Introduction of Comprehensive Whistleblower Protection Systems: The Federal Cabinet's Draft on Whistleblower Protection Obliges Employers to Set Up Internal Reporting Systems

On 27 July 2022, the federal cabinet adopted the draft for a Whistleblower Protection Act (HinSchG). This draft is intended to implement Directive (EU) 2019/1937 of the European Parliament and the council of 23 October 2019 on the protection of persons who report infringements of European Union law (HinSch-RL). Originally, the EU member states were given an implementation deadline of 17 December 2021. Due to the failure to transpose the HinSch-RL into national law on schedule, the EU Commission initiated infringement proceedings against Germany and other EU member states in January 2022.

Even though the HinSchG has not yet been passed by the Bundestag and Bundesrat, employers are already encouraged to prepare for the establishment of the planned whistleblower protection systems in their companies. It is expected that the law will come into force in the fall of 2022 and will be followed by only a short transition period. This will require companies to act quickly with regard to the establishment of internal whistleblower protection systems. The core of these systems will be the establishment of so-called internal reporting offices.

According to the draft, the following points will be of particular importance and should be taken into account (the legal details refer to the draft of 27 July 2022):

Scope of Application

On personal terms there is protection for (sec. 1 HinSchG):

• All persons who obtain information about violations or potential violations in connection with their professional activity and report or disclose such information in the form provided for under this act, or so-called whistleblowers;
• Persons who are the subject of such reports/disclosures or are otherwise affected by them; and
• These include employees within the meaning of Article 45(1) TFEU (including civil servants); self-employed persons within the meaning of Article 49 TFEU; shareholders; persons who are members of the administrative, management, or supervisory bodies of companies (including nonexecutive members); volunteers and trainees; and persons working under the supervision and management of contractors and suppliers.

In factual terms, reports/disclosures are protected that primarily concern the following areas (sec. 2 HinSchG):

• Violations of national legal provisions, with the stipulation that these are punishable by law;
• Violations of national legal provisions subject to fines, conceding these serve the protection of life, limb, or health, and the protection of the rights of employees or their representative bodies;
• With reference to the catalog of regulations in the HinSch-RL, violations of federal and state regulations and legal acts of the European Union and the European Atomic Energy Community from certain areas (in particular, public procurement and public health, financial services, financial products and financial markets, transport safety, radiation protection and nuclear safety, animal health and welfare, consumer protection, protection of privacy and personal data, product safety and conformity, prevention of money laundering and terrorist financing, environmental protection, food and feed safety, and network and information system security); and
• Violations of national procurement, antitrust, and tax regulations.

Protection System: Use of Secure Reporting Channels; Public Disclosure of Violations Only to Occur in Exceptional Cases

Reports made in the following manner are protected: 

Via Internal Reporting Offices:

• According to sec. 12 HinSchG, “employers” (private companies and public corporations) with usually at least 50 employees are obliged to set up internal reporting offices, with the following lead time:
  • For employment providers with 250 or more employees, immediately after the act comes into force;
  • For certain institutions/companies, regardless of the number of employees, immediately after the act comes into force (securities services companies, stock exchange operators, credit institutions, capital management companies, etc.); and
  • For private employment providers with 50 to 249 employees, as of 17 December 2023.
• The design of the reporting offices must also be implemented in such a way that unauthorized persons are prevented from accessing them and the confidentiality of the whistleblower’s identity and third parties is guaranteed.
• The regulation in sec. 16 HinSchG provides for the following reporting offices:
  • Reports must be possible in oral form or in text form (e.g., by e-mail or by an internet technology-supported whistleblower system, establishment of a telephone hotline); and
  • If desired, a personal meeting must be possible.
• There is no obligation to follow up on anonymous reports.
• Companies can use external service providers to operate the reporting offices.
• Several private companies with about 50 to 249 employees may establish a joint internal reporting office.

Via External Reporting Offices:

• The federal government establishes an external reporting office at the Federal Office of Justice. This office has “omni-responsibility” for all reports that are made externally, except for reports concerning state administrations and local governments if the states have set up their own reporting offices for this purpose;
• BAFIN (Bundesaufsichtsamt für Finanzdienstleistungen – Federal Financial Supervisory Authority) is responsible for reports pursuant to sec. 21 HinSchG concerning the Financial Services Supervision Act and the Money Laundering Act; and
• The BKartellA (Bundeskartellamt – Federal Cartel Office) remains responsible for reports of violations of antitrust law, ss. 2 para. 1 no. 8, 22 HinSchG.

Note: The public prosecutor’s office is not an external reporting office in the sense of this law.

Authority to disclose (make available to the public), sec. 32 HinSchG:

Whistleblowers only have protection under HinSchG in limited conditions in the case of disclosure, namely:

• The external report was initially made, but it was unsuccessful (no follow-up action within the time limits or no feedback on it);
• There is sufficient reason to believe that violation will lead to an immediate or obvious threat to the public interest;
• If there was fear of reprisals in case of external reporting; and
• If, due to special circumstances, it was to be feared that the external reporting office would not take effective follow-up measures (above all, cooperation with the author of the violation).

Obligations of the Employer in the Case of Reporting via the Internal Reporting Office

According to ss. 17, 18 HinSchG, internal reporting offices must take the following measures when reports are made:

• Acknowledge receipt to the whistleblower within seven days; 
• Check whether the violation falls within the material scope of application according to sec. 2 HinSchG; 
• Maintain contact with the whistleblower; 
• Check the validity of the report and request further information if necessary; and
• Take appropriate follow-up measures, e.g.:
  • Conduct internal investigations at the employer or the department and contact the persons and work units concerned; 
  • Refer the person making the report to other appropriate agencies; and
  • Close the case for lack of evidence or other reasons.

If obstruction by the company occurs after whistleblowing or if the identity of the whistleblower is not kept confidential, companies face sanctions in the form of fines.

Consequence of Proper Reporting Under the HinSchG: Protection Against Discrimination for the Whistleblower

Pursuant to sec. 36 HinSchG, any form of retaliation against whistleblowers in connection with the facts affected by the whistleblower is prohibited and entitles the whistleblower to damages. Inadmissible forms of retaliation include dismissals, suspensions, denial of promotion, mobbing, negative performance appraisals, salary cuts, discrimination, and others.

The burden of proof will then lie with the employer and not the whistleblower.

Consequence of an Intentional or Grossly Negligent False Report

Pursuant to sec. 38 HinSchG, whistleblowers who intentionally or grossly negligently report or disclose incorrect information are obligated to compensate the resulting damage. In addition, this also constitutes an administrative offense. 

Regulations on Fines, sec. 40 HinSchG

The HinSchG entails further administrative offenses. For example, failure to set up an internal reporting office in contravention of the obligation under sec. 12 of the HinSchG as well as a violation of the ban on reprisals constitute administrative offenses punishable by fines of up to €20,000 or €100,000. 

Our Comments and Remarks on the Legal Draft

The draft has been given a broad scope of application that goes beyond the requirements of Directive (EU) 2019/1937. It is, therefore, to be expected that the evaluation of detailed notes will be reserved primarily for lawyers, due to the complexity and the need to distinguish them from other areas of law. Lawyers can also be commissioned as external third parties, but conflicts of interest must be avoided both internally and externally. This applies, for example, to the permanent legal advisor (labor law, antitrust law) as well as to in-house lawyers in the company and, basically, also to the Human Resources department of a company. The aforementioned are likely to be eliminated as processors of whistleblower notices under the HinSchG. 

The implementation of the internal reporting office is legally, and most likely technically, complex and should be well prepared. This applies, for example, to the involvement of a company’s data protection officer. Information technology solutions offered on the market that enable the automated processing of reports certainly require the participation of the works council in accordance with sec. 87 (1) No. 6 BetrVG (Betriebsverfassungsgesetz – Works Constitution Act) and must therefore be negotiated with the works council.