Whistleblower Protection: Germany implements the EU Directive, at last!

Germany adopted the Whistleblower Protection Act (‘Act’) on 12 May, which implements the EU Whistleblowing Directive (‘Directive’). It will enter into force one month after the publication in the German Federal Law Gazette. This is an important development as to date, regulations on whistleblower protection in Germany have only existed in certain industries, such as the financial sector.

I.         Scope of Application

The Act defines whistleblowers as natural persons who have obtained information about violations of the law as defined below in connection with their professional activities or in the run-up to professional activities and who report or disclose such information to the relevant reporting bodies. This includes applicants or former employees. It does not cover anyone who becomes aware of violations exclusively in a private context.

Only persons who report to the reporting bodies provided for in the Act or - if special conditions are met - disclose information publicly are protected. If employees choose other ways to report violations (e.g., to their supervisor or the works council), they will not be in scope and thus not be able to call for the protection as established by the new law.

In addition to whistleblowers, the personal scope of application also includes persons who are the subject of a report or disclosure, as well as other persons who are affected by a report or disclosure, such as witnesses.

The material scope of application of the Act, goes beyond that of the Directive. While the latter only covers breaches of certain areas of EU law, the Act provides for an expanded scope that refers to:

• National criminal provisions;
• Regulations subject to fines for the protection of life, limb, health or the rights of employees/their representative bodies (e.g. certain provisions in the Minimum Wage Act or the Act on Temporary Agency Work);
• Federal and state legislation based on EU law, directly applicable legal acts of the EU or Euratom.

II.        Reporting channels

The Act provides for equal priority between the use of internal and external reporting channels. It stipulates that whistleblowers should give preference to reporting to an internal reporting channel, provided that the violation can be dealt with effectively and they do not fear reprisals. If employees do not comply with this, however, they do not face any sanction. Employers can also create incentives to use internal reporting channels, although it is not specified what these might look like.

1.         Internal reporting body

Employers with at least 50 employees are obliged to set up an internal reporting body, but for companies with generally fewer than 250 employees, this obligation will only be applicable on December 17, 2023. Companies in certain regulated industries, such as the financial industry, are obliged to set up such body irrespective of the number of employees.

The internal reporting body can be established by the employer, or a third party (including another group company) can be entrusted with the task. The Act, just like the Directive, allows employers with 50 to 249 employees to establish a joint body. Both in the case of entrusting third parties and in the case of setting up a joint reporting body, the employer remains obligated to take suitable measures to remedy a violation.

According to the explanatory memorandum of the Act, an internal whistleblowing channel can also be established at the group level. In this case the German legislator is of the opinion that only the obligation for follow-up measures remains with the legal entity, whereas the report can already take place at a centralized channel set of for instance by the parent company.

The internal reporting body will set up reporting channels through which employees and temporary workers can report violations. The internal reporting body shall also process anonymous reports. However, there is no obligation to design the reporting channels in such a way that they allow anonymous reports to be submitted.

The timeline for the follow up process and the feedback, also follows as suggested by the Directive. Therefore, upon receipt of a report, the whistleblower shall receive confirmation of receipt of a report no later than seven (calendar) days. The internal reporting office checks the validity of the report received and takes appropriate follow-up action if necessary. Within three months, feedback must be provided on which follow-up measures are planned or have been taken, as well as the relevant reasons for this. No feedback may be given if it affects internal inquiries or investigations and impairs the rights of persons who are the subject of the report or are named in it.

2.         External reporting channels

The Act has already designated the external reporting channels. For instance, a federal external reporting office is established at the Federal Office of Justice. Special responsibilities as an external reporting office are held by the Federal Financial Supervisory Authority (Bundesanstalt für Finanzdienstleistungsaufsicht) or the Federal Cartel Office (Bundeskartellamt). The external reporting offices provide information and advice on remedies and procedures for the protection of reprisals to persons considering making a report. There are some parallels between the procedures of internal and external hotlines, especially with regard to the obligation to report back to the person making the report, although the external hotline may take six months to report back in more extensive cases.

3.         Public disclosure

The Act also grants whistleblower protection to people that publicly disclose information about the aforementioned violations of law. The cases for which the Act grants this protection are the same as those suggested by the Directive.

III.      Protective measures

Whistleblowers are subject to special protective measures if:

• A report has been made internally or externally or a disclosure has been made if the preconditions have been met; and
• At the time of the report or disclosure, they have reasonable grounds to believe that the information reported or disclosed is true; and
• The information relates to violations that fall within the scope of the Act or they have sufficient reason to believe that this is the case at the time of the report or disclosure.

Natural persons who confidentially assist whistleblowers in making an internal or external report or disclosure in a professional context are also subject to the protection.

• The whistleblower protection includes:
• A whistleblower cannot be held legally responsible for obtaining or accessing the reported/disclosed information if the obtaining or access does not constitute a criminal offense.
• A whistleblower does not violate disclosure restrictions if he or she had reasonable grounds to believe that disclosure of the information was necessary to detect a violation.
• Retaliation against whistleblowers is prohibited and should the whistleblower claims retaliation, as the Directive provides, the Act sets out that the burden of proof will be on the employer. In the event of retaliation, the whistleblower is entitled to compensation for damages (no compensation for immaterial damages). The latter does not however include entitlement to the establishment of an employment or vocational training relationship or any other contractual relationship or to career advancement. You can read more about whistleblower’s protection from retaliation and the burden of proof in this briefing. 

On the other hand, the whistleblower is obliged to compensate for the damage resulting from having intentionally or grossly negligently reported or disclosed false information. For example, the reasonable costs of an internal investigation or legal defense as a result of the false reporting are compensable (no compensation for immaterial damages) will be borne by the whistleblower.

IV.       Sanctions

The Act provides for sanctions to be imposed, in similar cases as those listed by the Directive, namely:

• Communication between the whistleblower and the reporting office is obstructed;
• The required internal reporting office is not established and operated (this case group will not become valid until six months after the Act comes into force); or
• Retaliation measures have been taken; or
• Confidentiality is not maintained.

In these cases the sanction will be in the form of a fine. On the other hand, the Act also imposes fines for the whistleblowers who knowingly disclosed an incorrect information.