Draft update of the German whistleblower protection law

On July 27, 2022, the Federal Cabinet passed the Whistleblower Protection Bill (HinSchG). This project aims to implement Directive (EU) 2019/1937 of the European Parliament and of the Council of 23 October 2019 on the protection of persons who report breaches of European Union law (HinSch-RL). Originally, EU member states had an implementation deadline of 17 December 2021. Due to the failure to transpose the HinSch RL into national law within the deadline, the European Commission has initiated infringement proceedings against Germany and other EU Member States in January 2022.

Even though the HinSchG has not yet been adopted by the Bundestag and the Bundesrat, employers are already encouraged to prepare for the implementation of the planned whistleblower protection systems in their companies. It is expected that the law will come into force in the fall of 2022 and will only be followed by a short transition period. This will force companies to act quickly on putting in place internal whistleblower protection systems. Central to these systems will be the establishment of so-called internal reporting desks.

Depending on the draft, the following points will be of particular importance and must be taken into account (legal details refer to the draft of July 27, 2022):

Scope

On a personal level, there is protection for (Art. 1 HinSchG):

• All persons who obtain information about violations or potential violations in the course of their professional activity and report or disclose this information in the form provided by this law, or so-called whistleblowers;

• Persons who are the subject of such reports/disclosures or who are otherwise affected by them; and

• These include employees within the meaning of Article 45(1) TFEU (including civil servants); self-employed persons within the meaning of Article 49 TFEU; shareholders; persons who are members of the administrative, management or supervisory bodies of companies (including non-executive members); volunteers and interns; and persons working under the supervision and direction of contractors and suppliers.

In fact, reports/communications which mainly concern the following areas are protected (Art. 2 HinSchG):

• Violations of national legal provisions, it being specified that these are punishable by law;

• Violations of national legal provisions subject to fines, assuming that these serve the protection of life, physical integrity or health, and the protection of the rights of employees or their representative bodies;

• With reference to the catalog of regulations of the HinSch-RL, violations of federal and state regulations and legal acts of the European Union and the European Atomic Energy Community in certain areas (in particular public procurement and public health , financial services, financial products and financial markets, transport security, radiation protection and nuclear safety, animal health and welfare, consumer protection, protection of privacy and personal data , product safety and compliance, prevention of money laundering and terrorist financing, environmental protection, food and feed safety, and security of network and information systems ); and

• Violations of national procurement, antitrust and tax regulations.

Protection system: use of secure reporting channels; Public disclosure of violations should only occur in exceptional cases

Reports made in the following manner are protected:

Via the Internal Reporting Offices:

• According to sec. 12 HinSchG, “employers” (private companies and public companies) generally with at least 50 employees are required to set up internal declaration offices, with the following deadlines:

  • For job providers with 250 or more employees, immediately after the entry into force of the law;

  • For certain establishments/companies, regardless of the number of employees, immediately after the entry into force of the law (securities companies, stock market operators, credit institutions, capital management companies, etc.); and

  • For private companies with 50 to 249 employees, as of December 17, 2023.

• The design of reporting desks must also be implemented in such a way that unauthorized persons cannot access them and that the confidentiality of the identity of the whistleblower and third parties is guaranteed.

• The regulation of art. 16 HinSchG provides for the following reporting offices:

  • Reports should be possible in oral form or in text form (eg by e-mail or through a reporting system based on Internet technology, establishment of a telephone helpline); and

  • If desired, a personal meeting should be possible.

• There is no obligation to act on anonymous reports.

• Companies can use external service providers to operate the reporting offices.

• Several private companies with approximately 50 to 249 employees can set up a joint internal reporting office.

Via external reporting offices:

• The federal government is creating an external communication office at the Federal Office of Justice. This office is “omni-responsible” for all declarations that are made outside, with the exception of declarations concerning state and local governments if the States have created their own declaration offices for this purpose. ;

• BAFIN (Bundesaufsichtsamt für Finanzdienstleistungen – Federal Financial Supervisory Authority) is responsible for reporting in accordance with Art. 21 HinSchG regarding the Financial Services Supervision Act and the Money Laundering Act; and

• The BKartellA (Bundeskartellamt – Federal Cartel Office) remains responsible for reporting breaches of antitrust law, Art. 2 par. 1 no. 8, 22 HinSchG.

To note: The public prosecutor’s office is not an external reporting office within the meaning of this law.

Power to disclose (make available to the public), sec. 32 HinSchG:

Whistleblowers are only granted protection under the HinSchG under limited conditions in the event of disclosure, namely:

• The external report was first made, but it was not successful (no timely follow-up or no feedback on it);

• There are sufficient grounds to believe that the breach will lead to an immediate or obvious threat to the public interest;

• If there was fear of reprisals in the event of external denunciation; and

• If, due to special circumstances, there was concern that the external reporting office would not take effective follow-up action (especially cooperation with the violator).

Obligations of the employer in the event of a report via the internal reporting office

According to art. 17, 18 HinSchG, internal reporting offices must take the following measures when reporting:

• Acknowledge receipt to the whistleblower within seven days;

• Check whether the violation falls within the material scope according to Art. 2 HinSchG;

• Maintain contact with the whistleblower;

• Check the validity of the report and request additional information if necessary; and

• Take appropriate follow-up actions, for example:

  • Conduct internal employer or departmental investigations and contact relevant individuals and work units;

  • Refer the person making the report to other appropriate agencies; and

  • Close the case for lack of evidence or for other reasons.

In the event of obstruction by the company after the launch of the whistleblower or if the identity of the whistleblower is not kept confidential, the companies expose themselves to sanctions in the form of fines.

Consequence of appropriate reporting under the HinSchG: protection against discrimination for the whistleblower

In accordance with art. 36 HinSchG, any form of retaliation against whistleblowers in connection with the facts concerned by the whistleblower is prohibited and entitles the whistleblower to damages. Inadmissible forms of retaliation include terminations, suspensions, denial of promotion, mobbing, negative performance reviews, pay cuts, discrimination, and others.

The burden of proof will then be on the employer and not on the whistleblower.

Consequence of an intentional or grossly negligent misrepresentation

In accordance with art. 38 HinSchG, whistleblowers who intentionally or through gross negligence report or disclose incorrect information are obliged to compensate for the resulting damage. In addition, this is also an administrative offence.

Fines Regulations, s. 40 HinSchG

The HinSchG leads to further administrative offences. For example, the failure to set up an internal reporting office in violation of the obligation of art. 12 HinSchG as well as a violation of the prohibition of retaliation are administrative offenses punishable by fines of up to €20,000 or €100,000.

Our comments and remarks on the legal draft

The project has been given a broad scope that goes beyond the requirements of Directive (EU) 2019/1937. It is therefore to be expected that the evaluation of the detailed notes will be reserved primarily for lawyers, due to the complexity and the need to distinguish them from other areas of law. Lawyers can also be appointed as external third parties, but conflicts of interest must be avoided both internally and externally. This applies, for example, to the permanent legal adviser (labour law, competition law) as well as to the company’s in-house lawyers and, fundamentally, also to the human resources department of a company. The aforementioned persons are liable to be eliminated as whistleblower notice processors under the HinSchG.

The establishment of the internal reporting office is legally, and most probably technically, complex and must be well prepared. This applies, for example, to the involvement of a company’s data protection officer. The IT solutions offered on the market for the automated processing of declarations certainly require the participation of the works council in accordance with Art. 87 (1) no. 6 BetrVG (Betriebsverfassungsgesetz – company constitution law) and must therefore be negotiated with the works council.