedies and procedures for protection against reprisals.
The external reporting bodies also confirm receipt of the report to the whistleblower within seven days and inform the whistleblower of any follow-up measures taken after three or six months at the latest.
- What does "disclosure" mean?
Disclosure refers to making information about violations available to the public, i.e. usually going to the press or social networks. While the whistleblower can choose between internal (vis-à-vis the company) and external (vis-à-vis the competent authority) reporting, he may only disclose a violation without sanction, i.e. make it accessible to the public, if either no response has been received to an external report within the respective period or if another of the exceptional cases mentioned in the Directive is given (immediate endangerment of public interests; threat of reprisals; no prospects of success for external reporting).
For the whistleblower, disclosure is highly risky in view of the exceptions that are open to interpretation. How, for example, will he assess whether an external report would have no chance of success? If he is wrong in his assessment, the HinSchG does not protect him from sanctions under labor law.
Employers must realize that they cannot ultimately prevent a disclosure by taking action themselves, because they have no influence on whether or not the external reporting office complies with the statutory deadlines. If employers suffer damage as a result, this is a case for state liability.
- How are whistleblowers protected?
The Directive orders a comprehensive protection of the whistleblower against "reprisals" as long as only the whistleblower had reasonable grounds to believe that the information he reported or disclosed was true and the (alleged) violation concerns a set of rules covered by the future HinSchG. Reprisals are actions or omissions in connection with professional activities which are a reaction to a report or disclosure and as a result of which the whistleblower suffers or may suffer an unjustified disadvantage. This includes everything from a reprimand to the omission of a salary increase or a training trip to a warning and termination, but also, for example, the failure to continue employment without a time limit.
Caution: The Directive imposes a reversal of the burden of proof, according to which a disadvantage is considered a reprisal in the legal sense if it only occurs after a whistleblowing event. The employer must therefore prove that the whistleblower was transferred for other reasons, not promoted, not given a fixed term, etc.
The whistleblower is also entitled to damages if he is subjected to reprisals.
- Will the identity of the whistleblower remain anonymous?
Although confidentiality about the identity of the whistleblower is comprehensively protected in the Directive, at least external reporting offices are explicitly not required to investigate anonymous reports. However, there is no corresponding clarification for internal reporting offices, which is why it is sometimes argued that internal reporting offices must therefore also follow up on anonymous tips.
It is obvious that taking anonymous internal reports into account can increase acceptance of and trust in the company's internal whistleblowing system. However, it also increases the risk of unsubstantiated denunciations. Companies may be willing to accept this, however, since the more attractive the internal reporting channels are, the less incentive there is to make external reports.
If you would like more information, please contact
Berlin: Hannes Barck
Duesseldorf: Dr. Torben Weihmann
Frankfurt am Main: Dr. Frank Zaumseil
Munich: Dr. Esther Dehmel