Germany’s new draft Whistleblower Protection Act

The deadline for implementing the EU Whistleblowing Directive expired in December 2021 yet Germany still lacks an implementation law. In mid-April, the Federal Ministry of Justice published a draft bill to be passed by autumn 2022 – the German Whistleblower Protection Act (Hinweisgeberschutzgesetz / HinSchG).

What are the aims of the new Act?

The HinSchG is intended to transpose the new whistleblower protection requirements adopted at EU level in 2019 into Germany’s national law. Therefore, the HinSchG, just like the underlying EU Whistleblowing Directive ((EU) 2019/1937), aims to expand the protection of whistleblowers, which has been incomplete and insufficient in the view of the (European and German) legislator.

Who must comply with these new requirements?

The HinSchG in principle obliges all companies with at least 50 employees to establish internal reporting channels. In some industries, such reporting channels must even be set up regardless of the number of employees; this can affect, for example, securities services companies, financial institutions and insurance companies.

Furthermore, the HinSchG stipulates that in addition to these internal reporting channels, an external reporting channel must also be established by the federal authorities. Thus, a separate unit is to be created at the Federal Office of Justice (Bundesamt für Justiz), which is responsible for the independent receipt and processing of reports from whistleblowers.

Unlike in the past, whistleblowers will in future be free to either report allegations of violations internally within their own company or to contact the Federal Office of Justice directly.

Who will be protected by the new law?

Protections extend to people who have obtained information about violations in connection with their professional activity (not purely private) and report these to the (internal or external) reporting channels provided for under the HinSchG. This includes not only employees but also, among others, trainees, freelancers, self-employed persons, employees of suppliers, employee representatives, members of executive bodies. In addition, persons who are subject of a report as well as other persons named in a report (for example as witnesses) are also protected.

What is the scope of application?

Under the EU Whistleblowing Directive, the EU legislator has, in accordance with its legislative competence, limited the scope of application to reports of violations of specific EU law. The German legislator has made use of the possibility to extend the scope and has included reports with regard to all kinds of criminal offences in the scope of the HinSchG. Additionally, reports regarding administrative offences are included insofar as the violated regulation serves to protect life, limb or health or to protect the rights of employees or their representative bodies.

Based on this scope, the HinSchG is applicable if the whistleblower reports an unlawful or abusive act or a corresponding omission that occurs during professional or entrepreneurial activity (not purely private). The whistleblower does not have to report clear evidence of a possible violation; it is sufficient that he or she presents reasonable grounds for suspicion and has sufficient reason to believe (at the time of the report) that the information reported is true.

Which corporates are required to operate internal reporting channels?

In principle, the HinSchG provides that every company with at least 50 employees must establish and operate an internal reporting channel that enables at least its own employees (and temporary workers) to report unlawful or abusive acts or omissions.

An internal reporting unit must operate an internal reporting channel, check the validity of a report after it has been received on the basis of specific procedural rules (eg a confirmation of receipt must be sent to the whistleblower within seven days) and, in the case of a valid report, take appropriate follow-up measures. In this respect, the initiation of an internal investigation to comprehensively clarify the facts may be considered as a follow-up measure.

The HinSchG does not prescribe the concrete organisational form of the internal reporting unit; rather, it depends on the organisational structure and the size and type of activity of the respective company as to how this unit is to be designed. However, the unit or person performing the task must be able to act independently. Companies with 50 to 249 employees are also allowed to form a joint internal reporting unit together with other such medium-sized companies, ie to pool their resources at one unit.

The German law also opens up the possibility of outsourcing the internal reporting unit to third parties, such as lawyers or auditors. The German legislator clarifies that, in the context of group structures, the parent company or a subsidiary can also be considered as such a third party. In a group, the operation of the internal reporting unit can therefore be centrally located at one group company. Yet even in the case of outsourcing to third parties (eg a group company or external lawyers), the respective company remains obliged to take appropriate measures itself to remedy any violation in the event of indications of legal violations.

However, the European Commission has emphasised in recent months that the outsourcing of the internal reporting unit to a (central) group company is not compliant with the requirements of the EU Whistleblowing Directive. Instead, the Commission demands that each company operate an independent (decentralised) reporting unit to enable whistleblowers to contact a local reporting unit directly at their employer. The German draft law is not compatible with this interpretation of the Directive. Therefore, it is to be expected that – should the current draft be implemented as now proposed –infringement proceedings will be initiated against Germany. In addition, if subsidiaries are located in EU member states that have implemented the EU Whistleblowing Directive on the basis of the Commission's interpretation and, therefore, do not allow a central group solution, a local reporting unit must be established in the respective (eg France-based) subsidiary, at least as a supplementary measure.

How should corporates adapt internal structures?

Internal reporting channels do not necessarily have to accept and process reports from third parties (for example, from employees of suppliers) or anonymous reports. However, given that also third parties may report indications of possible misconduct directly to authorities, companies should examine internal processes and ensure that internal reporting channels are properly designed to include third parties and anonymous reporting, as well as clearly and transparently advertised, so employees and third parties are encouraged to prefer internal reporting channels to directly reporting to authorities. At the same time, the internal reporting channels must be structured so that the confidentiality of the whistleblower and the persons affected by the report is comprehensively guaranteed.

What protections do whistleblowers have?

Reprisals are prohibited against whistleblowers whose reports fall within the scope of the HinSchG. Violations of this prohibition are subject to fines. Prohibited reprisals include, for example, dismissals, warnings, non-renewal of a fixed-term contract, relocation to another department or mobbing. If a whistleblower suffers a detriment after a report, it is presumed that this is an illegal reprisal taken because of the report. The employer must, therefore, prove that the measure is not based on the report, but on duly justified grounds. At the same time, the violation of the prohibition of reprisals gives rise to a claim for monetary damages on the part of the person concerned, but the violation does not give rise to a claim for the establishment of an employment or other contractual relationship or for career advancement.

How will the relationship with authorities change?

In addition to reports to the internal reporting channels, whistleblowers will be able to contact the newly established external reporting channel at the Federal Office of Justice directly. A separate, independent unit is to be established at the Federal Office of Justice, which will serve as a central contact point (a "one-stop shop") for whistleblowers, check the validity of whistleblower's report in a first step and then initiate further follow-up measures. In the case of valid reports, it is expected that the respective report will be forwarded to the specialised authority or the public prosecutor's office for further investigation and clarification as such investigative measures often require more extensive rights of investigation, which are the responsibility of the specialised authorities in charge or the public prosecutors' offices.

Next steps on whistleblowing in Germany

Companies operating in Germany should check their existing whistleblowing systems against the requirements of the draft and adapt if necessary. With regard to the obligation to maintain an internal reporting channel, the HinSchG only allows a transitional period (till December 2023) for medium-sized companies; larger companies will be subject to the new regulations as soon as the Act enters into force.

The implementation period provided for in the EU Whistleblowing Directive expired more than 5 months ago so a comparatively quick enactment of the HinSchG is expected. The current timetable foresees enactment by autumn 2022 at the latest.